CN107846279B - Security protection component interconnection structured system and implementation method - Google Patents

Security protection component interconnection structured system and implementation method Download PDF

Info

Publication number
CN107846279B
CN107846279B CN201711072942.0A CN201711072942A CN107846279B CN 107846279 B CN107846279 B CN 107846279B CN 201711072942 A CN201711072942 A CN 201711072942A CN 107846279 B CN107846279 B CN 107846279B
Authority
CN
China
Prior art keywords
measurement
module
protection component
communication
security protection
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201711072942.0A
Other languages
Chinese (zh)
Other versions
CN107846279A (en
Inventor
陶源
李明
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Third Research Institute of the Ministry of Public Security
Original Assignee
Third Research Institute of the Ministry of Public Security
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Third Research Institute of the Ministry of Public Security filed Critical Third Research Institute of the Ministry of Public Security
Priority to CN201711072942.0A priority Critical patent/CN107846279B/en
Publication of CN107846279A publication Critical patent/CN107846279A/en
Application granted granted Critical
Publication of CN107846279B publication Critical patent/CN107846279B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

The invention discloses a security protection component interconnection structuralization system and an implementation method, the scheme is implemented by a key distribution module, a credible measurement module and a credible transmission module, the key distribution module is used as a credible authentication base, supports the request and issue of a host certificate, and receives and processes a credible identity verification request; the credibility measurement module is used for receiving a credibility measurement request of the safety protection component, sending the measurement request to the key distribution module, forwarding the connection request to the credibility transmission module when a measurement success result is received, and terminating communication when a measurement failure result is received; the trusted transmission module is used for receiving a trusted transmission request of the security protection component, negotiating a key and exchanging the key. The invention ensures the credibility of the communication component through the credible computing technology and realizes the credibility of the component connection through the channel integrity protection.

Description

Security protection component interconnection structured system and implementation method
Technical Field
The invention relates to a network security technology, in particular to a security protection component interconnection structuring technology.
Background
The traditional communication mode is that communication is carried out between processes, a connection request is sent out through a connection initiator, a receiving party processes the receiving request, and a channel is established for communication when the connection process is successful.
Taking a Three-Way Handshake connection process in a TCP connection process as an example, a Three-Way Handshake (Three-Way Handshake) means that a TCP connection is established, that is, when a TCP connection is established, a client and a server need to send 3 packets in total to confirm establishment of the connection. In socket programming, this process is triggered by the client executing connect, as shown in fig. 1, the whole flow is as follows:
(1) first handshake: setting a flag bit SYN to 1 by the Client, randomly generating a value seq equal to J, sending the data packet to the Server, and enabling the Client to enter a SYN _ SENT state to wait for the confirmation of the Server.
(2) Second handshake: after receiving the data packet, the Server knows that the Client requests to establish connection by setting the flag bit SYN to 1, sets the flag bit SYN and ACK to 1, sets the ACK to J +1, randomly generates a value seq to K, sends the data packet to the Client to confirm the connection request, and enters a SYN _ RCVD state.
(3) Third handshake: after receiving the confirmation, the Client checks whether ACK is J +1 or not, whether ACK is 1 or not, if the ACK is correct, the flag bit ACK is 1, ACK is K +1, the data packet is sent to the Server, the Server checks whether ACK is K +1 or not, whether ACK is 1 or not, if the ACK is correct, connection establishment is successful, the Client and the Server enter an ESTABLISHED state, three-way handshake is completed, and then data transmission can be started between the Client and the Server.
The traditional communication mode has two safety problems: 1. the identities of the Client and the Server of the communication subject can be falsely used; 2. the communication process is easy to intercept, intercept and even maliciously tamper with the communication information.
Disclosure of Invention
In order to solve the problem of the existing communication method in the aspect of security, a new secure communication scheme is needed.
Therefore, the invention aims to provide a safety protection component interconnection structuring system and an implementation method thereof so as to realize the structuring of the communication connection of the safety protection component.
In order to achieve the above object, the present invention provides a safety protection component interconnection structured system, including:
the key distribution module is used as a credible authentication base, supports the request and issuing of a host certificate, and receives and processes a credible identity verification request;
the trusted measurement module is used for receiving a trusted measurement request of the security protection component, sending the measurement request to the key distribution module, forwarding the connection request to the trusted transmission module when a measurement success result is received, and terminating communication when a measurement failure result is received;
and the trusted transmission module is used for receiving the trusted transmission request of the security protection component, negotiating a key and exchanging the key.
Furthermore, the system also comprises an information interception module, and the information interception module intercepts the connection security request and transfers the connection security request to the credibility measurement module.
Further, the information intercepting module is a hook module.
In order to achieve the above object, the method for implementing interconnection and structuring of security protection components according to the present invention establishes a trusted channel between the security protection components after the trusted metrics pass for the identity trusted metrics of both parties of communication before the communication between the security protection components establishes connection.
Further, the implementation method comprises the following steps:
intercepting a communication connection request between safety protection components as both communication parties;
the credibility measuring modules of the two communication parties measure the credibility of the communication host of the other party;
the trusted transmission modules of the two communication parties negotiate and receive a connection key after the trusted measurement is passed;
an encrypted communicable channel is established between the two communicating parties.
Further, the implementation method further includes: and the security protection component serving as both communication parties registers in the key distribution module, and the key distribution module issues an identity certificate to the security protection component.
Further, the measuring the credibility of the communication host of the other party by the credibility measuring module comprises:
after obtaining the identity measurement request, the credible measurement module initiatively initiates a request to the key distribution module;
and the key distribution module acquires the certificate information of the communication security protection component of the two communication parties, measures the identity of the communication security protection component, and returns the verification result to the credible measurement module after the measurement is passed.
The invention ensures the credibility of the communication component through the credible computing technology and realizes the credibility of the component connection through the channel integrity protection.
In the invention, a trust foundation verification platform is constructed for supporting the credibility verification of a safety protection component and the credibility of connection communication, and is used as a credible technology safety trust foundation; and constructing a key distribution module, a credibility measurement support module and a credibility transmission support module as the registration, credibility measurement and communication credibility connection function support of the support component.
Moreover, the scheme of the invention fully embodies the universality of the safety mechanism, and the communication process is guided into the module of the scheme through the reconstruction of the communication process, thereby realizing the purposes of credible identity of the communication subject and integrity protection of the communication process.
Drawings
The invention is further described below in conjunction with the appended drawings and the detailed description.
FIG. 1 is a schematic diagram of a TCP three-way handshake flow;
FIG. 2 is a system architecture diagram of a security protection component interconnect structured system in accordance with an embodiment of the present invention;
fig. 3 is a communication flow diagram of the interconnection structure of the security protection components in the embodiment of the present invention.
Detailed Description
In order to make the technical means, the creation characteristics, the achievement purposes and the effects of the invention easy to understand, the invention is further explained below by combining the specific drawings.
According to the description of the GB/T25070 information system grade protection safety design technical requirement on the interconnection structuralization of the safety protection components, the technical key points are as follows: 1. mutually verifying the credibility of the other sides through a credible verification mechanism; 2. and ensuring the credible connection between the safety protection components.
The resource devices communicate in various ways, and can communicate through a TCP connection, UDP communication, HTTP communication, FTP communication, and the like. Regardless of the communication mode, the main body of communication is a program, a process or a service, and the example takes the program or the process of communication as a safety protection component and realizes the structure of the connection of the safety protection component.
Therefore, in order to realize the interconnection and the structurization of the safety protection component, the credibility of both communication parties is verified through the credible computing technology, and a corresponding interconnection and structurization system of the safety protection component is constructed.
Referring to fig. 2, the security protection component interconnection structured system 100 constructed in this example is mainly composed of a key distribution module 110, a trusted measurement module 120, and a trusted transmission module 130, which are three key core modules cooperatively configured.
Wherein, the key distribution module 110: the module is used as a credible authentication basis, supports the functions of requesting and issuing a host certificate, and receives and processes a credible identity verification request.
The confidence measure module 120: the operation of the device in the corresponding host is used for receiving a trusted measurement request of a security protection component in the host, sending the measurement request to the key distribution module, forwarding a connection request to the trusted transmission module 130 when a measurement success result is received, and terminating communication when a measurement failure result is received.
Trusted transfer module 130: which runs in the corresponding host and cooperates with the trusted metrics module 120 for receiving trusted transmission requests, negotiating keys, and key exchanges for the security components.
On the basis, the system further enters an information interception module 140, wherein the information interception module 140 runs in the host, and cooperates with the trusted measurement module 120 and the trusted transmission module 130 to intercept the corresponding connection request and transfer the connection request to the trusted measurement module 120 in the host, so as to realize the identity trusted measurement of the communication security protection component before the communication is established.
Specifically, if the host where the information intercepting module 140 is located is the connection request initiator, the information intercepting module 140 directly intercepts the connection request initiated by the security protection component; if the host where the information intercepting module 140 is located is the connection request receiver, the information intercepting module 140 directly intercepts the connection request received by the security protection component.
The information intercepting module 140 may be implemented by a corresponding hooking module.
The safety protection component interconnection structured system 100 constructed according to the method comprises the following basic processes of realizing the safety protection component interconnection structure:
(1) and an information interception module of the request initiator intercepts the communication connection request initiated by the security protection component and transmits the communication connection request to the credibility measurement module.
(2) And an information interception module of the request receiver intercepts the communication connection request received by the security protection component and transmits the communication connection request to the credibility measurement module.
(3) After receiving the connection request, the credible measurement modules of the two communication parties send the measurement request to the key distribution module, and the key distribution module completes the credible measurement of the identities of the two communication parties; and forwarding the connection request to the trusted transmission module when receiving the measurement success result, and terminating the communication when receiving the measurement failure result.
(4) The trusted transmission modules of the two communication parties negotiate and receive a connection key after the trusted measurement is passed;
(5) and an encrypted communicable channel is established between the two communication parties based on the connection key obtained by the negotiation of the trusted transmission modules of the two communication parties.
Therefore, based on the interconnected and structured system of the safety protection components, before the communication between the safety protection components is established, the credible measurement of the identities of the two communication parties can be established, and the credible channel is established between the safety protection components after the credible measurement passes.
The present solution is illustrated below by a specific application example.
Taking Windows as an example, hooks are a technical point of message processing mechanism in Windows, and by installing various hooks, an application program can set corresponding subroutines to monitor message passing in a system and process messages before the messages reach a target window program. The hooks are of various types, each hook can intercept and process corresponding messages, for example, a keyboard hook can intercept keyboard messages, a mouse hook can intercept mouse messages, a shell hook can intercept messages for starting and closing applications, and a log hook can monitor and record input events.
In this case, a hook and a similar mechanism are used to construct a corresponding information interception module to reform a communication connection process, and a key distribution module, a trusted measurement module and a trusted transmission module are combined to realize identity trusted measurement and communication integrity protection of a communication security protection component before communication connection is established, so as to realize final interconnection structurization of the security protection component (as shown in fig. 2).
Therefore, before operation, the two communication parties firstly serve as security protection components, registration needs to be carried out in the key distribution module, and the key distribution module issues corresponding identity certificates to each registered security protection component.
Referring to fig. 2 and 3, the process of performing the interconnection structured communication of the safety protection components in this embodiment is as follows:
when the communication security protection component 1 in the host a initiates a connection request, the connection request is acquired by the hook in the host a, and the security protection component in the host a requests the trusted measurement module to perform the identity measurement request of the communication security protection component. After obtaining the identity measurement request, the credible measurement module initiatively initiates a request to the key distribution module; when the communication security protection component 2 in the B host receives the connection request, the received connection request is acquired by the hook in the B host, the security protection component in the B host requests the credible measurement module to perform the identity measurement request of the communication security protection component, and after the credible measurement module acquires the identity measurement request, the request is actively initiated to the key distribution module.
The key distribution module acquires certificate information of communication security protection components of both communication parties, identity measurement is carried out, after the measurement is passed, a verification result is returned to the credible measurement module of the corresponding host, and the credible measurement process is finished; if the measurement is not passed, the communication security protection component identity is not credible, connection is forbidden, and the connection process is finished.
After the measurement process is finished, entering a second process for communication encryption, requesting the trusted transmission module to perform key negotiation with the target trusted transmission module, after the key negotiation is determined, finally establishing a trusted connection channel between the communication security protection component 1 and the communication security protection component 2, and realizing communication integrity protection.
Through the processes, the mutual authentication of the credibility of the other party through a credible authentication mechanism is finally realized, and meanwhile, the credible connection between the safety protection components can be ensured.
The foregoing shows and describes the general principles, essential features, and advantages of the invention. It will be understood by those skilled in the art that the present invention is not limited to the embodiments described above, which are described in the specification and illustrated only to illustrate the principle of the present invention, but that various changes and modifications may be made therein without departing from the spirit and scope of the present invention, which fall within the scope of the invention as claimed. The scope of the invention is defined by the appended claims and equivalents thereof.

Claims (7)

1. A safety protection component interconnect structured system, comprising:
the key distribution module is used as a credible authentication base, supports the request and issuing of a host certificate, and receives and processes a credible measurement request; as the security protection components of both communication parties, the key distribution module is required to register, and issues a corresponding identity certificate to each registered security protection component; the key distribution module acquires certificate information of communication security protection components of both communication parties, measures identities, returns verification results to the credible measurement module of the corresponding host after measurement is passed, and ends the credible measurement process; if the measurement is not passed, the identity of the communication security protection component is not credible, connection is forbidden, and the connection process is finished;
the credibility measurement module runs in the hosts of the two parties to be communicated and is used for receiving a credibility measurement request of the safety protection component in the host and actively sending the credibility measurement request to the key distribution module, for the identity credibility measurement of the safety protection component in the host, if a measurement success result is received, the connection request sent by the safety protection component in the host is forwarded to the credibility transmission module running in the host, and if a measurement failure result is received, the communication is terminated;
the trusted transmission module runs in the host of the two parties to be communicated and is used for receiving the safety protection componentConnection requestAnd the server negotiates a key with a trusted transmission module running in a host of the communication counterpart and exchanges the key.
2. The security protection component interconnect structured system of claim 1, further comprising an information intercept module that intercepts a connection request and passes it to a trust metrics module.
3. The safety protection component interconnection structured system of claim 2, wherein the information interception module is a hook module.
4. The method for implementing interconnection and structuring of security protection components is characterized in that before the connection is established between the security protection components, a trusted channel is established between the security protection components after the trusted metrics pass on the basis of the identity trusted metrics of the security protection component interconnection and structuring system of any one of claims 1 to 3 on both communication parties.
5. The method for realizing the interconnection structure of the safety protection component according to claim 4, wherein the method for realizing the interconnection structure of the safety protection component comprises the following steps:
intercepting a connection request between safety protection components as both communication parties;
the credibility measuring modules of the two communication parties measure the credibility of the communication host of the other party;
the trusted transmission modules of the two communication parties negotiate and receive a connection key after the trusted measurement is passed;
an encrypted communicable channel is established between the two communicating parties.
6. The method for implementing the interconnection structure of the safety protection component according to claim 5, further comprising: and the security protection component serving as both communication parties registers in the key distribution module, and the key distribution module issues an identity certificate to the security protection component.
7. The method of claim 6, wherein the measuring the credibility of the communication host of the other party by the credibility measuring module comprises:
after obtaining the identity measurement request, the credible measurement module initiatively initiates a request to the key distribution module;
and the key distribution module acquires the certificate information of the communication security protection component of the two communication parties, measures the identity of the communication security protection component, and returns the verification result to the credible measurement module after the measurement is passed.
CN201711072942.0A 2017-11-04 2017-11-04 Security protection component interconnection structured system and implementation method Active CN107846279B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201711072942.0A CN107846279B (en) 2017-11-04 2017-11-04 Security protection component interconnection structured system and implementation method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201711072942.0A CN107846279B (en) 2017-11-04 2017-11-04 Security protection component interconnection structured system and implementation method

Publications (2)

Publication Number Publication Date
CN107846279A CN107846279A (en) 2018-03-27
CN107846279B true CN107846279B (en) 2021-08-27

Family

ID=61681315

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201711072942.0A Active CN107846279B (en) 2017-11-04 2017-11-04 Security protection component interconnection structured system and implementation method

Country Status (1)

Country Link
CN (1) CN107846279B (en)

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101951388B (en) * 2010-10-14 2013-03-20 中国电子科技集团公司第三十研究所 Remote attestation method in credible computing environment
CN106411524B (en) * 2016-08-31 2019-07-12 广州世安信息技术股份有限公司 The method of mobile terminal trust computing based on bluetooth

Also Published As

Publication number Publication date
CN107846279A (en) 2018-03-27

Similar Documents

Publication Publication Date Title
Niruntasukrat et al. Authorization mechanism for MQTT-based Internet of Things
US10587586B2 (en) System and method for a multi system trust chain
US9021552B2 (en) User authentication for intermediate representational state transfer (REST) client via certificate authority
US20140337619A1 (en) Derived Certificate based on Changing Identity
US11736304B2 (en) Secure authentication of remote equipment
KR101762013B1 (en) Method for registering device and setting secret key using two factor communacation channel
US20090199009A1 (en) Systems, methods and computer program products for authorising ad-hoc access
US10404475B2 (en) Method and system for establishing a secure communication tunnel
WO2017185450A1 (en) Method and system for authenticating terminal
WO2014060046A1 (en) Unidirectional deep packet inspection
WO2023071751A1 (en) Authentication method and communication apparatus
Suomalainen Smartphone assisted security pairings for the Internet of Things
CN111801924B (en) Apparatus, methods, and articles of manufacture for messaging using message-level security
JP2007181123A (en) Digital certificate exchange method, terminal device, and program
CN110855561A (en) Intelligent gateway of Internet of things
US20210377239A1 (en) Method for distributed application segmentation through authorization
CN109995723B (en) Method, device and system for DNS information interaction of domain name resolution system
US20090144436A1 (en) Reverse network authentication for nonstandard threat profiles
CN103986716A (en) Establishing method for SSL connection and communication method and device based on SSL connection
JP2014147039A (en) Cryptocommunication device, proxy server, cryptocommunication system, cryptocommunication program and proxy server program
CN107846279B (en) Security protection component interconnection structured system and implementation method
JP2006053799A (en) Terminal device, firewall device, and method and program for controlling firewall device
CN115484038A (en) Data processing method and equipment thereof

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant