CN112738064A

CN112738064A - Method for improving security of SSH protocol based on SM2 and SM4 cryptographic algorithm

Info

Publication number: CN112738064A
Application number: CN202011559517.6A
Authority: CN
Inventors: 单酉; 冀天宇
Original assignee: Beijing Casicloud Co ltd
Current assignee: Beijing Casicloud Co ltd
Priority date: 2020-12-25
Filing date: 2020-12-25
Publication date: 2021-04-30

Abstract

The invention relates to the technical field of networks, in particular to a method for improving the security of an SSH protocol based on SM2 and SM4 cryptographic algorithm; the symmetric encryption algorithm and the asymmetric encryption algorithm in the SSH protocol are replaced by the SM2 and the SM4, so that the safety of the SSH protocol in a secret-related network is improved, and the safety risk of the SSH protocol in the secret-related network is avoided; the method comprises the following steps: in the SSH connection process, the algorithm of key authentication is replaced by SM2 national cipher algorithm, and in the client-server communication stage, the symmetric encryption algorithm is replaced by SM4 national cipher algorithm, so that the SSH protocol supporting the national cipher algorithm is realized.

Description

Method for improving security of SSH protocol based on SM2 and SM4 cryptographic algorithm

Technical Field

The invention relates to the technical field of networks, in particular to a method for improving the security of an SSH protocol based on SM2 and SM4 cryptographic algorithms.

Background

Secure Shell (SSH) is an encrypted network transport protocol, and can provide a Secure transport environment for network services in an insecure network. As shown in fig. 1, a diagram of the SSH connection process is shown. SSH enables a connection between an SSH client and a server by creating a secure tunnel in the network. The most common use of SSH is for telnet systems, where people typically use SSH to transport command line interfaces and execute commands remotely. The most frequently used cases of SSH are Unix-like systems, but Windows operating systems can also use SSH to a limited extent. In 2015, microsoft announced that native SSH protocol support will be provided in future operating systems, and Windows 101803 version has provided the OpenSSH tool.

SSH implements authentication with asymmetric encryption. There are a number of ways of identity verification, for example one of them is simply to encrypt the network connection using an automatically generated public-private key pair, followed by login using password authentication; another method is to manually generate a pair of a public key and a private key, and authenticate through the generated key, so that login can be performed without inputting a password. Anyone can generate the key by himself. The public key needs to be placed in the computer to be accessed, and the corresponding private key needs to be kept by the user. The authentication process is based on the generated private key, but the private key is not transmitted to the network in the whole authentication process.

There are two major versions of the SSH protocol, SSH-1 and SSH-2, respectively. Regardless of the version, it is important to verify the unknown key source, because SSH only verifies that the providing user has the private key that matches the public key, and the key matching server will grant permission once the public key is accepted. Thus, once the public key of a malicious attacker is accepted, the system will also treat the attacker as a legitimate user.

In Unix-like systems, the public key of the licensed login is typically kept in the-/. SSH/authorized _ keys file of the user/home directory, which is used only by SSH. When the remote machine holds the public key and the corresponding private key locally, the login process no longer requires manual entry of a password. In addition, the private key itself can be cryptographically protected for additional security. SSH requires that private key files cannot be accessed by multiple users, which should modify file authority 0600 on Linux; and modifying file rights on Windows, deleting the Inheritance rights, and then granting the unique Full control right to the user. The private key may be stored in a fixed location or may be specified by a command line parameter (e.g., the "-i" option of ssh command). ssh-keygen is one of the tools to generate keys. SSH also supports password-based authentication, where keys are automatically generated. If the client and the server never perform identity authentication and the SSH does not record the key used by the server, the attacker can simulate the server to request and obtain the password, i.e. man-in-the-middle attack. But cryptographic authentication can be disabled and the SSH client will alert the user when a new key or unknown server is discovered.

The classic use of SSH is to log into a remote computer to execute commands. SSH also supports tunneling protocols, port mapping, and X11 connections, among other things. SSH can also transmit files by means of SFTP or SCP protocols. SSH uses a client-server model with a standard port of 22. The server needs to open an SSH daemon to accept the connection from the remote end, and the user needs to create a connection with it using an SSH client. Most modern operating systems (including macOS, most Linux, OpenBSD, FreeBSD, Solaris, etc. systems) provide SSH, including Windows systems, as well as SSH programs (after Windows 101809 version). At the software level, many proprietary software, free software and open source software for SSH are developed, such as: file management software (synchronization, copy, delete, etc.). Such as: WinSCP under PuTTY and Windows, Konquerr under Unix-like system, and the like. From the perspective of cloud computing, SSH can prevent some security problems caused by direct exposure to the internet, and plays an important role in solving connection problems. The SSH tunnel may provide a secure channel between the internet, a firewall, and a virtual machine.

SSH is a replacement for Telnet and non-secure shells in design. Protocols such as Telnet and Berkeley rlogin, rsh, rexec and the like adopt plaintext transmission, use unreliable passwords and are easy to be monitored, sniffed and attacked by a man-in-the-middle. SSH is intended to ensure that information encryption is complete and reliable in an unsecure network environment (e.g., the internet).

The cryptographic algorithm is a core technology for guaranteeing information security, and particularly the most critical banking core field continues to use the international universal cryptographic algorithm systems such as 3DES, SHA-1, RSA, AES and the like and relevant standards for a long time. In the end of 2010, the national cryptology administration publishes an elliptic curve public key cryptographic algorithm (SM2 algorithm) which is independently developed in China. In order to ensure the password application safety of an important economic system, the national password administration publishes 'notice about the completion of public key password algorithm upgrading work' in 2011, and requires that a public key password infrastructure electronic authentication system and a key management system are built and proposed to use a national password algorithm from 3 months and 1 day in 2011. Since 7/1/2011, an SM2 algorithm should be used to launch an information system that uses public key cryptography.

Disclosure of Invention

In order to solve the technical problems, the invention provides a method for improving the security of an SSH protocol based on SM2 and SM4 cryptographic algorithms, which uses the SM2 and SM4 cryptographic algorithms to replace symmetric encryption and asymmetric encryption algorithms in the SSH protocol, improves the security of the SSH protocol in a secret-related network, and avoids the security risk of the SSH protocol in the secret-related network.

The invention discloses a method for improving the security of an SSH protocol based on SM2 and SM4 cryptographic algorithms, which comprises the following steps: in the SSH connection process, the algorithm of key authentication is replaced by SM2 national cipher algorithm, and in the client-server communication stage, the symmetric encryption algorithm is replaced by SM4 national cipher algorithm, so that the SSH protocol supporting the national cipher algorithm is realized.

The invention discloses a method for improving security of an SSH protocol based on SM2 and SM4 cryptographic algorithms, which comprises the following steps:

s1, taking the golang official code as a project root directory;

s2, creating folders SM2 and SM4 in the project root directory, and copying the contents in the folders SM2 and SM4 of the code library into the newly created folders SM2 and SM4 respectively;

s3, modifying ssh/cipher. go file, adding function newSM4CTR (key, iv [ ] byte) (cipher. stream, error) to create SM4 algorithm object; adding an object of 'sm 4128-ctr' in the nepherModes array to provide other method calls;

(S4) modifying a ssh/common. go file, a supported graphs array and an added object 'sm 4128-ctr' in a preferredcontacts array, wherein the added object is used for providing other method calls;

s5, modifying ssh/server. go files, modifying isanceppetablealgo functions, and adding KeyAlgoSM2P256 and KeyAlgoSM4P256 objects;

s6, modifying the ssh/agent/client file, adding a sm2KeyMsg structural body and a sm2CertMsg structural body, and realizing the serialization and deserialization methods of the algorithm, such as parseSM2Key, parseSM2Cert and unmarshalSM 2.

Compared with the prior art, the invention has the beneficial effects that: the SH protocol only supports standard international universal encryption algorithms, such as AES, RSA and the like, which are potential threats to information security of secret-related places in China, the national encryption algorithm is a domestic commercial encryption algorithm identified by the national crypto administration and plays an important role in guaranteeing the information security, the scheme is realized by modifying the standard of an SSH protocol in the golang official code (htps:// githu. com/golang/crypto), the international encryption algorithm is replaced by the national encryption algorithm, the code can be directly compiled into a binary file, a server can easily support a large number of client connections, and the SH protocol has high performance, meanwhile, the code is developed based on golang, has good maintainability, has good support for subsequent function expansion and has excellent maintainability.

Drawings

Fig. 1 is a diagram of SHH connection process in the prior art.

Fig. 2 is a diagram of the SHH connection process of the present invention.

Detailed Description

The following detailed description of embodiments of the present invention is provided in connection with the accompanying drawings and examples. The following examples are intended to illustrate the invention but are not intended to limit the scope of the invention.

s1, taking the galang official code (https:// githu. com/galang/crypto) as a project root directory;

s2, creating folders SM2 and SM4 in the project root directory, and copying the contents in the SM2 and SM4 folders of the code library (https:// github. com/tjfoc/gmsm) into the newly created folders SM2 and SM4, respectively;

The above description is only a preferred embodiment of the present invention, and it should be noted that, for those skilled in the art, several modifications and variations can be made without departing from the technical principle of the present invention, and these modifications and variations should also be regarded as the protection scope of the present invention.

Claims

1. A method for improving SSH protocol security based on SM2 and SM4 cryptographic algorithm is characterized by comprising the following steps: in the SSH connection process, the algorithm of key authentication is replaced by SM2 national cipher algorithm, and in the client-server communication stage, the symmetric encryption algorithm is replaced by SM4 national cipher algorithm, so that the SSH protocol supporting the national cipher algorithm is realized.

2. The method for improving the security of the SSH protocol based on SM2 and SM4 cryptographic algorithms as claimed in claim 1, comprising the following steps:

s1, taking the golang official code as a project root directory;