WO2009062373A1

WO2009062373A1 - Method of implementing network genuine identification

Info

Publication number: WO2009062373A1
Application number: PCT/CN2008/001687
Authority: WO
Inventors: Yongjin Li; Tong Liu; Ying Li; Guifen Zhao; Jiya Jiang; Guanning Xu; Liping Du; Suyan Wu; Yu Liu; Xiangyi Hu
Original assignee: Beijing Jinaobo Digital Information Technology Co., Ltd.
Priority date: 2007-10-15
Filing date: 2008-09-28
Publication date: 2009-05-22
Also published as: CN101136750A

Abstract

A method of network genuine identification for native country or region government to supervise network is implemented, which includes: establishing authentication(CA) centre on network nodes i.e. web servers respectively; connecting web server, CA centre and network resource or application server serially; pre-storing all net user's ID and CA parameters of native country or region in CA servers of CA centres; establishing encryption authentication protocol based on symmetric key arithmetic and compounding symmetric key technique in hardware chip of client and CA centre; providing all network identification authentication for native country or region network users in each network node CA centre; logging on resource or application servers in network nodes with having one network authentication hardware device in each network user to pass authentication of CA centre in network nodes.

Description

A method for realizing network real name system

The invention relates to the field of information security, and uses computer network, password and chip technology to realize network identity authentication. The invention is applicable to national or regional governments to establish a real name system on the network. Back:

At present, there are no practical products that can completely solve the real-name system of the network at home and abroad. Some of the cryptographic-based network authentication products produced by some manufacturers have security vulnerabilities, such as: KEYB0RES, RADIUS, PPP, and other vendors' network authentication products are more secure. High, such as: PKI/CA, IBE, however, the establishment cost and maintenance cost are very high, they are just like the "Iridium" technology, even if the technology is advanced, but the high price is still ruthlessly eliminated by the market. In short, the existing The network identity authentication products can not achieve large-scale certification, and can not meet the market demand for network real-name system.

Summary of the invention:

A real-name system implementation method uses computer, network, password and chip technology to establish a CA authentication center for each network node to identify the network user. The implementation steps are as follows: The network node is: network WEB server Establish a CA certificate center. When a user logs in to the web server and wants to enter the resource server or application server, the user must be authenticated by the CA certificate center. The legal user can enter the resource server or application server and pre-store the authentication server on each CA certificate center. The identification of the entire network user in the country or the region - the user number and the corresponding authentication parameters, and the establishment of the authentication parameter database, the authentication parameters of each network user are different, accounting for about 1. 312 K~1. 68 Κ / person The encryption card hardware is set on each authentication server end of each CA certification center, and a set of encryption authentication protocol is stored in the encryption card hardware chip, and the WEB server evenly distributes the task of network user identity authentication to each of the CA certification centers according to the user number. Taiwan authentication server to complete, in Network authentication client hardware end is provided, to store the user number, a network authentication parameter in authentication hardware chips, plus Confidential authentication protocol and network user information, the network user has a network authentication hardware device, and the network authentication is performed by the CA client of each network node through different clients, and the two-way authentication is adopted at both ends of the client and each CA certification center. In the mode, the symmetric key selection parameters generated by the WEB server, the timestamp and the random number, are symmetrically generated by the client and each CA authentication center according to a symmetric key generation algorithm consisting of a symmetric key selection parameter and an authentication parameter. Key, and generate a one-time symmetric key and authentication password in each authentication process. The network authentication hardware device of the network user is produced and issued by the public security department, and the encryption card hardware used by the CA certification center and the whole country or the region. The user number and authentication parameters of the network user are also produced by the public security department and sent to the network node unit. When the network user logs in to the network node and needs to enter the network resource server or the network application server, the network authentication hardware device is used in the corresponding CA authentication. The center performs authentication, and the encryption authentication system sends the legitimate user Resource or application server on the network node, thus, achieve national or regional government network real-name system management, the whole process with a combination of software and hardware manner, as follows -

1. Establish a CA authentication center on the network node to provide identification for all network users in the country or the region. The network nodes are: WEB server, CA authentication center authentication, and resource server or application server. The methods are connected together, and the user must be authenticated by the CA certification center, and the legitimate user can break into the resource server or the application server, thereby preventing the hacker from using the "trojan" virus control recommendation server to directly enter the resource or the application server.

2. The CA certification center consists of 1 to 30 authentication servers. Each authentication server is connected in "parallel" mode. Each authentication server is inserted with 1 to 8 encryption card hardware, according to the number of network node users and user concurrency. Size, to increase or decrease the number of CA certificate authority authentication server and encryption card hardware.

3. The network WEB server distributes the user identity authentication task to each authentication server of the CA certificate center on average according to the concurrent quantity of the user, and each authentication server evenly distributes the user identity authentication task to different encryption cards inserted into the authentication server. The task quantity is allocated according to the serial number of the encryption card hardware, wherein: each encryption card hardware has a serial number, and the serial number of each encryption card hardware is different and unique.

4, the encryption card is based on the PCI interface built-in CPU smart chip hardware equipment, unified by the public security department The identity of the entire network user in the country or the region—the user number and the corresponding authentication parameters are also uniformly produced by the public security department. The network node unit obtains the encryption card hardware and the home country in the CA authentication center authentication server by applying to the public security department. Or the user number and authentication parameters of all network users in the region.

5. The user number of the network user consists of 18~36 digits, each digit occupies 4 bits, occupying 9~18 bytes, among which: The network user is composed of personal network users and legal person network users, the whole country or the whole region network The user's user number is uniformly numbered in order of size. Each network user has a different user number and is unique and continuous.

6. The authentication parameters of the network user are composed of two-digit system. The random number function is used to generate garbled characters, and has randomness. Each network user has a set of authentication parameters, and each user number corresponds to a set of authentication parameters, and each network user The authentication parameters of each network user are 1. 312 K to 1. 68 K bytes, and constitute the MXN authentication parameter table A. Each element of the table A is 0.5 or 1 byte.

, 0 0, V 0 1, , o N-1 l 0, Vi i, Vl N-1

A

VM-I 0, M-1 l, VM-1 N-1

Where: The elements of Table A are: Vi ] , i=0 ～ M- 1, then j=0 ～ N-l

7. Set the network authentication hardware device on the client side, such as: a smart card based on the USB interface or a smart chip embedded in the resident ID card, and store the user number, the authentication parameter, and the encryption authentication protocol of the client end in the network authentication hardware device chip. The client-side encryption authentication protocol includes: A set of symmetric password calculations The method is: block cipher algorithm or sequence cipher algorithm, a set of symmetric key generation algorithm and comparison protocol, wherein: The comparison protocol is to encrypt the user number with the symmetric cryptographic algorithm and a set of symmetric keys at both ends of the client and the CA authentication center. Or the random number, the generated authentication password is compared to determine the authenticity of the network user, and the network user information is also stored in the network authentication hardware device chip, wherein: the personal network user information includes: a name and an address, the corporate network user information includes : The name and address of the legal entity.

8. The network authentication hardware equipment is uniformly produced by the public security department. The public security department produces the equipment according to the application of the equipment by the network user, and creates different authentication parameters for each network user. The user number of the network user corresponds to the authentication parameter. If an individual network user loses the network authentication hardware device and applies to the public security department, the public security department regenerates a set of authentication parameters, and writes a user ID, network user information, and client-side encryption authentication protocol with the original network user. The new network authentication hardware device is then sent to the network user.

9. In the encryption card hardware chip of each CA certification center authentication server, a set of encryption authentication protocol is stored, and the encryption authentication protocol of the CA authentication center includes: a set of symmetric cryptographic algorithms - block cipher algorithm or sequence cipher algorithm, a group A fixed symmetric key Kq, a set of symmetric key generation algorithms, and a set of comparison protocols, where: The comparison protocol is to encrypt the user number or random number with the symmetric cryptographic algorithm and a set of symmetric keys at both ends of the client and the CA authentication center. The generated authentication passwords are compared to determine the authenticity of the network users. The encryption authentication protocols stored in the different encryption card hardware chips of the same CA certification center are the same, including: a set of fixed symmetric keys Kq Similarly, in the encryption card hardware chip of different CA certification centers, the stored encryption authentication protocol is the same except for a set of fixed symmetric keys, and a set of fixed symmetric keys Kq stored in the encryption card hardware of different CA certification centers are different. .

10. In each CA certification center authentication server, store the user number and authentication parameters of all network users in the country or the region, and use a fixed set of symmetric key Kq stored in the encryption card hardware to connect all network users in the country or the region. The authentication parameters are encrypted into cipher texts - the authentication parameters are stored in cipher text.

11. In the authentication server of each CA certification center, the entire Internet users of the country or the region are stored. The user number and the authentication parameters are the same. However, each group of CA authentication center authentication server encryption card hardware has a different set of fixed symmetric key Kq, and the authentication parameter ciphertext generated by encrypting the same authentication parameter is different.

12. In each CA certification center, the user number and authentication parameter ciphertext of all network users in the country or the region are stored in the authentication parameter database, and the database is composed of an ID number field and an authentication parameter ciphertext field, wherein: the ID number field The user ID is stored. Each CA certificate center stores the records of the user's authentication parameter database in the X authentication server according to the size of the network user, where: 30^X^ 1, divides the number of records into X shares, and stores them in X respectively. In the authentication server, the records of the authentication parameter database are stored in order according to the size of the user number.

13. The ID number field in the authentication parameter database is defined as a digital type, and a "cluster" index is established on the digital ID number field, and each ID number field corresponds to a set of authentication parameter ciphertext fields, and the CA authentication center is based on the user. No. directly locates the user number in the authentication parameter database and the authentication parameter ciphertext of the corresponding record, and can quickly locate the user number and the authentication parameter ciphertext to be selected, and does not need to retrieve and locate the database, thereby greatly improving the authentication efficiency.

14. The length of the symmetric key is 128 bits according to the national regulations. The symmetric cryptographic algorithm uses SSF33, SCB2 or SMS33 according to national regulations.

15. Establish a symmetric key generation algorithm, which selects the authentication parameter table A according to the symmetric key selection parameters—timestamp and random number, and combines the selected authentication parameters to generate a set of symmetric keys! ^, The method is as follows:

(1) The timestamp is: 8 ~ 10 digits, that is: "Year" consists of 4 digits: XXX0 year ~ XXX9 year takes 10 years, "month" consists of 2 digits: January ~ 12 Month, "day" consists of 2 digits: 1 0~31, "hour" consists of 2 digits: 0:00 to 23:00, such as: 2007101819, which means 19:00 on October 18, 2007, when time When the stamp is 8 bits, M=82, when the timestamp is 10 bits, M=105, the random number is composed of N sets of binary numbers, which are 64 or 160 bits, and each set of random numbers is: 4 or 5 bits, when random When the number is 64 bits, take a random number every 4 bits to form a group, a total of 16 groups: N=16, When the random number is 160 bits, the random number is composed of 5 groups every 5 bits, and a total of 32 groups are: N=32 _;

(2) Use the ^^ 12 to 1680 group authentication parameters to form M rows and N columns of authentication parameter table A, M=82 or 105, N=16 or 32. When the timestamp is 10 digits, M=105, g _: Timestamps are year, month, day, hour,

"Year" corresponds to the 1st to 10th rows in Table A, a total of 10 rows, "Month" corresponds to the 11th to 22nd rows in Table A, a total of 12 rows, and "Day" corresponds to the 23rd to 53rd rows in Table A, A total of 31 lines, "hour" corresponds to the 54th to 77th lines in Table A, a total of 24 lines, Table A and 28 lines do not correspond to the timestamp, when the timestamp is 8 digits, M=82, namely: time Poke for year, month, day, "year" corresponds to the first to ten rows in table A, a total of 10 rows, "month" corresponds to the 11th to 22th rows in table A, a total of 12 rows, "day" corresponds to table A In the 23rd to 53rd lines, a total of 31 lines, Table A and 29 lines do not correspond to timestamps;

(3) The total number of authentication parameters in Table A is ∑ = MXN group. When M=82, N=16, the elements of Table A take 1 byte, Z-1312 group, accounting for 1312 bytes, when M 2 105, N ===================================================================================================== 1312 bytes, when M=i05, N=32, the elements of Table A take 0.5 bytes, Z 2360 groups, accounting for 1680 bytes;

(4) Select "row" from the elements of the authentication parameter table A according to the timestamp, for a total of N lines. The method is: Take 1 line from the 10th line of the T:10 line of the table A: "The number of single digits in the number, as the number of rows corresponding to "year" in Table A, such as: Timestamp: 2009XXXXXX, then: Take the 9th row in Table A, from the 11th to 22nd rows of Table A Take 1 line out of 12 lines: Use the value of the timestamp "month" as the "row" corresponding to "month" in table A, such as: Timestamp: 20ΧΧ11ΧΠΧ, then: take the 21st in table A Line, take 1 line from the 23rd to 53rd line of Table A, a total of 31 lines: Use the value of the time stamp "曰" as the "row" corresponding to the "day" in Table A, such as: The timestamp is: 20XXXX30XX, then: Take the 52nd line in Table A, take 1 line from the 54th to 77th lines of Table A, a total of 24 lines: The value of the "time" number is used as the "row" corresponding to "time" in Table A. For example, the timestamp is: 20XXXXXX21, then: take the 74th line in Table A, and then the 78th line of Table A~ Line M is taken out in total M-78+1 lines, totaling - 32 lines;

(5) After selecting the "row" of table A by timestamp: a total of 32 rows are selected, set to: Qi, Q ₂ , ...,

Q32, and then select the column from each row of Ql, Q2, ..., Q32 according to the random number, and obtain the element of the table A at the intersection of the row and the column - the authentication parameter, by: when the random number is 64 bits, The random number consists of 1 group of 4 digits, a total of 16 groups: N= L6, and the binary values of the 16 random numbers are: 0~15 kinds of values, ^{1 is} set to: Li, L ₂ , ..., L ₁₆ , Select the "column" of table A, that is: use L to select the first column of the row, then use L ₂ to select the L2 column of the Q ₂ row, ..., use L ₁₆ to select the L of the ₁₆ row ₁₆ columns, a total of 16 sets of authentication parameters are selected, 1 is used to select the Li column of Q ₁₇ rows, L _{2 is} used to select the L2 column of Q ₁₈ rows, ..., L _{16 is} used to select the Li2 of Q ₃₂ rows Columns, a total of 16 sets of authentication parameters are selected, and the 16 sets of authentication parameters are combined into 32 sets of authentication parameters. When the random number is 160 bits, the random number is taken every 5 groups, and a total of 32 groups are: N II 32, using the binary values of the 32 sets of random numbers: 0 ~ 31 kinds of values, set to:, L ₂ , ..., L ₃₂ , to select the "column" of the table A, that is: use 1 to select Take the column of Ql, use L ₂ to select the L ₂ column of Q ₂ , ···., use L ₃₂ to select the L ₃₂ column of Q ₃₂ , and select N=32 group authentication parameters;

(6) Combine the 32 sets of authentication parameters selected from Table A into KK. If the authentication parameters are: 8 bits, ΚΚ is 256 bits, then fold ΚΚ and perform modulo two addition to 128 bits, if the authentication parameter is : 4 bits, ΚΚ is 128 bits, then ΚΚ is unchanged, and then added with the random number alignment modulo to generate a set of symmetric keys Κ. When the random number is 64 bits, the random number is taken twice and connected end to end. 128 bits, and then ΚΚ ΚΚ modulo modulo, to generate a set of symmetric keys Κ, when the random number is 160 bits, take the first 128 bits of the random number, and ΚΚ ΚΚ modulo modulo, to generate a set of symmetric Key key.

16. The symmetric key selects the authentication parameter table by using a time stamp and a random number. And by generating a random number calculation with one change, the symmetric key is changed once and for all, that is: each authentication process uses a set of symmetric keys, which are cleared after use, are not reused, and the symmetric key generated by the combination has Temporary - Temporary symmetric key, realize symmetric key update without manual maintenance. At the same time, encrypt the random number or user number with a symmetric key once, and the generated authentication password also changes once.

17. Establish an encryption authentication protocol, adopt the two-way authentication mode of the client end and the CA authentication center, and perform authentication at both ends. The specific implementation process is as follows -

(1) The client sends an authentication request and sends a user number to the network WEB server. The network WEB server generates a timestamp and a random number, and assigns the authentication task to the authentication server of the CA certificate center according to the user number. The authentication server is based on the user number. Select the corresponding authentication parameter ciphertext, and input the encryption card hardware chip together with the time stamp and the random number. In the chip, the encryption authentication protocol of the CA authentication center end uses a fixed symmetric key Kq to authenticate the authentication parameter ciphertext. Decryption, generate a set of symmetric keys K1 according to the symmetric key generation algorithm, encrypt the user number with K1 to generate the authentication password 1, and send it to the client side together with the timestamp and the random number, and then generate the authentication password by encrypting the random number with K1. 4. At the same time, the network WEB server generates the authentication life cycleΤ;

(2) In the chip of the client-side network authentication hardware device, the symmetric key generation algorithm in the client-side encryption authentication protocol generates a set of symmetric keys 根据2 according to the received timestamp and the random number, and encrypts the user with Κ2. No. Generate authentication password 2, and compare authentication password 1 with authentication password 2? If they are not the same, the network node is an illegal website. If the same, the one-way authentication is passed, and then the encrypted password is generated by using the Κ2 encrypted random number, and then the user number, time stamp, random number, authentication password 3, name or legal entity The name and address are sent to the authentication server;

(3) After receiving the information sent by the client, the network WEB server first compares whether the user number, timestamp and random number at both ends of the client and the network WEB server are the same? Recalculate the certification life cycle Τ Is it over? If both pass, enter the authentication password 3 into the authentication server encryption card hardware chip corresponding to the CA certificate authority. The comparison protocol in the chip compares the authentication password 3 with the authentication password 4 to determine the identity of the user, and the legitimate user. Send to a network resource or application server, in a network resource or application Establish the authentication log on the server, §P: Register the information about the network user, personal network user registration: user number, login time, name and address, legal person network user registration: user number, login time, legal entity name and address.

18. Establish the authentication life cycle T on the WEB server, Τ=10 〜 30 seconds. When the two-way authentication process exceeds the value of Τ, the authentication process is interrupted, and the WEB server gives an authentication failure prompt, thereby preventing hackers from using "replay". Attack the encryption authentication system.

19. Establish a chip-level authentication system at both ends of the authentication server and the client, gp: store and run the encryption authentication protocol in the hardware chip, store the symmetric cryptographic algorithm, symmetric key generation algorithm, authentication parameters and comparison protocol storage. The operation process is protected by the network authentication hardware device chip. The symmetric authentication algorithm of the CA authentication center authentication server, the symmetric key generation algorithm, the storage and operation of a set of fixed symmetric keys Kq and the comparison protocol are also subjected to the encryption card hardware chip. Protection, in addition, the authentication parameters of all network users in the country or the region are stored in cipher text, protected by the encryption system in the encryption card hardware chip, greatly improving the security level of the encryption authentication protocol of the present invention, unlike some based on asymmetric The encryption authentication protocol of the cryptographic algorithm is as follows: ΡΠ technology, in the CA certification center, the public key and certificate of all network users are stored in the database of the authentication server, which is vulnerable to hackers using the "trojan" virus to tamper with the public key and certificate. Attack on the "impersonation" method .

20. The network node obtains the user's real name and detailed personal information through the authentication process of the network user. At the same time, the authenticity of the network node is also confirmed, and the real name system at both ends of the client and the network node is reached.

21. The CA authentication center authentication server and the client respectively generate a set of symmetric keys at the same time to encrypt different sets of parameters to complete the two-way authentication, which not only ensures the security of the encryption system but also saves time.

22. In the encryption authentication protocol, the current mainstream authentication protocol, such as the certificate used by the PKI technology, is removed as the identifier of the network user identity. The present invention uses the user number as the identifier of the network user to guide the encryption system to select the correct authentication parameter. The user number and the temporarily generated random number are encrypted to generate an authentication password, and the identity of the user is determined by comparing the authentication password, thereby reducing the complexity of the encryption authentication system, reducing the resources occupied by the encryption authentication system and improving the CA authentication center. Certification speed. 23. The cryptographic authentication protocol established by the symmetric cryptographic algorithm and the combined symmetric key technology occupies less CA resources, runs fast, and has low construction cost. The CA certification center established by investing RMB 42,000, of which: An authentication server with a value of RMB 13,000/set and four encryption card hardware worth RMB 40,000/block, totaling: RMB 20,000, capable of marking and authentication parameters of 300 million network users. About 393. 6G ~ 504 Gbytes, stored in the authentication server of the CA certification center, 艮卩: Register 300 million network users, and can achieve 2000 network users concurrent authentication, greatly improve the authentication efficiency, and achieve establishment on the network node Low-cost CA certification center solves the worldwide problem of large-scale network identity authentication.

24. All network users in the country or the region can use their own network authentication hardware devices to perform identity authentication on all network nodes in the country or region. That is: network users use one of their own network authentication hardware devices to be available on all networks. The node is authenticated and logged in, and the network real name system is implemented. The network users authenticated in the CA certificate center of each network node are random and not fixed, but are all one of the network users in the country or the region.

25. The public security department is responsible for updating the data of the CA certification center of each network node, creating the user number and authentication parameters of the new network user, and encrypting the whole country or the whole region with a set of fixed symmetric key Kq in the corresponding encryption card hardware. The network user includes: the authentication parameters of the new and old network users, generates the authentication parameter ciphertext, and sends it to the authentication server of the corresponding CA certificate center together with the corresponding user number, or stores the user number and the authentication parameter ciphertext in the public security department. In the website, the corresponding network node unit is authenticated and safely logged into the website of the public security department and downloaded.

26. The CA certificate center of each network node replaces the content of the updated network user user number and the authentication parameter ciphertext with the content of the original authentication server authentication parameter database, and re-establishes the clustering of the ID number field. "Index, thereby completing the routine maintenance of network user data updates for each CA certification center.

BRIEF DESCRIPTION OF THE DRAWINGS: Figure 1: Topology diagram of establishing a CA certificate center on a network node

Figure 2: Flowchart of application and production of client-side network authentication hardware device for network real-name system Figure 3: Flow chart for establishment of CA authentication center for network real-name system

BEST MODE FOR CARRYING OUT THE INVENTION - The following describes the implementation steps of the network real name system in conjunction with the drawings:

Figure 1: The architecture of the network real-name system to establish a CA certificate center on the network node. Each network user on the client side has a network authentication hardware device and inserts it into the client. The WEB server is logged into the network node through the INTERNET network. The WEB server will be the network. The identity authentication task is submitted to the CA certification center. Only the legitimate users authenticated by the CA certification center can enter the resources or application servers on the network node. The WEB server, the CA authentication center, and the resource or application server are connected in series. , where: The CA authentication center is composed of 1~K (Κ^30) authentication servers, and each piece of authentication server is inserted with multiple blocks (1~8 pieces) of encryption card hardware, and the resources or application servers on the network nodes are also composed of 1~ Μ (Μ^ΙΟ) consists of a network domain name on the WEB server. There is no network domain name on each authentication server and resource or application server of the CA certificate center.

Figure 2: Describes the process of applying and manufacturing the client-side network authentication hardware device of the network real-name system. The network user (including: personal network user or legal person network user) applies to the public security department for network authentication hardware equipment, and the public security department applies for the device according to the network user. The device is created successively. First, the user number of the network user is generated in order of size, and then the random number function is used to generate the authentication parameters of 1.312 K to 1.68 Kbytes, and one-to-one correspondence with the network user information is generated. The user number, authentication parameters and network user information, including: name or legal entity name and address, written into the chip of the network authentication hardware device, and then the client-side encryption authentication protocol is written into the chip of the network authentication hardware device, The network authentication hardware device that has been created is sent to the network user. If the network user loses the network authentication hardware device, the application is re-applied. The public security department regenerates the authentication parameters corresponding to the user number, and the user number, network user information, and client-side encryption. The authentication protocol is unchanged, and the user number, network User information, client-side encryption and authentication protocol regenerated authentication parameters, together to write a new network authentication hardware devices, and then distributed to network with Household.

Figure 3: The process of establishing the CA certification center of the network real name system. The network node unit applies to the public security department to establish the encryption card, user number and authentication parameters of the CA certification center. The public security department makes one or more encryption card hardware according to the requirements of the user. The device writes the encryption authentication protocol of the CA authentication center in the encryption card hardware chip. If the network user applies for multiple encryption card hardware, write the same encryption authentication protocol to the chip of multiple encryption card hardware, and then use the encryption card. A set of fixed symmetric key Kq in the encryption authentication protocol of the hardware chip, respectively encrypts the authentication parameters of the entire network user of the home country or the local area into a ciphertext, and establishes the ciphertext of the authentication parameter together with the corresponding user number. A set of authentication parameter database, the authentication parameter database and the encryption card hardware device are sent to the network node unit, and the network node unit obtains the user number and the authentication parameter of the encryption card hardware device and all network users in the country or the region, in the unit WEB server and resource or application server of the network node Establish a CA certification center. If the CA certification center consists of X authentication servers, where: 30 Χ 1 , divide the number of records in the authentication parameter database by X, that is, divide the number of records into X shares and store them in X-certification. In the server, a "cluster" index is established on the ID number field of the authentication parameter database. When the CA certificate center updates the data of the network user every time, the public security department will update the network user authentication parameters with the country or the local Together with the authentication parameters of all the original network users in the area, the fixed authentication key Kq in the CA authentication center encryption card hardware is used to encrypt the ciphertext, and the authentication parameter database is established with the corresponding user number and sent to the network node. Unit, the network node unit replaces the original record with the new authentication parameter database record, and re-establishes the "cluster" index on the numeric ID field of the authentication parameter database.

Claims

Claim

1. A method for realizing a real-name network system is to use a computer, a network, a password, and a chip technology to establish a CA authentication center as a network node, that is, a network WEB server, when the user logs in to the WEB server and wants to enter the resource server or the application server. It must be authenticated by the CA certification center. Legal users can enter the resource server or application server. In the authentication server end of each CA certificate center, the identifiers of all network users in the country or the region - user numbers and corresponding authentication parameters are pre-stored. And establish a database of authentication parameters, each network user's authentication parameters are different, accounting for about 1.312 K~ 1. 68 K / person, setting encryption card hardware on each authentication server end of each CA certification center, in encryption The card hardware chip stores a set of encryption authentication protocol, and the WEB server distributes the task of network user identity authentication to each authentication server of the CA certification center according to the user number, and sets the network authentication hardware device on the client side, and performs network authentication. Storage in hardware device chip The account number, the authentication parameter, the encryption authentication protocol, and the network user information, the network user has a network authentication hardware device, and the network identity authentication is performed by the CA client of each network node through different clients, and the client and each CA authentication center At both ends, the two-way authentication mode is adopted, and the symmetric key selection parameters generated by the WEB server, the timestamp and the random number, are generated by the client and each CA authentication center according to symmetric key selection parameters and authentication parameters. The algorithm combines to generate a symmetric key, and generates a one-time symmetric key and authentication password in each authentication process. The network authentication hardware device of the network user is produced and issued by the public security department, and the encryption card hardware used by the CA authentication center is used. The user number and authentication parameters of all network users in the country or the region are also produced by the public security department and sent to the network node unit. When the network user logs in to the network node and needs to enter the network resource server or network application server, the network authentication hardware is used. The device is authenticated at the corresponding CA certificate center. Secret authentication system will give users a legitimate resource or application server on the network node, thus, achieve national or regional government network real-name system management.

2. A method according to claim 1, characterized in that:

(1) The network WEB server, the CA authentication center authentication server group, and the resource or application server are connected in a "series" manner. The user must be authenticated by the CA certification center, and the legal person can enter the resource or the application server. Thus, to prevent hackers from using the "trojan" virus to control the WEB service. To access the resource or application server directly;

(2) The authentication servers of the CA certification center are connected in a "parallel" manner. The number of CA authentication center authentication servers is increased or decreased according to the number of network node users and the amount of concurrent users. The network WEB server is based on the concurrent amount of users. The user identity authentication task is evenly distributed to each authentication server of the CA certificate center, and each authentication server evenly distributes the user identity authentication task to different encryption cards inserted into the authentication server, and based on the serial number of the encryption card hardware. Assign the amount of tasks.

3. A method according to claim 1 and claim 2, characterized in that:

(1) The client-side network user uses a smart chip-based network authentication hardware device uniformly produced by the public security department, such as a smart card based on a USB interface or a smart chip embedded in a resident ID card, and the network user obtains an application from the public security department. The network authentication hardware device stores the user number, authentication parameter, network user information and a set of client-side encryption authentication protocol of the network user in the chip of the network authentication hardware device, and the client-side encryption authentication protocol includes: a set of symmetric cryptographic algorithms~ ^ Block cipher algorithm or sequence cipher algorithm, a set of symmetric key generation algorithm and comparison protocol. If individual network users lose network authentication hardware equipment, they also apply to the public security department, and the public security department regenerates the authentication parameters and the original network users. The user number, network user information, and the client-side encryption authentication protocol are written together in a new network authentication hardware device and then sent to the network user;

(2) The authentication server of the CA certification center is inserted into the hard card based on the PCI interface built-in CPU intelligent chip uniformly prepared by the public security department. Each authentication server inserts 1 to 8 encryption card hardware, and the network node unit applies to the public security department. Obtain the user ID and authentication parameters of the encryption card hardware in the CA certification center authentication server and all network users in the country or the region, and store a set of encryption authentication protocols of the CA certification center in the chip of the encryption card hardware, including: Symmetric cryptographic algorithm - block cipher algorithm or sequence cipher algorithm, a set of symmetric key generation algorithm, a set of fixed symmetric key Kq and comparison protocol; (3) In each CA certification center authentication server, store the user number and authentication parameter ciphertext of all network users in the country or the region, SP: use a fixed set of symmetric keys stored in the encryption card hardware to The authentication parameters of all network users in the area are encrypted into cipher texts - the authentication parameters are stored in cipher text;

(4) In each CA authentication center authentication server encryption card hardware, the symmetric cryptographic algorithm, symmetric key generation algorithm and comparison protocol are the same, except that a fixed symmetric key Kq is used in the same CA authentication center. In the block encryption card hardware, a set of fixed symmetric keys Kq are the same. The user numbers and authentication parameters of all network users in the home country or the local area stored in each CA certificate authority authentication server are the same, but each CA certificate center is used separately. A set of different fixed symmetric keys Kq in the authentication server encryption card hardware, and the authentication parameters generated by encrypting the same authentication parameters are different.

4. The method according to claims 1, 2 and 3, characterized in that - a user number and a quick selection method for the authentication parameters are established in each CA certification center, and the authentication parameters of all network users in the country or the region are stored in the authentication parameter database. The database consists of an ID number field and an authentication parameter ciphertext field, wherein: the ID number field stores the user number, and each CA authentication center stores the records of the user's authentication parameter database in 1 to 30 authentication servers according to the size of the user. And storing the records of the authentication parameter database in order according to the size of the user number, and then defining the ID number field in the authentication parameter database as a numeric type, and establishing a "cluster" index on the digital ID number field, each ID number The field corresponds to a set of authentication parameter ciphertext fields, and the CA authentication center encryption authentication protocol directly locates the authentication parameter ciphertext corresponding to the user number in the authentication parameter database according to the user number, and can quickly locate the ciphertext of the authentication parameter to be selected. The database is searched and located, thereby greatly improving the authentication speed.

5. A method according to claims 1, 3 and 4, characterized in that:

(1) The public security department is responsible for updating the information and authentication parameters of the network users of the CA certification centers of each network node. The public security department will use the network users of the newly applied network authentication hardware devices and the authentication parameters of the entire national or local network users. Corresponding to a set of fixed symmetric key Kq in the encryption card hardware, generating an authentication parameter ciphertext, and sending it to the corresponding authentication server of the CA certification center together with the corresponding user number. In, or store the user number and the authentication parameter ciphertext in the website of the public security department, and the corresponding network node unit is authenticated and safely logged into the website of the public security department and downloaded;

(2) Each network node CA authentication center replaces the user number and authentication parameter ciphertext of the newly updated network user with the content in the original authentication parameter database, and re-establishes the "cluster" index on the ID number field. Thus, the daily maintenance of data of newly added network users is completed.

6. A method according to claims 1, 2, 3, 4 and 5, characterized in that:

(1) The client sends an authentication request and sends a user number to the network WEB server. The network WEB server generates a timestamp and a random number, and assigns the authentication task to the authentication server of the CA certificate center according to the user number. The authentication server is based on the user number. Select the corresponding authentication parameter ciphertext, and input the encryption card hardware chip together with the user number, time stamp and random number, decrypt the authentication parameter ciphertext with the fixed symmetric key Kq in the chip, and generate according to the symmetric key. The algorithm generates a set of symmetric keys Kl, encrypts the user number with K1 to generate the authentication password 1, and sends it to the client side together with the timestamp and the random number, and then generates the authentication password 4 by using the K1 encrypted random number. Meanwhile, the network WEB server Generate a certification life cycleΤ;

(2) In the chip of the client-side network authentication hardware device, the symmetric key generation algorithm generates a set of symmetric keys 根据2 according to the received timestamp and the random number, and encrypts the user number with Κ2 to generate the authentication password 2, and compares the authentication password. 1 Is the authentication password 2 the same? If they are not the same, the network node is an illegal website. If the same, the one-way authentication is passed, and then the 认证2 encrypted random number is used to generate the authentication password 3, and then the user number, time stamp, random number, authentication password 3, name or legal person institution The name and address are sent to the authentication server;

(3) After the network WEB server receives the information sent by the client, first, compare the user number, timestamp and random number between the client and the network WEB server. Does it calculate the end of the certification life cycle? If both pass, enter the authentication password 3 into the authentication server encryption card hardware chip corresponding to the CA certificate authority. In the chip, the authentication protocol compares the authentication password 3 with the authentication password 4 to determine the identity of the user, and send the legitimate user. To the network resource or application server, establish an authentication log on the network resource or application server, namely: the user number of the registered user, the login time, the name or the name of the legal entity, and the address.

7. A method according to claims 1, 3, 4 and 6, characterized in that:

(1) Establish a chip-level authentication system at both ends of the authentication server and client, namely: store and run the encryption authentication protocol in the hardware chip, the symmetric cryptographic algorithm on the client side, the symmetric key generation algorithm, the authentication parameter and the comparison protocol storage. And the running process, both protected by the network authentication hardware device chip, the CA authentication center authentication server side symmetric cryptographic algorithm, symmetric key generation algorithm, a set of fixed symmetric key Kq and comparison protocol storage and operation, also received by the encryption card hardware Chip protection, in addition, the authentication parameters of all network users in the country or the region are stored in cipher text, greatly improving the security level of the encryption authentication protocol, unlike some encryption authentication protocols based on asymmetric cryptographic algorithms such as: PKI As with technology, the CA authentication center stores asymmetric cryptographic algorithms, public keys, and certificates on the hard disk of the authentication server. It is vulnerable to hackers using the "trojan" virus to tamper with public keys and certificates, and to perform "impersonation" attacks. ;

(2) Encryption authentication protocol established by symmetric cryptographic algorithm and combined symmetric key technology, occupying CA certification center with less resources, fast running speed and low construction cost. The CA certification center established by investing RMB 42,000, among which: Two authentication servers worth RMB 13,000/set and four encryption card hardware worth RMB 40,000/block, totaling: RMB 20,000, which can provide network certification registration for 300 million network users. Realize the concurrent authentication of 2000 network users, greatly improve the authentication efficiency, realize the establishment of a low-cost CA certification center on the network node, and solve the worldwide problem of large-scale network identity authentication.

8. A method according to claims 1, 2 and 6, characterized in that:

(1) The network node obtains the real name or name of the network user and the address through the authentication process of the network user, and the authenticity of the network node is also confirmed, reaching the real name system at both ends of the client and the network node;

(2) The CA authentication center authentication server and the client respectively generate a set of symmetric keys to encrypt different sets of parameters and complete two-way authentication, which not only ensures the security of the encryption system, but also saves time;

(3) In the encryption authentication protocol, the current mainstream authentication protocol, such as the certificate used by the PKI technology, is removed as the identifier of the network user identity. The present invention uses the user number as the identifier of the network user to guide the encryption system to select the correct authentication parameter. , combined to generate a symmetric key, the user number and the randomly generated random The number is encrypted to generate an authentication password, and the identity of the network user is judged by comparing the authentication password, thereby reducing the complexity of the encryption authentication protocol and improving the authentication efficiency.

9. A method according to claims 1, 2, 3 and 6, characterized in that:

(1) All network users in the country or the region can use their own network authentication hardware devices to perform identity authentication on all network nodes in the country or region, that is, users can use one of their own network authentication hardware devices to be available on all networks. Perform authentication and login on the node to implement the real-name system of the network;

(2) The network users who authenticate at the CA certificate center of each network node are random and not fixed, but they are all one of the network users in the country or the region.

10. A method according to claims 1, 3, 4 and 6, characterized in that:

(1) The symmetric key is generated by a combination of symmetric key generation algorithms, that is, the symmetric key is based on the timestamp and the random number, and the authentication parameter table A is controlled and selected, and the selected authentication parameter elements are combined with the random number model. Generated after two additions;

(2) The symmetric key selects the authentication parameter table A by using a time-varying time-stamp and a random number, and generates and converts the symmetric key by one-time variable random number, that is, each authentication The process uses a set of symmetric keys, which are cleared after use and are not reused. The symmetric key generated by the combination has a temporary-temporary symmetric key, which realizes symmetric key update without manual maintenance. At the same time, it uses one change. The symmetric key encrypts the random number or the user number, and the generated authentication password also changes once.