JP2021190817A - Information processing device, method, and program - Google Patents

Abstract

To prevent replay attacks while saving resources for session management.SOLUTION: An information processing device generates ticket data by encrypting session resumption information, calculates and stores a hash value of the ticket data, acquires the session resumption information by decrypting the received ticket data when receiving a session resumption request including the ticket data from a client who has received the issued ticket data, compares a hash value of the received ticket data with the stored hash value, and determines whether a session should be resumed.SELECTED DRAWING: Figure 5

Description

The present disclosure relates to communication session management techniques.

Conventionally, the session information of the TLS (Transport Layer Security) protocol processed by the relay server is written to the TLS session information database whose access is restricted by the secure OS, and the role 1 server is used for the second and subsequent user accesses. A technique has been proposed in which the TLS protocol processing is performed by omitting the handshake processing of the corresponding portion by reusing this information (see Patent Document 1).

In addition, from the start of transfer of processing from the information processing device to another information processing device, until the communication destination of the terminal accessing the processing is switched from the own device to another information processing device, the communication with the own device is started. A technique has been proposed for issuing a session ticket that can be decrypted with the key information shared between the own device and another information processing device for a new session with the terminal that accesses the process established in (Patent Document 2). reference).

Japanese Unexamined Patent Publication No. 2007-0363889 Japanese Unexamined Patent Publication No. 2020-014170

Conventionally, a method using a session ticket has been used to enable the resumption of a session once established. However, when managing the information required for session resumption (stateful), there is a problem that replay attacks can be detected but resources for information management are consumed, and all the information required for session resumption is stored. When the information required for resuming the session is not managed by including it in the session ticket (stateless), there is a problem that it is possible to save resources for information management but it is difficult to detect a replay attack.

In view of the above problems, the present disclosure aims to prevent replay attacks while conserving resources for session management.

One example of the present disclosure is a session management means for establishing a communication session with a client and a ticket generation means for generating ticket data, in which information including session restart information used for restarting the session is encrypted. A ticket generation means for generating ticket data, a hash value calculation means for calculating a hash value for identifying the ticket data, a ticket management means for storing ticket determination information including the hash value, and the ticket data. By the ticket transmitting means to be transmitted to the client, the restart request receiving means for receiving the session restart request including the ticket data from the client that has received the ticket data issuance from the information processing apparatus, and the restart request receiving means. By decoding the received ticket data, the decoding means for acquiring the information including the session restart information and the ticket data calculated by the hash value calculation means and received by the restart request receiving means are identified. By comparing the hash value for the purpose with the hash value stored by the ticket management means, a restart determination means for determining whether or not the session can be restarted based on the ticket data received by the restart request receiving means, and a restart determination means. It is an information processing device provided with.

The present disclosure can be understood as an information processing device, a system, a method executed by a computer, or a program executed by a computer. Further, the present disclosure can be grasped as if such a program is recorded on a recording medium that can be read by a computer or other device, a machine, or the like. Here, a recording medium that can be read by a computer or the like is a recording medium that can be read from a computer or the like by accumulating information such as data or programs by electrical, magnetic, optical, mechanical or chemical action. Say.

According to the present disclosure, it is possible to prevent replay attacks while conserving resources for session management.

It is a schematic diagram which shows the structure of the system which concerns on embodiment. It is a figure which shows the outline of the functional structure of the information processing apparatus which concerns on embodiment. In the embodiment, it is a figure which shows the information contained in the session ticket in the encrypted state. In the embodiment, it is a figure which shows the information which is managed by the ticket management part of the TLS apparatus. It is a flowchart and a communication sequence which show the outline of the flow of the session management process which concerns on embodiment. It is a schematic diagram which shows the structure of the system which concerns on variation.

Hereinafter, embodiments of the information processing apparatus, method, and program according to the present disclosure will be described with reference to the drawings. However, the embodiments described below are examples of the embodiments, and the information processing apparatus, method, and program according to the present disclosure are not limited to the specific configurations described below. In the implementation, a specific configuration according to the embodiment may be appropriately adopted, and various improvements and modifications may be made.

In this embodiment, an embodiment when the information processing apparatus, method and program according to the present disclosure are implemented in a server / client system will be described. However, the information processing apparatus, method, and program according to the present disclosure can be widely used for a technique for managing a communication session, and the scope of application of the present disclosure is not limited to the examples shown in the embodiments.

<System configuration>
FIG. 1 is a schematic diagram showing a configuration of a system according to the present embodiment. The system according to the present embodiment includes an information processing device 1 that can communicate with each other by being connected to a network, one or more server devices 5, and one or more client terminal devices 9. In the present embodiment, a configuration in which the information processing device 1 (hereinafter referred to as “TLS device 1”) installed between the server device 5 and the client terminal device 9 performs TLS processing will be described as an example. However, the configuration of the network and the device is not limited to the examples in the present embodiment. For example, the server device that is the communication partner of the client terminal device 9 may be provided with a function as an TLS device that performs TLS processing (see FIG. 6 of a variation described later).

The TLS device 1 includes a CPU (Central Processing Unit) 11, a ROM (Read Only Memory) 12, a RAM (Random Access Memory) 13, an EEPROM (Electrically Erasable Memory), an EEPROM (Electrically Erasable Memory), and an EEPROM (Electrically Erasable Memory). A computer including 14, a communication unit 15 such as an NIC (Network Interface Card), and the like. However, the specific hardware configuration of the TLS device 1 can be omitted, replaced, or added as appropriate depending on the embodiment. Further, the TLS device 1 is not limited to a device having a single housing. The TLS device 1 may be realized by a plurality of devices using so-called cloud or distributed computing technology.

The server device 5 is a computer for providing various services to the user. The server device 5 is a computer including a CPU, a ROM, a RAM, a storage device, a communication unit, an input device, an output device, and the like (not shown). However, the specific hardware configuration of the server device 5 can be omitted, replaced, or added as appropriate depending on the embodiment. Further, the server device 5 is not limited to a device having a single housing. The server device 5 may be realized by a plurality of devices using so-called cloud or distributed computing technology.

The client terminal device 9 is a computer used by the user. The client terminal device 9 is a computer including a CPU, a ROM, a RAM, a storage device, a communication unit, an input device, an output device, and the like (not shown). However, the specific hardware configuration of the client terminal device 9 can be omitted, replaced, or added as appropriate depending on the embodiment. Further, the client terminal device 9 is not limited to the device having a single housing. The client terminal device 9 may be realized by a plurality of devices using so-called cloud or distributed computing technology. The user uses various services provided by the server device 5 via these client terminal devices 9.

The TLS device 1 provides security by the TLS (Transport Layer Security) protocol for communication between the client terminal device 9 and the server device 5. When the TLS device 1 receives the TLS session start request from the client terminal device 9, it executes a handshake to the client terminal device 9 that is the source of the start request and establishes the TLS session. Here, in order to enable the resumption of the session once established, a method of using a session ticket (ticket data) issued from the TLS device 1 has been conventionally used. The TLS device 1 issues a session ticket (ticket data) including information necessary for resuming the session to the client terminal device 9. When requesting the restart of the session, the client terminal device 9 transmits the session ticket received from the TLS device 1 at the time of establishing the session to the TLS device 1 as it is.

Conventionally, the session ticket management method in TLS communication is stateful in which the information required for session resumption is managed by the TLS device 1, and the TLS device 1 includes all the information necessary for session resumption in the session ticket and the TLS device 1 is the client terminal. There are two types of methods, stateless, which are transmitted to the device 9 and the TLS device 1 does not manage the information.

When the conventional stateless method is used for the session ticket management method, the TLS device 1 encrypts all the information necessary for resuming the session, includes it in the session ticket, and transmits the information, and causes the client terminal device 9 to manage the information. According to this method, since the TLS device 1 does not need to manage the information necessary for resuming the session, the session ticket can be issued without consuming the memory of the TLS device 1. On the other hand, since the TLS device 1 cannot recognize that the same session ticket has been used a plurality of times, there is a possibility that the replay attack cannot be detected.

On the other hand, when the conventional stateful is used as the session ticket management method, the TLS device 1 manages the information necessary for resuming the session. Therefore, the TLS device 1 can record the use of the session ticket and can detect the replay attack. However, the information required for resuming a session is large in size, and the number of session tickets sent must be managed, which consumes a huge amount of memory.

In view of the above problems, in the system according to the present disclosure, by adopting the configuration described in the present embodiment in the session ticket management, the shortcomings of stateless and stateful are compensated for, and the memory for session management is saved. , Makes it possible to prevent replay attacks.

FIG. 2 is a diagram showing an outline of the functional configuration of the information processing device 1 (TLS device 1) according to the present embodiment. In the TLS device 1, the program recorded in the storage device 14 is read out into the RAM 13, executed by the CPU 11, and each hardware provided in the TLS device 1 is controlled, so that the session management unit 21 and the session management unit 21 can control the program. It functions as an information processing device including a ticket generation unit 22, a hash value calculation unit 23, a ticket management unit 24, a ticket transmission unit 25, a restart request reception unit 26, a decoding unit 27, and a restart determination unit 28. In this embodiment and other embodiments described later, each function included in the TLS device 1 is executed by the CPU 11 which is a general-purpose processor, but some or all of these functions are one or a plurality of dedicated processors. May be performed by.

The session management unit 21 establishes a communication session for the client terminal device 9. More specifically, when the session management unit 21 receives the TLS session start request from the client terminal device 9, the session management unit 21 executes a handshake using a so-called session ticket to the client terminal device 9 that is the source of the start request. Establish a TLS session. Since the flow of the handshake executed here is a technique known as an TLS session using a session ticket, the description thereof is omitted (see RFC5077). However, in the system according to the present disclosure, the order of communication is the same as that of the conventional handshake, but the data included in the issued ticket has a part different from that of the conventional ticket.

Further, the session management unit 21 is acquired from the session ticket when it is determined by the resumption determination unit 28 that the session can be resumed based on the session ticket (ticket data) received by the resumption request receiving unit 26. The session is restarted based on the session restart information. On the other hand, if the resumption determination unit 28 does not determine that the session resumption based on the session ticket received by the resumption request receiving unit 26 is possible, the session management unit 21 refuses to resume the session related to the session ticket. do.

The ticket generation unit 22 generates a session ticket by encrypting information including the session resumption information used for resuming the session, the ticket identifier for identifying the session ticket, and the validity period of the session.

FIG. 3 is a diagram showing information included in the session ticket in an encrypted state in the present embodiment. In the present embodiment, the session restart information is all information necessary for session restart, and is used in the session, the cipher suite used in the session, the encryption key (master key), the ticket identifier, the validity period of the session, and the session. Includes information such as certificate information. However, the information to be encrypted can be appropriately changed according to the embodiment, and is not limited to the example described in the present embodiment. For example, either one or both of the ticket identifier and the validity period of the session may be omitted.

The hash value calculation unit 23 calculates a hash value for identifying the session ticket. That is, the hash value calculated in the present disclosure is not limited to the hash value of the entire session ticket as long as it can be used for identification of the session ticket. For example, a hash value of a part of the session ticket may be used as the hash value.

The ticket management unit 24 stores the ticket determination information including the hash value and the ticket identifier, and invalidates the ticket determination information related to the session ticket used for resuming the session. In the present embodiment, the ticket management unit 24 further stores the valid period of the session as the ticket determination information, and invalidates the ticket determination information related to the ticket whose valid period has expired. Further, in order to save resources, the ticket management unit 24 may release the resources used for storing the ticket determination information when invalidating the ticket determination information.

FIG. 4 is a diagram showing information managed by the ticket management unit 24 of the TLS device 1 in the present embodiment. In the present embodiment, the ticket management unit 24 manages the ticket identifier, the ticket validity period, and the hash value in combination for each established session. By managing such information, the TLS device 1 according to the present embodiment can prevent a replay attack while saving resources for session management without managing the entire session ticket. Become. However, the object stored by the ticket management unit 24 is not limited to the examples in the present embodiment. For example, the ticket management unit 24 may omit the memory of the ticket identifier and the validity period.

The ticket transmission unit 25 transmits the session ticket to the client terminal device 9. The TLS device 1 according to the present embodiment does not manage / store the session ticket transmitted to the client terminal device 9. The transmitted session ticket may be deleted from the resource under the control of the TLS device 1.

The restart request receiving unit 26 receives a session restart request including the session ticket from the client terminal device 9 that has received the session ticket issuance from the TLS device 1.

The decoding unit 27 decodes the session ticket received by the resume request receiving unit 26 to acquire information including the session restart information, the ticket identifier of the session ticket, and the validity period of the session.

The restart determination unit 28 compares the hash value calculated by the hash value calculation unit 23 for identifying the session ticket received by the restart request receiving unit 26 with the hash value stored by the ticket management unit 24. By doing so, it is determined whether or not the session can be restarted based on the session ticket received by the restart request receiving unit 26. Further, in the present embodiment, the resumption determination unit 28 further compares the ticket identifier acquired by the decoding unit 27 with the ticket identifier stored by the ticket management unit 24 in order to determine whether or not the session can be resumed. Further, the validity period acquired from the session ticket received by the restart request receiving unit 26 is compared with the validity period stored by the ticket management unit 24. However, the information used for determining whether or not the session can be resumed is not limited to the examples in the present embodiment. For example, the hash value comparison, the ticket identifier comparison, and the validity period comparison illustrated above may be performed only as necessary according to the embodiment.

<Processing flow>
Next, the flow of processing executed by the information processing apparatus 1 (TLS apparatus 1) according to the present embodiment will be described. The specific contents and processing order of the processing described below are examples for carrying out the present disclosure. The specific processing content and processing order may be appropriately selected according to the embodiment of the present disclosure.

FIG. 5 is a flowchart and a communication sequence showing an outline of the flow of the session management process according to the present embodiment. The process shown in this flowchart is executed when the information necessary for generating the session ticket is prepared after the TLS negotiation is started by the session management unit 21.

In step S101, a session ticket (ticket data) is created. The ticket generation unit 22 generates a session ticket by encrypting information including session resumption information (all information necessary for session resumption), a ticket identifier, and a session validity period. After that, the process proceeds to step S102.

In step S102, the hash value is calculated from the session ticket. The hash value calculation unit 23 calculates the hash value of the entire encrypted data (that is, the entire session ticket generated in step S101) as the hash value for identifying the session ticket. However, the calculated hash value may be any one that can be used for identification of the session ticket, and is not limited to the examples in the present disclosure. After that, the process proceeds to step S103.

In step S103, the ticket identifier, the validity period, and the hash value are managed. The ticket management unit 24 stores the ticket identifier and validity period included in the session ticket, and the hash value calculated from the session ticket in association with each other. After that, the process proceeds to step S104.

In step S104, the session ticket is transmitted to the client terminal device 9. The ticket transmission unit 25 transmits the session ticket generated in step S101 to the client terminal device 9.

After that, when the TLS handshake is completed, the TLS session is established, and the client terminal device 9 securely communicates with the communication partner (server device 5 in this embodiment) via the established TLS session. Can be done. Then, even after the communication is finished, the client terminal device 9 can send a session ticket to the TLS device 1 and request the session to be restarted.

In step S105, the session ticket is received from the client terminal device 9 at the same time as the session restart request. The restart request receiving unit 26 receives a session restart request including the session ticket from the client terminal device 9 that has received the session ticket issuance from the TLS device 1. After that, the process proceeds to step S106.

In step S106, the hash value is calculated from the received session ticket. The hash value calculation unit 23 calculates the entire hash value of the session ticket received from the client terminal device 9 in step S105 as the hash value for identifying the session ticket. However, the calculated hash value may be any as long as it can be used for identification of the session ticket, and the range of data for which the hash value is calculated may correspond to step S102. After that, the process proceeds to step S107.

In step S107, the session ticket received from the client terminal device 9 is decrypted. By decrypting the session ticket received by the resumption request receiving unit 26, the decoding unit 27 acquires information including session resumption information (all information necessary for session resumption), a ticket identifier, and a session validity period. After that, the process proceeds to step S108.

In step S108, it is determined whether or not the session can be resumed. The restart determination unit 28 compares the hash value calculated in step S106 with the hash value managed by the TLS device 1, the ticket identifier and validity period acquired in step S107, and the ticket managed by the TLS device 1. By comparing the identifier and the validity period and confirming whether the session ticket received in step S105 and the session ticket generated in step S101 are the same, the session ticket received from the client terminal device 9 can be obtained. Make sure it has not been tampered with. As a result of the confirmation, when the information obtained from the received session ticket matches the information managed by the TLS device 1 and it is determined that the session can be restarted (YES in step S108), the process proceeds to step S109. move on.

In steps S109 and S110, when the valid period has not expired, the managed information is invalidated and the session restart process is performed. In the present embodiment, since the session ticket has a valid period, the restart determination unit 28 confirms whether or not the session ticket is within the valid period (step S109). When it is determined that the current date and time is within the valid period (YES in step S109), the session management unit 21 initiates a session based on the session restart information acquired in step S107 by decrypting the session ticket. It is restarted (step S110). Since the flow of session resumption using session resumption information is a technique known as a TLS session using a session ticket, the description thereof is omitted (see RFC5077).

That is, in the present embodiment, the session is restarted after it is confirmed that the session ticket has not been tampered with and that the validity period of the session ticket has not expired. Further, since the session ticket can be used only once, the ticket management unit 24 invalidates the managed ticket identifier, validity period, and hash value for the session ticket used once. After that, the process shown in this flowchart ends.

On the other hand, when it is not determined that the session can be restarted as a result of the confirmation in step S108 (NO in step S108), and when it is determined as a result of the determination in step S109 that the current date and time is out of the valid period (NO). NO in step S109), the resumption of the session is rejected. The session management unit 21 refuses to restart the session related to the session ticket received in step S105 (does not restart the session), and the TLS device 1 discards the received session ticket. After that, the process shown in this flowchart ends.

According to the system shown in the present embodiment, when a session restart request including a session ticket is received, the hash value of the received session ticket is compared with the hash value of the session ticket stored in advance. By determining whether the session can be resumed, it is possible to prevent replay attacks while saving resources for session management.

<Variation>
FIG. 6 is a schematic diagram showing the configuration of the system according to the variation. The system according to this variation includes a server device (TLS device) 1 that can communicate with each other by being connected to a network, and one or a plurality of client terminal devices 9. That is, in this variation, the server device 1 which is the communication partner of the client terminal device 9 is provided with a function as a TLS device that performs TLS processing.

1 Information processing device (TLS device)

Claims (10)

A session management method for establishing a communication session with a client,
A ticket generation means for generating ticket data, which is a ticket generation means for generating ticket data by encrypting information including session restart information used for restarting the session.
A hash value calculating means for calculating a hash value for identifying the ticket data, and
A ticket management means for storing ticket determination information including the hash value, and
A ticket transmission means for transmitting the ticket data to the client, and
A restart request receiving means for receiving a session restart request including the ticket data from the client that has received the ticket data issuance from the information processing device.
Decoding means for acquiring information including the session restart information by decoding the ticket data received by the restart request receiving means, and
The hash value for identifying the ticket data received by the restart request receiving means calculated by the hash value calculating means is compared with the hash value stored by the ticket management means. A restart determination means for determining whether or not a session can be restarted based on ticket data received by the restart request receiving means, and a restart determination means.
Information processing device equipped with. The ticket generation means generates ticket data by encrypting information including an identifier of the ticket data in addition to the session restart information.
The ticket management means further stores the identifier of the ticket data and stores it.
The decoding means further acquires the identifier of the ticket data by decoding the ticket data, and obtains the identifier of the ticket data.
The resumption determination means further determines whether or not the session can be resumed by comparing the identifier acquired by the decoding means with the identifier stored by the ticket management means.
The information processing apparatus according to claim 1. The ticket management means further stores the validity period of the session as the ticket determination information, and invalidates the ticket determination information related to the ticket whose validity period has expired.
The information processing apparatus according to claim 1 or 2. The ticket generation means generates ticket data by encrypting information including the validity period of the session in addition to the session restart information.
The decoding means further acquires the validity period of the session by decoding the ticket data, and obtains the validity period of the session.
The restart determination means further compares the valid period acquired from the ticket data received by the restart request receiving means with the valid period stored by the ticket management means, thereby restarting the session. Judging whether or not
The information processing apparatus according to claim 3. When the session management means determines that the session resumption based on the ticket data received by the resumption request receiving means is possible by the resumption determination means, the session resumption information acquired from the ticket data is used. Based on, the session is restarted,
The information processing apparatus according to any one of claims 1 to 4. The ticket management means invalidates the ticket determination information related to the ticket data used for resuming the session.
The information processing apparatus according to any one of claims 1 to 5. If the session management means does not determine that the session resumption based on the ticket data received by the resumption request receiving means is possible by the resumption determination means, the session management means refuses to resume the session related to the ticket data.
The information processing apparatus according to any one of claims 1 to 6. The session resumption information includes information on the validity period of the session, the cipher suite used in the session, the encryption key used in the session, and the certificate used in the session.
The information processing apparatus according to any one of claims 1 to 7. The computer
Session management steps to establish a communication session for a client,
A ticket generation step for generating ticket data, which is a ticket generation step for generating ticket data by encrypting information including session restart information used for restarting the session.
A hash value calculation step for calculating a hash value for identifying the ticket data, and
A ticket management step for storing ticket determination information including the hash value, and
A ticket transmission step for transmitting the ticket data to the client, and
A resumption request receiving step for receiving a session resumption request including the ticket data from the client that has received the ticket data issuance from the information processing apparatus.
A decoding step for acquiring information including the session restart information by decoding the ticket data received in the restart request reception step, and a decoding step.
By comparing the hash value calculated in the hash value calculation step for identifying the ticket data received in the restart request receiving step with the hash value stored in the ticket management step, the said A restart determination step that determines whether or not to restart the session based on the ticket data received in the restart request reception step, and a restart determination step.
How to run. Computer,
A session management method for establishing a communication session with a client,
A ticket generation means for generating ticket data, which is a ticket generation means for generating ticket data by encrypting information including session restart information used for restarting the session.
A hash value calculating means for calculating a hash value for identifying the ticket data, and
A ticket management means for storing ticket determination information including the hash value, and
A ticket transmission means for transmitting the ticket data to the client, and
A restart request receiving means for receiving a session restart request including the ticket data from the client that has received the ticket data issuance from the information processing device.
Decoding means for acquiring information including the session restart information by decoding the ticket data received by the restart request receiving means, and
The hash value for identifying the ticket data received by the restart request receiving means calculated by the hash value calculating means is compared with the hash value stored by the ticket management means. A restart determination means for determining whether or not a session can be restarted based on ticket data received by the restart request receiving means, and a restart determination means.
A program to function as.

Images