CN110620750A - Network security verification method of distributed system - Google Patents
Network security verification method of distributed system Download PDFInfo
- Publication number
- CN110620750A CN110620750A CN201810634905.2A CN201810634905A CN110620750A CN 110620750 A CN110620750 A CN 110620750A CN 201810634905 A CN201810634905 A CN 201810634905A CN 110620750 A CN110620750 A CN 110620750A
- Authority
- CN
- China
- Prior art keywords
- server
- network security
- security authentication
- ssk
- digital certificate
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/10—Protocols in which an application is distributed across nodes in the network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3297—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving time stamps, e.g. generation of time stamps
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Power Engineering (AREA)
- Storage Device Security (AREA)
Abstract
A network security verification method of a distributed system comprises the following steps: when a server in the distributed network acts, the server is subjected to identity authentication, a key distribution center KDC and a service ticket admission service component KDC-TGS are respectively integrated into each HBase server to form each network security authentication server, and Kerberos clients are respectively integrated into each HBase client to form each network security authentication client; the network security authentication client uses the ssk to perform request interaction with any network security authentication server, and the requested network security authentication server verifies the network security authentication client according to ssk stored in the data center; the digital certificate and the key of the server are bound with the server information, so that one server can only correspond to one fixed digital certificate and key, and the validity and the integrity of the server identity authentication are further ensured.
Description
Technical Field
The invention belongs to the technical field of distributed systems, and particularly relates to a network security verification method and system of a distributed system.
Background
With the rapid development of industrial automation control, more and more industrial enterprises use their internal (or dedicated) network to interconnect their production process-specific devices or industrial Intelligent devices (IEDs) together to form a production control system network. Such industrial enterprises are referred to as industrial internets using internal (or private) networks.
Large enterprises, such as power companies, oil and gas transmission enterprises, and large mining groups mainly for mineral resource exploration and development, often have their stock-controlling companies distributed throughout the country or even around the world, and cannot meet their information interaction requirements only by using internal networks. With the development of the industrial internet, the industrial internet is not limited to a station or a city any more, and two or more industrial internets are in communication connection by using hardware and software facilities of the existing public network (the web), so that a central control system can supervise and control all sub-production control systems, and a plurality of sub-production control systems can communicate with each other to form a larger industrial internet, and resources of the industrial internet are controlled and used more optimally.
Because each subsystem in the industrial internet is usually distributed in each region, in order to improve the system operation efficiency, balance the load and improve the system robustness, a distributed system is usually used in the industrial internet to provide a distributed database, a distributed service and the like, and different servers in the industrial internet are used for respectively storing data, processing information, transmitting, providing services and the like. Each computer in a distributed system has its own processor, memory, and peripherals, which can either operate independently or cooperate. In this system the computers can operate in parallel and there can be multiple control centers, i.e. with parallel processing and distributed control functions. In addition, the distributed system is an integrated system, and a global operating system is required in the whole system, and is responsible for the work of resource allocation and scheduling, task division, information transmission, control coordination and the like of the whole system (including each computer), and provides a uniform interface and a standard interface for users. Thus, the distributed operating system is born. With a distributed operating system, a user can implement required operations and use system resources through a unified interface, and it is not necessary for the user to know about which computer the operations are executed on or which computer resources are used, that is, the system is transparent to the user.
Because the information transmitted in the industrial internet is industrial internal information and the provided service is an internal service, the requirement on safety is high. In order to ensure security, in the industrial internet, before obtaining services, data and information, users, clients and application processes all need to perform corresponding identity authentication. The essence of authentication is the process of verifying whether the object being authenticated is authentic and valid. Generally, a password technology is adopted, and a digital certificate is used for verifying an authenticated object, so that the aim of determining whether the authenticated object is real and effective is fulfilled.
Only after the character object is identified and authenticated can further operations be performed on the basis of the authentication. Taking a user as an example, the industrial internet system performs identity authentication on each user at the client, and a Certificate Authority (CA Certificate Authority for short) issues a digital Certificate and a secret key after the authentication is passed. When a user logs in and operates or accesses resources at a client, the system firstly authenticates a certificate and a secret key provided by the user, and only after the user is proved to be legal, the request provided by the user can obtain the response of the system.
The inventor of the invention finds that in the existing distributed network system, users, clients and application processes all have digital certificates and keys for authenticating identities. The system authenticates the identity of the user through the digital certificate and the secret key to provide services for the user.
However, the server serving as the service provider does not have an identifiable identity authentication, nor does it have any digital certificate and key, and thus, it is not possible to ensure that the service provided by such a server is legitimate, nor is it possible to identify whether the obtained data is valid. Although the background server cluster is in a relatively isolated internal local area network, the security threat is small, but internal behaviors such as internal leakage or internal hacking cannot be completely excluded. The mutual communication between the server and the server can not guarantee the security requirement of the data, namely confidentiality, integrity and non-repudiation of the data, the security level has little influence on a common internet system, but is not enough for an industrial internet which requires high confidentiality, and the consequences are more serious once illegal behaviors occur.
Distributed systems (distributed systems) are software systems built on top of a network. It is the nature of software that the distributed system is highly cohesive and transparent. Thus, the distinction between networks and distributed systems is much more in the high-level software (specifically the operating system) than in the hardware. Cohesiveness means that each database distribution node is highly autonomous and has a local database management system. Transparency means that each database distribution node is transparent to the user's application, not seen locally or remotely. In a distributed database system, a user does not feel that data is distributed, i.e., the user does not have to know whether a relationship is split, whether there is a copy, where data is stored, and on which site a transaction is executed, etc.
In view of the above considerations, it is necessary to provide a method and a system for verifying network security of a distributed system, which are novel, inventive and practical. .
Disclosure of Invention
The invention mainly solves the technical problem of providing a network security verification method and a network security verification system for a distributed system, so that the identity of a server in a distributed environment is verified, the security and the reliability of the distributed system are further ensured, and the security requirement of a user is met.
The invention is realized by the following technical proposal that the network security verification method of a distributed system comprises at least two servers distributed in different areas, and comprises the following steps: when a server in the distributed network acts, the server is authenticated,
respectively integrating a key distribution center KDC and a service ticket admission service component KDC-TGS into each HBase server to form each network security authentication server, and respectively integrating Kerberos clients into each HBase client to form each network security authentication client;
the network security authentication client sends a verification request to any network security authentication server; after the network security authentication server passes the verification, a login session key lsk and a service session key ssk are created, and the lsk and ssk are returned to the network security authentication client; and storing lsk and ssk in a data center accessible to each network security authentication server;
the network security authentication client uses the ssk to perform request interaction with any network security authentication server, and the requested network security authentication server verifies the network security authentication client according to ssk stored in the data center;
allowing the server to take place if the authentication passes; denying the server to take place if the authentication is not passed.
As a preferred technical solution, the authentication request includes: a client user name, an authenticator T1 encrypted by using a long-term password UK and request service operation information Sinfo; the network security authentication server side obtains a long-term password UK according to the client user name query, decrypts the authenticator T1 encrypted by the long-term password UK by using the long-term password UK to obtain an authenticator T1, creates a login session key lsk and a service session key ssk when verifying that the authenticator T1 is valid, stores the lsk and ssk in a data center accessible to each network security authentication server, and sends lsk encrypted by using the long-term password UK, ssk encrypted by using lsk and an authenticator T1 encrypted by using ssk to the network security authentication client side; the network security authentication client decrypts lsk encrypted using the long-term password UK by using the long-term password UK to obtain lsk; ssk encrypted using lsk is decrypted with lsk to obtain ssk; decrypting the certifier T1 encrypted using ssk with ssk to obtain a certifier T1, comparing the decrypted certifier T1 with the certifier T1 in the transmission verification request, determining that the secure network certification is passed when the verification is passed, and caching the lsk and the ssk; the data center is a resident memory table, a relational database or a distributed cache.
As a preferred embodiment, the method further comprises: when ssk valid time arrives, the data center clears the saved ssk; the network security authentication client updates ssk to any network security authentication server using the lsk.
As a preferred embodiment, the method further comprises: when lsk valid time arrives, the data center clears the saved lsk; the network security authentication client updates ssk to any network security authentication server using the long-term password UK.
As a preferred technical solution, the server behavior at least includes one of the following or any combination thereof: starting a server, providing a service by the server, providing data by the server, providing operation by the server and using system resources by the server; before the step of authenticating the identity of the server, the method further comprises the following steps: the information of the server is checked in advance, a digital certificate and a secret key are distributed to the server after the checking is passed, and the information of the server is bound with the distributed digital certificate and the distributed secret key; and in the step of authenticating the identity of the server, verifying the digital certificate and the secret key of the server, verifying whether the server information bound by the digital certificate is matched with the server information in authentication, and if the digital certificate and the secret key pass the verification and the server information is matched, the server passes the authentication.
As a preferred technical solution, the digital certificate and the secret key are stored in an external storage module, and in the step of verifying the digital certificate and the secret key of the server, the digital certificate and the secret key of the server are obtained through the external storage module connected to the server, and the verification of the digital certificate and the secret key of the server is realized; after the server is disconnected with the external storage module, the digital certificate and the key cannot be verified; the server information is composed of one of the following or any combination thereof: server name, server IP address, server MAC address, and server identification.
A distributed network security authentication system comprises at least two servers distributed in different areas, and further comprises: the server authentication module is used for performing identity authentication on the server when the server in the distributed network acts, and allowing the server to act if the server passes the authentication; denying the server to take place if the authentication is not passed.
As a preferred technical solution, the server behavior at least includes one of the following or any combination thereof:
server startup, server provisioning operations, and server usage of system resources.
As a preferred technical solution, the system further comprises an auditing module, which is used for auditing the information of the server; the certificate distribution module is used for distributing a digital certificate and a key for the server after the server passes the audit, and the information of the server is bound with the distributed digital certificate and the key; the server authentication module authenticates the identity of the server in the following way: and verifying the digital certificate and the secret key of the server, verifying whether the server information bound by the digital certificate is matched with the server information in the authentication, and if the digital certificate and the secret key pass the verification and the server information is matched, the server passes the authentication.
As a preferred technical solution, the digital certificate and the secret key are stored in an external storage module, and the server authentication module obtains the digital certificate and the secret key of the server through the external storage module connected to the server, and realizes verification of the digital certificate and the secret key of the server; after the server is disconnected with the external storage module, the digital certificate and the key cannot be verified; the server information is composed of one of the following or any combination thereof: server name, server IP address, server MAC address, and server identification.
Compared with the prior art, the invention has the beneficial effects that:
(1) if ssk expires in 5 minutes, the server informs the user that it needs to retrieve ssk when ssk is found to be invalid. The user requests a new ssk at this time, and the content carried by the request is still information such as E (lsk, Tn) and user name. If lsk is not present, the content that needs to be carried becomes: e (UK, Tn) and user name, and server information to get a new ssk. If lsk is available and the expiration time is 10 hours, lsk will not expire after 10 hours, and the user password itself will be used to obtain the new session key. If lsk is not present, then ssk has a time-to-failure of 5 minutes, and every 5 minutes it will use its own long-term key UK to request a new session key. The principle is as follows: data encrypted using a long-term key is not transmitted over the network as much as possible. Therefore, with lsk added, the data encrypted using the UK will not be used to request a new session key until the login session key expires. This reduces the number of times data encrypted using the long-term key is transmitted over the network.
(2) Anti-eavesdropping and anti-Replay (Replay attach); and (3) eavesdropping prevention: because service session key ssk has a relatively short validity time, if you eavesdrop on the user's outgoing data, the key will expire even if you decrypt it. Replay prevention: because the contents of the ssk service session key encrypted authenticator used for each access contain a time stamp, the time stamp is invalid if replayed.
(3) Stability and easy expansion and maintenance; stability: the bottleneck of network security verification is the single-point nature of services of the HBase table, because the table of the data center is stored in one HBase table, the table is served by one RegionServer, if the RegionServer is down, the services are divided into middle sections, but the regions can be redistributed to another RegionServer for serving, and the probability of the down of the RegionServer is very small, because the ROOT table of the HBase is also served on one RegionServer, the stability of the HBase can be relieved; easy expansion and maintenance: when a new HBase server is added, no extra operations are required, as in the normal extension.
(4) The concept that servers in a distributed network are safe and do not need identity authentication in the traditional concept is broken through, the legality of the services provided by the servers in the distributed network is ensured by carrying out real-time identity authentication on the servers providing the services in the distributed network at each moment, the validity of the provided data effectively avoids the condition that the servers are stolen, and the safety requirements of users, including confidentiality, integrity and non-repudiation of the data, are met, so that the safety level achieved by the distributed network can meet the high-level safety requirements of the users in the industrial fields of industrial internet and the like, including high-level safety requirements of the users in the industrial fields of electric power, oil gas, traffic and the like.
(5) The digital certificate and the key of the server are bound with the server information, so that one server can only correspond to one fixed digital certificate and key, and the validity and the integrity of the server identity authentication are further ensured.
(6) The server digital certificate and the key are stored in the external storage module, once the server is disconnected with the external storage module, the digital certificate and the key cannot be verified, so that illegal persons are effectively prevented from acquiring the digital certificate and the password of the server through illegal means, and the safety and the effectiveness of the server in the identity authentication process are further ensured.
Drawings
FIG. 1 is a flowchart of the authentication principle of Kerberos;
FIG. 2 is a flow chart of a method for network security verification of a distributed system according to the present invention;
FIG. 3 is a block diagram of a network security verification system for a distributed system according to the present invention;
FIG. 4 is a schematic diagram of a client and server secure network authentication interaction in accordance with the present invention;
FIG. 5 is a diagram illustrating the updating of ssl according to the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
With reference to fig. 1-5: a network security verification method for a distributed system, the distributed network comprising at least two servers distributed in different areas, comprising the steps of: when a server in the distributed network acts, the server is authenticated,
respectively integrating a key distribution center KDC and a service ticket admission service component KDC-TGS into each HBase server to form each network security authentication server, and respectively integrating Kerberos clients into each HBase client to form each network security authentication client;
the network security authentication client sends a verification request to any network security authentication server; after the network security authentication server passes the verification, a login session key lsk and a service session key ssk are created, and the lsk and ssk are returned to the network security authentication client; and storing lsk and ssk in a data center accessible to each network security authentication server;
the network security authentication client uses the ssk to perform request interaction with any network security authentication server, and the requested network security authentication server verifies the network security authentication client according to ssk stored in the data center;
allowing the server to take place if the authentication passes; denying the server to take place if the authentication is not passed.
As a preferred technical solution, the authentication request includes: a client user name, an authenticator T1 encrypted by using a long-term password UK and request service operation information Sinfo; the network security authentication server side obtains a long-term password UK according to the client user name query, decrypts the authenticator T1 encrypted by the long-term password UK by using the long-term password UK to obtain an authenticator T1, creates a login session key lsk and a service session key ssk when verifying that the authenticator T1 is valid, stores the lsk and ssk in a data center accessible to each network security authentication server, and sends lsk encrypted by using the long-term password UK, ssk encrypted by using lsk and an authenticator T1 encrypted by using ssk to the network security authentication client side; the network security authentication client decrypts lsk encrypted using the long-term password UK by using the long-term password UK to obtain lsk; ssk encrypted using lsk is decrypted with lsk to obtain ssk; decrypting the certifier T1 encrypted using ssk with ssk to obtain a certifier T1, comparing the decrypted certifier T1 with the certifier T1 in the transmission verification request, determining that the secure network certification is passed when the verification is passed, and caching the lsk and the ssk; the data center is a resident memory table, a relational database or a distributed cache.
As a preferred embodiment, the method further comprises: when ssk valid time arrives, the data center clears the saved ssk; the network security authentication client updates ssk to any network security authentication server using the lsk.
As a preferred embodiment, the method further comprises: when lsk valid time arrives, the data center clears the saved lsk; the network security authentication client updates ssk to any network security authentication server using the long-term password UK.
As a preferred technical solution, the server behavior at least includes one of the following or any combination thereof: starting a server, providing a service by the server, providing data by the server, providing operation by the server and using system resources by the server; before the step of authenticating the identity of the server, the method further comprises the following steps: the information of the server is checked in advance, a digital certificate and a secret key are distributed to the server after the checking is passed, and the information of the server is bound with the distributed digital certificate and the distributed secret key; and in the step of authenticating the identity of the server, verifying the digital certificate and the secret key of the server, verifying whether the server information bound by the digital certificate is matched with the server information in authentication, and if the digital certificate and the secret key pass the verification and the server information is matched, the server passes the authentication.
As a preferred technical solution, the digital certificate and the secret key are stored in an external storage module, and in the step of verifying the digital certificate and the secret key of the server, the digital certificate and the secret key of the server are obtained through the external storage module connected to the server, and the verification of the digital certificate and the secret key of the server is realized; after the server is disconnected with the external storage module, the digital certificate and the key cannot be verified; the server information is composed of one of the following or any combination thereof: server name, server IP address, server MAC address, and server identification.
A distributed network security authentication system comprises at least two servers distributed in different areas, and further comprises: the server authentication module is used for performing identity authentication on the server when the server in the distributed network acts, and allowing the server to act if the server passes the authentication; denying the server to take place if the authentication is not passed.
As a preferred technical solution, the server behavior at least includes one of the following or any combination thereof:
server startup, server provisioning operations, and server usage of system resources.
As a preferred technical solution, the system further comprises an auditing module, which is used for auditing the information of the server; the certificate distribution module is used for distributing a digital certificate and a key for the server after the server passes the audit, and the information of the server is bound with the distributed digital certificate and the key; the server authentication module authenticates the identity of the server in the following way: and verifying the digital certificate and the secret key of the server, verifying whether the server information bound by the digital certificate is matched with the server information in the authentication, and if the digital certificate and the secret key pass the verification and the server information is matched, the server passes the authentication.
As a preferred technical solution, the digital certificate and the secret key are stored in an external storage module, and the server authentication module obtains the digital certificate and the secret key of the server through the external storage module connected to the server, and realizes verification of the digital certificate and the secret key of the server; after the server is disconnected with the external storage module, the digital certificate and the key cannot be verified; the server information is composed of one of the following or any combination thereof: server name, server IP address, server MAC address, and server identification.
If ssk expires in 5 minutes, the server informs the user that it needs to retrieve ssk when ssk is found to be invalid. The user requests a new ssk at this time, and the content carried by the request is still information such as E (lsk, Tn) and user name. If lsk is not present, the content that needs to be carried becomes: e (UK, Tn) and user name, and server information to get a new ssk. If lsk is available and the expiration time is 10 hours, lsk will not expire after 10 hours, and the user password itself will be used to obtain the new session key. If lsk is not present, then ssk has a time-to-failure of 5 minutes, and every 5 minutes it will use its own long-term key UK to request a new session key. The principle is as follows: data encrypted using a long-term key is not transmitted over the network as much as possible. Therefore, with lsk added, the data encrypted using the UK will not be used to request a new session key until the login session key expires. This reduces the number of times data encrypted using the long-term key is transmitted over the network.
The invention prevents eavesdropping and Replay (Replay attach); and (3) eavesdropping prevention: because service session key ssk has a relatively short validity time, if you eavesdrop on the user's outgoing data, the key will expire even if you decrypt it. Replay prevention: because the contents of the ssk service session key encrypted authenticator used for each access contain a time stamp, the time stamp is invalid if replayed.
The invention has the advantages of stability, easy expansion and maintenance; stability: the bottleneck of network security verification is the single-point nature of services of the HBase table, because the table of the data center is stored in one HBase table, the table is served by one RegionServer, if the RegionServer is down, the services are divided into middle sections, but the regions can be redistributed to another RegionServer for serving, and the probability of the down of the RegionServer is very small, because the ROOT table of the HBase is also served on one RegionServer, the stability of the HBase can be relieved; easy expansion and maintenance: when a new HBase server is added, no extra operations are required, as in the normal extension.
The invention breaks the concept that the server in the distributed network is safe and does not need identity authentication in the traditional concept, ensures the legality of the service provided by the server at each moment by carrying out real-time identity authentication on the server providing the service in the distributed network, effectively avoids the condition that the server is stolen, meets the safety requirements of users, including the confidentiality, the integrity and the non-repudiation of data, and ensures that the safety level achieved by the distributed network can meet the high-level safety requirements of the users in the industrial fields of power, oil gas, traffic and the like.
The invention binds the digital certificate and the key of the server with the server information, so that one server can only correspond to one fixed digital certificate and key, and the validity and the integrity of the server identity authentication are further ensured.
The server digital certificate and the key are stored in the external storage module, once the server is disconnected with the external storage module, the digital certificate and the key cannot be verified, so that illegal persons are effectively prevented from acquiring the digital certificate and the password of the server by illegal means, and the safety and the effectiveness of the server in the identity authentication process are further ensured.
In the description of the present invention, it is to be understood that the terms "one end", "front upper", "end", "length", "width", "inner", "upper", "other end", "both ends", "horizontal", "coaxial", "bottom", "lower", etc., indicate orientations or positional relationships based on those shown in the drawings, and are only for convenience of description and simplicity of description, and do not indicate or imply that the referred device or element must have a particular orientation, be constructed and operated in a particular orientation, and thus, are not to be construed as limiting the present invention.
Furthermore, the terms "first", "second", etc. are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first," "second," etc. may explicitly or implicitly include one or more of that feature. In the description of the present invention, "a plurality" means two or more unless otherwise specified.
In the present invention, unless otherwise specifically stated or limited, the terms "disposed", "engaged", "connected", "fitted", "cover" and the like are to be understood in a broad sense, and may be, for example, fixedly connected, detachably connected, or integrated; can be mechanically or electrically connected; they may be directly connected or indirectly connected through intervening media, or they may be connected internally or in any other suitable relationship, unless expressly stated otherwise. The specific meanings of the above terms in the present invention can be understood by those skilled in the art according to specific situations.
The above description is only a preferred embodiment of the present invention, and not intended to limit the scope of the present invention, and all equivalent structural changes made by using the contents of the present specification, or any direct or indirect application attached to other related technical fields, are included in the scope of the present invention.
Claims (10)
1. A method for verifying network security of a distributed system, the distributed network comprising at least two servers distributed in different areas, the method comprising the steps of: when a server in the distributed network acts, the server is authenticated,
respectively integrating a key distribution center KDC and a service ticket admission service component KDC-TGS into each HBase server to form each network security authentication server, and respectively integrating Kerberos clients into each HBase client to form each network security authentication client;
the network security authentication client sends a verification request to any network security authentication server; after the network security authentication server passes the verification, a login session key lsk and a service session key ssk are created, and the lsk and ssk are returned to the network security authentication client; and storing lsk and ssk in a data center accessible to each network security authentication server;
the network security authentication client uses the ssk to perform request interaction with any network security authentication server, and the requested network security authentication server verifies the network security authentication client according to ssk stored in the data center;
allowing the server to take place if the authentication passes; denying the server to take place if the authentication is not passed.
2. The network security authentication method of a distributed system according to claim 1, wherein: the authentication request includes: a client user name, an authenticator T1 encrypted by using a long-term password UK and request service operation information Sinfo; the network security authentication server side obtains a long-term password UK according to the client user name query, decrypts the authenticator T1 encrypted by the long-term password UK by using the long-term password UK to obtain an authenticator T1, creates a login session key lsk and a service session key ssk when verifying that the authenticator T1 is valid, stores the lsk and ssk in a data center accessible to each network security authentication server, and sends lsk encrypted by using the long-term password UK, ssk encrypted by using lsk and an authenticator T1 encrypted by using ssk to the network security authentication client side; the network security authentication client decrypts lsk encrypted using the long-term password UK by using the long-term password UK to obtain lsk; ssk encrypted using lsk is decrypted with lsk to obtain ssk; decrypting the certifier T1 encrypted using ssk with ssk to obtain a certifier T1, comparing the decrypted certifier T1 with the certifier T1 in the transmission verification request, determining that the secure network certification is passed when the verification is passed, and caching the lsk and the ssk; the data center is a resident memory table, a relational database or a distributed cache.
3. The network security authentication method of a distributed system according to claim 2, wherein: the method further comprises the following steps: when ssk valid time arrives, the data center clears the saved ssk; the network security authentication client updates ssk to any network security authentication server using the lsk.
4. The network security authentication method of a distributed system according to claim 2, wherein: the method further comprises the following steps: when lsk valid time arrives, the data center clears the saved lsk; the network security authentication client updates ssk to any network security authentication server using the long-term password UK.
5. The network security authentication method of a distributed system according to claim 1, wherein: the server behavior at least comprises one or any combination of the following: starting a server, providing a service by the server, providing data by the server, providing operation by the server and using system resources by the server; before the step of authenticating the identity of the server, the method further comprises the following steps: the information of the server is checked in advance, a digital certificate and a secret key are distributed to the server after the checking is passed, and the information of the server is bound with the distributed digital certificate and the distributed secret key; and in the step of authenticating the identity of the server, verifying the digital certificate and the secret key of the server, verifying whether the server information bound by the digital certificate is matched with the server information in authentication, and if the digital certificate and the secret key pass the verification and the server information is matched, the server passes the authentication.
6. The network security authentication method of a distributed system according to claim 5, wherein: the digital certificate and the secret key are stored in an external storage module, and in the step of verifying the digital certificate and the secret key of the server, the digital certificate and the secret key of the server are obtained through the external storage module connected with the server, and the verification of the digital certificate and the secret key of the server is realized; after the server is disconnected with the external storage module, the digital certificate and the key cannot be verified; the server information is composed of one of the following or any combination thereof: server name, server IP address, server MAC address, and server identification.
7. A distributed network security authentication system comprises at least two servers distributed in different areas, and is characterized by further comprising: the server authentication module is used for performing identity authentication on the server when the server in the distributed network acts, and allowing the server to act if the server passes the authentication; denying the server to take place if the authentication is not passed.
8. The distributed network security authentication system of claim 7, wherein the server behavior comprises at least one of the following or any combination thereof:
server startup, server provisioning operations, and server usage of system resources.
9. The distributed network security authentication system of claim 7, further comprising an audit module configured to audit information of the server; the certificate distribution module is used for distributing a digital certificate and a key for the server after the server passes the audit, and the information of the server is bound with the distributed digital certificate and the key; the server authentication module authenticates the identity of the server in the following way: and verifying the digital certificate and the secret key of the server, verifying whether the server information bound by the digital certificate is matched with the server information in the authentication, and if the digital certificate and the secret key pass the verification and the server information is matched, the server passes the authentication.
10. The distributed network security authentication system of claim 9, wherein the digital certificate and the secret key are stored in an external storage module, and the server authentication module obtains the digital certificate and the secret key of the server through the external storage module connected to the server, and verifies the digital certificate and the secret key of the server; after the server is disconnected with the external storage module, the digital certificate and the key cannot be verified; the server information is composed of one of the following or any combination thereof: server name, server IP address, server MAC address, and server identification.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810634905.2A CN110620750A (en) | 2018-06-20 | 2018-06-20 | Network security verification method of distributed system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810634905.2A CN110620750A (en) | 2018-06-20 | 2018-06-20 | Network security verification method of distributed system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110620750A true CN110620750A (en) | 2019-12-27 |
Family
ID=68920334
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810634905.2A Pending CN110620750A (en) | 2018-06-20 | 2018-06-20 | Network security verification method of distributed system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110620750A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113259319A (en) * | 2021-04-12 | 2021-08-13 | 顶象科技有限公司 | Verification processing method and system |
| WO2023160375A1 (en) * | 2022-02-24 | 2023-08-31 | 华为技术有限公司 | Session key generation method, control device, and device clustering system |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080072303A1 (en) * | 2006-09-14 | 2008-03-20 | Schlumberger Technology Corporation | Method and system for one time password based authentication and integrated remote access |
| CN102255870A (en) * | 2010-05-19 | 2011-11-23 | 上海可鲁系统软件有限公司 | Security authentication method and system for distributed network |
| CN102487383A (en) * | 2010-12-02 | 2012-06-06 | 上海可鲁系统软件有限公司 | Industrial internet distributed system safety access control device |
| CN104092702A (en) * | 2014-07-22 | 2014-10-08 | 北京京东尚科信息技术有限公司 | Network security verification method and system for distributed system |
-
2018
- 2018-06-20 CN CN201810634905.2A patent/CN110620750A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080072303A1 (en) * | 2006-09-14 | 2008-03-20 | Schlumberger Technology Corporation | Method and system for one time password based authentication and integrated remote access |
| CN102255870A (en) * | 2010-05-19 | 2011-11-23 | 上海可鲁系统软件有限公司 | Security authentication method and system for distributed network |
| CN102487383A (en) * | 2010-12-02 | 2012-06-06 | 上海可鲁系统软件有限公司 | Industrial internet distributed system safety access control device |
| CN104092702A (en) * | 2014-07-22 | 2014-10-08 | 北京京东尚科信息技术有限公司 | Network security verification method and system for distributed system |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113259319A (en) * | 2021-04-12 | 2021-08-13 | 顶象科技有限公司 | Verification processing method and system |
| CN113259319B (en) * | 2021-04-12 | 2023-05-12 | 杭州顶象科技有限公司 | Verification processing method and system |
| WO2023160375A1 (en) * | 2022-02-24 | 2023-08-31 | 华为技术有限公司 | Session key generation method, control device, and device clustering system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| KR101908712B1 (en) | Security method for smart grid system using block chain | |
| CN106878318B (en) | Block chain real-time polling cloud system | |
| CN1323508C (en) | A Single Sign On method based on digital certificate | |
| CN112422532B (en) | Service communication method, system and device and electronic equipment | |
| US7062654B2 (en) | Cross-domain access control | |
| Riabi et al. | A survey on Blockchain based access control for Internet of Things | |
| US7571311B2 (en) | Scheme for sub-realms within an authentication protocol | |
| US20010020274A1 (en) | Platform-neutral system and method for providing secure remote operations over an insecure computer network | |
| CN103259663A (en) | User unified authentication method in cloud computing environment | |
| JPH06223041A (en) | Rarge-area environment user certification system | |
| US8977857B1 (en) | System and method for granting access to protected information on a remote server | |
| CN103248479A (en) | Cloud storage safety system, data protection method and data sharing method | |
| CN105553666B (en) | Intelligent power terminal safety authentication system and method | |
| CN112039870A (en) | Privacy protection-oriented vehicle-mounted network authentication method and system based on block chain | |
| CN111970299A (en) | Block chain-based distributed Internet of things equipment identity authentication device and method | |
| CN101321064A (en) | Information system access control method and apparatus based on digital certificate technique | |
| CN104683306A (en) | Safe and controllable internet real-name certification mechanism | |
| CN111901432A (en) | Block chain-based safety data exchange method | |
| CN112861157A (en) | Data sharing method based on decentralized identity and proxy re-encryption | |
| CN112118242A (en) | Zero trust authentication system | |
| CN105072138B (en) | A kind of cloud system safety access method | |
| KR101464724B1 (en) | OpenID Based User Authentication Scheme for Multi-clouds Environment | |
| CN110620750A (en) | Network security verification method of distributed system | |
| CN110035035B (en) | Secondary authentication method and system for single sign-on | |
| CN116668190A (en) | Cross-domain single sign-on method and system based on browser fingerprint |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20191227 |
|
| RJ01 | Rejection of invention patent application after publication |