CN112468517A - Tracing-resistant anonymous communication network access method, system and device - Google Patents
Tracing-resistant anonymous communication network access method, system and device Download PDFInfo
- Publication number
- CN112468517A CN112468517A CN202110097396.6A CN202110097396A CN112468517A CN 112468517 A CN112468517 A CN 112468517A CN 202110097396 A CN202110097396 A CN 202110097396A CN 112468517 A CN112468517 A CN 112468517A
- Authority
- CN
- China
- Prior art keywords
- client
- access
- proxy server
- request message
- response
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
- H04L63/0421—Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/2854—Wide area networks, e.g. public data networks
- H04L12/2856—Access arrangements, e.g. Internet access
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Power Engineering (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses an anti-tracing anonymous communication network access method, system and device, wherein the method comprises the following steps: before accessing an anonymous communication network, a client acquires an identity, a public/private key pair and an accessible access proxy server list through a registration center; when accessing an anonymous communication network, sending an access request message to an access proxy server; after receiving the access request message, forwarding the access request message to an authoritative directory server; after receiving the access request message, the authoritative directory server packs and stores the control information corresponding to the access request to a third-party storage node; after receiving the response message from the authoritative directory server, the access proxy server returns the response message to the client and informs the client to read the control information from the appointed third-party storage node; and after receiving the response message from the access proxy server, the client reads the control information from the appointed third-party storage node. The invention can be widely applied to the technical field of electronic communication.
Description
Technical Field
The invention relates to the technical field of electronic communication, in particular to an anti-tracing anonymous communication network access method, system and device.
Background
With the continuous improvement of the commercial value of the internet, network communication in the internet environment faces huge security threats, and an attacker monitors the network traffic of an application system through various network tools and steals commercial secrets. In addition, the exposure of the snooker event proves that in the internet environment, the internet environment brings various conveniences to the life of people, and meanwhile, a new technical challenge is brought to the privacy protection band of personal communication. Anonymous communication technology is currently an effective means to combat interception, traceability and other network regulatory activities. The basic idea of covert communication is to hide the sharing and transmission behavior of important information in the transmission process of common information by means of various technologies such as information hiding, channel hiding, path hiding, protocol hiding, etc., for example: webpage browsing, email, video sharing and the like, and information transmission is completed under an uncontrolled network environment. Compared with the traditional encryption communication technology based on VPN, the covert communication technology can not only protect the communication content, but also hide the characteristics and existence of communication, and prevent the information transmission process from being monitored and blocked. The anonymous communication networks widely used at present mainly include: tor networks based on onion routing technology and I2P networks based on garlic routing technology. With the great improvement of computing power and the rapid development of artificial intelligence technology, the capabilities of large-scale APT organizations (hereinafter referred to as supervisors) in network monitoring, traffic analysis and password cracking are continuously enhanced. In a competitive network environment, anonymous communication networks still face many security threats due to imperfect design.
Anonymous communication technology can not only protect confidentiality, integrity and availability of network communication content, but also hide communication relation and routing information through onion routing and other technologies. Although anonymous communication networks may provide better security and confidentiality, the control plane of most anonymous communication networks still lacks adequate protection mechanisms. In Tor example, the user node needs to download necessary control information through Tor's authoritative directory server before using anonymous service, and the communication behavior between the user node and the authoritative directory server lacks sufficient security protection mechanism. Therefore, by tracking the communication behavior of the user node, the authoritative directory server can be quickly positioned, and the authoritative directory server is further sealed and controlled, so that the purpose of attacking or destroying the anonymous communication network is achieved. In order to protect the authoritative directory server and related nodes, the main research direction of security researchers is how to prevent supervisors from discovering and controlling the nodes for the communication system of the Tor and other end-to-end architectures. In practical application, in order to prevent a supervisor from monitoring or actively detecting the traffic in the access process, a security researcher adopts three means of resource acquisition limitation, proxy forwarding and traffic confusion. Taking Tor as an example, to prevent exhausting all nodes, Tor uses key space based partitioning, social networking and gear shifting agent based methods to limit the access rate of the relevant nodes (including bridge nodes for implementing agents and OBFS nodes for obfuscating traffic). With the development of Web technologies and cloud computing, some services of large cloud service providers are applied to covert communication systems. Related methods of the prior art have achieved some results, but they have not changed the end-to-end explicit communication model between the client node and the directory server. When the client node downloads control information from the rights directory server, the communication relationship between the two parties and their traffic is still easily identified and tracked.
When a client accesses the anonymous communication network, an implicit communication model is adopted, and the communication relation between the client and an authoritative directory server is not exposed while the access control information of the anonymous communication network is obtained, so that the safety of the anonymous communication network is further improved.
Disclosure of Invention
In view of this, embodiments of the present invention provide a tracing-resistant anonymous communication network access method, apparatus, device, and medium with high security and low cost.
The embodiment of the invention provides an anti-tracing anonymous communication network access method, which comprises the following steps:
before accessing an anonymous communication network, a client firstly acquires an identity, a public/private key pair and an accessible access proxy server list through a registration center; after the registration of the client is finished, the registration center sends the identity identification and the public key of the client to an access proxy server which can be accessed by the client;
when a client accesses an anonymous communication network, firstly, an access request message is sent to an access proxy server;
after receiving the access request message, the access proxy server forwards the access request message to an authoritative directory server;
after receiving the access request message, the authoritative directory server packs and stores control information corresponding to the access request to a third-party storage node, and returns an access address of the storage node to the access proxy server;
after receiving the response message from the authoritative directory server, the access proxy server returns the response message to the client and informs the client to read the control information from the appointed third-party storage node;
and after receiving the response message from the access proxy server, the client reads the control information from the appointed third-party storage node.
Preferably, the method further comprises the step of registering the client through a registry, and the step comprises:
when a client sends a registration request to a registration center, an electronic mailbox and a mobile phone number of a client user are provided; the electronic mailbox is used for receiving encrypted information, and the information comprises: the system comprises an identity mark, a public/private key pair and an accessible access proxy server list, wherein the identity mark, the public/private key pair and the accessible access proxy server list are generated by a registration center, and the accessible access proxy server list comprises an access proxy server address and an access proxy server public key; the mobile phone number is used for receiving the decryption key.
Preferably, the step of sending the access request message to the access proxy server by the client includes:
encrypting the access request message by using a public key of the access proxy server; the access request message includes: the client identity ID, the request message serial number, the control information list requested by the client, the request time and the digital signature calculated by the client for the access request message.
Preferably, the step of forwarding the access request message to the authoritative directory server by the access proxy server includes:
when the access proxy server forwards an access request message from a client, firstly, the message is decrypted by using a private key, then, a local digital certificate library is inquired according to a client Identity (ID) carried in the message, a corresponding public key is read, the digital signature of the message is verified, and after the confirmation of no error, a new request message is generated and sent to an authoritative directory server;
the new request message is encrypted using the public key of the authoritative server, the new request message including: the client identity ID, the request message serial number, the control information list requested by the client, the request time, the client public key, the access proxy server ID and the digital signature calculated by the access proxy server for the request message.
Preferably, the step of processing the authoritative directory server after receiving the access request message includes:
the authoritative server firstly uses the private key to decrypt the request message and uses the public key accessed to the proxy server to verify the integrity and the authenticity of the request message;
after confirming that the request message is true and correct, the authoritative server firstly generates a response random number and a random life cycle, and then stores the control information in a response data file according to a specified format, wherein the response data file comprises a file header, a file body, a data file integrity verification code, a file signing mark and a file signing mark verification code;
wherein the file header comprises: client identity ID, request serial number and control information length; the file body stores control information content;
the file body part is encrypted by using a client public key;
the data file integrity verification code is calculated by using a signature verification algorithm HMAC-SHA1 or HMAC-MD 5;
the input parameters of the signature verification algorithm HMAC-SHA1 or HMAC-MD5 comprise: the SHA1 hash value or MD5 hash value after the file header and the file body are combined;
the file signing mark and the file signing mark verification code part are filled with a 0 value;
after the authoritative server generates the response data file, the response data file is stored in a third-party storage node, then a request response message is generated and sent to the access proxy server, and the request response message is encrypted by using a public key of the access proxy server; wherein the request reply message comprises: the method comprises the steps of a client identity ID, a request message serial number, third-party storage node access information, a response random number used for calculating a data file integrity verification code and a digital signature of a response message.
Preferably, after receiving the response message from the authoritative directory server, the access proxy server further includes:
the access proxy server firstly decrypts the response message and verifies the correctness of the digital signature; after the confirmation is correct, generating a new response message to be sent to the client, wherein the response message is encrypted by using a client public key;
the response message includes: the method comprises the steps of a client identity ID, a request message serial number, third-party storage node access information, a response random number used for calculating a data file integrity verification code and a digital signature of a response message.
Preferably, after receiving the response message from the access proxy server, the processing characteristics include:
the client firstly decrypts the response message and verifies the correctness of the digital signature;
after the data file integrity verification code is confirmed to be correct, the third-party storage node access information contained in the response information and the response random number used for calculating the data file integrity verification code are further decrypted by using a private key;
then reading a response data file to a specified address according to the access information of the third-party storage node;
when the response data file is read, the file body of the response data is decrypted by using a client private key, and the integrity verification code of the data file is verified by using a response random number;
after the verification is correct, writing a random character string in the file signing mark part, and simultaneously calculating a file signing mark verification code by using a signature verification algorithm HMAC-SHA1 or HMAC-MD 5;
the input parameters of the signature verification algorithm HMAC-SHA1 or HMAC-MD5 comprise: the file signing mark and a response random number returned by the authoritative server.
Another aspect of the embodiments of the present invention provides an anti-tracing anonymous communication network access system, including:
the system comprises a registration module, a service module and a service module, wherein the registration module is used for acquiring an identity identifier, a public/private key pair and an accessible access proxy server list through a registration center before a client accesses an anonymous communication network; after the registration of the client is finished, the registration center sends the identity identification and the public key of the client to an access proxy server which can be accessed by the client;
the sending module is used for firstly sending an access request message to an access proxy server when a client accesses an anonymous communication network;
the forwarding module is used for forwarding the access request message to the authoritative directory server after the access proxy server receives the access request message;
the receiving module is used for packing and storing the control information corresponding to the access request to a third-party storage node after the authoritative directory server receives the access request message, and returning the access address of the storage node to the access proxy server;
the response module is used for returning a response message to the client after the access proxy server receives the response message from the authoritative directory server and informing the client to read the control information from the appointed third-party storage node;
and the reading module is used for reading the control information from the appointed third-party storage node after the client receives the response message from the access proxy server.
Another aspect of an embodiment of the present invention provides an electronic device, including:
a memory for storing a program;
a processor for executing the program to implement the anonymous communication network access method as described above.
The invention improves the safety of the communication process and reduces the cost.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.
FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present application;
FIG. 2 is a schematic diagram of a design of a response data file provided in an embodiment of the present application;
fig. 3 is a flowchart illustrating overall steps of a communication network access method according to an embodiment of the present application.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.
Aiming at the problems in the prior art, the invention adopts the idea of 'end to cloud' to improve the Tor and other anonymous communication networks, stores control information by means of a third-party storage node, solves the safety problem of a control plane when a client node accesses the network, and specifically comprises the following three problems:
1. how to establish an implicit communication relation and acquire a response data file under the condition that a node and an authoritative server in a covert communication network do not sense, and how to send receipt information to the server under the condition that the node does not sense after acquiring the response data file.
2. How the authoritative server constructs the response data file and how to prevent the response data file from being leaked.
3. How to protect the anonymity of the node and the whole covert communication network and protect the privacy of a forwarding node in the covert communication system.
Specifically, an embodiment of the present invention provides an anti-tracing anonymous communication network access method, including:
introducing a registration center and an access agent;
the node completes registration through a registration center and receives registration information in a mail and mobile phone mode;
determining information of sending an access request by a client node and an access agent;
determining information forwarded by an access agent to an authoritative directory server;
determining a processing process after the authoritative directory server receives the request;
determining response information sent by an authoritative directory server to an access agent;
determining a processing process after the access agent receives the response;
the completion of the information transmission process after the client node receives the response is determined.
In some embodiments, the node completes registration through the registration center, and receiving the registration information in a mail and mobile phone manner includes:
when the client sends a registration request to a registration center, an electronic mailbox and a mobile phone number which can be controlled by a client user are provided; the electronic mailbox is used for receiving encrypted 'Identity (ID) generated by a registration center, a public/private key pair and an accessible access proxy server list (comprising an access proxy server address and an access proxy server public key)'; the mobile phone is used for receiving the decryption password. Wherein, the access proxy server is also called as the access proxy for short.
In some embodiments, determining information that the client node sends the access request with the access agent comprises:
the main content of the request information is as follows: the client identity ID, the request message sequence number, the control information list requested by the client, and the request time (for preventing replay attack);
the client node carries out digital signature on the information through a private key of the client node, and encrypts the request information by using a public key accessed to the proxy server;
the client sends the encrypted information to the interventional band.
In some embodiments, the determining information that the access agent forwards to the authoritative directory server includes:
the access agent decrypts the request by using its own private key;
the access agent queries a local digital certificate library according to the identity ID of the node and determines a public key of the client node;
the access agent verifies the signature of the request;
the access agent constructs a new request message which comprises a client identity ID, a request message serial number, a control information list requested by the client, request time, a client node public key and an access agent server ID;
the access agent carries out digital signature on the information by using a private key of the access agent, and encrypts the information by using a public key of an authoritative server;
and the access agent forwards the information to the server side.
In some embodiments, the processing characteristics of the authoritative directory server after receiving the access request message include:
the authority server firstly uses a private key of the authority server to decrypt the request message and uses a public key accessed to the proxy server to verify the integrity and the authenticity of the request message;
after confirming that the request message is true and correct, the authoritative server generates a response random number and a random life cycle, wherein the upper and lower bounds of the life cycle are respectively 60 minutes and 45 minutes;
the server constructs a response data file, and the response data file comprises: the file comprises a file header, a file body, a data file integrity verification code, a file signing mark and a file signing mark verification code. The file header includes: client identity ID, request sequence number and control information length. The file body stores the control information content, and the file body part is encrypted by using a client public key. The data file integrity verification code is calculated by using a signature verification algorithm HMAC-SHA1 or HMAC-MD5, and input parameters of the signature verification algorithm HMAC-SHA1 or HMAC-MD5 comprise: and merging the file header and the file body to obtain the hash value. The file sign-on tag and the file sign-on tag verification code portion are filled with a 0 value.
After the authoritative server generates a response data file, storing the file to a third-party storage node;
and the authoritative server starts timing after the file is stored in the third-party storage node, and deletes the resource in the storage node after the time exceeds the life cycle.
In some embodiments, the determining request response information sent by the authoritative directory server to the access agent includes:
the main content of the request response information is as follows: client ID, request message serial number, third party storage node access information (encrypted using client node public key), random number of replies used to calculate data file integrity verification code (encrypted using client node public key), digital signature of reply message (calculated using authority server private key)
The authority server uses the public key of the access proxy server to encrypt the main content;
and sending a request response message to the access proxy server.
In some embodiments, the processing after determining that the access agent received the response includes:
the access proxy server decrypts the response message and verifies the correctness of the digital signature;
the access agent generates a new response message to be sent to the client, and the response message is encrypted by using a client public key and comprises the following contents: client ID, request message serial number, third party storage node access information (encrypted using client public key), random number of replies used to calculate data file integrity verification code (encrypted using client public key), digital signature of reply message (calculated using access proxy's private key).
In some embodiments, determining completion of the information transfer process after the client node receives the response comprises:
the client node decrypts the reply message and verifies the correctness of the digital signature;
the client node decrypts the third-party storage node access information contained in the response information and the response random number used for calculating the data file integrity verification code by using a private key;
the client node reads a response data file to a specified address according to the access information of the third-party storage node;
the client node decrypts the file body of the response data using the client private key and verifies the data file integrity verification code using the response random number. After confirming that no error exists, writing a random character string in the file signing mark part, and simultaneously calculating a file signing mark verification code by using a signature verification algorithm HMAC-SHA1 or HMAC-MD5, wherein the input parameters of the signature verification algorithm HMAC-SHA1 or HMAC-MD5 comprise: the file signing mark and a response random number returned by the authoritative server.
The following detailed description is made with reference to the accompanying drawings.
In one implementation environment, as shown in fig. 1, the communication network access method of the present invention includes five major parts, namely, an anonymous communication network, a third-party storage node, a client node, a registry, and an access agent.
Wherein, 1) the anonymous communication network: the anonymous communication network refers to an anonymous communication network built by P2P technology, such as Tor, and the like, wherein an authoritative directory server for managing and maintaining the network and the whole P2P network are contained.
2) A third-party storage node: the embodiment of the invention regards the public resource sharing service platform of a large-scale internet manufacturer as a warehouse. And the third-party storage node temporarily stores control information data to be exchanged between the two communication parties by means of various services of large-scale internet manufacturers. The communication parties can carry out 'uploading', 'downloading' and 'destroying' operations on the control information in the third-party storage node. Implementations of third-party storage nodes include, but are not limited to, network disks, mail and forums, and the like. The scheme provides that the following prerequisites need to be met for the common platform to be able to become a third-party storage node:
2.1) large user quantity: in the region of the supervisor, the public platform needs to have enough users to carry out normal services to cover the traffic characteristics of both communication parties, so as to prevent characteristic analysis.
2.2) supporting anonymous resource acquisition: the anonymity here refers to front-end anonymity, that is, after the user publishes the resource, others except the platform service provider cannot identify the identity of the user who acquires the resource.
3) A user node: corresponding to a physical terminal accessing the anonymous communication network, it needs to exchange control information with the core switching network before accessing the anonymous communication network.
4) The registration center: before the node communicates with the access agent, the node is provided with the function of registering the identity identifier, and meanwhile, the key distribution is completed, so that the safety of the node before the communication with the access agent is guaranteed.
5) An access agent: and as an intermediate agent of the node and the authoritative server, communication forwarding service is provided for the two parties in the registration stage and the third-party storage node constructing stage, and only a specific access agent can associate the identity with the corresponding node.
Referring to fig. 2, in the embodiment of the present invention, the design of the response data file specifically includes:
1. a file header: the file header is used for identifying information such as client identity ID, request serial number, control information length, length of file block, data life cycle and the like;
2. a file body: storing the control information content, and encrypting the file body part by using a client public key;
3. data file integrity verification code: the data file integrity verification code is calculated by using a signature verification algorithm HMAC-SHA1 or HMAC-MD5, and input parameters of the signature verification algorithm HMAC-SHA1 or HMAC-MD5 comprise: the hash value after the file header and the file body are combined;
4. document signing mark and document signing mark verification code: the data of the part is set to be all 0 when being initialized, the node modifies the file after receiving the file, the file signing mark part is written into a random character string, the file signing mark verification code is calculated by a signature verification algorithm HMAC-SHA1 or HMAC-MD5, and the input of the file signing mark and the response random number returned by the authoritative server are included.
Referring to fig. 3, the communication network access method according to the embodiment of the present invention specifically includes the following steps S201 to S203:
s201, identity registration:
s2011, before accessing an anonymous communication network, a client requests an Identity (ID), a public/private key pair and an accessible access agent list from a registration center;
s2012, the registration center receives the request and generates registration information, wherein the registration information comprises an Identity (ID), a public/private key pair and an accessible access agent list;
s2013, after the registration center sends the access agent list and the node private key to the node, the registration center sends the identity ID and the public key of the node to the access agents in the list through the existing encryption session and forwards the identity ID and the public key to the authoritative server, and the node is guaranteed to access the anonymous network only through the access agents in the access agent list;
s2014, the client node receives registration information;
s2015, the access agent receives the identity ID and the public key of the node.
S202, requesting an access stage:
s2021, the node to be accessed and the agent in the access agent list initiate a request for establishing communication. The access request message needs to be encrypted using the public key of the access agent. The access request message needs to include: the client identity ID, the request message serial number, a control information list requested by the client, the request time (used for preventing replay attack), and a digital signature calculated by the client for the access request message;
s2022, when the access agent forwards the access request message from the client, the access agent uses a private key of the access agent to decrypt the message;
and S2023, the access agent queries the local digital certificate bank according to the client identity ID carried in the message, reads the corresponding public key, verifies the digital signature of the message, and generates a new request message after confirming that no error exists. The new request message is encrypted using the public key of the authoritative server, including: the method comprises the steps that a client identity ID, a request message serial number, a control information list of a client request, request time, a client public key, an access agent ID and a digital signature calculated by the access agent for the request message are sent to an authoritative server by the access agent;
s2024, after receiving the request, the authority server decrypts the request by using a private key of the authority server and verifies the signature by using a public key of the access agent;
s2025, the authoritative server generates a response random number and a life cycle after verifying that the data is correct, and a response data file is constructed by using the response random number;
s2026, after the authoritative server generates the response data file, storing the response data file to a third-party storage node;
s2027, the authoritative server generates a request response message and sends the request response message to the access agent, wherein the request response message is encrypted by using a public key of the access agent, and the request response message comprises: client ID, request message serial number, third party storage node access information (encrypted using client public key), random number of replies used to calculate data file integrity verification code (encrypted using client public key), digital signature of reply message (calculated using authority server's private key).
S203, response data transmission stage:
s2031, timing is started after the authoritative server sends the response message;
s2031(a), downloading the released resources and destroying the response data file in the designated address when the life cycle is exceeded; s2031(b) verifying whether the file signing part is correctly written in the downloaded resources;
s2032, the access agent decrypts the response message and verifies the correctness of the digital signature;
s2033, the access proxy generates a new response message to send to the client, the response message is encrypted by the client public key, and the content comprises the following contents: a client identity ID, a request message serial number, third-party storage node access information (encrypted by using a client public key), a response random number for calculating a data file integrity verification code (encrypted by using the client public key), and a digital signature of a response message (calculated by using a private key of an access agent);
s2034, the client node decrypts the response message, verifies the correctness of the digital signature, and uses a private key to decrypt the third-party storage node access information contained in the response message and the response random number used for calculating the data file integrity verification code;
s2035, the client node reads the response data file to the appointed address according to the third-party storage node access information;
s2036, when the client node reads the response data file, the file body of the response data is decrypted by using the client private key, and the integrity verification code of the data file is verified by using the response random number;
s2037, after the client node confirms that no error exists, writing a random character string in the file sign-in mark part, and simultaneously calculating a file sign-in mark verification code by using a signature verification algorithm HMAC-SHA1, wherein the input parameters of the signature verification algorithm HMAC-SHA1 comprise: the file signing mark and a response random number returned by the authoritative server;
s2038, the client node releases the response data file again to prove that the client node has received the content.
To sum up, compared with the prior art, the application has the following outstanding characteristics:
1) registration and access agent mechanism: in the scheme, the node to be accessed registers identity and obtains a key through the registration center before requesting access, and an access agent is adopted during access. The real two communication parties do not sense the opposite party when transmitting data, end-to-end communication does not exist, data encryption is realized, traceability and attack modes such as flow association, man-in-the-middle attack and the like can be prevented, and the method has stronger safety and anonymity compared with the traditional anonymous network;
2) file construction: the file construction of the scheme refers to the idea of messages in a network, a header and a response part are added to help both communication parties to finish a confirmation request, and verification on the integrity of the file is introduced at the same time, so that compared with a traditional request response mechanism, the method is difficult to find the characteristics by a packet capturing or file characteristic analyzing mode and has more concealment;
3) a common platform mechanism: in the scheme, the real sender and the receiver realize concealment by means of a third-party storage node, in the view of a supervisor, an object of each communication of the real sender and the real receiver is a common platform, and in addition, the confusion of other service flows, the supervisor is difficult to distinguish the real starting point and the real end point of information, so that the anonymity of the sender and the receiver is realized.
4) The life cycle mechanism is as follows: the scheme adopts a life cycle mechanism, so that the whole communication process and the transmitted response data file have timeliness, and once the life cycle is reached, the file is destroyed. Due to the asynchronous nature, the supervisor cannot correlate the communication relationships of the parties. The mechanism thus guarantees the privacy of the behaviour "accessing an anonymous communication network".
The embodiment of the invention also provides an anti-tracing anonymous communication network access system, which comprises:
the system comprises a registration module, a service module and a service module, wherein the registration module is used for acquiring an identity identifier, a public/private key pair and an accessible access proxy server list through a registration center before a client accesses an anonymous communication network; after the registration of the client is finished, the registration center sends the identity identification and the public key of the client to an access proxy server which can be accessed by the client;
the sending module is used for firstly sending an access request message to an access proxy server when a client accesses an anonymous communication network;
the forwarding module is used for forwarding the access request message to the authoritative directory server after the access proxy server receives the access request message;
the receiving module is used for packing and storing the control information corresponding to the access request to a third-party storage node after the authoritative directory server receives the access request message, and returning the access address of the storage node to the access proxy server;
the response module is used for returning a response message to the client after the access proxy server receives the response message from the authoritative directory server and informing the client to read the control information from the appointed third-party storage node;
and the reading module is used for reading the control information from the appointed third-party storage node after the client receives the response message from the access proxy server.
The embodiment of the invention also provides the electronic equipment, which comprises a processor and a memory;
the memory is used for storing programs;
the processor executes the program to implement the method as described above.
An embodiment of the present invention further provides a computer-readable storage medium, where the storage medium stores a program, and the program is executed by a processor to implement the method described above.
The embodiment of the invention also discloses a computer program product or a computer program, which comprises computer instructions, and the computer instructions are stored in a computer readable storage medium. The computer instructions may be read by a processor of a computer device from a computer-readable storage medium, and the computer instructions executed by the processor cause the computer device to perform the foregoing method.
In alternative embodiments, the functions/acts noted in the block diagrams may occur out of the order noted in the operational illustrations. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality/acts involved. Furthermore, the embodiments presented and described in the flow charts of the present invention are provided by way of example in order to provide a more thorough understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and in which sub-operations described as part of larger operations are performed independently.
Furthermore, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise stated to the contrary, one or more of the described functions and/or features may be integrated in a single physical device and/or software module, or one or more functions and/or features may be implemented in a separate physical device or software module. It will also be appreciated that a detailed discussion of the actual implementation of each module is not necessary for an understanding of the present invention. Rather, the actual implementation of the various functional modules in the apparatus disclosed herein will be understood within the ordinary skill of an engineer, given the nature, function, and internal relationship of the modules. Accordingly, those skilled in the art can, using ordinary skill, practice the invention as set forth in the claims without undue experimentation. It is also to be understood that the specific concepts disclosed are merely illustrative of and not intended to limit the scope of the invention, which is defined by the appended claims and their full scope of equivalents.
The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.
The logic and/or steps represented in the flowcharts or otherwise described herein, e.g., an ordered listing of executable instructions that can be considered to implement logical functions, can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor-containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. For the purposes of this description, a "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.
More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection (electronic device) having one or more wires, a portable computer diskette (magnetic device), a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium could even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via for instance optical scanning of the paper or other medium, then compiled, interpreted or otherwise processed in a suitable manner if necessary, and then stored in a computer memory.
It should be understood that portions of the present invention may be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, the various steps or methods may be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any one or combination of the following techniques, which are known in the art, may be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application specific integrated circuit having an appropriate combinational logic gate circuit, a Programmable Gate Array (PGA), a Field Programmable Gate Array (FPGA), or the like.
In the description herein, references to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., mean that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention. In this specification, the schematic representations of the terms used above do not necessarily refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.
While embodiments of the invention have been shown and described, it will be understood by those of ordinary skill in the art that: various changes, modifications, substitutions and alterations can be made to the embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.
While the preferred embodiments of the present invention have been illustrated and described, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.
Claims (9)
1. A tracing-resistant anonymous communication network access method is characterized by comprising the following steps:
before accessing an anonymous communication network, a client firstly acquires an identity, a public/private key pair and an accessible access proxy server list through a registration center; after the registration of the client is finished, the registration center sends the identity identification and the public key of the client to an access proxy server which can be accessed by the client;
when a client accesses an anonymous communication network, firstly, an access request message is sent to an access proxy server;
after receiving the access request message, the access proxy server forwards the access request message to an authoritative directory server;
after receiving the access request message, the authoritative directory server packs and stores control information corresponding to the access request to a third-party storage node, and returns an access address of the storage node to the access proxy server;
after receiving the response message from the authoritative directory server, the access proxy server returns the response message to the client and informs the client to read the control information from the appointed third-party storage node;
and after receiving the response message from the access proxy server, the client reads the control information from the appointed third-party storage node.
2. The method of claim 1, further comprising the step of registering the client with a registry, the step comprising:
when a client sends a registration request to a registration center, an electronic mailbox and a mobile phone number of a client user are provided; the electronic mailbox is used for receiving encrypted information, and the information comprises: the system comprises an identity mark, a public/private key pair and an accessible access proxy server list, wherein the identity mark, the public/private key pair and the accessible access proxy server list are generated by a registration center, and the accessible access proxy server list comprises an access proxy server address and an access proxy server public key; the mobile phone number is used for receiving the decryption key.
3. The method for accessing the anonymous traceability communication network as claimed in claim 1, wherein the step of sending the access request message from the client to the access proxy server comprises:
encrypting the access request message by using a public key of the access proxy server; the access request message includes: the client identity ID, the request message serial number, the control information list requested by the client, the request time and the digital signature calculated by the client for the access request message.
4. The method for accessing an anonymous tracking source resistant communication network according to claim 1, wherein the step of forwarding the access request message to the authoritative directory server by the access proxy server comprises:
when the access proxy server forwards an access request message from a client, firstly, the message is decrypted by using a private key, then, a local digital certificate library is inquired according to a client Identity (ID) carried in the message, a corresponding public key is read, the digital signature of the message is verified, and after the confirmation of no error, a new request message is generated and sent to an authoritative directory server;
the new request message is encrypted using the public key of the authoritative server, the new request message including: the client identity ID, the request message serial number, the control information list requested by the client, the request time, the client public key, the access proxy server ID and the digital signature calculated by the access proxy server for the request message.
5. The method for accessing an anonymous tracking source resistance communication network according to claim 1, wherein the step of processing the authoritative directory server after receiving the access request message comprises:
the authoritative server firstly uses the private key to decrypt the request message and uses the public key accessed to the proxy server to verify the integrity and the authenticity of the request message;
after confirming that the request message is true and correct, the authoritative server firstly generates a response random number and a random life cycle, and then stores the control information in a response data file according to a specified format, wherein the response data file comprises a file header, a file body, a data file integrity verification code, a file signing mark and a file signing mark verification code;
wherein the file header comprises: client identity ID, request serial number and control information length; the file body stores control information content;
the file body part is encrypted by using a client public key;
the data file integrity verification code is calculated by using a signature verification algorithm HMAC-SHA1 or HMAC-MD 5;
the input parameters of the signature verification algorithm HMAC-SHA1 or HMAC-MD5 comprise: the SHA1 hash value or MD5 hash value after the file header and the file body are combined;
the file signing mark and the file signing mark verification code part are filled with a 0 value;
after the authoritative server generates the response data file, the response data file is stored in a third-party storage node, then a request response message is generated and sent to the access proxy server, and the request response message is encrypted by using a public key of the access proxy server; wherein the request reply message comprises: the method comprises the steps of a client identity ID, a request message serial number, third-party storage node access information, a response random number used for calculating a data file integrity verification code and a digital signature of a response message.
6. The method of claim 1, wherein the access proxy server, after receiving the response message from the authoritative directory server, further comprises:
the access proxy server firstly decrypts the response message and verifies the correctness of the digital signature; after the confirmation is correct, generating a new response message to be sent to the client, wherein the response message is encrypted by using a client public key;
the response message includes: the method comprises the steps of a client identity ID, a request message serial number, third-party storage node access information, a response random number used for calculating a data file integrity verification code and a digital signature of a response message.
7. The method of claim 1, wherein after receiving the response message from the access proxy server, the client processes the processing characteristics including:
the client firstly decrypts the response message and verifies the correctness of the digital signature;
after the data file integrity verification code is confirmed to be correct, the third-party storage node access information contained in the response information and the response random number used for calculating the data file integrity verification code are further decrypted by using a private key;
then reading a response data file to a specified address according to the access information of the third-party storage node;
when the response data file is read, the file body of the response data is decrypted by using a client private key, and the integrity verification code of the data file is verified by using a response random number;
after the verification is correct, writing a random character string in the file signing mark part, and simultaneously calculating a file signing mark verification code by using a signature verification algorithm HMAC-SHA1 or HMAC-MD 5;
the input parameters of the signature verification algorithm HMAC-SHA1 or HMAC-MD5 comprise: the file signing mark and a response random number returned by the authoritative server.
8. An anonymous communication network access system that is resistant to traceability, comprising:
the system comprises a registration module, a service module and a service module, wherein the registration module is used for acquiring an identity identifier, a public/private key pair and an accessible access proxy server list through a registration center before a client accesses an anonymous communication network; after the registration of the client is finished, the registration center sends the identity identification and the public key of the client to an access proxy server which can be accessed by the client;
the sending module is used for firstly sending an access request message to an access proxy server when a client accesses an anonymous communication network;
the forwarding module is used for forwarding the access request message to the authoritative directory server after the access proxy server receives the access request message;
the receiving module is used for packing and storing the control information corresponding to the access request to a third-party storage node after the authoritative directory server receives the access request message, and returning the access address of the storage node to the access proxy server;
the response module is used for returning a response message to the client after the access proxy server receives the response message from the authoritative directory server and informing the client to read the control information from the appointed third-party storage node;
and the reading module is used for reading the control information from the appointed third-party storage node after the client receives the response message from the access proxy server.
9. An electronic device, comprising:
a memory for storing a program;
a processor for executing the program to implement the anti-traceable anonymous communication network access method of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110097396.6A CN112468517B (en) | 2021-01-25 | 2021-01-25 | Tracing-resistant anonymous communication network access method, system and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110097396.6A CN112468517B (en) | 2021-01-25 | 2021-01-25 | Tracing-resistant anonymous communication network access method, system and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112468517A true CN112468517A (en) | 2021-03-09 |
| CN112468517B CN112468517B (en) | 2021-05-07 |
Family
ID=74802316
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110097396.6A Active CN112468517B (en) | 2021-01-25 | 2021-01-25 | Tracing-resistant anonymous communication network access method, system and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112468517B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114143073A (en) * | 2021-11-29 | 2022-03-04 | 北京中睿天下信息技术有限公司 | Content distribution IP (Internet protocol) hiding method and system based on dynamic agent chain |
| CN114157491A (en) * | 2021-12-02 | 2022-03-08 | 北京八分量信息科技有限公司 | Authentication method and device in heterogeneous network and related products |
| CN115277054A (en) * | 2022-06-08 | 2022-11-01 | 北京邮电大学 | Directory service method and system in anonymous network |
| CN115314491A (en) * | 2022-06-14 | 2022-11-08 | 北京邮电大学 | Directory service method and system of directory server cluster based on distributed structure |
| CN115941269A (en) * | 2022-11-04 | 2023-04-07 | 西安电子科技大学 | Method for realizing receiver anonymity based on cMix anonymous network |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101800760A (en) * | 2009-02-10 | 2010-08-11 | 中国移动通信集团公司 | Realization method and system for accessing data service |
| CN104539598A (en) * | 2014-12-19 | 2015-04-22 | 厦门市美亚柏科信息股份有限公司 | Tor-improved safety anonymous network communication system and method |
| CN105812359A (en) * | 2016-03-04 | 2016-07-27 | 四川长虹电器股份有限公司 | Method for realizing Internet anonymity by using distributed multiple-proxy encryption network |
| CN108234461A (en) * | 2017-12-22 | 2018-06-29 | 中国电子科技集团公司第三十研究所 | A kind of encrypted blinded communication system and method based on USB pairings |
| CN108259461A (en) * | 2017-11-28 | 2018-07-06 | 中国科学院信息工程研究所 | A kind of method and system that credible anonymous access is realized in distributed network |
| CN110119469A (en) * | 2019-05-22 | 2019-08-13 | 北京计算机技术及应用研究所 | A kind of data collection and transmission and method towards darknet |
| WO2019237126A1 (en) * | 2018-06-08 | 2019-12-12 | Gcp Ip Holdings I, Llc | Blockchain overwatch |
| CN111182537A (en) * | 2019-12-31 | 2020-05-19 | 北京指掌易科技有限公司 | Network access method, device and system for mobile application |
-
2021
- 2021-01-25 CN CN202110097396.6A patent/CN112468517B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101800760A (en) * | 2009-02-10 | 2010-08-11 | 中国移动通信集团公司 | Realization method and system for accessing data service |
| CN104539598A (en) * | 2014-12-19 | 2015-04-22 | 厦门市美亚柏科信息股份有限公司 | Tor-improved safety anonymous network communication system and method |
| CN105812359A (en) * | 2016-03-04 | 2016-07-27 | 四川长虹电器股份有限公司 | Method for realizing Internet anonymity by using distributed multiple-proxy encryption network |
| CN108259461A (en) * | 2017-11-28 | 2018-07-06 | 中国科学院信息工程研究所 | A kind of method and system that credible anonymous access is realized in distributed network |
| CN108234461A (en) * | 2017-12-22 | 2018-06-29 | 中国电子科技集团公司第三十研究所 | A kind of encrypted blinded communication system and method based on USB pairings |
| WO2019237126A1 (en) * | 2018-06-08 | 2019-12-12 | Gcp Ip Holdings I, Llc | Blockchain overwatch |
| CN110119469A (en) * | 2019-05-22 | 2019-08-13 | 北京计算机技术及应用研究所 | A kind of data collection and transmission and method towards darknet |
| CN111182537A (en) * | 2019-12-31 | 2020-05-19 | 北京指掌易科技有限公司 | Network access method, device and system for mobile application |
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114143073A (en) * | 2021-11-29 | 2022-03-04 | 北京中睿天下信息技术有限公司 | Content distribution IP (Internet protocol) hiding method and system based on dynamic agent chain |
| CN114143073B (en) * | 2021-11-29 | 2023-10-13 | 北京中睿天下信息技术有限公司 | Content distribution IP hiding method and system based on dynamic proxy chain |
| CN114157491A (en) * | 2021-12-02 | 2022-03-08 | 北京八分量信息科技有限公司 | Authentication method and device in heterogeneous network and related products |
| CN115277054A (en) * | 2022-06-08 | 2022-11-01 | 北京邮电大学 | Directory service method and system in anonymous network |
| CN115277054B (en) * | 2022-06-08 | 2023-11-10 | 北京邮电大学 | Directory service method and system in anonymous network |
| CN115314491A (en) * | 2022-06-14 | 2022-11-08 | 北京邮电大学 | Directory service method and system of directory server cluster based on distributed structure |
| CN115314491B (en) * | 2022-06-14 | 2023-10-20 | 北京邮电大学 | Directory service method and system for directory server cluster based on distributed structure |
| CN115941269A (en) * | 2022-11-04 | 2023-04-07 | 西安电子科技大学 | Method for realizing receiver anonymity based on cMix anonymous network |
| CN115941269B (en) * | 2022-11-04 | 2024-03-12 | 西安电子科技大学 | Method for realizing receiver anonymity based on cMix anonymity network |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112468517B (en) | 2021-05-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112468517B (en) | Tracing-resistant anonymous communication network access method, system and device | |
| Eskandarian et al. | Express: Lowering the cost of metadata-hiding communication with cryptographic privacy | |
| Ranchal et al. | Protection of identity information in cloud computing without trusted third party | |
| Fotiou et al. | Access control enforcement delegation for information-centric networking architectures | |
| US20160294794A1 (en) | Security System For Data Communications Including Key Management And Privacy | |
| CN114172735A (en) | Double-chain mixed block chain data sharing method and system based on intelligent contract | |
| KR20190069759A (en) | Method for managing and distributing content cryptographic keys in blockchain | |
| Yan et al. | Integrity audit of shared cloud data with identity tracking | |
| WO2022206453A1 (en) | Method and apparatus for providing cross-chain private data | |
| CN109040134A (en) | A kind of design method and relevant apparatus of information encryption | |
| Tu et al. | A secure, efficient and verifiable multimedia data sharing scheme in fog networking system | |
| Kfoury et al. | Secure End-to-End VoIP System Based on Ethereum Blockchain. | |
| Jia et al. | {OblivP2P}: An Oblivious {Peer-to-Peer} Content Sharing System | |
| Yadav et al. | Automatic detection of fake key attacks in secure messaging | |
| CN108573071A (en) | A kind of file operation method and relevant apparatus | |
| CN111538740A (en) | Information disclosure method and device | |
| CN105518696A (en) | Performing an operation on a data storage | |
| CN105187379A (en) | Multi-party distrust-based password split managing method | |
| Idrissi et al. | Agent-based blockchain model for robust authentication and authorization in IoT-based healthcare systems | |
| AbdulKader et al. | A privacy-preserving data transfer in a blockchain-based commercial real estate platform using random address generation mechanism | |
| Bhattacharya et al. | Cryptanalysis of a centralized location-sharing scheme for mobile online social networks | |
| Jacobino et al. | TrustVault: A privacy-first data wallet for the European Blockchain Services Infrastructure | |
| JP2005167968A (en) | Anonymous communication method | |
| Al‐Tariq et al. | A scalable framework for protecting user identity and access pattern in untrusted Web server using forward secrecy, public key encryption and bloom filter | |
| JP2020155801A (en) | Information management system and method therefor |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CB03 | Change of inventor or designer information | ||
| CB03 | Change of inventor or designer information |
Inventor after: Hu Ning Inventor after: Cheng Xinda Inventor after: Zhang Chi Inventor after: Zhao Yan Inventor before: Hu Ning Inventor before: Cheng Xinda Inventor before: Zhang Chi Inventor before: Zhao Yan |