CN112929374A - Cloud computing-based multi-factor bidirectional dynamic authentication encryption system - Google Patents
Cloud computing-based multi-factor bidirectional dynamic authentication encryption system Download PDFInfo
- Publication number
- CN112929374A CN112929374A CN202110175984.7A CN202110175984A CN112929374A CN 112929374 A CN112929374 A CN 112929374A CN 202110175984 A CN202110175984 A CN 202110175984A CN 112929374 A CN112929374 A CN 112929374A
- Authority
- CN
- China
- Prior art keywords
- client
- tgs
- server
- module
- service module
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 230000002457 bidirectional effect Effects 0.000 title claims abstract description 18
- 238000000034 method Methods 0.000 claims abstract description 17
- 238000004891 communication Methods 0.000 claims description 15
- 238000005516 engineering process Methods 0.000 claims description 5
- 238000012795 verification Methods 0.000 claims description 5
- 230000005540 biological transmission Effects 0.000 description 3
- 238000005336 cracking Methods 0.000 description 3
- 238000011161 development Methods 0.000 description 3
- 238000010586 diagram Methods 0.000 description 3
- 238000012423 maintenance Methods 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000012946 outsourcing Methods 0.000 description 1
- 230000000149 penetrating effect Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/068—Network architectures or network communication protocols for network security for supporting key management in a packet data network using time-dependent keys, e.g. periodically changing keys
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Storage Device Security (AREA)
Abstract
The invention discloses a cloud computing-based multi-factor bidirectional dynamic authentication encryption system, which comprises an encryption system main body; the encryption system comprises a client module, a server module, an AS authentication service module, a KDC bill management service module and a relational database storage module; the relational database storage module is respectively connected with the AS authentication service module and the KDC bill management service module; the AS authentication service module, the KDC bill management service module, the client module and the server module are connected with each other; the invention uses temporary bill to encrypt and decrypt data, the real key is not transmitted on the network, even if the bill is stolen on the network, the bill can not be decrypted in short time due to the use of asymmetric encryption algorithm and the characteristics of the bill such as specific timeliness and the like, even if the data encrypted by the current bill is decrypted, the bill is invalid; the invention simplifies the use method of the authentication encryption system and improves the safety.
Description
Technical Field
The invention relates to the field of cloud computing data communication security, in particular to a cloud computing-based multi-factor bidirectional dynamic authentication encryption system.
Background
With the continuous development of information technology, cloud computing becomes a new computing mode following distributed computing, parallel computing, grid computing and the like, can provide services such as resource renting, service outsourcing, application hosting and the like for users, quickly becomes a hotspot of information technology development due to the advantages of simplicity, convenience, economy, easy expandability and the like, but brings convenience to users and simultaneously brings great challenges to the safety and maintenance of user information safety assets.
In the cloud computing virtual environment, a plurality of virtual machines exist in a physical server, each virtual machine bears different service systems, and different service scenes are dynamic complex service scenes, so that the requirement on safe transmission of data services during centralized operation and maintenance is very high.
Disclosure of Invention
The technical problem to be solved by the invention is to provide a cloud computing-based multi-factor bidirectional dynamic authentication encryption system, fingerprint information of a client and a server is collected and reported to a cloud system after the client and the server are installed, the client is ensured to comprise a PC (personal computer) end android mobile phone end IOS (internet of things) mobile phone end, a windows server end and a Linux server end are unique in a global system, and a program can log in and register in a cloud server message system after being started. And the long link exists in a WebScoket mode, and the client and the server are verified through the AS authentication service module. Then, a KDC distributes a self and temporary bill to a client and a server respectively, the bill has timeliness, when the bill is due, the cloud server notifies the client and the server to update a new bill, when the client manages and operates the server, the distributed bill is used for carrying out data asymmetric encryption, and after the server receives the data, the server decrypts the data by using the distributed temporary bill, so as to realize timely arrangement and adjustment according to the business dynamic, thereby realizing that the cloud computing adapts and adjusts the dynamic configuration under the dynamic complex business environment to meet the business reliability stability, solving the problem of data communication encryption under a virtual machine under the centralized management cloud computing environment, improving the safety of the management system and the communication system, solving the insecurity caused by a simple encryption method, mainly using multi-factor bidirectional authentication, dynamic key bill updating and effective use timeliness of each bill, and the difficulty of cracking is improved by using an asymmetric encryption algorithm.
The cloud computing-based multi-factor bidirectional dynamic authentication encryption system is realized by the following technical scheme: comprises an encryption system main body; the encryption system comprises a client module, a server module, an AS authentication service module, a KDC bill management service module and a relational database storage module;
the relational database storage module is respectively connected with the AS authentication service module and the KDC bill management service module; the AS authentication service module, the KDC bill management service module, the client module and the server module are connected with each other;
the client module is used for authenticating login to the AS authentication service module, ensuring that a user is unique in the system by reporting fingerprint information of the user, distributing bills by the KDC bill management service module, and subsequently encrypting and decrypting data communication between the bills distributed by the KDC bill management service module and the server side;
the server side module is used for authenticating login to the AS authentication service module, reporting fingerprint information of the server to ensure that a user is unique in the system, distributing bills by the KDC bill management service module, and subsequently encrypting and decrypting data communication between the bills distributed by the KDC bill management service module and the client side;
the AS authentication service module is used for authenticating the login of the client and the server and confirming the identity;
the KDC bill management service module is used for distributing bills to the client and the server, managing the life cycle of the bills and informing the client and the server to update the bills;
and the relational database storage module is used for storing the bill data and the identity information of the client and the server.
As a preferred technical scheme, the client module comprises a PC end, an Android end and an IOS end; the server side module comprises a Windows side and a Linux side.
As a preferred technical scheme, the encryption system main body adopts a distributed micro-servitization module to deploy application.
As a preferred technical scheme, the correctness of the authentication ticket set in the KDC ticket management service module is based on network clock synchronization.
As a preferred technical scheme, a kerberos timestamp in the distributed microservices module is replaced by a synchronization variable N; kerberos employs public key technology; a fixed Master Key is used to simplify the service Key.
The cloud computing-based multi-factor bidirectional dynamic authentication encryption method is realized by the following technical scheme:
the method comprises the following steps: the client login is authenticated through AS login, namely a user mailbox + TGS name + user password md5 encrypts (timestamp) -KRB _ AS _ REQ;
step two: after receiving the request, the AS finds the Master Key of the client through the mailbox provided by the user and finds the TGS Master Key through the TGS name;
step three: the AS generates a random encryption key Kc-Tgs (client and TGS communication authentication dynamic key);
step four: encrypting Kc-Tgs by using a Client Master Key and encrypting Kc-Tgs by using a TGS Master Key respectively;
step five: the first share is Tgs _ principal and timestamp + Kc-Tgs encrypted using Client Master Key (Tc, Tgs);
step six: secondly, encrypting the client _ private and the timestamp + Kc-Tgs by using TGS Master Key (Ttgs, c) - -KRB _ AS _ REP;
step seven: after receiving the data, the client decrypts Tc by using the Master Key of the client, and Tgs obtains Kc-Tgs + Tgs _ principal + timestamp;
step eight: the client side verifies whether the request is sent by the tgs server;
step nine: obtaining a Kc-Tgs random key after verification;
step ten: the decrypted ticket is stored (the ticket is used to apply for accessing service to the TGS within the subsequent validity period);
step eleven: the client generates an authentication factor Authenticator (timestamp + client _ private + c _ check _ sum signature);
step twelve: encrypting the Authenticator using the random key Kc-Tgs;
step thirteen: sending the encrypted Authenticator + Ttgs, c + Server _ primary + timestamp to TGS-KRB _ TGS _ REQ;
fourteen steps: the TGS decrypts the Ttgs, c to obtain Kc, TGS by using the Master Key of the TGS after receiving the request, and decrypts the Authenticator by using the Kc, TGS;
step fifteen: the information sent by the client is authenticated, and the guarantee request is sent by the client;
sixthly, the steps are as follows: then TGS generates a session key Kc, s of the client and the server;
seventeen steps: copying the session key by two parts;
eighteen steps: the first encrypts Tc, s by using the session key Kc, s, the server _ private and the timestamp between Kc and tgs; the second part encrypts the Kc, s session key, the client _ private and the timestamp by using a server Master key;
nineteen steps: TGS responds the two bills to client-KRB _ TGS _ REP;
twenty steps: after the client receives the two bills, the client uses Kc, tgs to solve Tc, s to obtain Kc, s
Twenty one: then generating an authentication factor Authenticator (timeStamp + Ts, c _ checkSum);
step twenty-two: encrypting the Authenticator using the obtained Kc, s;
twenty-three steps: finally, the Authenticator and the obtained second Ts, c are sent to the Server-KRB _ AP _ REQ;
twenty-four steps: the server decrypts Ts, c to obtain Kc, s by using the Master Key of the server after receiving the request;
twenty-five steps: then, decrypting the content acquired by the Authenticator by using Kc, s;
twenty-six steps: the data content is read after the client is authenticated;
twenty-seven steps: the data acquired after the authentication is finished is responded to the client-KRB _ AP _ REP by using the Kc, s + timestamp;
twenty-eight steps: after receiving the message, the client can normally communicate with the server.
The invention has the beneficial effects that: the fingerprint information collection of the client and the server is reported to a cloud system after the client and the server are installed, the client is guaranteed to comprise a PC (personal computer) android mobile phone IOS (internet of things) mobile phone end, and a windows server and a Linux server are unique in a global system, and a program can log in and register in a cloud server message system after being started. And the long link exists in a WebScoket mode, and the client and the server are verified through the AS authentication service module. Then, a KDC distributes a self and temporary bill to a client and a server respectively, the bill has timeliness, when the bill is due, the cloud server notifies the client and the server to update a new bill, when the client manages and operates the server, the distributed bill is used for carrying out data asymmetric encryption, and after the server receives the data, the server decrypts the data by using the distributed temporary bill, so as to realize timely arrangement and adjustment according to the business dynamic, thereby realizing that the cloud computing adapts and adjusts the dynamic configuration under the dynamic complex business environment to meet the business reliability stability, solving the problem of data communication encryption under a virtual machine under the centralized management cloud computing environment, improving the safety of the management system and the communication system, solving the insecurity caused by a simple encryption method, mainly using multi-factor bidirectional authentication, dynamic key bill updating and effective use timeliness of each bill, and the difficulty of cracking is improved by using an asymmetric encryption algorithm; the use method and the improved safety are simplified, the data safety is increased for cloud computing management, the user reliability is improved, and the cloud computing development is promoted better.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.
Fig. 1 is a schematic structural diagram of a cloud computing-based multi-factor bidirectional dynamic authentication encryption system according to an embodiment of the present invention;
FIG. 2 is a flow chart illustrating steps of a general encryption system according to an embodiment of the present invention;
FIG. 3 is a flow chart of a general encryption system according to an embodiment of the present invention;
FIG. 4 is a flowchart of an authentication service of the disassembled steps provided by the present invention;
FIG. 5 is a timing diagram of a ticket distribution service according to the second embodiment of the present invention;
FIG. 6 is a timing diagram of key exchange in step three after the key exchange is disassembled according to the embodiment of the present invention.
Detailed Description
All of the features disclosed in this specification, or all of the steps in any method or process so disclosed, may be combined in any combination, except combinations of features and/or steps that are mutually exclusive.
Any feature disclosed in this specification (including any accompanying claims, abstract and drawings), may be replaced by alternative features serving equivalent or similar purposes, unless expressly stated otherwise. That is, unless expressly stated otherwise, each feature is only an example of a generic series of equivalent or similar features.
In the description of the present invention, it is to be understood that the terms "one end", "the other end", "outside", "upper", "inside", "horizontal", "coaxial", "central", "end", "length", "outer end", and the like, indicate orientations or positional relationships based on those shown in the drawings, and are used only for convenience in describing the present invention and for simplicity in description, and do not indicate or imply that the device or element being referred to must have a particular orientation, be constructed in a particular orientation, and be operated, and thus, should not be construed as limiting the present invention.
Further, in the description of the present invention, "a plurality" means at least two, e.g., two, three, etc., unless specifically limited otherwise.
The use of terms such as "upper," "above," "lower," "below," and the like in describing relative spatial positions herein is for the purpose of facilitating description to describe one element or feature's relationship to another element or feature as illustrated in the figures. The spatially relative positional terms may be intended to encompass different orientations of the device in use or operation in addition to the orientation depicted in the figures. For example, if the device in the figures is turned over, elements described as "below" or "beneath" other elements or features would then be oriented "above" the other elements or features. Thus, the exemplary term "below" can encompass both an orientation of above and below. The device may be otherwise oriented (rotated 90 degrees or at other orientations) and the spatially relative descriptors used herein interpreted accordingly.
In the present invention, unless otherwise explicitly specified or limited, the terms "disposed," "sleeved," "connected," "penetrating," "plugged," and the like are to be construed broadly, e.g., as a fixed connection, a detachable connection, or an integral part; can be mechanically or electrically connected; they may be directly connected or indirectly connected through intervening media, or they may be connected internally or in any other suitable relationship, unless expressly stated otherwise. The specific meanings of the above terms in the present invention can be understood by those skilled in the art according to specific situations.
As shown in fig. 1, the cloud computing-based multi-factor bidirectional dynamic authentication encryption system of the present invention includes an encryption system main body; the encryption system comprises a client module 1, a server module 2, an AS authentication service module 3, a KDC bill management service module 4 and a relational database storage module 5;
the relational database storage module 5 is respectively connected with the AS authentication service module 3 and the KDC bill management service module 4; the AS authentication service module 3, the KDC bill management service module 4, the client module 1 and the server module 2 are connected with each other;
the client module 1 is used for authenticating login to the AS authentication service module 3, ensuring that a user is unique in the system by reporting fingerprint information of the user, distributing bills by the KDC bill management service module 4, and subsequently performing data communication encryption and decryption with the server by using the bills distributed by the KDC bill management service module 4;
the server module 2 is used for authenticating login to the AS authentication service module 3, reporting fingerprint information of a server to ensure that a user is unique in the system, distributing bills by the KDC bill management service module 4, and subsequently performing data communication encryption and decryption with the client by using the bills distributed by the KDC bill management service module 4;
the AS authentication service module 3 is used for authenticating the login of the client and the server and confirming the identity;
the KDC bill management service module 4 is used for distributing bills to the client and the server, managing the life cycle of the bills and informing the client and the server to update the bills;
and the relational database storage module 5 is used for storing the bill data and the identity information of the client and the server.
In this embodiment, the client module 1 includes a PC end, an Android end, and an IOS end; the server module 2 comprises a Windows end and a Linux end.
In this embodiment, the encryption system main body adopts a distributed microservices module to deploy and apply.
In the embodiment, the kerberos timestamp in the distributed microservices module is replaced by a synchronization variable N; kerberos employs public key technology; a fixed Master Key is used to simplify the service Key.
In this embodiment, the correctness of the authentication ticket set in the KDC ticket management service module 4 is based on network clock synchronization.
As shown in fig. 2 to 6, the cloud computing-based multi-factor bidirectional dynamic authentication encryption method of the present invention includes the following steps:
the method comprises the following steps: the client login is authenticated through AS login, namely a user mailbox + TGS name + user password md5 encrypts (timestamp) -KRB _ AS _ REQ;
step two: after receiving the request, the AS finds the Master Key of the client through the mailbox provided by the user and finds the TGS Master Key through the TGS name;
step three: the AS generates a random encryption key Kc-Tgs (client and TGS communication authentication dynamic key);
step four: encrypting Kc-Tgs by using a Client Master Key and encrypting Kc-Tgs by using a TGS Master Key respectively;
step five: the first share is Tgs _ principal and timestamp + Kc-Tgs encrypted using Client Master Key (Tc, Tgs);
step six: secondly, encrypting the client _ private and the timestamp + Kc-Tgs by using TGS Master Key (Ttgs, c) - -KRB _ AS _ REP;
step seven: after receiving the data, the client decrypts Tc by using the Master Key of the client, and Tgs obtains Kc-Tgs + Tgs _ principal + timestamp;
step eight: the client side verifies whether the request is sent by the tgs server;
step nine: obtaining a Kc-Tgs random key after verification;
step ten: the decrypted ticket is stored (the ticket is used to apply for accessing service to the TGS within the subsequent validity period);
step eleven: the client generates an authentication factor Authenticator (timestamp + client _ private + c _ check _ sum signature);
step twelve: encrypting the Authenticator using the random key Kc-Tgs;
step thirteen: sending the encrypted Authenticator + Ttgs, c + Server _ primary + timestamp to TGS-KRB _ TGS _ REQ;
fourteen steps: the TGS decrypts the Ttgs, c to obtain Kc, TGS by using the Master Key of the TGS after receiving the request, and decrypts the Authenticator by using the Kc, TGS;
step fifteen: the information sent by the client is authenticated, and the guarantee request is sent by the client;
sixthly, the steps are as follows: then TGS generates a session key Kc, s of the client and the server;
seventeen steps: copying the session key by two parts;
eighteen steps: the first encrypts Tc, s by using the session key Kc, s, the server _ private and the timestamp between Kc and tgs; the second part encrypts the Kc, s session key, the client _ private and the timestamp by using a server Master key;
nineteen steps: TGS responds the two bills to client-KRB _ TGS _ REP;
twenty steps: after the client receives the two bills, the client uses Kc, tgs to solve Tc, s to obtain Kc, s
Twenty one: then generating an authentication factor Authenticator (timeStamp + Ts, c _ checkSum);
step twenty-two: encrypting the Authenticator using the obtained Kc, s;
twenty-three steps: finally, the Authenticator and the obtained second Ts, c are sent to the Server-KRB _ AP _ REQ;
twenty-four steps: the server decrypts Ts, c to obtain Kc, s by using the Master Key of the server after receiving the request;
twenty-five steps: then, decrypting the content acquired by the Authenticator by using Kc, s;
twenty-six steps: the data content is read after the client is authenticated;
twenty-seven steps: the data acquired after the authentication is finished is responded to the client-KRB _ AP _ REP by using the Kc, s + timestamp;
twenty-eight steps: after receiving the message, the client can normally communicate with the server.
In this embodiment, the flow of steps optimizes the following points:
1. issuing bills to realize authority centralized management;
2. a public Key mechanism is adopted, the user identity is contained in the certificate, and the Master Key is prevented from being lost;
3. thirdly, utilizing the signature to ensure that the authenticity and integrity of the message source cannot be repudiated;
4. the public key of the receiver is encrypted, so that only the receiver can unlock the data, and meanwhile, the integrity and confidentiality of the data are ensured;
5. using a synchronization variable N to prevent replay data attacks;
6. the method adopts the bill life parameter, does not need to request the Agent every time of logging, and can repeatedly use the bill in the life.
In this embodiment, the protocol flow optimizes the following points:
1. the bill request (Ticket _ req) C- > Agent C, S, N, CERTc;
2. ticket issuing (Ticket _ rep) Agent- > C: Ts, ((Kcs, N) SIGNA) ENCPubc
Ts＝((C,S,Kcs,N,lifetime)SIGNA)ENCpubs；
3. Service request (S _ req) C- > S: Ts, (N, ra, seq, option) Kcs;
4. server identity authentication (S _ rep) S- > C (ra) Kcs (optional-whether two-way verification is decided by option);
in this embodiment, the message transmission communication protocol Websocket Connect Header is defined as shown in the following table:
the invention is explained in further detail:
the method comprises the following steps: the Client uses md5 (past) Master Key (timestamp) + Client _ primary + tgs _ primary to send to AS authentication server (KRB _ AS _ REQ);
step two: the AS authentication server receives the KRB _ AS _ REQ, finds the Client Master Key through db, decrypts the data to obtain a timestamp to prove that the password provided by the Client is correct;
step three: the AS generates a session password (kc, tgs);
the method comprises the following steps: the AS respectively acquires Client Master Key and TGS Master Key from DB to encrypt kc, TGS;
step four: the first one encrypts kc, tgs and tgs _ principal and timestamp using Client Master Key (md5 (passswd));
step five: the second share encrypts kc, TGS and client _ principal and timestamp using TGS Master Key (kdc);
step six: responding to the client (KRB _ AS _ REP);
step seven: the client decrypts Tc by using the Master Key of the client, tgs to obtain Kc, tgs;
step eight: the client encrypts by using time _ stamp and checksum and using Kc, tgs to obtain an Authenticator;
step nine: the client sends a request (KRB _ TGS _ REQ) Authenticator + Ttgs, c obtained from AS and the name of the server to be accessed (Authenticator and Ttgs, c are used to prove its identity);
step ten: after receiving the request, the TGS decrypts the Ttgs, c by using the Master Key of the TGS to obtain Kc, TGS;
step eleven: the Authenticator decrypts the authentication to the client by using Kc, tgs;
step twelve: TGS generates a session key Kc, s and copies two times at the same time;
step thirteen: the first to the client is encrypted using Kc, tgs;
fourteen steps: secondly, encrypting the client by using a Server Master Key;
step fifteen: responding to the client (KRB _ TGS _ REP);
sixthly, the steps are as follows: after receiving the bill, the client uses Kc, tgs to solve Tc, s to obtain Kc, s;
seventeen steps: generating an Authenticator;
eighteen steps: then, encrypting by using Kc, s to generate the Authenticator;
nineteen steps: the client sends the generated Authenticator and Ts, c obtained from TGS to Server (KRB _ AP _ REQ);
twenty steps: after receiving the request, the server decrypts Ts, c to obtain Kc, s and then decrypts the Authenticator by using Kc, s to authenticate the client;
twenty one: the server can also return the encrypted current timestamp using Kc, s to the client;
step twenty-two: client verifies the data that the server sends- -two-way verification;
twenty-three steps: finally the server responds to the client (KRB _ AP _ REP).
The invention uses temporary bill to encrypt and decrypt data; the real key is not transmitted on the network, even if the bill is stolen on the network by people, the bill has the characteristics of time effectiveness and the like due to the use of an asymmetric encryption algorithm. Cracking cannot be performed in a short time. Even if the encrypted data of the current ticket is cracked, the ticket is already invalid. It can not be used for a long time. The method mainly solves the problem of data transmission leakage caused by symmetric encryption key loopholes and the problem of data loss caused by private key leakage under an asymmetric encryption method.
The above description is only an embodiment of the present invention, but the scope of the present invention is not limited thereto, and any changes or substitutions that are not thought of through the inventive work should be included in the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope defined by the claims.
Claims (6)
1. A cloud computing based multi-factor bidirectional dynamic authentication encryption system is characterized in that: comprises an encryption system main body; the encryption system comprises a client module (1), a server module (2), an AS authentication service module (3), a KDC bill management service module (4) and a relational database storage module (5);
the relational database storage module (5) is respectively connected with the AS authentication service module (3) and the KDC bill management service module (4); the AS authentication service module (3), the KDC bill management service module (4), the client module (1) and the server module (2) are connected with each other;
the client module (1) is used for authenticating login to the AS authentication service module (3), ensuring that a user is unique in the system by reporting fingerprint information of the user, distributing bills by the KDC bill management service module (4), and subsequently performing data communication encryption and decryption on the bills distributed by the KDC bill management service module (4) and the server;
the server side module (2) is used for authenticating login to the AS authentication service module (3), reporting fingerprint information of a server to ensure that a user is unique in the system, distributing bills by the KDC bill management service module (4), and subsequently performing data communication encryption and decryption by using the bills distributed by the KDC bill management service module (4) and a client;
the AS authentication service module (3) is used for authenticating the login of a client and a server and confirming the identity;
the KDC bill management service module (4) is used for distributing bills to the client and the server, managing the life cycle of the bills and informing the client and the server to update the bills;
and the relational database storage module (5) is used for storing the bill data and the identity information of the client and the server.
2. The cloud computing-based multi-factor bidirectional dynamic authentication encryption system according to claim 1, wherein: the client module (1) comprises a PC end, an Android end and an IOS end; the server side module (2) comprises a Windows side and a Linux side.
3. The cloud computing-based multi-factor bidirectional dynamic authentication encryption system according to claim 1, wherein: the encryption system main body adopts a distributed micro-service module to deploy application.
4. The cloud-computing-based multi-factor bidirectional dynamic authentication encryption system according to claim 3, wherein: replacing a kerberos timestamp by a synchronization variable N by a kerberos in the distributed microservices module; the kerberos adopts a public key technology; a fixed Master Key is used to simplify the service Key.
5. The cloud-computing-based multi-factor bidirectional dynamic authentication encryption system according to claim 3, wherein: the correctness of the authentication bill arranged in the KDC bill management service module (4) is based on network clock synchronization.
6. A cloud computing-based multi-factor bidirectional dynamic authentication encryption method is characterized by comprising the following steps:
the method comprises the following steps: the client login is authenticated through AS login, namely a user mailbox + TGS name + user password md5 encrypts (timestamp) -KRB _ AS _ REQ;
step two: after receiving the request, the AS finds the Master Key of the client through the mailbox provided by the user and finds the TGS Master Key through the TGS name;
step three: the AS generates a random encryption key Kc-Tgs (client and TGS communication authentication dynamic key);
step four: encrypting Kc-Tgs by using a Client Master Key and encrypting Kc-Tgs by using a TGS Master Key respectively;
step five: the first share is Tgs _ principal and timestamp + Kc-Tgs encrypted using Client Master Key (Tc, Tgs);
step six: secondly, encrypting the client _ private and the timestamp + Kc-Tgs by using TGS Master Key (Ttgs, c) - -KRB _ AS _ REP;
step seven: after receiving the data, the client decrypts Tc by using the Master Key of the client, and Tgs obtains Kc-Tgs + Tgs _ principal + timestamp;
step eight: the client side verifies whether the request is sent by the tgs server;
step nine: obtaining a Kc-Tgs random key after verification;
step ten: the decrypted ticket is stored (the ticket is used to apply for accessing service to the TGS within the subsequent validity period);
step eleven: the client generates an authentication factor Authenticator (timestamp + client _ private + c _ check _ sum signature);
step twelve: encrypting the Authenticator using the random key Kc-Tgs;
step thirteen: sending the encrypted Authenticator + Ttgs, c + Server _ primary + timestamp to TGS-KRB _ TGS _ REQ;
fourteen steps: the TGS decrypts the Ttgs, c to obtain Kc, TGS by using the Master Key of the TGS after receiving the request, and decrypts the Authenticator by using the Kc, TGS;
step fifteen: the information sent by the client is authenticated, and the guarantee request is sent by the client;
sixthly, the steps are as follows: then TGS generates a session key Kc, s of the client and the server;
seventeen steps: copying the session key by two parts;
eighteen steps: the first encrypts Tc, s by using the session key Kc, s, the server _ private and the timestamp between Kc and tgs; the second part encrypts the Kc, s session key, the client _ private and the timestamp by using a server Master key;
nineteen steps: TGS responds the two bills to client-KRB _ TGS _ REP;
twenty steps: after the client receives the two bills, the client uses Kc, tgs to solve Tc, s to obtain Kc, s
Twenty one: then generating an authentication factor Authenticator (timeStamp + Ts, c _ checkSum);
step twenty-two: encrypting the Authenticator using the obtained Kc, s;
twenty-three steps: finally, the Authenticator and the obtained second Ts, c are sent to the Server-KRB _ AP _ REQ;
twenty-four steps: the server decrypts Ts, c to obtain Kc, s by using the Master Key of the server after receiving the request;
twenty-five steps: then, decrypting the content acquired by the Authenticator by using Kc, s;
twenty-six steps: the data content is read after the client is authenticated;
twenty-seven steps: the data acquired after the authentication is finished is responded to the client-KRB _ AP _ REP by using the Kc, s + timestamp;
twenty-eight steps: after receiving the message, the client can normally communicate with the server.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110175984.7A CN112929374A (en) | 2021-02-09 | 2021-02-09 | Cloud computing-based multi-factor bidirectional dynamic authentication encryption system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110175984.7A CN112929374A (en) | 2021-02-09 | 2021-02-09 | Cloud computing-based multi-factor bidirectional dynamic authentication encryption system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN112929374A true CN112929374A (en) | 2021-06-08 |
Family
ID=76171303
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110175984.7A Pending CN112929374A (en) | 2021-02-09 | 2021-02-09 | Cloud computing-based multi-factor bidirectional dynamic authentication encryption system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112929374A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114362998A (en) * | 2021-12-02 | 2022-04-15 | 北京交通大学 | Network security protection method based on edge cloud system |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20060224891A1 (en) * | 2005-04-01 | 2006-10-05 | Microsoft Corporation | Scheme for sub-realms within an authentication protocol |
| CN108574576A (en) * | 2018-04-26 | 2018-09-25 | 中科边缘智慧信息科技（苏州）有限公司 | Across high in the clouds authentication method based on Kerberos systems |
| CN109862024A (en) * | 2019-02-27 | 2019-06-07 | 苏州浪潮智能科技有限公司 | A kind of the network authorization protocol access control method and system of cloud management system |
-
2021
- 2021-02-09 CN CN202110175984.7A patent/CN112929374A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20060224891A1 (en) * | 2005-04-01 | 2006-10-05 | Microsoft Corporation | Scheme for sub-realms within an authentication protocol |
| CN108574576A (en) * | 2018-04-26 | 2018-09-25 | 中科边缘智慧信息科技（苏州）有限公司 | Across high in the clouds authentication method based on Kerberos systems |
| CN109862024A (en) * | 2019-02-27 | 2019-06-07 | 苏州浪潮智能科技有限公司 | A kind of the network authorization protocol access control method and system of cloud management system |
Non-Patent Citations (2)
| Title |
|---|
| 范宏生等: "基于公钥密码体制的Kerberos协议的改进", 《计算机技术与发展》 * |
| 蔡雪莲: "一种基于挑战/应答技术的Kerberos协议改进", 《计算机与数字工程》 * |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114362998A (en) * | 2021-12-02 | 2022-04-15 | 北京交通大学 | Network security protection method based on edge cloud system |
| CN114362998B (en) * | 2021-12-02 | 2023-05-16 | 北京交通大学 | Network security protection method based on edge cloud system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| KR100953095B1 (en) | Super peer based peer-to-peer network system and peer authentication method therefor | |
| CN107769913B (en) | Quantum UKey-based communication method and system | |
| CN102448061B (en) | Method and system for preventing phishing attack on basis of mobile terminal | |
| CN101212293B (en) | Identity authentication method and system | |
| CN104917741B (en) | A kind of plain text document public network secure transmission system based on USBKEY | |
| WO2018095322A1 (en) | Method for issuing quantum key chip, application method, issuing platform and system | |
| KR20170139093A (en) | A method for a network access device to access a wireless network access point, a network access device, an application server, and a non-volatile computer readable storage medium | |
| TW201628369A (en) | Method, apparatus, and system for quantum key distribution | |
| CN103023920B (en) | Secure virtual machine guard method and device | |
| US10133861B2 (en) | Method for controlling access to a production system of a computer system not connected to an information system of said computer system | |
| CN102685749B (en) | Wireless safety authentication method orienting to mobile terminal | |
| CN103634265B (en) | Method, equipment and the system of safety certification | |
| CN113746632B (en) | Multi-level identity authentication method for Internet of things system | |
| CN108683501A (en) | Based on quantum communication network using timestamp as the multiple identity authorization system and method for random number | |
| CN101547095A (en) | Application service management system and management method based on digital certificate | |
| CN108566273A (en) | Identity authorization system based on quantum network | |
| CN113645195B (en) | Cloud medical record ciphertext access control system and method based on CP-ABE and SM4 | |
| CN108964897A (en) | Identity authorization system and method based on group communication | |
| CN111865609A (en) | Private cloud platform data encryption and decryption system based on state cryptographic algorithm | |
| CN108737376A (en) | A kind of double factor authentication method and system based on fingerprint and digital certificate | |
| CN111917543B (en) | User access cloud platform security access authentication system and application method thereof | |
| CN108964896A (en) | A kind of Kerberos identity authorization system and method based on group key pond | |
| Wei et al. | BAVP: Blockchain‐Based Access Verification Protocol in LEO Constellation Using IBE Keys | |
| Chattaraj et al. | HEAP: an efficient and fault-tolerant authentication and key exchange protocol for Hadoop-assisted big data platform | |
| CN101345723B (en) | Management authentication method and system of client gateway |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20210608 |
|
| RJ01 | Rejection of invention patent application after publication |