CN101741842B - Method for realizing dependable SSH based on dependable computing - Google Patents

Abstract

The invention provides a method for realizing dependable SSH based on dependable computing. The method integrates remote authentication of the dependable computing with key exchange of an SSH protocol so as to closely combine platform status information verification with session key negotiation; and the method enhances the security of data at a communication end point on the premise that safe transmission of the data is ensured. The method requires that both a server and a client are provided with dependable security chips; and the platform status can be measured by a measurement module and a dependable operating system. The method can not only effectively prevent the security threat that the communication with an unknown end point by using a security channel may undergo various attacks in the SSH protocol, but also effectively protect against replay attack, impersonation attack and man-in-the-middle attack.

Description

A kind of method that realizes trusted SSH based on Trusted Computing

Technical field

The present invention relates to field of computer information security, be meant a kind of method that realizes trusted SSH based on Trusted Computing especially.

Background technology

SSH (Secure Shell) agreement is that the network work group of IETF has formulated a security protocol, is used to protect the data of transmitting between client and the server end.The SSH agreement has adopted the hierarchy design, comprises four sub-protocol: SSH transport layer sub-protocol, authentification of user sub-protocol, connexon agreement and file transfer sub-protocol.Preceding two sub-protocol are performed at first successively; Wherein SSH transport layer sub-protocol is responsible for setting up escape way the server and client side; This sub-protocol comprises protocol version exchange, parameter negotiation (comprising the series of algorithms of using in key exchange method and the key exchange process) and three processes of key change; A session key be will negotiate behind this sub-protocol end of run, the authentication information of encrypting user authentication phase, the communication data of access phase communicating pair and file transfer phase communication both sides' communication data will be used for.Fig. 1 is the flow chart of the transport layer sub-protocol of SSH protocol specification definition, wherein k ^cAnd k ^sBe respectively the key that the client and server end produces, sign ^sThe signing messages of representative server, the public key certificate of Cert (server) representative server.The SSH agreement can be used for remote command execution, the telefile transmission of safety, the TCP/IP port of safe Telnet, safety and transmits or the like.Though the SSH agreement allows server and client to carry out authentication each other; But the SSH agreement is not considered the communication terminal fail safe of (comprising the server and client side); Do not provide protection not do checking to the software that moves on the terminal yet, that is to say that present SSH protocol specification do not realize trusted channel.Trusted channel is the secured communication channel that and the software and hardware configuration state at terminal carry out secure binding.

Security threats such as existing P C system is attacked by malicious code easily in network times, information is illegally stolen, data and system's unauthorised broken.The attack method at many infringements terminal is to implement through the malicious code that injects various ways such as virus, worm, wooden horse, spyware, fishing software rather than through the infringement safe lane; Therefore with unknown endpoint communication the time; Even passage safe in utilization still suffers a series of attacks.The safety problem of computerized information is difficult to depend merely on software and solves; In order to solve the existing structural unsafe problems of PC; Fundamentally improve its credibility; The TCPA of credible calculating platform alliance (renaming TCG afterwards as) proposes to guarantee through the fail safe that strengthens existing terminal architecture the safety of whole system, and core concept is on hardware platform, to introduce credible platform module (the being called credible chip again) TPM with safe storage and encryption function.Credible calculating platform is root of trust with TPM; By credible metric function system platform configuration is measured; Safely running situation is recorded in the platform configuration register (PCR) among the TPM then, preserves the historical metric daily record SML (storage measurement log) of integrity measurement that has represented the credible platform of being verified in system simultaneously.The long-distance user according to SML judge with relevant PCR value whether this running environment credible, whether some link safety problem occurs, this process is known as remote proving.In the TCG standard, TPM uses proof of identification key A IK (attestation identity key) to prove the identity of oneself, and every entity through the AIK signature all shows the processing of having passed through TPM.For prevent to reset, distort, attack such as personation, the remote proving process uses AIK to guarantee that the information of receiving handles through a certain appointment TPM.Fig. 2 is the flow chart of remote proving agreement of the researcher design of American I BM company.In this remote proving process, verify that at first the requestor generates a 160bit random number and is designated as nonce, and send to by the verifier; After receiving nonce, asked built-in TPM with the private key SKAIK of AIK value and the nonce of the PCR of appointment to be signed by the verifier, the signature result is designated as Quote, then Quote, SML and AIK public key certificate Cert (AIK) is sent to the checking requestor; Verify that at last the requestor verifies the content that receives, and confirms the authenticity of remote computing platform identity and institute's report content thereof.

Trusted Computing can improve the security intensity of escape way technology through the fail safe that improves the terminal, but also is not applied to the research report or the software of SSH agreement about the remote proving with Trusted Computing at present.

Summary of the invention

The objective of the invention is to avoid above-mentioned weak point of the prior art and a kind of method that realizes trusted SSH based on Trusted Computing is provided.This method is through carrying out organic combination with the remote proving of Trusted Computing and these two processes of key change of SSH agreement; Realized combining closely of platform status information checking and session key agreement; Under the prerequisite of transmission that guarantees data security, strengthened the fail safe of data at communication end point.

The object of the invention can reach through following measure:

A kind of method that realizes trusted SSH based on Trusted Computing; The remote proving of Trusted Computing and these two processes of key change of SSH agreement are carried out organic combination; Thereby the checking of implementation platform state information is combined closely with session key agreement; This method relates to the client and server end, and the concrete steps of its method are following:

Step 1, parameter negotiation: client and server end carry out parameter negotiation, negotiate content except the content of SSH agreement regulation, also comprise the platform status information checking the numbering of the PCR that will use; Client and server end are noted the information of information of receiving in the parameter-negotiation procedure and transmission respectively in addition, and leave Msg in respectively ₁ ^cAnd Msg ₁ ^s

Step 2, client transmission information are given server end: client is at first selected one less than p and greater than 1 positive integer x, calculates k ^c=g ^xMod p, and to V_C||V_S||Msg ₁ ^c|| Msg ₁ ^s|| PUK _AIK ^c|| k ^cCarry out Hash operation, Hash operation result is designated as hash ^cThe content of the PCR of appointment and be designated as PCR in the obtaining step 1 the safety chip TPM of client from the mainboard that is installed in client place computer then ^c, use SK _AIK ^cTo PCR ^c|| hash ^cSign, signature result note is made sign ^cAt last will ${\mathrm{Msg}}_2^c=({\mathrm{SML}}^c,k^c,{\mathrm{Sign}}^c,{\mathrm{Cert}}_{\mathrm{AIK}}^c)$ Send to server end; Wherein p is a big prime number, and g is a positive integer, and V_C and V_S represent the identifier of client and the identifier of server end respectively, symbol || expression link, SK _AIK ^c, PUK _AIK ^cAnd Cert _AIK ^cBe respectively private key, PKI and the public key certificate of customer end A IK, SML ^cThe metric daily record of expression client platform;

Step 3, the server end checking client: server end is received Msg ₂ ^cAfter, at first verify Cert _AIK ^cValidity and legitimacy, if the checking do not pass through, then stop key exchange process, if the checking pass through, then utilize Cert _AIK ^cIn PKI PUK _AIK ^cFrom sign ^cThe middle SML that obtains in the step 2 ^c, hash ^cAnd PCR ^c, and note is made t_SML respectively ^s, t_hash ^sAnd t_PCR ^sThen to V_C and the V_S and the Msg of self record ₁ ^cAnd Msg ₁ ^s, and received PUK _AIK ^cAnd Msg ₂ ^cIn k ^cDo Hash operation, the result's note after the Hash operation is made s_hash ^s, inspection t_hash ^sAnd s_hash ^sWhether mate,, then stop key exchange process if do not match; If end value is calculated and obtained to coupling then according to the whole integrity measurement process of t_SML reconstruct client,, note is made s_PCR ^s, judge s_PCR ^sWith t_PCR ^sWhether mate,, then stop key exchange process if do not match; If coupling then gets into step 4;

Step 4, server end transmission information are given client: server end is at first selected one less than p and greater than 1 positive integer y, calculates k ^s=g ^yMod p and k ^Sc=(k ^c) ^yMod p, and to V_C||V_S||Msg ₁ ^c|| Msg ₁ ^s|| Msg ₂ ^c|| PUK _AIK ^s|| k ^c|| k ^s|| k ^ScCarry out Hash operation, Hash operation result is designated as hash ^s, the content of the PCR of appointment in the obtaining step 1 the safety chip TPM of server end from the mainboard that is installed in server place computer then, note is made PCR ^s, use SK _AIK ^sTo PCR ^s|| hash ^sSign, signature result note is made sign ^sAt last will ${\mathrm{Msg}}_2^c=({\mathrm{SML}}^c,k^c,{\mathrm{Sign}}^c,{\mathrm{Cert}}_{\mathrm{AIK}}^c)$ Send to client; SK wherein _AIK ^s, PUK _AIK ^sAnd Cert _AIK ^sBe private key, PKI and the public key certificate of server end AIK, SML ^sThe metric daily record of expression server end platform;

Step 5, the client validation server end: client is received Msg ₂ ^sAfter, at first verify Cert _AIK ^sValidity and legitimacy, if the checking do not pass through, then stop key exchange process, if the checking pass through, then utilize Cert _AIK ^sIn PKI PUK _AIK ^sFrom sign ^sThe middle SML that obtains in the step 4 ^s, hash ^sAnd PCR ^s, and note is made t_SML respectively ^c, t_hash ^cAnd t_PCR ^cCalculate k then ^Cs=(k ^s) ^xMod p, and to V_C and the V_S and the Msg of self record ₁ ^cAnd Msg ₁ ^sAnd Msg ₂ ^cAnd k ^c, and the PUK that receives _AIK ^sAnd Msg ₂ ^sIn k ^s, k ^CsCarry out Hash operation, the result's note after the Hash operation is made c_hash ^cInspection t_hash ^cAnd c_hash ^cWhether mate,, then stop key exchange process if do not match; If coupling is then according to t_SML ^cFinal value c_PCR is calculated and obtained to the whole integrity measurement process of reconstruct server end ^c, judge c_PCR ^cWith t_PCR ^cWhether mate,, then stop key exchange process if do not match; If coupling then gets into step 6;

Step 6, client and server end are sent " new session key affirmation " confirmation mutually, finish key exchange process.

The present invention compares prior art and has following advantage: this method has been taken precautions against the security threat that utilizes escape way and unknown endpoint communication still possibly suffer various attack that exists in the SSH agreement effectively, has taken precautions against Replay Attack, impersonation attack and man-in-the-middle attack simultaneously effectively.

Description of drawings

Fig. 1 is the flow chart of the transport layer sub-protocol of SSH protocol specification definition;

Fig. 2 is the flow chart of remote proving agreement of the researcher design of American I BM company;

Fig. 3 is a flow chart of having integrated the key exchange method of Fig. 1 and Fig. 2 provided by the present invention.

Specific embodiment

Method provided by the invention supposes that on hardware the server and client side is furnished with credible and secure chip, and server and client side's BIOS supports TPM; The hypothesis server and client side installs metric module and trusted operating system on software.The entity that metric module decision is measured, measuring period and security maintenance tolerance result's method, its major function comprise the metric that calculates those entities of being measured, will measure logout is charged to appointment among the TPM to the metric daily record with metric PCR.The method that metric is charged to PCR is: new PCR value=hash (former PCR value || metric).The metric daily record comprises at least: information, metric and the measuring period of the entity of being measured.

Below in conjunction with Fig. 3 the key change flow process of the SSH agreement of having integrated the Trusted Computing remote proving is elaborated:

Step 1, parameter negotiation: client and server end carry out parameter negotiation, negotiate content except the content of SSH agreement regulation, also comprise the platform status information checking the numbering of the PCR that will use; Client and server end are noted the information of information of receiving in the parameter-negotiation procedure and transmission respectively in addition, and leave Msg in respectively ₁ ^cAnd Msg ₁ ^s

Step 2, client transmission information are given server end: client is at first selected one less than p and greater than 1 positive integer x, calculates k ^c=g ^xMod p, and to V_C||V_S||Msg ₁ ^c|| Msg ₁ ^s|| PUK _AIK ^c|| k ^cCarry out Hash operation, Hash operation result is designated as hash ^cThe content of the PCR of appointment and be designated as PCR in the obtaining step 1 the safety chip TPM of client from the mainboard that is installed in client place computer then ^c, use SK _AIK ^cTo PCR ^c|| hash ^cSign, signature result note is made sign ^cAt last will ${\mathrm{Msg}}_2^c=({\mathrm{SML}}^c,k^c,{\mathrm{Sign}}^c,{\mathrm{Cert}}_{\mathrm{AIK}}^c)$ Send to server end; Wherein p is a big prime number, and g is a positive integer, and V_C and V_S represent the identifier of client and the identifier of server end respectively, symbol || expression link, SK _AIK ^c, PUK _AIK ^cAnd Cert _AIK ^cBe respectively private key, PKI and the public key certificate of customer end A IK, SML ^cThe metric daily record of expression client platform.

Step 3, the server end checking client: server end is received Msg ₂ ^cAfter, at first verify Cert _AIK ^cValidity and legitimacy, if the checking do not pass through, then stop key exchange process, if the checking pass through, then utilize Cert _AIK ^cIn PKI PUK _AIK ^cFrom sign ^cThe middle SML that obtains in the step 2 ^c, hash ^cAnd PCR ^c, and note is made t_SML respectively ^s, t_hash ^sAnd t_PCR ^sThen to V_C and the V_S and the Msg of self record ₁ ^cAnd Msg ₁ ^s, and received PUK _AIK ^cAnd Msg ₂ ^cIn k ^cDo Hash operation, the result's note after the Hash operation is made s_hash ^s, inspection t_hash ^sAnd s_hash ^sWhether mate,, then stop key exchange process if do not match; If end value is calculated and obtained to coupling then according to the whole integrity measurement process of t_SML reconstruct client,, note is made s_PCR ^s, judge s_PCR ^sWith t_PCR ^sWhether mate,, then stop key exchange process if do not match; If coupling then gets into step 4.

Step 4, server end transmission information are given client: server end is at first selected one less than p and greater than 1 positive integer y, calculates k ^s=g ^yMod p and k ^Sc=(k ^c) ^yMod p, and to V_C||V_S||Msg ₁ ^c|| Msg ₁ ^s|| Msg ₂ ^c|| PUK _AIK ^s|| k ^c|| k ^s|| k ^ScCarry out Hash operation, Hash operation result is designated as hash ^s, the content of the PCR of appointment in the obtaining step 1 the safety chip TPM of server end from the mainboard that is installed in server place computer then, note is made PCR ^s, use SK _AIK ^sTo PCR ^s|| hash ^sSign, signature result note is made sign ^sAt last will ${\mathrm{Msg}}_2^c=({\mathrm{SML}}^c,k^c,{\mathrm{Sign}}^c,{\mathrm{Cert}}_{\mathrm{AIK}}^c)$ Send to client; SK wherein _AIK ^s, PUK _AIK ^sAnd Cert _AIK ^sBe private key, PKI and the public key certificate of server end AIK, SML ^sThe metric daily record of expression server end platform.

Step 5, the client validation server end: client is received Msg ₂ ^sAfter, at first verify Cert _AIK ^sValidity and legitimacy, if the checking do not pass through, then stop key exchange process, if the checking pass through, then utilize Cert _AIK ^sIn PKI PUK _AIK ^sFrom sign ^sThe middle SML that obtains in the step 4 ^s, hash ^sAnd PCR ^s, and note is made t_SML respectively ^c, t_hash ^cAnd t_PCR ^cCalculate k then ^Cs=(k ^s) ^xMod p, and to V_C and the V_S and the Msg of self record ₁ ^cAnd Msg ₁ ^sAnd Msg ₂ ^cAnd k ^c, k ^Cs, and the PUK that receives _AIK ^sAnd Msg ₂ ^sIn k ^sCarry out Hash operation, the result's note after the Hash operation is made c_hash ^cInspection t_hash ^cAnd c_hash ^cWhether mate,, then stop key exchange process if do not match; If coupling is then according to t_SML ^cFinal value c_PCR is calculated and obtained to the whole integrity measurement process of reconstruct server end ^c, judge c_PCR ^cWith t_PCR ^cWhether mate,, then stop key exchange process if do not match; If coupling then gets into step 6.

Step 6, client and server end are sent " new session key affirmation " confirmation mutually, finish key exchange process.

Pass through said method; Utilize escape way and unknown endpoint communication that the SSH agreement exists still possibly suffer the safety problem of various attack to obtain effective solution; Realized the SSH trusted channel, and Replay Attack, impersonation attack and man-in-the-middle attack have also obtained effective strick precaution.

Claims (1)

1. method that realizes trusted SSH based on Trusted Computing; It is characterized in that: the remote proving of Trusted Computing and these two processes of key change of SSH agreement are carried out organic combination; Thereby the checking of implementation platform state information is combined closely with session key agreement; This method relates to the client and server end, and the concrete steps of its method are following:

Step 1, parameter negotiation: client and server end carry out parameter negotiation, negotiate content except the content of SSH agreement regulation, also comprise the platform status information checking the numbering of the PCR that will use; Client and server end are noted the information of information of receiving in the parameter-negotiation procedure and transmission respectively in addition, and leave

and

respectively in

Step 2, client transmission information are given server end: client is at first selected one less than p and greater than 1 positive integer x, calculates k ^c=g ^xMod p, and right

Carry out Hash operation, Hash operation result is designated as hash ^cThe content of the PCR of appointment and be designated as PCR in the obtaining step 1 the safety chip TPM of client from the mainboard that is installed in client place computer then ^c, use To PCR ^c|| hash ^cSign, signature result note is made sign ^cAt last will

Send to server end; Wherein p is a big prime number, and g is a positive integer, and V_C and V_S represent the identifier of client and the identifier of server end respectively, symbol || the expression link,

With

Be respectively private key, PKI and the public key certificate of customer end A IK, SML ^cThe metric daily record of expression client platform;

Step 3, the server end checking client: server end is received

After, at first checking

Validity and legitimacy, if checking is not passed through, then stop key exchange process, if checking is passed through, then utilize

In PKI From The middle SML that obtains in the step 2 ^c, hash ^cAnd PCR ^c, and note is made t_SML respectively ^s, t_hash ^sAnd t_PCR ^sThen to the V_C of self record and V_S with

With

And it is received

With

In k ^cDo Hash operation, the result's note after the Hash operation is made s_hash ^s, inspection t_hash ^sAnd s_hash ^sWhether mate,, then stop key exchange process if do not match; If coupling is then according to t_SML ^sEnd value is calculated and obtained to the whole integrity measurement process of reconstruct client, and note is made s_PCR ^s, judge s_PCR ^sWith t_PCR ^sWhether mate,, then stop key exchange process if do not match; If coupling then gets into step 4;

Step 4, server end transmission information are given client: server end is at first selected one less than p and greater than 1 positive integer y, calculates k ^s=g ^yMod p and k ^Sc=(k ^c) ^yMod p, and right

Carry out Hash operation, Hash operation result is designated as hash ^s, the content of the PCR of appointment in the obtaining step 1 the safety chip TPM of server end from the mainboard that is installed in server place computer then, note is made PCR ^s, use

To PCR ^s|| hash ^sSign, signature result note is made sign ^sAt last will

Send to client; Wherein With

Be private key, PKI and the public key certificate of server end AIK, SML ^sThe metric daily record of expression server end platform;

Step 5, the client validation server end: client is received

After, at first checking Validity and legitimacy, if checking is not passed through, then stop key exchange process, if checking is passed through, then utilize

In PKI From

The middle SML that obtains in the step 4 ^s, hash ^sAnd PCR ^s, and note is made t_SML respectively ^c, t_hash ^cAnd t_PCR ^cCalculate k then ^Cs=(k ^s) ^xMod p, and to the V_C of self record and V_S with

With

With

And k ^c, and receive With

In k ^s, k ^CsCarry out Hash operation, the result's note after the Hash operation is made c_hash ^cInspection t_hash ^cAnd c_hash ^cWhether mate,, then stop key exchange process if do not match; If coupling is then according to t_SML ^cFinal value c_PCR is calculated and obtained to the whole integrity measurement process of reconstruct server end ^c, judge c_PCR ^cWith t_PCR ^cWhether mate,, then stop key exchange process if do not match; If coupling then gets into step 6;

Step 6, client and server end are sent " new session key affirmation " confirmation mutually, finish key exchange process.

Images