WO2017219886A1

WO2017219886A1 - Simple network protocol authentication method and device

Info

Publication number: WO2017219886A1
Application number: PCT/CN2017/087893
Authority: WO
Inventors: 阚江涛
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-06-23
Filing date: 2017-06-12
Publication date: 2017-12-28
Also published as: CN107547466A

Abstract

Provided in the present disclosure are a simple network protocol authentication method and device. The method comprises: a network management server acquiring authentication data request information sent by a network device, the authentication data request information being used for verifying the identity of the network device and acquiring information of authentication data, the authentication data being used for performing an SNMP operation between the network management server and the network device; the network management server determining, according to the authentication data request information, the identity of the network device and the authentication data; and the network management server sending authentication data request response information to the network device. By means of an encryption key, a first entity digital certificate and a second entity digital certificate, the invention realizes the determination of authentication data for performing an SNMP operation between a network device and a network management server, thereby improving the security of the network device.

Description

Simple network protocol authentication method and device

Technical field

The present disclosure relates to optical communication technologies, and in particular, to a simple network protocol authentication method and apparatus.

Background technique

The Simple Network Management Protocol (SNMP) is a network management standard based on the Transmission Control Protocol/Internet Protocol (TCP/IP). That is, the network administrator can also receive notification messages from network nodes through SNMP. The alarm event report determines a problem with the network, where the management network node can be a server, workstation, router, or switch.

Generally, the network management server can be connected to multiple network nodes, that is, network devices, and the SNMP authentication key is configured on the network device during the initial configuration of each network device, and the SNMP authentication secret is configured on the network management server. The key, then, when the network management server communicates with the network device, the network management server can manage the network device when the two keys are matched.

However, in the process of implementing the foregoing prior art, the disclosure of the present disclosure finds that the SNMP authentication key is transmitted in plain text during the configuration process and may be stolen, resulting in lower security of the network device.

Summary of the invention

In order to solve the above technical problem, the present disclosure provides a simple network protocol authentication method and apparatus for solving the problem of low security of a network device.

In order to achieve the objectives of the present disclosure, the present disclosure provides a simple network protocol authentication method, including:

The network management server determines the identity of the network device and the first authentication data according to the obtained authentication data request information sent by the network device, where the first authentication data includes the network management server and the network determined by the network management server. Authentication data for simple network protocol SNMP operations between devices;

Sending, by the network management server, authentication data request response information to the network device, where the authentication data request response information is used by the network device to verify an identity of the network management server, and determining second authentication data, the second authentication data And including authentication data determined by the network device for performing a simple network protocol SNMP operation between the network management server and the network device.

Optionally, the network management server, before determining the identity of the network device and the first authentication data, according to the obtained authentication data request information sent by the network device, further includes:

Sending, by the network management server, the second authentication request information to the network device, where the second authentication request information carries a second entity digital certificate parameter and the second random number, where the second entity digital certificate parameter is used for verification The parameter of the legality of the second entity digital certificate, the second entity digital certificate comprising a digital certificate set on the network management server.

Optionally, the network management server determines the network according to the authentication data request information sent by the obtained network device. Before the identity of the device and the first authentication data, it also includes:

The network management server determines that the usage duration of the third authentication data is greater than a threshold, where the third authentication data includes: the network management server determines, before the network management server determines the identity of the network device and the first authentication data, Authentication data for performing SNMP operations between the network management server and the network device; or

The network management server obtains the first authentication request information sent by the network device, where the first authentication request information is used to request authentication between the network management server and the network device.

Optionally, the authentication data request information includes at least one of the following or a combination thereof: a first public key, a first random number, the second random number, a network management server identifier, a first entity digital certificate parameter, and a first a signature value of the entity digital certificate, the first public key includes a public key generated by the network device according to the second random number, and the first random number includes a random number randomly generated by the network device, where the An entity digital certificate parameter includes parameters for verifying the legitimacy of the first entity digital certificate, the first entity digital certificate including a digital certificate disposed at the network device.

Optionally, in the case that the authentication data request information includes the second random number, the first entity digital certificate parameter, the signature value of the first entity digital certificate, and the network management server identifier, the network management server is configured according to Determining the identity of the network device and the first authentication data, including:

Determining, by the network management server, that the second random number is a random number that is sent by the network management server to the network device and carried in the authentication request response information, according to the second random number;

Determining, by the network management server, that the network device is a device that can perform SNMP operations according to the first entity digital certificate parameter, the signature value of the first entity digital certificate, the second random number, and the network management server identifier;

The network management server determines the first authentication data according to the third random number and the first public key.

Optionally, the authentication data request response information includes at least one of the following or a combination thereof: a second public key, the first random number, the second random number, the network device identifier, and the second entity number a certificate parameter, a signature value of the second entity digital certificate, the second public key includes a public key generated by the network management server according to the second random number, and the second entity digital certificate parameter includes a verification The parameter of the legality of the second entity digital certificate.

The present disclosure also provides a simple network protocol authentication method, including:

The network device sends the authentication data request information to the network management server, where the authentication data request information is used to verify the identity of the network device, and obtain information of the first authentication data, where the first authentication data includes the network management server determines Authenticating data of a simple network protocol SNMP operation between the network management server and the network device;

Receiving, by the network device, authentication data request response information sent by the network management server, where the authentication data request response information is used by the network device to verify an identity of the network management server, and determining second authentication data, the second authentication The data includes authentication data determined by the network device for performing a simple network protocol SNMP operation between the network management server and the network device;

And determining, by the network device, the identity of the network management server and the second authentication data according to the authentication data request response information.

Optionally, before the sending, by the network device, the authentication data request information to the network management server, the method further includes:

Obtaining, by the network device, a second entity digital certificate;

The network device sends the first authentication request information to the network management server according to the second entity digital certificate, where the first authentication request information is used to request authentication between the network management server and the network device.

The network device receives the second authentication request information sent by the network management server, where the second authentication request response information carries the second entity digital certificate parameter and the second random number, where the second entity digital certificate parameter includes And a parameter for verifying the legality of the second entity digital certificate, the second entity digital certificate comprising a digital certificate set in the network management server.

Optionally, the authentication data request information includes at least one of the following or a combination thereof: a first public key, a first random number, a second random number, the network management server identifier, a first entity digital certificate parameter, and a first a signature value of the entity digital certificate, the first public key includes a public key generated by the network device according to the second random number, and the first random number includes a random number randomly generated by the network device, where the An entity digital certificate parameter includes parameters for verifying the legitimacy of the first entity digital certificate, the first entity digital certificate including a digital certificate disposed at the network device.

Optionally, the authentication data request response information includes at least one of the following or a combination thereof: a second public key, the first random number, the second random number, a network device identifier, and a second entity digital certificate parameter a signature value of the second entity digital certificate, the second public key includes a public key generated by the network management server according to the second random number, and the second entity digital certificate parameter includes a second entity for verifying The parameter of the validity of the digital certificate.

Optionally, the determining, by the network device, the second authentication data according to the authentication data request response information, including:

Determining, by the network device, that the network management server is operable according to the second entity digital certificate parameter, the signature value of the second entity digital certificate, the first random number, the second random number, and the network device identifier SNMP operated device;

The network device determines the authentication data according to the third random number and the second public key, where the third random number includes a random number generated by the network device to generate the first random number.

Optionally, after the network device receives the second authentication request information sent by the network management server, the method further includes:

Determining, by the network device, that the second entity digital certificate is a legal certificate according to the second entity digital certificate parameter;

Determining, by the network device, the first public key according to the third random number and a curve base point;

Determining, by the network device, the first according to the network device private key, the first public key, the first random number, the second random number, the network management server identifier, and the first entity digital certificate parameter The signature value of the entity digital certificate.

The present disclosure also provides a simple network protocol authentication apparatus, including:

a determining module, configured to determine an identity of the network device and first authentication data according to the authentication data request information sent by the obtained network device, where the first authentication data includes the network management server determined by the network management server Authentication data of a simple network protocol SNMP operation between the network devices;

a sending module, configured to send, to the network device, authentication data request response information, where the authentication data request response information is used by the network device to verify an identity of the network management server, and determine second authentication data, the second identification The certificate data includes authentication data determined by the network device for performing a simple network protocol SNMP operation between the network management server and the network device.

Optionally, the sending module is further configured to send, to the network device, second authentication request information, where the second authentication request information carries a second entity digital certificate parameter and the second random number, where the second The entity digital certificate parameter includes a parameter for verifying the legality of the second entity digital certificate, and the second entity digital certificate includes a digital certificate set on the network management server.

Optionally, the method further includes: a processing module;

The processing module is configured to determine that the usage duration of the third authentication data is greater than a threshold, where the third authentication data includes: determining, by the network management server, the identity of the network device and the first authentication data, the network management server determines Authenticating data for performing an SNMP operation between the network management server and the network device; or acquiring first authentication request information sent by the network device, where the first authentication request information is used to request the network management server Authentication with the network device.

Optionally, the processing module is further configured to determine, according to the second random number, that the second random number is a random number that is sent by the network management server to the network device to be carried in the authentication request response information; Determining, according to the first entity digital certificate parameter, the signature value of the first entity digital certificate, the second random number, and the network management server identifier, that the network device is a device that can perform SNMP operations; according to the third random number and the The first public key determines the first authentication data.

a sending module, configured to send, to the network management server, the authentication data request information, where the authentication data request information is used to verify the identity of the network device, and obtain information of the first authentication data, where the first authentication data includes the network management server Determining authentication data for performing an SNMP operation between the network management server and the network device;

a receiving module, configured to receive authentication data request response information sent by the network management server, where the authentication data request response information is used by the network device to verify an identity of the network management server, and determine second authentication data of the second authentication data. The data includes authentication data determined by the network device for performing a simple network protocol SNMP operation between the network management server and the network device;

a determining module, configured to determine, according to the authentication data request response information, an identity and a location of the network management server The second authentication data is described.

Optionally, the receiving module is further configured to obtain a second entity digital certificate;

The sending module is further configured to send the first authentication request information to the network management server according to the second entity digital certificate, where the first authentication request information is used to request the network management server and the network device Certification.

Optionally, the receiving module is further configured to receive second authentication request information sent by the network management server, where the second authentication request response information carries a second entity digital certificate parameter and the second random number, The second entity digital certificate parameter includes a parameter for verifying the legitimacy of the second entity digital certificate, and the second entity digital certificate includes a digital certificate set at the network management server.

Optionally, the determining module is further configured to: according to the second entity digital certificate parameter, the signature value of the second entity digital certificate, the first random number, the second random number, and the network device identifier, Determining that the network management server is a device that can perform an SNMP operation; the network device determines the authentication data according to a third random number and the second public key, where the third random number includes the network device generating the A random number generated simultaneously with the first random number.

Optionally, the determining module is further configured to determine, according to the second entity digital certificate parameter, that the second entity digital certificate is a legal certificate; determining the first according to the third random number and a curve base point. a public key; determining, according to the network device private key, the first public key, the first random number, the second random number, the network management server identifier, and the first entity digital certificate parameter, the first entity The signature value of the digital certificate.

In this embodiment, the network management server obtains the authentication data request information sent by the network device, where the authentication data request information is used to verify the identity of the network device, and obtain information of the authentication data, where the authentication data is used by the network management system. And the authentication data of the SNMP operation performed between the server and the network device; the network management server determines the identity of the network device and the authentication data according to the authentication data request information; and the network management server sends the network device to the network device The authentication data request response information is used by the network device to verify the identity of the network management server and determine information of the authentication data. The authentication data used for the SNMP operation between the network device and the network management server is determined by using the encryption key and the first entity digital certificate and the second entity digital certificate, thereby improving the security of the network device.

The present disclosure also provides a storage medium configured to store program code for performing the simple network protocol authentication method of any of the above embodiments.

Other features and advantages of the present disclosure will be set forth in the description which follows. The objectives and other advantages of the present disclosure can be realized and obtained by the structure particularly pointed out in the appended claims.

DRAWINGS

The drawings are used to provide a further understanding of the technical solutions of the present disclosure, and constitute a part of the specification, and the embodiments of the present application are used to explain the technical solutions of the present disclosure, and do not constitute a limitation of the technical solutions of the present disclosure.

1 is a schematic flowchart of an embodiment of a method for authenticating a simple network protocol according to the present disclosure;

2 is a schematic flowchart of a second embodiment of a method for authenticating a simple network protocol according to the present disclosure;

3 is a schematic flowchart of a third embodiment of a simple network protocol authentication method according to the present disclosure;

4 is a schematic structural diagram of an embodiment of a simple network protocol authentication apparatus according to the present disclosure;

FIG. 5 is a schematic structural diagram of a second embodiment of a simple network protocol authentication apparatus according to the present disclosure

FIG. 6 is a schematic structural diagram of a third embodiment of a simple network protocol authentication apparatus according to the present disclosure.

detailed description

The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

The simple network protocol authentication method provided by the embodiment of the present disclosure can be applied to the SNMP authentication process. The simple network protocol authentication method provided by this embodiment may be implemented by a simple network protocol authentication device, which may be integrated in a network management server or separately set, wherein the simple network protocol authentication device may adopt software and/or Hardware way to achieve. The simple network protocol authentication method and apparatus provided in this embodiment are described in detail below.

FIG. 1 is a schematic flowchart of a simple network protocol authentication method according to an embodiment of the present disclosure. As shown in FIG. 1 , the simple network protocol authentication method provided by the present disclosure includes:

Step 101: The network management server determines the identity of the network device and the first authentication data according to the obtained authentication data request information sent by the network device. In this embodiment, the authentication data request information is used to verify the identity of the network device, and obtain information of the authentication data, where the first authentication data includes the network management server and the server determined by the network management server. The authentication data of the simple network protocol SNMP operation between the network devices.

For the network management server to obtain the authentication data request information sent by the network device, the following two applicable scenarios are included:

In a first applicable scenario, the network management server determines that the usage duration of the authentication data is greater than a threshold.

In a second applicable scenario, the network management server obtains the authentication request information sent by the network device, where the authentication request information is used to request authentication between the network management server and the network device.

Illustratively, the network management server first determines, according to the authentication data request information, that the network device is a device that can perform an SNMP operation; and then, according to the authentication data request information, determines the first authentication data.

Step 102: The network management server sends authentication data request response information to the network device.

In this embodiment, the authentication data request response information is used by the network device to verify the identity of the network management server, and determine the second authentication data.

In this embodiment, the second authentication data includes authentication data determined by the network device for performing a simple network protocol SNMP operation between the network management server and the network device, and the network management server sends the network data according to the acquired network device. And the first authentication data includes authentication data for performing a simple network protocol SNMP operation between the network management server and the network device; The network management server sends the authentication data request response information to the network device, where the authentication data request response information is used by the network device to verify the identity of the network management server, and determine the second authentication data. The authentication data used for the SNMP operation between the network device and the network management server is determined by using the encryption key and the first entity digital certificate and the second entity digital certificate, thereby improving the security of the network device.

On the basis of the foregoing embodiment, before the network management server determines the identity of the network device and the first authentication data, the method further includes:

Sending, by the network management server, the second authentication request information to the network device, where the second authentication request information carries a second entity digital certificate parameter and the second random number, where the second entity digital certificate parameter is used for verification The parameter of the legality of the second entity digital certificate, the second entity digital certificate comprising a digital certificate set in the network management server.

Illustratively, the first authentication data request information includes at least one of the following or a combination thereof: a first public key, a first random number, the second random number, a network management server identifier, a first entity digital certificate parameter, a signature value of the first entity digital certificate, the first public key includes a public key generated by the network device according to the second random number, where the first random number includes a random number randomly generated by the network device, where The first entity digital certificate parameter includes a parameter for verifying the legitimacy of the first entity digital certificate, and the first entity digital certificate includes a digital certificate set in the network device.

Optionally, on the basis of the foregoing embodiment, the first authentication data request information includes the second random number, the first entity digital certificate parameter, a signature value of the first entity digital certificate, and the network management server. In the case of the identifier, the network management server determines the identity of the network device and the first authentication data according to the authentication data request information, including:

Illustratively, the second authentication data request information includes at least one of the following or a combination thereof: a second public key, the first random number, the second random number, the network device identifier, and a second entity a digital certificate parameter, a signature value of the second entity digital certificate, where the second public key includes a publicity generated by the network management server according to the second random number And the second entity digital certificate parameter includes a parameter for verifying the validity of the second entity digital certificate.

2 is a schematic flowchart of a second embodiment of a simple network protocol authentication method according to the present disclosure. As shown in FIG. 2, the simple network protocol authentication method provided by the present disclosure includes:

Step 201: The network device sends the authentication data request information to the network management server.

In this embodiment, the authentication data request information is used to verify the identity of the network device, and obtain the first authentication data, where the first authentication data includes the network management server and the server determined by the network management server. The authentication data for SNMP operations between network devices.

For the network device to send authentication data request information to the network management server, the following two applicable scenarios are included:

The first applicable scenario, the network management server determines that the usage duration of the third authentication data is greater than a threshold, and the third authentication data includes: before the network management server determines the identity of the network device and the first authentication data, Authentication data for SNMP operations between the network management server and the network device.

The second applicable scenario, the network management server obtains the first authentication request information sent by the network device, where the first authentication request information is used to request authentication between the network management server and the network device.

Step 202: The network device receives the authentication data request response information sent by the network management server.

In this embodiment, the authentication data request response information is used by the network device to verify the identity of the network management server, and determine second authentication data, where the second authentication data includes a location determined by the network device. The authentication data of the simple network protocol SNMP operation between the network management server and the network device is described.

Step 203: The network device determines the identity of the network management server and the second authentication data according to the authentication data request response information.

Illustratively, the network device first determines, according to the authentication data request information, that the network management server is a device that can perform SNMP operations; and then, according to the authentication data request information, determines the authentication data.

In this embodiment, the network device sends authentication data request information to the network management server, where the authentication data request information is used to verify the identity of the network device, and obtain first authentication data, where the first authentication data is used for the The authentication data of the SNMP operation is performed between the network management server and the network device; the network device receives the authentication data request response information sent by the network management server, and the authentication data request response information is used by the network device to verify the network management The identity of the server, and determining the second authentication data; the network device determining the identity of the network management server and the second authentication data according to the authentication data request response information. The authentication data used for the SNMP operation between the network device and the network management server is determined by using the encryption key and the first entity digital certificate and the second entity digital certificate, thereby improving the security of the network device.

On the basis of the foregoing embodiment, before the network device sends the authentication data request information to the network management server, the method further includes:

Receiving, by the network device, second authentication request information sent by the network management server, where the second authentication request information carries a second entity digital certificate parameter and the second random number, where the second entity digital certificate parameter is included A parameter for verifying the legality of the second entity digital certificate, the second entity digital certificate comprising a digital certificate set in the network management server.

Illustratively, the authentication data request information includes at least one of the following or a combination thereof: a first public key, a first random number, a second random number, the network management server identifier, a first entity digital certificate parameter, and a first a signature value of the entity digital certificate, the first public key includes a public key generated by the network device according to the second random number, and the first random number includes a random number randomly generated by the network device, where the An entity digital certificate parameter includes parameters for verifying the legitimacy of the first entity digital certificate, the first entity digital certificate including a digital certificate disposed at the network device.

Illustratively, the authentication data request response information includes at least one of the following or a combination thereof: a second public key, the first random number, the second random number, a network device identifier, and a second entity digital certificate parameter a signature value of the second entity digital certificate, the second public key includes a public key generated by the network management server according to the second random number, and the second entity digital certificate parameter includes a second entity for verifying The parameter of the validity of the digital certificate.

Optionally, on the basis of the foregoing embodiment, the determining, by the network device, the authentication data according to the authentication data request response information, including:

Optionally, after the network device receives the authentication request response information sent by the network management server, the network device further includes:

3 is a schematic flowchart of a third embodiment of a simple network protocol authentication method according to the present disclosure. As shown in FIG. 3, the simple network protocol authentication method provided by the present disclosure includes:

Step 301: The network device receives the second authentication request information sent by the network management server.

In this embodiment, the second authentication request information carries a second entity digital certificate parameter and the second random number, and the second entity digital certificate parameter includes a parameter for verifying the validity of the second entity digital certificate. The second entity digital certificate includes a digital certificate set in the network management server. For example, the network device receives the authentication request response information sent by the network management server and carries the ZX_MDHello message. The ZX_MDHello message is a UDP packet carrying a second random number Nm and a second entity digital certificate parameter MDCert.

This embodiment applies to the following applicable scenarios:

The first applicable scenario, the network device acquires the second entity digital certificate; the network device sends the first authentication request information to the network management server according to the second entity digital certificate, where the first authentication request information is used Request Authentication between the network management server and the network device.

For example, the network device detects that the entity discriminator is inserted on the USB port of the network device, and the entity discriminator is provided with the first entity digital certificate. Then, the network device sends a trap packet to the network management server, where the trap packet carries the authentication request information. At the same time, the network device starts the authentication mode and waits for the network management server to perform authentication. The trap message sent by the network device to the network management server needs to have a specific oid identifier, indicating that the device has enabled the authentication mode and needs to be authenticated. After the network management server obtains the authentication request information, it needs to initiate the authentication process.

The second applicable scenario, the network management server determines that the usage duration of the authentication data is greater than a threshold.

The third authentication data includes: authentication data for performing an SNMP operation between the network management server and the network device before the network management server determines the identity of the network device and the first authentication data.

Step 302: The network device determines, according to the authentication request response information, a signature value of the first entity digital certificate.

Illustratively, the network device determines, according to the second entity digital certificate parameter, that the second entity digital certificate is a legal certificate; and the network device determines the first according to the third random number and a curve base point. a public key; the network device, according to the network device private key, the first public key, the first random number, the second random number, the network management server identifier, and the first entity digital certificate parameter, Determine the signature value of the first entity digital certificate.

For example, the certificate verification function of the entity discriminator is invoked to verify the validity of the MDCert certificate. Then, the first entity digital certificate random number function is called to generate a random number fourth random number Rn and Nn; the point multiplication function is called to calculate the temporary public key TempPKn; the signature function is called to generate the signature value NDSign; and the ZX_NDHello message is sent to the network management server. The first public key TempPKn, the first random number Nn, the second random number Nm, the identifier IDm of the network management server identifier MD (using the IP address of the MD), the certificate of the ND, the first entity digital certificate parameter NDCert, and the first entity number The signature value of the certificate NDSign, where

TempPKn=Rn×P, P is the curve base point;

NDSign = ECC_Sign (SKn: TempPKn, Nn, Nm, IDm, NDCert), SKn is the private key of ND.

Step 303: The network device sends the authentication data request information to the network management server.

Illustratively, the authentication data request information is used to verify an identity of the network device, and obtain information of authentication data, where the authentication data is used for authentication data of an SNMP operation between the network management server and the network device. .

For example, the authentication data request information is carried in the ZX_NDHello packet, where the authentication data request information includes the first public key TempPKn, the first random number Nn, the second random number Nm, and the identifier IDm of the network management server identifier MD (using the IP of the MD) Address), ND certificate first entity digital certificate parameter NDCert and first entity digital certificate signature value NDSign.

Step 304: The network management server determines the identity of the network device and the first authentication data according to the authentication data request information.

The network management server determines, according to the second random number, that the second random number is a random number that is sent by the network management server to the network device to carry the authentication request response information; the network management server And according to the first entity digital certificate parameter, the signature value of the first entity digital certificate, the second random number, and the network management server identifier, Determining that the network device is a device that can perform SNMP operations; and the network management server determines the first authentication data according to the third random number and the first public key.

For example, first verify that the Nm random number is correct. Then verify the validity of the NDCert certificate body and the validity of the certificate, and then use the public key in the certificate to verify the validity of the signature value NDSign, and finally verify Nm and IDm. After passing, the ND is considered to be true. At the same time, a random number Rm is generated, a temporary public key TempPKm, a signature value MDSign are calculated, and the shared data AuthData is calculated and saved, wherein

TempPKm=Rm×P;

MDSign=ECC_Sign(SKm:TempPKm,Nm,Nn,IDn,MDCert), SKm is the private key of the MD;

AuthData=Rm×TempPKn=Rm×(Rn×P).

Step 305: The network management server sends the authentication data request response information to the network device.

Illustratively, the authentication data request response information is used by the network device to verify the identity of the network management server and determine information of the second authentication data. The authentication data request response information includes at least one of the following or a combination thereof: a second public key, the first random number, the second random number, the network device identifier, a second entity digital certificate parameter, and a a signature value of the second entity digital certificate, the second public key includes a public key generated by the network management server according to the second random number, and the second entity digital certificate parameter includes a digital certificate for verifying the second entity The parameter of legality.

For example, the authentication data request response information is carried in a ZX_MDAuth message, and the authentication data request response information may include a second public key TempPKm, a second random number Nm, a first random number Nn, a network device identification device identifier IDn, and a certificate of the MD. The second entity digital certificate parameter MDCert and the signature value MDSign of the second entity digital certificate.

Step 306: The network device determines the identity of the network management server and the second authentication data according to the authentication data request response information.

For example, using the public key of the CA preset in the entity discriminator, verify the validity of the MDCert certificate body and the validity of the certificate, and then call the signature verification function to verify the validity of the signature value MDSign, and verify Nm, Nn, IDn After the verification is passed, the network management server is considered to be authentic. Calculate and save AuthData at the same time, where

AuthData=Rn×TempPKm=Rn×(Rm×P).

On the basis of the foregoing embodiment, the network management server needs to carry the authentication information AuthData in the SNMP message for the SNMP operation of the device, including the write command such as set/setNex and the read command of get/getNext/getBulk/walk. .

The device receives an SNMP request packet from the network management server. The AuthData data is taken out and the validity of the packet is verified through the interface of the entity discriminator. If the packet is valid, the SNMP request result of the network management server will be returned to the network management server, and the authentication information AuthData will be carried.

The network management server receives the SNMP returned by the device. The AuthData data is taken out and the validity of the packet is verified through the interface of the entity discriminator. If the message is legal, the data returned by the device is read. The SNMP operation was successful. Otherwise, the SNMP operation is considered to have failed.

FIG. 4 is a schematic structural diagram of an embodiment of a simple network protocol authentication apparatus according to the present disclosure. As shown in FIG. 4, the simple network protocol authentication apparatus provided by the present disclosure includes: a determining module 41 and a sending module 42.

a determining module 41, configured to determine an identity of the network device and first authentication data according to the obtained authentication data request information sent by the network device, where the first authentication data includes the network management server determined by the network management server Authentication data for performing a simple network protocol SNMP operation with the network device;

The sending module 42 is configured to send, to the network device, authentication data request response information, where the authentication data request response information is used by the network device to verify an identity of the network management server, and determine second authentication data, where the second The authentication data includes authentication data determined by the network device for performing a simple network protocol SNMP operation between the network management server and the network device.

On the basis of the foregoing embodiment, the sending module 42 is further configured to send, to the network device, second authentication request information, where the second authentication request information carries a second entity digital certificate parameter and the second random number. The second entity digital certificate parameter includes a parameter for verifying the validity of the second entity digital certificate, and the second entity digital certificate includes a digital certificate set on the network management server.

5 is a schematic structural diagram of a second embodiment of a simple network protocol authentication apparatus, as shown in FIG. 5, the simple network protocol authentication apparatus provided by the present disclosure further includes: a processing module 43;

The processing module 43 is configured to determine that the usage duration of the third authentication data is greater than a threshold, where the third authentication data includes: before the network management server determines the identity of the network device and the first authentication data, the network management server Determining the authentication data for performing the SNMP operation between the network management server and the network device; or acquiring the first authentication request information sent by the network device, where the first authentication request information is used to request the network management Authentication between the server and the network device.

Optionally, on the basis of the foregoing embodiment, the processing module 43 is further configured to determine, according to the second random number, that the second random number is sent by the network management server to the network device. Authentication request response letter a random number of the information; determining, according to the first entity digital certificate parameter, the signature value of the first entity digital certificate, the second random number, and the network management server identifier, that the network device is a device capable of performing SNMP operations; The first authentication data is determined by a random number and the first public key.

Optionally, on the basis of the foregoing embodiment, the authentication data request response information includes at least one of the following or a combination thereof: a second public key, the first random number, and the second random number, a network device identifier, a second entity digital certificate parameter, a signature value of the second entity digital certificate, the second public key includes a public key generated by the network management server according to the second random number, and the second entity digital certificate The parameters include parameters for verifying the legitimacy of the second entity digital certificate.

FIG. 6 is a schematic structural diagram of a third embodiment of a simple network protocol authentication apparatus according to the present disclosure. As shown in FIG. 6, the simple network protocol authentication apparatus provided by the present disclosure includes: a sending module 61, a receiving module 62, and a determining module 63. among them,

The sending module 61 is configured to send, to the network management server, the authentication data request information, where the authentication data request information is used to verify the identity of the network device, and obtain information of the first authentication data, where the first authentication data includes the network management Authentication data determined by the server for performing an SNMP operation between the network management server and the network device;

The receiving module 62 is configured to receive authentication data request response information sent by the network management server, where the authentication data request response information is used by the network device to verify an identity of the network management server, and determine second information of the second authentication data. The authentication data includes authentication data determined by the network device for performing a simple network protocol SNMP operation between the network management server and the network device;

The determining module 63 is configured to determine an identity of the network management server and the second authentication data according to the authentication data request response information.

Optionally, on the basis of the foregoing embodiment, the receiving module 62 is further configured to obtain a second entity digital certificate;

Optionally, on the basis of the foregoing embodiment, the receiving module 62 is further configured to receive second authentication request information sent by the network management server, where the second authentication request response information carries a second entity digital certificate parameter and The second random number, the second entity digital certificate parameter includes a parameter for verifying the validity of the second entity digital certificate, and the second entity digital certificate includes a digital certificate set in the network management server.

Optionally, on the basis of the foregoing embodiment, the authentication data request information includes at least one of the following or a combination thereof: a first public key, a first random number, and a second random number, the network management server identifier, An entity digital certificate parameter, a signature value of the first entity digital certificate, the first public key includes a public key generated by the network device according to the second random number, and the first random number includes the network device randomly The generated random number, the first entity digital certificate parameter includes a parameter for verifying the validity of the first entity digital certificate, and the first entity digital certificate includes a digital certificate set in the network device.

Optionally, on the basis of the foregoing embodiment, the authentication data request response information includes at least one of the following or a combination thereof: a second public key, the first random number, the second random number, and a network device The identifier, the second entity digital certificate parameter, and the signature value of the second entity digital certificate, the second public key includes a public key generated by the network management server according to the second random number, and the second entity digital certificate parameter includes A parameter for verifying the legality of the second entity digital certificate.

Optionally, on the basis of the foregoing embodiment, the determining module 63 is further configured to: according to the second entity digital certificate parameter, the signature value of the second entity digital certificate, the first random number, the second random And determining, by the network device identifier, the network management server as a device capable of performing an SNMP operation; the network device determining the authentication data according to the third random number and the second public key, the third random The number includes a random number generated by the network device while generating the first random number.

Optionally, on the basis of the foregoing embodiment, the determining module 63 is further configured to determine, according to the second entity digital certificate parameter, that the second entity digital certificate is a legal certificate; according to the third random number And a curve base point, determining the first public key; and according to the network device private key, the first public key, the first random number, the second random number, the network management server identifier, and the first The entity digital certificate parameter determines the signature value of the first entity digital certificate.

The embodiments disclosed in the present disclosure are as described above, but are merely used to facilitate the understanding of the present disclosure, and are not intended to limit the present disclosure. Any modification or variation in the form and details of the implementation may be made by those skilled in the art without departing from the spirit and scope of the disclosure. The scope defined by the appended claims shall prevail.

Industrial applicability

The simple network protocol authentication method provided by the embodiment of the present disclosure may be applied to a network management server, where the network management server acquires authentication data request information sent by the network device, and determines the identity of the network device and the authentication data according to the authentication data request information, and then connects to the network device. The network device sends the authentication data request response information for the network device to verify the identity of the network management server, and is determined to be used between the network device and the network management server by using the encryption key and the first entity digital certificate and the second entity digital certificate. The authentication data of the SNMP operation improves the security of the network device.

Claims

A simple network protocol authentication method, including:

The network management server determines the identity of the network device and the first authentication data according to the obtained authentication data request information sent by the network device, where the first authentication data includes the network management server and the network determined by the network management server. Authentication data for simple network protocol SNMP operations between devices;

Sending, by the network management server, authentication data request response information to the network device, where the authentication data request response information is used by the network device to verify an identity of the network management server, and determining second authentication data, the second authentication data And including authentication data determined by the network device for performing a simple network protocol SNMP operation between the network management server and the network device.
The method of claim 1, wherein the network management server further comprises: before determining the identity of the network device and the first authentication data, according to the obtained authentication data request information sent by the network device,

Sending, by the network management server, the second authentication request information to the network device, where the second authentication request information carries a second entity digital certificate parameter and the second random number, where the second entity digital certificate parameter is used for verification The parameter of the legality of the second entity digital certificate, the second entity digital certificate comprising a digital certificate set on the network management server.
The method of claim 2, wherein the network management server further comprises: before determining the identity of the network device and the first authentication data, according to the obtained authentication data request information sent by the network device,

The network management server determines that the usage duration of the third authentication data is greater than a threshold, where the third authentication data includes: the network management server determines, before the network management server determines the identity of the network device and the first authentication data, Authentication data for performing SNMP operations between the network management server and the network device; or

The network management server obtains the first authentication request information sent by the network device, where the first authentication request information is used to request authentication between the network management server and the network device.
The method according to claim 3, wherein the authentication data request information includes at least one of the following or a combination thereof: a first public key, a first random number, the second random number, a network management server identifier, and a first An entity digital certificate parameter, a signature value of the first entity digital certificate, the first public key includes a public key generated by the network device according to the second random number, and the first random number includes randomly generated by the network device a random number, the first entity digital certificate parameter comprising a parameter for verifying the legitimacy of the first entity digital certificate, the first entity digital certificate comprising a digital certificate set in the network device.
The method according to claim 4, wherein said authentication data request information includes said second random number, a first entity digital certificate parameter, a signature value of said first entity digital certificate, and said network server identifier And determining, by the network management server, the identity of the network device and the first authentication data according to the authentication data request information, including:

Determining, by the network management server, that the second random number is a random number that is sent by the network management server to the network device and carried in the authentication request response information, according to the second random number;

The network management server is configured according to the first entity digital certificate parameter, the signature value of the first entity digital certificate, and the second random number And determining, by the network management server identifier, that the network device is a device that can perform SNMP operations;

The network management server determines the first authentication data according to the third random number and the first public key.
The method according to any one of claims 2 to 5, wherein the authentication data request response information includes at least one of the following or a combination thereof: a second public key, the first random number, and the second random number a number, the network device identifier, a second entity digital certificate parameter, and a signature value of the second entity digital certificate, where the second public key includes a public key generated by the network management server according to the second random number, The two entity digital certificate parameters include parameters for verifying the legitimacy of the second entity digital certificate.
A simple network protocol authentication method, including:

The network device sends the authentication data request information to the network management server, where the authentication data request information is used to verify the identity of the network device, and obtain information of the first authentication data, where the first authentication data includes the network management server determines Authenticating data of a simple network protocol SNMP operation between the network management server and the network device;

Receiving, by the network device, authentication data request response information sent by the network management server, where the authentication data request response information is used by the network device to verify an identity of the network management server, and determining second authentication data, the second authentication The data includes authentication data determined by the network device for performing a simple network protocol SNMP operation between the network management server and the network device;

And determining, by the network device, the identity of the network management server and the second authentication data according to the authentication data request response information.
The method of claim 7, wherein before the network device sends the authentication data request information to the network management server, the method further includes:

Obtaining, by the network device, a second entity digital certificate;

The network device sends the first authentication request information to the network management server according to the second entity digital certificate, where the first authentication request information is used to request authentication between the network management server and the network device.
The method according to claim 7 or 8, wherein before the network device sends the authentication data request information to the network management server, the method further includes:

The network device receives the second authentication request information sent by the network management server, where the second authentication request response information carries the second entity digital certificate parameter and the second random number, where the second entity digital certificate parameter includes And a parameter for verifying the legality of the second entity digital certificate, the second entity digital certificate comprising a digital certificate set in the network management server.
The method according to claim 9, wherein the authentication data request information comprises at least one of the following or a combination thereof: a first public key, a first random number, a second random number, the network management server identifier, the first An entity digital certificate parameter, a signature value of the first entity digital certificate, the first public key includes a public key generated by the network device according to the second random number, and the first random number includes randomly generated by the network device a random number, the first entity digital certificate parameter comprising a parameter for verifying the legitimacy of the first entity digital certificate, the first entity digital certificate comprising a digital certificate set in the network device.
The method according to claim 10, wherein the authentication data request response information comprises at least one of the following or a combination thereof: a second public key, the first random number, the second random number, a network device identifier a second entity digital certificate parameter, a signature value of the second entity digital certificate, the second public key includes a public key generated by the network management server according to the second random number, and the second entity digital certificate parameter includes A parameter for verifying the legality of the second entity digital certificate.
The method according to any one of claims 7 to 11, wherein the network device determines the second authentication data according to the authentication data request response information, including:

Determining, by the network device, that the network management server is operable according to the second entity digital certificate parameter, the signature value of the second entity digital certificate, the first random number, the second random number, and the network device identifier SNMP operated device;

The network device determines the authentication data according to the third random number and the second public key, where the third random number includes a random number generated by the network device to generate the first random number.
The method according to claim 12, wherein after the network device receives the second authentication request information sent by the network management server, the method further includes:

Determining, by the network device, that the second entity digital certificate is a legal certificate according to the second entity digital certificate parameter;

Determining, by the network device, the first public key according to the third random number and a curve base point;

Determining, by the network device, the first according to the network device private key, the first public key, the first random number, the second random number, the network management server identifier, and the first entity digital certificate parameter The signature value of the entity digital certificate.
A simple network protocol authentication device, comprising:

a determining module, configured to determine an identity of the network device and first authentication data according to the authentication data request information sent by the obtained network device, where the first authentication data includes the network management server determined by the network management server Authentication data of a simple network protocol SNMP operation between the network devices;

a sending module, configured to send, to the network device, authentication data request response information, where the authentication data request response information is used by the network device to verify an identity of the network management server, and determine second authentication data, the second authentication The data includes authentication data determined by the network device for performing a simple network protocol SNMP operation between the network management server and the network device.
The apparatus according to claim 14, wherein the sending module is further configured to send second authentication request information to the network device, where the second authentication request information carries a second entity digital certificate parameter and the second a random number, the second entity digital certificate parameter includes a parameter for verifying the validity of the second entity digital certificate, and the second entity digital certificate includes a digital certificate set on the network management server.
The apparatus of claim 15 further comprising: a processing module;

The processing module is configured to determine that the usage duration of the third authentication data is greater than a threshold, where the third authentication data includes: determining, by the network management server, the identity of the network device and the first authentication data, the network management server determines Authentication data for performing SNMP operations between the network management server and the network device; or The first authentication request information sent by the network device is used, where the first authentication request information is used to request authentication between the network management server and the network device.
The apparatus according to claim 16, wherein the authentication data request information includes at least one of the following or a combination thereof: a first public key, a first random number, the second random number, a network management server identifier, and a first An entity digital certificate parameter, a signature value of the first entity digital certificate, the first public key includes a public key generated by the network device according to the second random number, and the first random number includes randomly generated by the network device a random number, the first entity digital certificate parameter comprising a parameter for verifying the legitimacy of the first entity digital certificate, the first entity digital certificate comprising a digital certificate set in the network device.
The apparatus according to claim 17, wherein the processing module is further configured to determine, according to the second random number, the second random number that is sent by the network management server to the network device to be carried in the authentication. Determining a random number of the response information; determining, according to the first entity digital certificate parameter, the signature value of the first entity digital certificate, the second random number, and the network management server identifier, that the network device is a device capable of performing SNMP operations; The third random number and the first public key determine the first authentication data.
The apparatus according to any one of claims 15 to 18, wherein the authentication data request response information includes at least one of the following or a combination thereof: a second public key, the first random number, the second random a number, the network device identifier, a second entity digital certificate parameter, and a signature value of the second entity digital certificate, where the second public key includes a public key generated by the network management server according to the second random number, The two entity digital certificate parameters include parameters for verifying the legitimacy of the second entity digital certificate.
A simple network protocol authentication device, comprising:

a sending module, configured to send authentication data request information to the network management server, where the authentication data request information is used to verify the identity of the network device, and obtain information of the first authentication data, where the first authentication data includes the network management server Determining authentication data for performing an SNMP operation between the network management server and the network device;

a receiving module, configured to receive authentication data request response information sent by the network management server, where the authentication data request response information is used by the network device to verify an identity of the network management server, and determine second authentication data of the second authentication data The data includes authentication data determined by the network device for performing a simple network protocol SNMP operation between the network management server and the network device;

And a determining module, configured to determine an identity of the network management server and the second authentication data according to the authentication data request response information.
The apparatus according to claim 20, wherein the receiving module is further configured to acquire a second entity digital certificate;

The sending module is further configured to send the first authentication request information to the network management server according to the second entity digital certificate, where the first authentication request information is used to request the network management server and the network device Certification.
The device according to claim 20 or 21, wherein the receiving module is further configured to receive second authentication request information sent by the network management server, where the second authentication request response information carries a second entity digital certificate And the second random number, the second entity digital certificate parameter includes a parameter for verifying the validity of the second entity digital certificate, and the second entity digital certificate includes a digital certificate set in the network management server.
The apparatus according to claim 22, wherein the authentication data request information comprises at least one of the following or a combination thereof: a first public key, a first random number, a second random number, the network management server identifier, the first An entity digital certificate parameter, a signature value of the first entity digital certificate, the first public key includes a public key generated by the network device according to the second random number, and the first random number includes randomly generated by the network device a random number, the first entity digital certificate parameter comprising a parameter for verifying the legitimacy of the first entity digital certificate, the first entity digital certificate comprising a digital certificate set in the network device.
The apparatus according to claim 23, wherein said authentication data request response information comprises at least one of the following or a combination thereof: a second public key, said first random number, said second random number, a network device identifier a second entity digital certificate parameter, a signature value of the second entity digital certificate, the second public key includes a public key generated by the network management server according to the second random number, and the second entity digital certificate parameter includes A parameter for verifying the legality of the second entity digital certificate.
The apparatus according to any one of claims 20 to 24, wherein the determining module is further configured to: according to the second entity digital certificate parameter, the signature value of the second entity digital certificate, the first random number, the a second random number, and the network device identifier, determining that the network management server is a device that can perform an SNMP operation; and determining, by the network device, the authentication data according to the third random number and the second public key, The third random number includes a random number generated by the network device while generating the first random number.
The apparatus according to claim 25, wherein the determining module is further configured to determine, according to the second entity digital certificate parameter, that the second entity digital certificate is a legal certificate; according to the third random number and curve Base point, determining the first public key; and according to the network device private key, the first public key, the first random number, the second random number, the network management server identifier, and the first entity number The certificate parameter determines the signature value of the first entity digital certificate.