WO2011022919A1 - 一种引入在线第三方的实体鉴别方法 - Google Patents

一种引入在线第三方的实体鉴别方法 Download PDF

Info

Publication number
WO2011022919A1
WO2011022919A1 PCT/CN2009/076181 CN2009076181W WO2011022919A1 WO 2011022919 A1 WO2011022919 A1 WO 2011022919A1 CN 2009076181 W CN2009076181 W CN 2009076181W WO 2011022919 A1 WO2011022919 A1 WO 2011022919A1
Authority
WO
WIPO (PCT)
Prior art keywords
entity
message
party
trusted
random number
Prior art date
Application number
PCT/CN2009/076181
Other languages
English (en)
French (fr)
Inventor
铁满霞
曹军
赖晓龙
黄振海
Original Assignee
西安西电捷通无线网络通信股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 西安西电捷通无线网络通信股份有限公司 filed Critical 西安西电捷通无线网络通信股份有限公司
Priority to US13/392,915 priority Critical patent/US8763100B2/en
Priority to JP2012525851A priority patent/JP5468138B2/ja
Priority to KR1020127007895A priority patent/KR101471259B1/ko
Priority to EP09848651.7A priority patent/EP2472771A4/en
Publication of WO2011022919A1 publication Critical patent/WO2011022919A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3297—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving time stamps, e.g. generation of time stamps

Definitions

  • the present invention relates to an entity authentication method, and more particularly to an entity authentication method for introducing an online third party.
  • Entity authentication methods using asymmetric cryptography can be divided into two types, one-way authentication and two-way authentication.
  • the uniqueness or timeliness of identification is identified by time-varying parameters and is often used as a time-series, sequence number, random number, etc. for time-varying parameters. If the time stamp or the sequence number is used as the time-varying parameter, the one-way authentication only needs to use one message, and the two-way authentication needs to use two messages. If the random number is used as the time-varying parameter, the one-way authentication needs to use two messages. Pass-through, two-way authentication requires three messages or four messages (ie, parallel authentication for two messages;).
  • the verifier must have a valid public key of the claimant before or during the operation, otherwise the authentication process may be compromised or not successfully completed.
  • the three-way method of two-way authentication is taken as an example:
  • the entity ⁇ sends a random number R s , an optional text 73 ⁇ 4 ⁇ to the entity A;
  • Entity A sends the token 7 ⁇ « ⁇ , the option certificate 3 ⁇ 4rt A to the entity ⁇ ;
  • entity ⁇ sends token 7M a4, optional certificate to entity A;
  • the three-pass authentication mechanism must be successful in ensuring that the entities ⁇ and ⁇ respectively have the valid public key of the other party, and how to obtain the public key of the other party and its validity, the agreement itself is not involved.
  • This guarantee requirement condition cannot be satisfied in the current multi-application environment.
  • the communication network usually adopts an entity authentication mechanism to implement the user access control function. Before the authentication mechanism is successfully completed, the user is prohibited from accessing the network, and thus the user cannot be authenticated before the authentication. Or it is difficult to access the certificate authority to obtain the validity of the peer entity, the network access point public key.
  • communication networks especially wireless communication networks
  • communication networks usually need to complete authentication between users and network access points, not only to ensure that legitimate users access the network, but also to ensure that the network accessed by users is legitimate, and therefore for network entities.
  • the effective public key of the communication peer entity is not known before the authentication, but the verification of the public key of the peer entity is completed in the authentication process, the traditional entity authentication mechanism is not only perfected, but also the practical application is implemented. It has good feasibility and ease of use.
  • the present invention solves the above technical problems existing in the background art, and proposes an entity authentication method for introducing an online third party.
  • the technical solution of the present invention is:
  • the present invention is an entity authentication method for introducing an online third party, which is special in that the method includes the following steps:
  • the entity sends a message 1 to the entity ⁇ , the message 1 includes a random number R B and an optional text Textl
  • the entity A After receiving the message 1, the entity A sends a message 2 to the trusted third party TP, and the message 2 includes a random number, an identity/ A and an optional text 73 ⁇ 4Jrt2;
  • the trusted third party TP After receiving the message 2, the trusted third party TP checks the legality of the entity A according to the identity identifier ⁇ ; 4) After checking the legality of the entity A, the trusted third party TP returns a message 3 to the entity A, and the message 3 includes the entity verification result Res A , the token To/ enTA and the optional text Text4;
  • the entity A After receiving the message 3, the entity A sends a message 4 to the entity ⁇ , and the message 4 includes the entity verification result Res A , the tokens TokenTA and the TokenAB;
  • Step 6) includes:
  • trusted third party TP in the TokenTA verify a signature, the message and checks the entity B generates a random number R B and data contained in the signature of the trusted third party TP in the TokenTA random number R B are consistent, if the verification Pass through step 6.2);
  • Step 3 above) in legitimacy check entity A process as follows: In the message 2, if the identity of the entity A L A specifier entity A is valid public key of the trusted third party TP searches PublicKey A of the entity A; as ⁇ Entity A's identity / A is entity A's certificate C3 ⁇ 4r A , then trusted third party: TP check certificate (3 ⁇ 4 ⁇ 4 validity Valid A) .
  • the above random number R A 'and is a time stamp or a sequence number.
  • TokenAB Text6 ⁇ ⁇ I A ⁇ ⁇ sS A ( A ⁇ ⁇ R B ⁇ ⁇ Res A ⁇ ⁇ TokenTA ⁇ ⁇ Text5 )
  • the invention adopts a three-entity framework, and the authentication entity needs to obtain the public key or certificate of the trusted third party before the authentication, and obtain the user certificate issued by the trusted third party to itself or hand over the public key to the trusted third party for storage. There is no need to know in advance the valid public key of the peer authentication entity.
  • the public key of the authentication entity and its validity are automatically transmitted to the required peers through the search and verification of the trusted third party.
  • the invention discloses an online retrieval and authentication mechanism of the public key, realizes centralized management thereof, and simplifies the operating conditions of the protocol, and is convenient for its application implementation.
  • DRAWINGS 1 is a schematic diagram of authentication of a three-pass authentication mechanism in the prior art
  • Figure 2 is a schematic illustration of the process of the present invention.
  • the method of the present invention involves three entities, two authentication entities A and ⁇ , a trusted third party T, and a trusted third party TP is a trusted third party that authenticates entities A and ⁇ .
  • entity ⁇ provides an authentication service
  • the system for realizing the peer-to-peer authentication between the two entities A and ⁇ through the trusted third party TP is called a Tri-element Peer Authentication (TePA) system.
  • TePA Tri-element Peer Authentication
  • TokenTA sS T (R B ⁇ ⁇ Res A ⁇ I Text3 )
  • entity B sends message 1 to entity A, message 1 includes random number RS and optional text Tfcc;
  • the entity A After receiving the message 1, the entity A sends a message 2 to the trusted third party TP, and the message 2 includes a random number, an identity I A and an optional text Text2;
  • the trusted third party TP After receiving the message 2, the trusted third party TP checks the legality of the entity A according to the identity/ 4 : In the message 2, if the identity/ A of the entity A is the identifier A of the entity A, the trusted The three-party TP searches for the valid public key of the entity A, PublicKey A ; if the identity of the entity A is the certificate Cert A of the entity A , the trusted third party checks the validity of the certificate Cert A , Valid A.
  • the trusted third party TP checks the legality of the entity A, and returns a message 3 to the entity A.
  • the message 3 includes the entity verification result Re, the token TokenTA and the optional text Text4;
  • the entity A After receiving the message 3, the entity A sends a message 4 to the entity ⁇ , and the message 4 includes the entity verification result Res A , the tokens TokenTA and the TokenAB; 6) After the entity receives the message 4, it performs verification:
  • trusted third party TP in the TokenTA verify a signature, the message and checks the entity B generates a random number R B and data contained in the signature of the trusted third party TP in the TokenTA random number R B are consistent, if the verification Pass through step 6.2);
  • random numbers R A and R B can be replaced with time stamps or sequence numbers.
  • the authentication system is used.
  • the entity ⁇ resides on the communication user terminal, and the entity ⁇ resides on the network access point.
  • the user can authenticate the legality of the network access point and ensure that the network accessed by the user is legal.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer And Data Communications (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Information Transfer Between Computers (AREA)

Description

一种引入在线第三方的实体鉴别方法
本申请要求于 2009 年 8 月 28 日提交中国专利局、 申请号为 200910023735.5、 发明名称为"一种引入在线第三方的实体鉴别方法"的中国专 利申请的优先权， 其全部内容通过 1用结合在本申请中。
技术领域
本发明涉及一种实体鉴别方法，尤其是一种引入在线第三方的实体鉴别方 法。
背景技术
釆用非对称密码技术的实体鉴别方法可分为两种类型，即单向鉴别和双向 鉴别。鉴别的唯一性或时效性由时变参数进行标识， 常被用作时变参数的有时 间标记、 顺序号和随机数等。 若采用时间标记或顺序号作为时变参数， 则单向 鉴别只需要采用一次消息传递， 双向鉴别需要采用两次消息传递； 若采用随机 数作为时变参数， 则单向鉴别需要采用两次消息传递， 双向鉴别需要采用三次 消息传递或四次消息传递（即两次消息传递的并行鉴别；)。
不论上述哪种鉴别机制， 在运行之前或运行当中， 验证者必须具有声称者 的有效公开密钥， 否则鉴別过程会受到损害或不能成功完成。 在此， 以双向鉴 别的三次传递方法为例进行说明：
参见图 1 , 权标
Figure imgf000003_0001
( RA\ \RB\ \B\ \ Text2 ) , TokenBA=RB\ \RA\ \A\ \Text5\ \sSB ( RB\ \RA\ \A\ \Text4 λ 其中， X 为实体区分符， 该 鉴别系统有 Α和 β两个鉴别实体； Certx表示实体 X的证书； x表示实体 X 的签名； 表示实体 X产生的随机数； Tfcct为可选文本字段。
三次传递鉴别机制运行过程详述如下：
1 ) 实体 β发送随机数 Rs、 可选项文本 7¾ ^给实体 A;
2 ) 实体 A发送权标 7Μ«ιΑβ、 可选项证书 ¾rtA给实体 β;
3 ) 实体 β收到实体 Α发送的消息后， 执行以下步骤：
3.1 )通过检验实体 A的证书或通过别的方式确保拥有实体 A的有效公开 密钥。
3.2 )获取实体 A的公钥后， 验证步骤 2 ) 中的 TokmAB的签名， 校验区 分符 B的正确性， 并检查步骤 1 ) 中发送的随机数 ^和 TokenAB中的随机数 RB是否相符， 实体 完成对实体 A的验证；
4 ) 实体 β发送权标 7M a4、 可选项证书 给实体 A;
5 ) 实体 A收到实体 B发送的包括 TokenBA的消息后， 执行以下步骤：
5.1 )通过检验实体 B的证书或通过别的方式确保拥有实体 B的有效公开 密钥；
5.2 )获取实体 B的公钥后， 验证 4 )中的 TokenBA的签名， 校验区分符 A 的正确性， 并检查步驟 2 ) 中发送的随机数 RA和 TokenBA中的随机数 RA是否 相符及 1 ) 中收到的随机数 RB和 TokenBA中的随机数 RB是否相符； 实体 A完 成对实体 β的验证。
可见， 三次传递鉴别机制欲运行成功必须确保实体 Α和 β分别拥有对方 的有效公开密钥，而如何获得对方公开密钥及其有效性，协议本身并没有涉及。 这一保障需求条件在目前 ί艮多应用环境下都不能满足，比如通信网络通常采用 实体鉴别机制实现用户接入控制功能， 在鉴别机制成功完成前， 禁止用户访问 网络，因而在鉴别之前用户无法或难以访问证书机构获得对端实体——网络接 入点公开密钥的有效性。
目前通信网络， 特別是无线通信网络， 通常需要在用户和网络接入点之间 完成鉴别， 不仅要保证合法用户接入网络， 而且需要保证用户接入的网络是合 法的， 因此对于网络实体而言， 在鉴别之前若不知晓通信对端实体的有效公开 密钥， 而是在鉴别过程中完成对端实体公开密钥的验证， 则不仅完善了传统的 实体鉴别机制， 而且使其在实际应用中具有良好的可行性和易用性。
发明内容
本发明为解决背景技术中存在的上述技术问题，而提出一种引入在线第三 方的实体鉴别方法。
本发明的技术解决方案是： 本发明为一种引入在线第三方的实体鉴别方 法， 其特殊之处在于： 该方法包括以下步骤：
1 )实体 Β发送消息 1到实体 Α, 消息 1包括随机数 RB及可选文本 Textl
2 )实体 A收到消息 1后， 向可信第三方 TP发送消息 2, 消息 2包括随机 数 、 身份标识 /A 及可选文本 7¾Jrt2;
3 )可信第三方 TP收到消息 2后， 根据身份标识 ^检查实体 A的合法性； 4 )可信第三方 TP检查完实体 A的合法性后， 向实体 A返回消息 3， 消 息 3包括实体验证结果 ResA、 权标 To/ enTA及可选文本 Text4;
5 ) 实体 A收到消息 3后， 向实体 β发送消息 4, 消息 4包括实体验证结 果 ResA、 权标 TokenTA和 TokenAB;
6 ) 实体 收到消息 4后， 进行验证。
步骤 6 ) 包括：
6.1 )验证 TokenTA中可信第三方 TP的签名， 并检查消息 1中实体 B产生 的随机数 RB与包含在 TokenTA中可信第三方 TP的签名数据中的随机数 RB是 否相符， 若验证通过则执行步骤 6.2 );
6.2 )得到实体 A的验证结果 Re , 若实体 A合法有效， 则执行步骤 6.3 ), 否则结束；
6.3 )获取实体 A的公钥， 验证 TokenAB中实体 A的签名， 并检查消息 1 中实体 β产生的随机数 Rs与包含在 TokenAB中实体 A的签名数据中的随机数 Rs 是否一致， 若验证通过， 则实体 β完成对实体 A的鉴别。
上述步骤 3 ) 中检查实体 A合法性的过程为： 在消息 2中， 如果实体 A的 身份标识 lA为实体 A的区分符 则可信第三方 TP搜索实体 A的有效公钥 PublicKeyA； 如杲实体 A的身份标识 /A为实体 A的证书 C¾r A , 则可信第三方 ： TP检查证书（¾^4的有效性 ValidA。
上述随机数 RA '和 为时间标记或顺序号。
上述权标字段为：
TokenTA - sSj
Figure imgf000005_0001
Text3 )
TokenAB = Text6\ \IA\ \sSA ( A\ \RB\ \ResA\ \TokenTA\ \ Text5 )
本发明采用三实体构架，鉴别实体在鉴别之前需获得可信第三方的公钥或 证书，并获得可信第三方颁发给自己的用户证书或将自己的公钥交给可信第三 方保管， 而无需事先知晓对端鉴别实体的有效公开密钥。 在协议运行中， 鉴别 实体的公开密钥及其有效性通过可信第三方的搜索和验证， 自动传递给所需的 对端。 本发明相比传统鉴别机制， 公开了公开密钥的在线检索和鉴别机制， 实 现了对它的集中管理， 筒化了协议的运行条件， 便于其应用实施。
附图说明 图 1为现有技术中三次传递鉴别机制的鉴别示意图；
图 2为本发明的方法示意图。
具体实施方式
本发明的方法涉及三个实体， 两个鉴别实体 A和 β, —个可信第三方 T ( Trusted third Party ), 可信第三方 TP为鉴别实体 A和 β的可信第三方， 为实 体 Α和实体 β提供鉴别服务， 将这种通过可信第三方 TP实现两实体 A和 β 之间对等鉴别的系统， 称之为三元对等鉴别 TePA ( Tri-element Peer Authentication ) 系统。
为方便起见， 定义如下符号：
½/ 表示证书 Certx的有效性； PublicKeyA实体 X ( X代表 A或 β ) 的 公钥； /χ为实体 ί的身份标识， 由证书 Cer 或者实体的区分符 X表示； Resx 表示实体 X的验证结果， 由证书 C¾rtx及其有效性 ¾i &组成或者由实体 X及 其公钥
Figure imgf000006_0001
Token为权标字段。
参见图 2, 本发明的权标字段如下：
TokenTA = sST (RB\ \ResA\ I Text3 )
TokenAB^ Text6\ \IA\ \sSA ( A\ \RB\ \ResA\ \TokenTA\ \ Text5 )
实体 B对实体 A的鉴别的具体流程如下：
1 ) 当实体 β需要对实体 Α进行鉴别时， 实体 B发送消息 1到实体 A , 消 息 1包括随机数 RS及可选文本 Tfcc ;
2 )实体 A收到消息 1后， 向可信第三方 TP发送消息 2 , 消息 2包括随机 数 、 身份标识 IA及可选文本 Text2；
3 )可信第三方 TP收到消息 2后， 根据身份标识 /4检查实体 A的合法性： 在消息 2中， 如果实体 A的身份标识 /A为实体 A的区分符 A, 则可信第 三方 TP搜索实体 A的有效公钥 PublicKeyA; 如果实体 A的身份标识 l 为实体 A的证书 CertA , 则可信第三方 检查证书 CertA的有效性 ValidA。
4 )可信第三方 TP检查完实体 A的合法性后， 向实体 A返回消息 3 , 消 息 3包括实体验证结果 Re 、 权标 TokenTA及可选文本 Text4;
5 ) 实体 A收到消息 3后， 向实体 β发送消息 4, 消息 4包括实体验证结 果 ResA、 权标 TokenTA和 TokenAB; 6 ) 实体 收到消息 4后， 进行验证：
6.1 )验证 TokenTA中可信第三方 TP的签名， 并检查消息 1中实体 B产生 的随机数 RB与包含在 TokenTA中可信第三方 TP的签名数据中的随机数 RB是 否相符， 若验证通过则执行步骤 6.2 );
6.2 )得到实体 A的验证结果 Re , 若实体 A合法有效， 则执行步骤 6.3 ), 否则结束；
6.3 )获取实体 A的公钥， 验证 TokenAB中实体 A的签名， 并检查消息 1 中实体 β产生的随机数 Rs与包含在 TokenAB中实体 A的签名数据中的随机数 Rs 是否一致， 若验证通过， 则实体 β完成对实体 A的鉴别。
其中随机数 RA和 RB可使用时间标记或顺序号代替。
在实际应用中， 使用这种鉴別系统， 通常实体 β驻留在通信用户终端上， 实体 Α驻留在网络接入点上， 通过上述实施例中实体 A和实体 B之间的鉴别 方法， 可以实现用户对网络接入点的合法性认证， 确保用户接入的网络是合法 的。

Claims

权 利 要 求
1、 一种引入在线第三方的实体鉴别方法， 其特征在于： 该方法包括以下 步骤：
1 )实体 B发送消息 1到实体 Α, 消息 1包括随机数 Rs及可选文本 Textl ', 2 )实体 A收到消息 1后， 向可信第三方 TP发送消息 2 , 消息 2包括随机 数 、 身份标识 l及可选文本 Text2；
3 )可信第三方 TP收到消息 2后， 根据身份标识 /4检查实体 A的合法性；
4 )可信第三方 TP检查完实体 A的合法性后， 向实体 A返回消息 3， 消 息 3包括实体验证结果 ResA、 权标 TokenTA及可选文本 Text4;
5 ) 实体 A收到消息 3后， 向实体 β发送消息 4 , 消息 4包括实体验证结 果 ResA- 权标 TokenTA和 TokenAB;
6 ) 实体 收到消息 4后， 进行验证。
2、 根据权利要求 1所述的引入在线第三方的实体鉴别方法， 其特征在于： 步骤 6 ) 包括：
6.1 )验证 TokenTA中可信第三方 TP的签名， 并检查消息 1中实体 B产生 的随机数 RB与包含在 TokmTA中可信第三方 TP的签名数据中的随机数 RB是 否相符， 若验证通过则执行步骤 6.2 );
6.2 )得到实体 A的验证结果 ResA , 若实体 A合法有效， 则执行步骤 6.3 ), 否则结束；
6.3 )获取实体 A的公钥， 验证 TokenAB中实体 A的签名， 并检查消息 1 中实体 5产生的随机数 RB与包含在 TokenAB中实体 A的签名数据中的随机数 Rs 是否一致， 若验证通过， 则实体 β完成对实体 A的鉴别。
3、根据权利要求 1所述的引入在线第三方的实体鉴别方法， 其特征在于： 所述步骤 3 )中检查实体 A合法性的过程为： 在消息 2中， 如果实体 A的身份 标识 /A为实体 A 的区分符 则可信第三方 TP搜索实体 A 的有效公钥 PublicKeyA； 如果实体 A的身份标识 /A为实体 A的证书 CertA , 则可信第三方 P检查证书（¾ 的有效性 VcdidA。
4、根据权利要求 3所述的引入在线第三方的实体鉴别方法， 其特征在于： 所述随机数 RA和 Rs为时间标记或顺序号。 5、根据权利要求 1至 4任意一项所述的引入在线第三方的实体鉴别方法, 其特征在于： 所述权标字段为：
TokenTA = sST
Figure imgf000009_0001
)
TokenAB= Text6\ \IA\ I sSA (A\\RB\ \ResA\\ TokenTA\ I Text5 ) 。
PCT/CN2009/076181 2009-08-28 2009-12-29 一种引入在线第三方的实体鉴别方法 WO2011022919A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
US13/392,915 US8763100B2 (en) 2009-08-28 2009-12-29 Entity authentication method with introduction of online third party
JP2012525851A JP5468138B2 (ja) 2009-08-28 2009-12-29 オンライン第三者装置を導入するエンティティ認証方法
KR1020127007895A KR101471259B1 (ko) 2009-08-28 2009-12-29 온라인 제３자를 도입하는 개체 인증 방법
EP09848651.7A EP2472771A4 (en) 2009-08-28 2009-12-29 Entity authentication method by introducing online third party

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2009100237355A CN101645776B (zh) 2009-08-28 2009-08-28 一种引入在线第三方的实体鉴别方法
CN200910023735.5 2009-08-28

Publications (1)

Publication Number Publication Date
WO2011022919A1 true WO2011022919A1 (zh) 2011-03-03

Family

ID=41657503

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2009/076181 WO2011022919A1 (zh) 2009-08-28 2009-12-29 一种引入在线第三方的实体鉴别方法

Country Status (6)

Country Link
US (1) US8763100B2 (zh)
EP (1) EP2472771A4 (zh)
JP (1) JP5468138B2 (zh)
KR (1) KR101471259B1 (zh)
CN (1) CN101645776B (zh)
WO (1) WO2011022919A1 (zh)

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101984577B (zh) 2010-11-12 2013-05-01 西安西电捷通无线网络通信股份有限公司 匿名实体鉴别方法及系统
CN101997688B (zh) 2010-11-12 2013-02-06 西安西电捷通无线网络通信股份有限公司 一种匿名实体鉴别方法及系统
US8978120B2 (en) * 2011-05-18 2015-03-10 Panasonic Intellectual Property Management Co., Ltd. Communication control system and method, and communication device and method
CN103312499B (zh) 2012-03-12 2018-07-03 西安西电捷通无线网络通信股份有限公司 一种身份认证方法及系统
CN103312670A (zh) 2012-03-12 2013-09-18 西安西电捷通无线网络通信股份有限公司 一种认证方法及系统
CN103067385B (zh) * 2012-12-27 2015-09-09 深圳市深信服电子科技有限公司 防御会话劫持攻击的方法和防火墙
US9560046B2 (en) * 2014-11-07 2017-01-31 Kaiser Foundation Hospitals Device notarization
JP6489835B2 (ja) * 2015-01-09 2019-03-27 キヤノン株式会社 情報処理システム、情報処理装置の制御方法、及びプログラム
JP6387908B2 (ja) * 2015-06-22 2018-09-12 トヨタ自動車株式会社 認証システム
CN106572064B (zh) * 2015-10-10 2019-10-29 西安西电捷通无线网络通信股份有限公司 一种多ttp参与的实体身份有效性验证方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1297636A (zh) * 1998-03-17 2001-05-30 桑纳拉斯麦脱信托有限公司 可靠和安全地识别合同方的过程和系统
US20070208941A1 (en) * 2006-02-09 2007-09-06 Alejandro Backer Method and system for authentication of electronic communications
CN101247223A (zh) * 2008-03-06 2008-08-20 西安西电捷通无线网络通信有限公司 一种实用的基于可信第三方的实体双向鉴别方法
CN101364876A (zh) * 2008-09-12 2009-02-11 西安西电捷通无线网络通信有限公司 一种实现实体的公钥获取、证书验证及鉴别的方法

Family Cites Families (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH08297638A (ja) 1995-04-26 1996-11-12 Nippon Telegr & Teleph Corp <Ntt> 利用者認証方式
JPH08335208A (ja) * 1995-06-08 1996-12-17 Nippon Telegr & Teleph Corp <Ntt> 代理認証方法及びシステム
US5794221A (en) 1995-07-07 1998-08-11 Egendorf; Andrew Internet billing method
JPH10210023A (ja) 1997-01-27 1998-08-07 Oki Electric Ind Co Ltd 認証方法、暗号鍵共有方法および通信システム
US6886102B1 (en) * 1999-07-14 2005-04-26 Symantec Corporation System and method for protecting a computer network against denial of service attacks
CA2418740C (en) 2000-08-08 2010-07-27 Wachovia Corporation Internet third-party authentication using electronic tickets
US7370351B1 (en) 2001-03-22 2008-05-06 Novell, Inc. Cross domain authentication and security services using proxies for HTTP access
US7155608B1 (en) 2001-12-05 2006-12-26 Bellsouth Intellectual Property Corp. Foreign network SPAM blocker
US20030190046A1 (en) * 2002-04-05 2003-10-09 Kamerman Matthew Albert Three party signing protocol providing non-linkability
ATE367043T1 (de) 2002-05-24 2007-08-15 Ericsson Telefon Ab L M Verfahren zur authentifizierung eines anwenders bei einem zugang zu einem dienst eines diensteanbieters
CN100428667C (zh) 2003-12-01 2008-10-22 中国电子科技集团公司第三十研究所 一种采用公开密钥密码算法数字签名模式的强鉴别方法
ATE506797T1 (de) * 2004-05-07 2011-05-15 Alcatel Lucent Datenauthentifizierungsverfahren und agent basiertes system
JP4714482B2 (ja) 2005-02-28 2011-06-29 株式会社日立製作所 暗号通信システムおよび方法
JP4692167B2 (ja) 2005-09-05 2011-06-01 ヤマハ株式会社 ミキシング装置
CN101064605B (zh) 2006-04-29 2011-02-16 华为技术有限公司 一种多主机网络的aaa系统及认证方法
CN100495963C (zh) * 2006-09-23 2009-06-03 西安西电捷通无线网络通信有限公司 一种公钥证书状态的获取及验证方法
CN100488305C (zh) * 2006-09-23 2009-05-13 西安西电捷通无线网络通信有限公司 一种网络接入鉴别与授权方法以及授权密钥更新方法
CN101222328B (zh) * 2007-12-14 2010-11-03 西安西电捷通无线网络通信股份有限公司 一种实体双向鉴别方法
US20110131640A1 (en) * 2008-02-18 2011-06-02 Microelectronica Espanola S.A.U. Secure transfer of data
CN101364875B (zh) * 2008-09-12 2010-08-11 西安西电捷通无线网络通信有限公司 一种实现实体的公钥获取、证书验证及双向鉴别的方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1297636A (zh) * 1998-03-17 2001-05-30 桑纳拉斯麦脱信托有限公司 可靠和安全地识别合同方的过程和系统
US20070208941A1 (en) * 2006-02-09 2007-09-06 Alejandro Backer Method and system for authentication of electronic communications
CN101247223A (zh) * 2008-03-06 2008-08-20 西安西电捷通无线网络通信有限公司 一种实用的基于可信第三方的实体双向鉴别方法
CN101364876A (zh) * 2008-09-12 2009-02-11 西安西电捷通无线网络通信有限公司 一种实现实体的公钥获取、证书验证及鉴别的方法

Also Published As

Publication number Publication date
CN101645776B (zh) 2011-09-21
EP2472771A4 (en) 2017-07-26
KR20120052403A (ko) 2012-05-23
US20120167190A1 (en) 2012-06-28
JP2013503513A (ja) 2013-01-31
JP5468138B2 (ja) 2014-04-09
KR101471259B1 (ko) 2014-12-09
US8763100B2 (en) 2014-06-24
EP2472771A1 (en) 2012-07-04
CN101645776A (zh) 2010-02-10

Similar Documents

Publication Publication Date Title
WO2011022919A1 (zh) 一种引入在线第三方的实体鉴别方法
JP5099568B2 (ja) 信頼できる第三者に基づいたエンティティの相互認証の方法、及びシステム
WO2009076879A1 (zh) 一种实体双向鉴别方法和系统
WO2011022918A1 (zh) 一种引入在线第三方的实体双向鉴别方法
WO2009109136A1 (zh) 一种实用的基于可信第三方的实体双向鉴别方法
WO2011026296A1 (zh) 引入在线可信第三方的实体鉴别方法
KR101405509B1 (ko) 온라인 제 3 신뢰 기관을 도입함으로써 엔티티 공개키 획득, 인증서 검증 및 인증을 수행하는 방법 및 시스템
CN101364876B (zh) 一种实现实体的公钥获取、证书验证及鉴别的方法
KR101254868B1 (ko) 고속 핸드오프를 지원하는 엔티티 양방향 신원 방법
KR20190114434A (ko) 블록체인 기반의 권한 인증 방법, 단말 및 이를 이용한 서버
KR20050064119A (ko) 인터넷접속을 위한 확장인증프로토콜 인증시 단말에서의서버인증서 유효성 검증 방법
US20070234054A1 (en) System and method of network equipment remote access authentication in a communications network
KR20190114433A (ko) 블록체인 기반의 권한 인증 방법, 단말 및 이를 이용한 서버
KR20190114432A (ko) 블록체인 기반의 권한 인증 방법, 단말 및 이를 이용한 서버
KR20220006097A (ko) 블록체인을 이용한 공개 키 관리를 위한 방법 및 디바이스
JP6122399B2 (ja) クライアント証明書による端末認証方法、端末認証システム及びプログラム
CN114915494B (zh) 一种匿名认证的方法、系统、设备和存储介质
Bellatriu Kerberos Realm Crossover
KR20190114435A (ko) 블록체인 기반의 권한 인증 방법, 단말 및 이를 이용한 서버
WO2011075907A1 (zh) 一种实现实体的公钥获取、证书验证及双向鉴别的方法
WO2011075906A1 (zh) 一种实现实体的公钥获取、证书验证及鉴别的方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 09848651

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2009848651

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2012525851

Country of ref document: JP

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 13392915

Country of ref document: US

ENP Entry into the national phase

Ref document number: 20127007895

Country of ref document: KR

Kind code of ref document: A