WO2006089473A1 - A method for realizing network access authentication - Google Patents

A method for realizing network access authentication Download PDF

Info

Publication number
WO2006089473A1
WO2006089473A1 PCT/CN2005/002129 CN2005002129W WO2006089473A1 WO 2006089473 A1 WO2006089473 A1 WO 2006089473A1 CN 2005002129 W CN2005002129 W CN 2005002129W WO 2006089473 A1 WO2006089473 A1 WO 2006089473A1
Authority
WO
WIPO (PCT)
Prior art keywords
integrity value
accessed
network access
system integrity
access authentication
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2005/002129
Other languages
English (en)
French (fr)
Inventor
Wei Wei
Yadong Qu
Jun Chen
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Lenovo Beijing Ltd
Beijing Lenovo Software Ltd
Original Assignee
Lenovo Beijing Ltd
Beijing Lenovo Software Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Lenovo Beijing Ltd, Beijing Lenovo Software Ltd filed Critical Lenovo Beijing Ltd
Priority to JP2007556479A priority Critical patent/JP2008532124A/ja
Priority to GB0718493A priority patent/GB2439240B/en
Priority to DE112005003479.8T priority patent/DE112005003479B4/de
Priority to US11/817,189 priority patent/US8037306B2/en
Publication of WO2006089473A1 publication Critical patent/WO2006089473A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1475—Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/42—Anonymization, e.g. involving pseudonyms

Definitions

  • the present invention relates to the field of network access authentication technology and trusted computing technology, and in particular to a method for implementing network access authentication.
  • the authentication process performed by the network access authentication device on the device accessing the network is mainly implemented based on the following technical protocols:
  • the network access authentication device confirms whether the device to be accessed is allowed to access the device by determining whether the device to be accessed has a password and/or a key required by the authentication protocol.
  • the purpose of the above authentication process is to ensure that the access to the network is a secure device, not an attacker. However, if the device to be accessed has been attacked by itself, if the Trojan virus program has been implanted, then when the device accesses the network, the Trojan virus program in the device can listen to the authentication process, and Stealing the key information of the access device, using other devices to impersonate the device to be accessed, or using the device to be accessed to attack the network.
  • the main purpose of the present invention is to provide a method for implementing network access authentication, which enables the network access authentication device to confirm the true state of the current device to be accessed, so as to ensure that the device accessing the network is truly secure.
  • the technical solution of the present invention is implemented in such a manner that a network access authentication device pre-stores its own system integrity value calculated by the device to be accessed, and each Correspondence between the to-be-accessed device and its own system integrity value, the method includes the following steps - a.
  • the device to be accessed acquires its current system integrity value, and sends an authentication request including information including the current system integrity value to the network access authentication device.
  • the network access authentication device determines, according to the received authentication request and the corresponding relationship, the current system integrity value of the device to be accessed in the received authentication request and the system of the device to be accessed that has been saved by itself. Whether the integrity value is consistent, and determining the network access authentication if the current system integrity value of the to-be-accessed device in the received authentication request is consistent with the system integrity value of the device to be accessed that has been saved. by.
  • the current system integrity value is a basic system integrity value
  • Step a The device to be accessed obtains its current system integrity value.
  • the device to be accessed When the device to be accessed is started, it calculates its current basic system integrity value, and saves the current basic system integrity value for secure storage.
  • the device to be accessed In the component; when access to the network is required, the device to be accessed directly takes the basic system integrity value from the secure storage component as the current system integrity value.
  • the current system integrity value is an integrity value calculated by the basic system integrity value together with a module for network access;
  • Step a The device to be accessed obtains its current system integrity value, including: when the device to be accessed starts, calculates its basic system integrity value, and saves the current basic system integrity value in the secure storage component.
  • the device to be accessed removes the basic system integrity value from the secure storage component, and performs integrity calculation together with the module for network access to obtain the calculated value as its current current System integrity value.
  • the module for network access comprises a link layer network driver module, a network layer and a transport layer protocol software module, and a network access application software module.
  • the device to be accessed is a computer
  • the process of calculating a basic system integrity value of the user includes the following steps:
  • BIOS or EFI After the BIOS or EFI is started, calculate all the parameter information of the system that has been configured, the integrity of the main boot sector and the system boot partition, and store it in the secure storage component;
  • Iii Calculate the integrity value of the operating system load code and store it in the secure storage unit before the BIOS or EFI loads the boot operating system;
  • Iv after the operating system loads the code, calculate the operating system kernel, system startup files, system configuration File and driver software integrity values and store them in secure storage components;
  • the parameter information that has been configured includes: CPU microcode software, enable (disable) state configuration of various functions of the system, various authentication passwords, disk configuration parameters, peripheral configuration parameters, security functions Configuration parameters.
  • the secure storage component is a security chip TPM, a hard disk with security protection, a USB-key or a smart-card.
  • step b further comprises: verifying the credibility of the received information.
  • the device to be accessed generates a public-private key in advance, and the public-private key is signed by a trusted third party;
  • Step a Before the device to be accessed sends the authentication request, the method includes: applying the private key to the current system integrity The value is signed; the information in the authentication request is the plaintext of the current system integrity value, and the authentication request further includes: a signature of the current system integrity value and the public key;
  • the verifying the credibility of the received information includes: the network access authentication device uses the received public key to verify whether the received signature is correct, and if the signature is correct, determining that the received information is authentic, If the signature is incorrect, the received information is judged to be untrustworthy.
  • the public access key is pre-generated by the device to be accessed, and the public key is signed by a trusted third party, and the public key is pre-stored in the network access authentication device;
  • the method further includes: applying the private key to sign the current system integrity value; the information in the authentication request is the plaintext of the current system integrity value, and the The authentication request further includes: a signature of the current system integrity value;
  • the verifying the credibility of the received information comprises: the network access authentication device applying the pre-stored public key to verify whether the received signature is correct, and determining that the received information is authentic if the signature is correct, If the signature is incorrect, the received information is judged to be untrustworthy.
  • the device to be accessed is pre-generated by the public-private key, and the public-private key is not signed by the trusted third party.
  • the method further includes: applying the private key to the current system.
  • the attribute value is signed;
  • the information in the authentication request is the plaintext of the current system integrity value, and the authentication request further includes: a signature of the current system integrity value, and an anonymous identity certificate.
  • the public key is the public key;
  • the verifying the credibility of the received information comprises: after the network access authentication device applies the received anonymous identity certificate to verify that the sender identity is legal, the received public key is used to verify whether the signature is correct, and the signature is correct. In the case, it is judged that the received information is authentic, and if the signature is incorrect, it is judged that the received information is not authentic.
  • the symmetric access key is pre-stored in the device to be accessed and the network access authentication device.
  • Step a Before the device to be accessed sends the authentication request, the method further includes: applying the symmetric key to the current system integrity value. Encrypting, the information in the authentication request is a current system integrity value encrypted by a symmetric key;
  • the verifying the credibility of the received information includes: the network access authentication device decrypts the received information by using the saved symmetric key, and determines that the received information is trusted if the decryption succeeds. If the decryption is unsuccessful, it is judged that the received information is not trusted.
  • the method further includes: pre-storing a system integrity value of the network access authentication device in the device to be accessed;
  • the device to be accessed obtains the current system integrity value of the network access authentication device, and verifies that the current system integrity value of the obtained network access authentication device is consistent with the system integrity value of the network access authentication device that has been saved. Then perform step a.
  • the network access authentication device is composed of a server, or is configured by a firewall, a switch or a router and an authentication server.
  • the method further includes: if the current system integrity value of the to-be-accessed device in the received authentication request is inconsistent with the system integrity value of the device to be accessed that is saved by itself, the network is connected The incoming authentication device sends an alert to the device to be accessed indicating that the device to be accessed is currently insecure.
  • the information exchanged between the network access authentication device and the device to be accessed is carried by the SSL protocol, the TLS protocol, the IPv6 protocol, or the IKE protocol of the IPSec.
  • the device to be accessed in the step a will receive the ServerHello information from the server.
  • the integrity value information is sent to the network access authentication device along with the handshake protocol, or the device to be accessed in the step A contains the information including the integrity value in the sent ClientHello; the network access authentication device and the
  • the device to be accessed in step a sends the HDR, and the SA contains the integrity value.
  • the information is sent to the network access authentication device along with the handshake protocol.
  • the key to the application of the present invention is that the system integrity value of the device to be accessed is pre-stored in the network access authentication device, and the corresponding relationship between the device to be accessed and its system integrity value.
  • the device to be accessed needs to access the network, it obtains its current system integrity value and sends the current system integrity value to the network access authentication device.
  • the network access authentication device determines the received device to be accessed. Whether the current system integrity value is consistent with the integrity value of the device to be accessed that has been saved. If they are consistent, the network access authentication is performed, otherwise the network access authentication fails. In this way, the network access authentication device can confirm the true state of the device to be accessed, ensuring that the device accessing the network is truly secure, thereby ensuring network security.
  • FIG. 1 is a schematic diagram showing an implementation flow of an embodiment of the present invention
  • Figure 2 is a flow chart showing the calculation of its basic system integrity value by the device to be accessed to which the present invention is applied.
  • the idea of the present invention is that the system integrity value of the device to be accessed and the correspondence between each device to be accessed and its system integrity value are pre-stored in the network access authentication device.
  • the device to be accessed needs to access the network, it obtains its current system integrity value and sends the current system integrity value to the network access authentication device.
  • the network access authentication device determines the received device to be accessed. Whether the current system integrity value is consistent with the integrity value of the device to be accessed that has been saved. If the value is consistent, the network access authentication is passed, otherwise the network access authentication fails.
  • FIG. 1 is a schematic diagram showing an implementation flow of an embodiment of the present invention.
  • the network access authentication device pre-stores its own system integrity value calculated by the device to be accessed, and the correspondence between each device to be accessed and its own system integrity value, and the device to be accessed is pre-generated with public and private Key, the public private key has been signed by a trusted third party.
  • Step 101 The device to be accessed obtains its current system integrity value, and applies the private key to sign the current system integrity value. Then, the device sends an authentication request to the network access authentication device, where the authentication request includes: a system integrity value, a signature of a current system integrity value, and the public key;
  • Step 102 After receiving the information from the device to be accessed, the network access authentication device verifies whether the received signature is correct by using the received public key. If the signature is correct, the received information is trusted. Step 103 is performed; if the signature is incorrect, the received information is not trusted, and the network access authentication fails. Step 103: The network access authentication device obtains the system integrity value of the device to be accessed according to the received authentication request and the corresponding relationship, and determines the current system integrity value of the received device to be accessed. If the system integrity values of the device to be accessed are consistent, if the packets are consistent, the network access authentication is passed, otherwise the network access authentication fails.
  • the network access authentication device may further send an alert to the device to be accessed indicating that the device to be accessed is currently insecure, such as prompting the device to be accessed to have a security vulnerability, or prompting that the device to be accessed has Attacked, etc.
  • the network access authentication device completes the access authentication for the access device.
  • the current system integrity value described above may be a basic system integrity value or a integrity value calculated for the base system integrity value together with the module for network access.
  • the method for the device to be accessed to obtain its current system integrity value in step 101 is as follows: Each time the device to be accessed starts, calculate its current basic system. The integrity value, the current basic system integrity value is saved in the secure storage component; when the access network needs to be accessed, the to-be-accessed device directly extracts the basic system integrity value from the secure storage component as the current system integrity value .
  • the method for the device to be accessed to obtain its current system integrity value in step 101 is: Each time the device to be accessed starts, it calculates its current basic system integrity value, and saves the current basic system integrity value in the secure storage component; when it needs to access the network, the device to be accessed is from the secure storage component.
  • the basic system integrity value is taken out and calculated together with the module used for network access, and the calculated value is taken as its current system integrity value.
  • the module for network access includes a link layer network driver module, a network layer and a transport layer protocol software module, and a network access application software module.
  • FIG. 2 is a schematic flowchart of calculating a basic system integrity value of a device to be accessed by applying the present invention.
  • the device to be accessed is a computer. '
  • Step 201 After the power is turned on, the CPU calculates the system ROM, and the firmware values of the basic input/output system (BIOS) or the expandable firmware interface (EFI) and the integrity values of the hardware configuration parameters, and stores them in the security. In the storage unit.
  • BIOS basic input/output system
  • EFI expandable firmware interface
  • Step 202 After the BIOS or EFI is started, calculate all the parameter information of the system that has been configured, the integrity values of the primary boot sector and the system boot partition, and store them in the secure storage component;
  • the configured parameter information includes: CPU microcode software, enabling (enable or disable) state configuration of various functions of the system, various authentication passwords, disk configuration parameters, peripheral configuration parameters, and security function configuration parameters.
  • Step 203 Calculate the integrity value of the operating system load code and store it in the secure storage unit before the BIOS or EFI loads the boot operating system.
  • Step 204 After the operating system loads the code, calculate the integrity values of the operating system kernel, the system startup file, the system configuration file, and the driver software, and store them in the secure storage unit.
  • Step 205 After the operating system is started, calculate the integrity value of the application software and store it in the secure storage component.
  • Step 206 Calculate a basic system integrity value according to all integrity values described in steps 201 to 205.
  • the above secure storage components are security chips (TPM, Trusted Platform Module or hard disk with security protection, or USB-key, or smart-card.
  • the process shown in FIG. 1 is only an embodiment. Of course, there are multiple implementation manners.
  • the public access key is pre-generated by the device to be accessed, and the public key is pre-stored after being signed by the trusted third party.
  • the authentication request sent to the network access authentication device in step 101 only needs to include the current system integrity value and the signature of the current system integrity value; Other implementation steps are unchanged.
  • the public access key is pre-generated by the device to be accessed, but the public and private keys are not signed by the trusted third party.
  • the authentication request sent to the network access authentication device in step 101 needs to include the current system integrity. a value, a signature of the current system integrity value, an anonymous identity certificate, and the public key; after receiving the information from the device to be accessed, the network access authentication device first applies the received anonymous identity certificate to verify whether the identity of the sender is If it is legal, the received public key is used to verify whether the signature is accurate, and the subsequent steps are continued. If the identity of the sender is invalid, the network access authentication fails and ends.
  • the information to be transmitted between the device to be accessed and the network access authentication device is not protected by the public or private key, but is protected by the symmetric key, that is, the device to be accessed does not need to generate a public or private key, but the device to be accessed.
  • the network access authentication device stores a symmetric key in advance; at this time, the device to be accessed uses the symmetric key to encrypt the current system integrity value, and then the encrypted current system integrity value is included in the authentication request information.
  • the network access authentication device is sent to the network access authentication device, and the network access authentication device decrypts the received information. After the decryption is successful, the integrity judgment operation is performed.
  • the device to be accessed protects the current system integrity value by means of a public or private key or a symmetric key, in order to ensure that the system integrity value received by the network access authentication device is trusted, and is in transit. Not changed.
  • the device to be accessed can also directly transmit its current system integrity value to the network access authentication device in a civilized manner without protecting the transmitted system integrity value, which is not secure. Not recommended.
  • the operation of calculating the integrity value of the system is performed by the integrity information collection module in the device to be accessed, and the signing or encryption operation is performed by the signature encryption module in the device to be accessed.
  • the authentication operation performed by the network access authentication device is performed by the authentication module therein.
  • the device to be accessed may also perform integrity verification on the network access authentication device to confirm whether the network access authentication device is secure and trusted.
  • the device to be accessed also has a verification module for performing the verification operation
  • the network access authentication device further has an integrity information collection module for calculating the system integrity value and a signature encryption module for performing the signature or encryption operation.
  • the specific implementation process is consistent with the process of verifying the device to be accessed by the network access authentication device, that is, the system integrity value of the network access authentication device is pre-stored in the device to be accessed; and the device to be accessed receives the device from the network access authentication device. After the current system integrity value, it is verified whether the received current system integrity value is consistent with the system integrity value of the network access authentication device that has been saved by itself. If they are consistent, the process described in FIG. 1 is executed, and if they are inconsistent, End directly.
  • the network access authentication device When the network access authentication device transmits its current system integrity value to the device to be accessed, it can also be protected by using the above public or private key or symmetric key to ensure the security of the transmitted information during transmission.
  • the manner of applying a public or private key or a symmetric key is the same as that described above, and the description is not repeated here.
  • the network access authentication device described above is composed of a server, or is configured by a firewall, a switch, or a router together with an authentication server.
  • the server completes the operation of receiving the information, verifying the information, and verifying the integrity;
  • the firewall is configured by the firewall.
  • the switch or router will receive the information from the device to be accessed and send it to the server.
  • the server performs the operation of verifying the authenticity of the information and verifying the integrity. After that, the server returns the verification result to the firewall or router, which is verified by the firewall or router.
  • the result information is returned to the device to be accessed.
  • the information exchanged between the network access authentication device and the device to be accessed is implemented by Secure Socket Layer (SSL) protocol and Transport Layer Security (TLS).
  • SSL Secure Socket Layer
  • TLS Transport Layer Security
  • Key exchange IKE, Internet Key Exchange
  • IPv6 IPv6 protocol
  • IPSec IP protocol security
  • the timing of the integrity of the to-be-accessed device when the network access authentication device and the device to be accessed are carried by the foregoing protocol is further described below.
  • the specific sending mode of the device to be accessed and the authentication mode of the network access authentication device are the same as the above, and will not be described in detail below.
  • the device to be accessed is a client, and the network access authentication device is a server.
  • the client receives the ServerHello from the server, it sends the calculated integrity value to the server with the handshake protocol.
  • the server verifies that the received integrity value is consistent with the pre-stored value. If they are consistent, continue to handshake. Agreement, otherwise stop the handshake protocol.
  • the client sends the calculated integrity value to the server with the client Hello. After the server receives the ClientHello from the client, it verifies that the received integrity value is consistent with the pre-stored value. If they are consistent, continue the handshake protocol, otherwise stop. Handshake agreement.
  • the device to be accessed is used as an initiator, and the network access authentication device acts as a responder.
  • the Initiator sends the HDR
  • the SA sends the integrity value to the network access authentication device along with the handshake protocol.
  • the network access authentication device verifies whether the received integrity value is consistent with the pre-stored value. If they are consistent, the authentication succeeds. , and continue to follow up, otherwise stop the handshake protocol.
  • the packet containing the integrity value is sent separately, the packet includes at least the identity information, the length information, and the specific integrity value information of the integrity value. If the integrity value is sent along with the existing packet, multiple fields are added to the existing packet to carry the integrity information, the length information, and the specific integrity value information, or apply the existing
  • the reserved field in the message carries the identification information, the length information, and the specific integrity value information of the integrity value.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Computer And Data Communications (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Storage Device Security (AREA)

Description

一种实现网络接入认证的方法
技术领域
本发明涉及网络接入认证技术和可信计算技术领域， 特别是指一种实现网络 接入认证的方法。
背景技术
目前， 网络接入认证设备对待接入网络的设备进行的认证处理主要基于以下 技术协议实现：
( 1 ) 口令字认证协议；
( 2 ) 基于与共享密钥和挑战应答协议；
( 3 ) 基于动态一次口令协议；
( 4) 基于公钥体制的认证协议。
上述所有认证处理的思路都是： 网络接入认证设备通过判断待接入的设备是 否拥有认证协议需要的口令和 /或密钥来确认是否允许该待接入设备接入。上述认 证处理的目的就是为了保证接入网络的是一个安全的设备， 而不是一个攻击者。 但是， 如果待接入设备自身已受到了攻击， 如已被植入木马病毒程序， 那么， 当 该设备接入网络时， 其内的木马病毒程序是可以监听认证过程的， 并且， 通过监 听可以窃取该接入设备的关键信息， 用其他设备假冒该待接入设备， 或利用该待 接入设备对网络发起攻击。
由此可以看出， 仅验证待接入设备的口令和 /或密钥是无法保证待接入设备 是否真正是安全的， 进而无法保证网络的安全。
发明内容
有鉴于此， 本发明的主要目的在于提供一种实现网络接入认证的方法， 使网 络接入认证设备能够确认当前待接入设备的真正状态， 以确保接入网络的设备是 真正安全的。
为达到上述目的， 本发明的技术方案是这样实现的- 一种实现网络接入认证的方法， 网络接入认证设备预先保存待接入设备已计 算出的其自身的系统完整性值， 以及每个待接入设备与其自身的系统完整性值的 对应关系， 该方法包括以下步骤- a、待接入设备获取自身当前的系统完整性值， 向网络接入认证设备发送包括 包含当前的系统完整性值的信息的认证请求；
b、 网络接入认证设备根据接收到的认证请求以及所述对应关系， 判断接收到 的认证请求中的该待接入设备当前的系统完整性值与自身已保存的该待接入设备 的系统完整性值是否一致， 并在接收到的认证请求中的该待接入设备当前的系统 完整性值与自身已保存的该待接入设备的系统完整性值一致的情况下判断网络接 入认证通过。
较佳地， 所述当前的系统完整性值是基本系统完整性值；
步骤 a所述待接入设备获取自身当前的系统完整性值包括- 所述待接入设备启动时， 计算自身的当前的基本系统完整性值， 保存该当前 的基本系统完整性值于安全存储部件中； 当需要接入网络时， 待接入设备从安全 存储部件中直接取出该基本系统完整性值作为当前的系统完整性值。
较佳地， 所述当前的系统完整性值是基本系统完整性值和用于网络接入的模 块一起计算出的完整性值；
步骤 a所述待接入设备获取自身当前的系统完整性值包括： 所述待接入设备 启动时， 计算自身的基本系统完整性值， 保存该当前的基本系统完整性值于安全 存储部件中； 当需要接入网络时， 待接入设备从安全存储部件中取出基本系统完 整性值， 与用于网络接入的模块一起进行完整性计算， 以获取该计算出的值， 作 为自身当前的系统完整性值。
较佳地， 所述用于网络接入的模块包括链路层网络驱动模块、 网络层和传输 层协议软件模块和网络接入应用软件模块。
较佳地， 所述待接入设备是计算机， 所述计算自身的基本系统完整性值的过 程包括以下步骤：
i、 计算机电源开启后， 计算系统 ROM, 以及 BIOS或 EFI的固件代码以及硬 件配置参数的完整性值， 并将其存储在安全存储部件中；
ii、在 BIOS或 EFI启动后， 计算系统所有已经配置完成的参数信息、主引导 扇区和系统引导分区的完整性值， 并将其存储在安全存储部件中；
iii、 在 BIOS或 EFI 装入引导操作系统之前， 计算操作系统装入代码的完整 性值， 并将其存储在安全存储部件中；
iv、 在操作系统装入代码后， 计算操作系统内核、 系统启动文件、 系统配置 文件和驱动软件的完整性值， 并将其存储在安全存储部件中；
V、在操作系统启动后， 计算应用软件的完整性值， 并将其存储在安全存储部 件中；
vi、 根据步骤 i至步骤 vi 所述的所有完整性值， 计算基本系统完整性值。 较佳地， 所述已经配置完成的参数信息包括： CPU微码软件， 系统各类功能 的使能 （enable或 disable) 状态配置， 各类认证口令， 磁盘配置参数， 外设配 置参数， 安全功能配置参数。
较佳地， 安全存储部件为安全芯片 TPM、 具有安全保护功能的硬盘、 USB-key 或 smart-card。 较佳地， 步骤 b进一步包括： 对接收到的信息的可信性进行验证。
较佳地， 待接入设备预先生成公私钥， 且该公私钥经可信第三方签署； 步骤 a在所述待接入设备发送认证请求之前包括： 应用所述私钥对当前的系 统完整性值进行签名； 所述认证请求中的信息是当前的系统完整性值的明文， 且 该认证请求中进一步包括： 当前的系统完整性值的签名以及所述公钥；
所述对接收到的信息的可信性进行验证包括： 网络接入认证设备应用接收到 的公钥验证接收到的签名是否正确， 以及在签名正确的情况下判断接收到的信息 可信， 在签名不正确的情况下判断接收到的信息不可信。
较佳地， 待接入设备预先生成公私钥， 且该公私钥经可信第三方签署， 网络 接入认证设备中预先存储有所述公钥；
步骤 a所述待接入设备发送认证请求之前， 进一步包括： 应用所述私钥对当 前的系统完整性值进行签名； 所述认证请求中的信息是当前的系统完整性值的明 文， 且该认证请求中进一步包括： 当前的系统完整性值的签名；
所述对接收到的信息的可信性进行验证包括： 网络接入认证设备应用预先存 储的公钥验证接收到的签名是否正确， 以及在签名正确的情况下判断接收到的信 息可信， 在签名不正确的情况下判断接收到的信息不可信。
较佳地， 待接入设备预先生成公私钥， 该公私钥未经可信第三方签署； 步骤 a所述待接入设备发送认证请求之前， 进一步包括： 应用所述私钥对当 前的系统完整性值进行签名； 所述认证请求中的信息是当前的系统完整性值的明 文， 且该认证请求中进一步包括： 当前的系统完整性值的签名、 匿名身份证书以 及所述公钥；
所述对接收到的信息的可信性进行验证包括： 网络接入认证设备应用接收到 的匿名身份证书验证发送方身份合法后， 应用接收到的公钥验证签名是否正确， 以及在签名正确的情况下判断接收到的信息可信， 在签名不正确的情况下判断接 收到的信息不可信。
较佳地， 待接入设备和网络接入认证设备中预先存储有对称密钥； 步骤 a所述待接入设备发送认证请求之前进一步包括： 应用所述对称密钥对 当前的系统完整性值进行加密， 所述认证请求中的信息是经对称密钥加密后的当 前系统完整性值；
所述对接收到的信息的可信性进行验证包括： 网络接入认证设备应用自身已 保存的对称密钥对接收到的信息进行解密， 以及在解密成功的情况下判断接收到 的信息可信， 在解密未成功的情况下判断接收到的信息不可信。
较佳地， 该方法进一步包括： 待接入设备中预先保存有网络接入认证设备的 系统完整性值；
待接入设备获取网络接入认证设备当前的系统完整性值， 验证所获取网络接 入认证设备的当前系统完整性值与自身已保存的该网络接入认证设备的系统完整 性值一致后， 再执行步骤 a。
较佳地， 所述网络接入认证设备由一个服务器构成， 或者， 由防火墙、 交换 机或路由器与认证服务器共同构成。
较佳地， 该方法进一步包括： 在接收到的认证请求中的该待接入设备当前的 系统完整性值与自身已保存的该待接入设备的系统完整性值不一致的情况下， 网 络接入认证设备向待接入设备发送指示该待接入设备当前不安全的告警提示。
较佳地， 所述网络接入认证设备和待接入设备之间交互的信息由 SSL协议、 TLS协议、 IPv6协议、 或 IPSec的 IKE协议承载。
较佳地， 所述网络接入认证设备和待接入设备之间交互的信息由 SSL协议 或 TLS协议承载时，步骤 a所述待接入设备在接收到来自 server的 ServerHello 信息后， 将包含完整性值的信息随握手协议发送给网络接入认证设备， 或者， 步骤 a所述待接入设备在发送的 ClientHello中包含所述包含完整性值的信息； 所述网络接入认证设备和待接入设备之间交互的信息由 IPv6协议或 IPSec的 IKE协议承载时， 步骤 a所述待接入设备发送 HDR， SA时将包含完整性值的信 息随握手协议发送给网络接入认证设备。
应用本发明， 其关键是网络接入认证设备内预先保存待接入设备的系统完 整性值， 以及该待接入设备与其系统完整性值的对应关系。 当待接入设备需要 接入网络时， 其获取自身当前的系统完整性值， 将当前的系统完整性值发送给 网络接入认证设备； 网络接入认证设备判断接收到的该待接入设备当前的系统 完整性值与自身已保存的该待接入设备的完整性值是否一致， 如果一致， 则通 过网络接入认证， 否则网络接入认证失败。 这样， 使网络接入认证设备能够确 认当前待接入设备的真正状态， 确保了接入网络的设备是真正安全的， 进而保 证了网络的安全。
附图说明 . '
图 1所示为应用本发明的一实施例的实现流程示意图；
图 2所示为应用本发明的待接入设备计算自身的基本系统完整性值的流程示 意图。
具体实'施方式
下面结合附图及具体实施例对本发明再做进一步地详细说明。
本发明的思路是：网络接入认证设备内预先保存待接入设备的系统完整性值， 以及每个待接入设备与其系统完整性值的对应关系。 当待接入设备需要接入网络 时， 其获取自身当前的系统完整性值， 将当前的系统完整性值发送给网络接入认 证设备； 网络接入认证设备判断接收到的该待接入设备当前的系统完整性值与自 身已保存的该待接入设备的完整性值是否一致， 如果一致， 则网络接入认证通过， 否则网络接入认证失败。
图 1所示为应用本发明的一实施例的实现流程示意图。 网络接入认证设备预 先保存待接入设备已计算出的其自身的系统完整性值， 以及每个待接入设备与其 自身的系统完整性值的对应关系， 且待接入设备预先生成有公私钥， 该公私钥已 经可信第三方签署。
步骤 101， 待接入设备获取自身当前的系统完整性值， 应用上述私钥对当前 的系统完整性值进行签名； 之后， 向网络接入认证设备发送认证请求， 该认证请求 中包括： 当前的系统完整性值， 当前的系统完整性值的签名以及所述公钥；
步骤 102， 网络接入认证设备接收到来自待接入设备的信息后， 应用接收到 的公钥验证接收到的签名是否正确， 如果签名正确， 则表示接收到的信息可信， 执行步骤 103; 如果签名不正确则表示接收到的信息不可信， 网络接入认证失败。 步骤 103， 网络接入认证设备根据接收到的认证请求以及所述对应关系， 获 取该待接入设备的系统完整性值， 判断该接收到的待接入设备的当前系统完整性 值与自身已保存的该待接入设备所对应的系统完整性值是否一致， 如果一致， 则 网络接入认证通过， 否则网络接入认证失败。
如果网络接入认证失败， 网络接入认证设备可以进一步向待接入设备发送指 示该待接入设备当前不安全的告警提示， 如提示待接入设备存在安全漏洞， 或提 示待接入设备已受到攻击等。
至此， 网络接入认证设备完成了对待接入设备的接入认证。
上述当前的系统完整性值可以为基本系统完整性值， 也可以为基本系统完整性值 和用于网络接入的模块一起计算出的完整性值。
如果当前的系统完整性值是基本系统完整性值，则步骤 101所述待接入设备获取 自身当前的系统完整性值的方法为： 待接入设备每次启动时， 计算自身当前的基本 系统完整性值， 保存该当前的基本系统完整性值于安全存储部件中； 当需要接入网络 时， 待接入设备从安全存储部件中直接取出该基本系统完整性值作为当前的系统完整 性值。
如果当前的系统完整性值是基本系统完整性值和用于网络接入的模块一起计算 出的完整性值，则步骤 101所述待接入设备获取自身当前的系统完整性值的方法为： 待接入设备每次启动时， 计算自身当前的基本系统完整性值， 保存该当前的基本系统 完整性值于安全存储部件中； 当需要接入网络时， 待接入设备从安全存储部件中取出 基本系统完整性值， 与用于网络接入的模块一起进行计算， 将计算出的值作为自身当 前的系统完整性值。 所述用于网络接入的模块包括链路层网络驱动模块、 网络层和传 输层协议软件模块和网络接入应用软件模块。
参见图 2， 图 2所示为应用本发明的待接入设备计算自身的基本系统完整性值的 流程示意图。 在本实施例中， 待接入设备为计算机。 '
步骤 201， 计算机每次电源开启后， 由 CPU计算系统 ROM, 以及基本输入输 出系统（BIOS )或可扩展固件界面（EFI ) 的固件代码以及硬件配置参数的完整性 值， 并将其存储在安全存储部件中。
步骤 202, 在 BIOS或 EFI启动后， 计算系统所有已经配置完成的参数信息、 主引导扇区和系统引导分区的完整性值， 并将其存储在安全存储部件中； 所述已 经配置完成的参数信息包括： CPU 微码软件， 系统各类功能的使能 （enable 或 disable)状态配置， 各类认证口令， 磁盘配置参数， 外设配置参数以及安全功能 配置参数等。
步骤 203， 在 BIOS 或 EFI装入引导操作系统之前， 计算操作系统装入代码 的完整性值， 并将其存储在安全存储部件中。
步骤 204， 在操作系统装入代码后， 计算操作系统内核、 系统启动文件、 系 统配置文件和驱动软件的完整性值， 并将其存储在安全存储部件中。
步骤 205， 在操作系统启动后， 计算应用软件的完整性值， 并将其存储在安全存 储部件中。
步骤 206， 根据步骤 201至步骤 205所述的所有完整性值， 计算基本系统完整性 值。
上述安全存储部件为安全芯片 （TPM， Trusted Platform Module 或具有安全 保护功能的硬盘、 或 USB- key, 或 smart- card。
图 1所示流程仅为一实施例而已， 当然还可以有多种实现方式， 比如- 待接入设备预先生成公私钥， 且该公私钥经可信第三方签署后， 已将公钥预先存 储在了网络接入认证设备中； 此时， 步骤 101中所述向网络接入认证设备发送的认证 请求中只需包含当前的系统完整性值， 以及当前的系统完整性值的签名即可； 其 它实现步骤不变。
再比如：待接入设备预先生成了公私钥，但该公私钥未经可信第三方签署；此时， 步骤 101 中所述向网络接入认证设备发送的认证请求中需包含当前的系统完整性 值， 当前的系统完整性值的签名、 匿名身份证书以及所述公钥； 网络接入认证设备接 收到来自待接入设备的信息后， 首先应用接收到的匿名身份证书验证发送方身份是否 合法， 如合法， 再应用接收到的公钥验证签名是否准确， 并继续执行后续步骤， 如果 验证发送方的身份不合法， 则网络接入认证失败， 并结束。
再比如： 待接入设备和网络接入认证设备之间传送的信息不使用公私钥保护， 而 使用对称密钥的方式保护， 即不需要待接入设备生成公私钥， 而是待接入设备和网络 接入认证设备中预先存储有对称密钥； 此时， 待接入设备应用对称密钥对当前的系统 完整性值进行加密后， 将加密后的当前系统完整性值包含在认证请求信息中发送给网 络接入认证设备， 网络接入认证设备则对接收到的信息进行解密， 解密成功后， 进行 完整性判断操作。 上述待接入设备无论采用公私钥的方式还是对称密钥的方式保护当前的系统完 整性值， 都是为了保证网络接入认证设备所接收到的系统完整性值是可信的， 是传输 途中未被更改过的。
当然， 待接入设备也可以直接将自身当前的系统完整性值以文明的方式传送给网 络接入认证设备， 而不对所传输出的系统完整性值进行保护， 该传送方式不安全， 在 此并不推荐。
上述计算系统完整性值的操作是由待接入设备内的完整性信息釆集模块执行的， 上述签名或加密操作， 是由待接入设备内的签名加密模块完成的。 网络接入认证设备 所执行的验证操作是由其内的认证模块完成的。
为了进一步保证网络接入认证的安全可信性， 待接入设备也可以对网络接入认证 设备进行完整性验证， 以确认该网络接入认证设备是否为安全可信的。 此时待接入设 备内还具有用于执行的验证操作的验证模块， 网络接入认证设备还具有用于计算系统 完整性值的完整性信息采集模块以及执行签名或加密操作的签名加密模块。
具体实现过程与网络接入认证设备验证待接入设备的过程一致， 即 - 待接入设备中预先保存网络接入认证设备的系统完整性值； 待接入设备接收来自 网络接入认证设备的当前系统完整性值后， 验证所接收的当前系统完整性值与自身已 保存的该网络接入认证设备的系统完整性值是否一致， 如果一致， 再执行图 1所述流 程， 如果不一致， 则直接结束。
网络接入认证设备将自身的当前系统完整性值传送给待接入设备时， 也可以采用 上述公私钥或对称密钥的方式加以保护， 以确保所传送的信息在传输途中的安全。 具 体应用公私钥或对称密钥的方式与上述方式相同， 在此不再重复描述。
以上所述网络接入认证设备由一个服务器构成， 或者， 由防火墙、 交换机或路由 器与认证服务器共同构成。 当网络接入认证设备由一个服务器构成时， 该服务器完成 接收信息、 验证信息可信以及验证完整性的操作； 当网络接入认证设备由防火墙、 交 换机或路由器与认证服务器共同构成时， 由防火墙、 交换机或路由器将接收到来自待 接入设备的信息传送给服务器， 由服务器执行验证信息可信以及验证完整性的操作， 之后， 服务器将验证结果返回给防火墙或路由器， 由防火墙或路由器将验证结果信息 返回给待接入设备。
上述网络接入认证设备和待接入设备之间交互的信息由安全套接字 （SSL， Secure Socket Layer) 协议、 传输层安全 ( TLS, Transport Layer Security) 协议、 IPv6协议、 或 IP安全协议 （IPSec, Internet protocol Security) 中的 密钥交换 （IKE， Internet Key Exchange) 协议承载。 下面再进一步说明当网络 接入认证设备和待接入设备之间由上述协议承载时， 待接入设备发送完整性值的 时机。 对于待接入设备的具体发送方式， 以及网络接入认证设备的认证方式， 均 与上述方式相同， 下面不再详细说明。
当网络接入认证设备和待接入设备之间为 SSL或 TLS协议时， 所述待接入设 备为客户端 （client) ， 所述网络接入认证设备为 server。 此时， 当 client接 收到来自 server 的 ServerHello后， 将已计算出的完整性值随握手协议发送给 server, 由 server验证接收到的完整性值与预先存储的是否一致， 如果一致， 则 继续握手协议， 否则停止握手协议。 或者， client 将已计算出的完整性值随 ClientHello发送给 server; 在 server接收到来自 client的 ClientHello后验 证收到的完整性值与预先存储的是否一致， 如果一致， 则继续握手协议， 否则停 止握手协议。
当网络接入认证设备和待接入设备之间为 IPv6或 IPSec的 IKE协议时，所述 待接入设备作为发起方 （Initiator) ， 所述网络接入认证设备作为响应方 (Responder) 。 在 Initiator发送 HDR， SA时将完整性值随握手协议发送给网络 接入认证设备， 由网络接入认证设备则验证接收到的完整性值与预先存储的是否 一致， 如果一致， 则表明认证成功， 并继续后续操作， 否则停止握手协议。
如果是单独发送包含完整性值的报文， 则该报文中至少包含完整性值的标识 信息、 长度信息以及具体的完整性值信息。 如果是随现有的报文一起发送完整性 值， 则在现有的报文中增加多个字段， 以承载完整性值的标识信息、 长度信息以 及具体的完整性值信息，或应用现有报文中的保留字段承载完整性值的标识信息、 长度信息以及具体的完整性值信息。
以上所述仅为本发明的较佳实施例而已， 并不用以限制本发明， 凡在本发明 的精神和原则之内， 所作的任何修改、 等同替换、 改进等， 均应包含在本发明的 保护范围之内。

Claims

1、 一种实现网络接入认证的方法， 其特征在于， 网络接入认证设备预先保存待 接入设备已计算出的其自身的系统完整性值， 以及每个待接入设备与其自身的系统完 整性值的对应关系， 该方法包括以下步骤- a、 待接入设备获取自身当权前的系统完整性值， 向网络接入认证设备发送包括包 含当前的系统完整性值的信息的认证请求；
b、 网络接入认证设备根据接收到的认证请求以及所述对应关系， 判断接收到的 认证请求中的该待接入设备当前的系统完整性值与自身已保存的该待接入设备的系 统完整性值是否一致， 并在接收到的认证请求中的该待接入设备当前的系统完整性值 与自身已保存的该待接入设备的系统完整性值一致求的情况下， 判断网络接入认证通 过。
2、 根据权利要求 1所述的方法， 其特征在于，
所述当前的系统完整性值是基本系统完整性值；
步骤 a所述待接入设备获取自身当前的系统完整性值包括- J 所述待接入设备启动时， 计算自身的当前的基本系统完整性值， 保存该当前的基 本系统完整性值于安全存储部件中； 当需要接入网络时， 待接入设备从安全存储部件 中直接取出该基本系统完整性值作为当前的系统完整性值。
3、 根据权利要求 1所述的方法， 其特征在于，
所述当前的系统完整性值是基本系统完整性值和用于网络接入的模块一起计算 出的完整性值；
步骤 a所述待接入设备获取自身当前的系统完整性值包括： 所述待接入设备启动 时， 计算自身的基本系统完整性值， 保存该当前的基本系统完整性值于安全存储部件 中； 当需要接入网络时， 待接入设备从安全存储部件中取出基本系统完整性值， 与用 于网络接入的模块一起进行完整性计算， 以获取该计算出的值， 作为自身当前的系统 完整性值。
4、 根据权利要求 3所述的方法， 其特征在于， 所述用于网络接入的模块包括链 路层网络驱动模块、 网络层和传输层协议软件模块和网络接入应用软件模块。
5、 根据权利要求 2或 3所述的方法， 其特征在于， 所述待接入设备是计算机， 所述计算自身的基本系统完整性值的步骤包括以下步骤- i、 计算机电源开启后， 计算系统 ROM, 以及 BIOS或 EFI固件代码以及硬件 配置参数的完整性值， 并将其存储在安全存储部件中；
ii、 在 BIOS或 EFI启动后， 计算系统所有已经配置完成的参数信息、 主引 导扇区和系统引导分区的完整性值， 并将其存储在安全存储部件中；
ii i、在 BIOS 或 EFI装入引导操作系统之前，计算操作系统装入代码的完整 性值， 并将其存储在安全存储部件中；
iv、 在操作系统装入代码后， 计算操作系统内核、 系统启动文件、 系统配置 文件和驱动软件的完整性值， 并将其存储在安全存储部件中；
v、 在操作系统启动后， 计算应用软件的完整性值， 并将其存储在安全存储部件 中；
vi、 根据步骤 i至步骤 vi 所述的所有完整性值， 计算基本系统完整性值。
6、 根据权利要求 5所述的方法， 其特征在于， 所述已经配置完成的参数信息包 括- CPU微码软件， 系统各类功能的使能 （enable或 disable)状态配置， 各类认证 口令， 磁盘配置参数， 外设配置参数， 安全功能配置参数。
7、根据权利要求 2或 3所述的方法，其特征在于，安全存储部件为安全芯片 TPM、 具有安全保护功能的硬盘、 USB- key或 smart- card。
8、 根据权利要求 1所述的方法， 其特征在于， 步骤 b进一步包括： 对接收到的 信息的可信性进行验证。
9、 根据权利要求 8所述的方法， 其特征在于，
待接入设备预先生成公私钥， 且该公私钥经可信第三方签署；
步骤 a在所述待接入设备发送认证请求之前包括： 应用所述私钥对当前的系统完 整性值进行签名； 所述认证请求中的信息是当前的系统完整性值的明文， 且该认证请 求中进一步包括： 当前的系统完整性值的签名以及所述公钥；
所述对接收到的信息的可信性进行验证包括： 网络接入认证设备应用接收到的公 钥验证接收到的签名是否正确， 以及在签名正确的情况下判断接收到的信息可信， 在 签名不正确的情况下判断接收到的信息不可信。
10、 根据权利要求 8所述的方法， 其特征在于， 待接入设备预先生成公私钥， 且 该公私钥经可信第三方签署， 网络接入认证设备中预先存储有所述公钥；
步骤 a所述待接入设备发送认证请求之前， 进一步包括： 应用所述私钥对当前的 系统完整性值进行签名； 所述认证请求中的信息是当前的系统完整性值的明文， 且该 认证请求中进一步包括： 当前的系统完整性值的签名；
所述对接收到的信息的可信性进行验证包括： 网络接入认证设备应用预先存储的 公钥验证接收到的签名是否正确， 以及在签名正确的情况下判断接收到的信息可信， 在签名不正确的情况下判断接收到的信息不可信。
11、 根据权利要求 8所述的方法， 其特征在于， 待接入设备预先生成公私钥， 该 公私钥未经可信第三方签署；
步骤 a所述待接入设备发送认证请求之前， 进一步包括： 应用所述私钥对当前的 系统完整性值进行签名； 所述认证请求中的信息是当前的系统完整性值的明文， 且该 认证请求中进一步包括： 当前的系统完整性值的签名、 匿名身份证书以及所述公钥； 所述对接收到的信息的可信性进行验证包括： 网络接入认证设备应用接收到的匿 名身份证书验证发送方身份合法后， 应用接收到的公钥验证签名是否正确， 以及在签 名正确的情况下判断接收到的信息可信， 在签名不正确的情况下判断接收到的信息不 可信。
12、 根据权利要求 8所述的方法， 其特征在于， 待接入设备和网络接入认证设备 中预先存储有对称密钥；
步骤 a所述待接入设备发送认证请求之前进一步包括： 应用所述对称密钥对当前 的系统完整性值进行加密， 所述认证请求中的信息是经对称密钥加密后的当前系统完 整性值；
所述对接收到的信息的可信性进行验证包括： 网络接入认证设备应用自身已保存 的对称密钥对接收到的信息进行解密， 以及在解密成功的情况下判断接收到的信息可 信， 在解密未成功的情况下判断接收到的信息不可信。
13、 根据权利要求 1或 8所述的方法， 其特征在于， 该方法进一步包括： 待接入 设备中预先保存有网络接入认证设备的系统完整性值；
待接入设备获取网络接入认证设备当前的系统完整性值， 验证所获取网络接入认 证设备的当前系统完整性值与自身已保存的该网络接入认证设备的系统完整性值一 致后， 再执行步骤 a。
14、 根据权利要求 1所述的方法， 其特征在于， 所述网络接入认证设备由一个服 务器构成， 或者， 由防火墙、 交换机或路由器与认证服务器共同构成。
15、 根据权利要求 1所述的方法， 其特征在于， 该方法进一步包括： 在接收到的 认证请求中的该待接入设备当前的系统完整性值与自身已保存的该待接入设备的系 统完整性值不一致的情况下， 网络接入认证设备向待接入设备发送指示该待接入设备 当前不安全的告警提示。
16、 根据权利要求 1或 8所述的方法， 其特征在于，
所述网络接入认证设备和待接入设备之间交互的信息由 SSL协议或 TLS协议承载 时， 步骤 a所述待接入设备在接收到来自 server的 ServerHello信息后， 将包含完 整性值的信息随握手协议发送给网络接入认证设备， 或者， 步骤 a所述待接入设备在 发送的 ClientHello中包含所述包含完整性值的信息； ' 所述网络接入认证设备和待接入设备之间交 S的信息由 IPv6协议或 IPSec的 IKE协议承载时， 步骤 a所述待接入设备发送 HDR， SA时将包含完整性值的信息 随握手协议发送给网络接入认证设备。
PCT/CN2005/002129 2005-02-28 2005-12-08 A method for realizing network access authentication Ceased WO2006089473A1 (en)

Priority Applications (4)

Application Number Priority Date Filing Date Title
JP2007556479A JP2008532124A (ja) 2005-02-28 2005-12-08 ネットワークアクセス認証を実現する方法
GB0718493A GB2439240B (en) 2005-02-28 2005-12-08 A method for realizing network access authentication
DE112005003479.8T DE112005003479B4 (de) 2005-02-28 2005-12-08 Ein Verfahren zum Realisieren einer Netzzugriffsauthentifizierung
US11/817,189 US8037306B2 (en) 2005-02-28 2005-12-08 Method for realizing network access authentication

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2005100511173A CN1703004B (zh) 2005-02-28 2005-02-28 一种实现网络接入认证的方法
CN200510051117.3 2005-02-28

Publications (1)

Publication Number Publication Date
WO2006089473A1 true WO2006089473A1 (en) 2006-08-31

Family

ID=35632541

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2005/002129 Ceased WO2006089473A1 (en) 2005-02-28 2005-12-08 A method for realizing network access authentication

Country Status (6)

Country Link
US (1) US8037306B2 (zh)
JP (1) JP2008532124A (zh)
CN (1) CN1703004B (zh)
DE (1) DE112005003479B4 (zh)
GB (1) GB2439240B (zh)
WO (1) WO2006089473A1 (zh)

Families Citing this family (32)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101102180B (zh) * 2006-07-03 2010-08-25 联想(北京)有限公司 基于硬件安全单元的系统间绑定及平台完整性验证方法
CN101193426B (zh) * 2006-11-24 2010-12-01 中兴通讯股份有限公司 保护通信系统接入过程完整性的方法
CN101232372B (zh) * 2007-01-26 2011-02-02 华为技术有限公司 认证方法、认证系统和认证装置
CN101340281B (zh) * 2007-07-02 2010-12-22 联想(北京)有限公司 针对在网络上进行安全登录输入的方法和系统
US8200736B2 (en) 2007-12-24 2012-06-12 Qualcomm Incorporated Virtual SIM card for mobile handsets
CN101483522B (zh) * 2008-01-09 2012-04-04 华为技术有限公司 一种控制接入可信网络的方法、系统和设备
CN101729289B (zh) * 2008-11-03 2012-04-04 华为技术有限公司 平台完整性认证方法及系统、无线接入设备和网络设备
CN101784051B (zh) * 2009-01-21 2012-11-21 华为技术有限公司 一种平台完整性验证的方法、网络设备和网络系统
US8634828B2 (en) * 2009-06-08 2014-01-21 Qualcomm Incorporated Method and apparatus for switching virtual SIM service contracts based upon a user profile
US8639245B2 (en) * 2009-06-08 2014-01-28 Qualcomm Incorporated Method and apparatus for updating rules governing the switching of virtual SIM service contracts
US8811969B2 (en) * 2009-06-08 2014-08-19 Qualcomm Incorporated Virtual SIM card for mobile handsets
US20100311402A1 (en) * 2009-06-08 2010-12-09 Prasanna Srinivasan Method and apparatus for performing soft switch of virtual sim service contracts
US8649789B2 (en) * 2009-06-08 2014-02-11 Qualcomm Incorporated Method and apparatus for switching virtual SIM service contracts when roaming
US8676180B2 (en) * 2009-07-29 2014-03-18 Qualcomm Incorporated Virtual SIM monitoring mode for mobile handsets
US20110191581A1 (en) * 2009-08-27 2011-08-04 Telcordia Technologies, Inc. Method and system for use in managing vehicle digital certificates
US9721101B2 (en) * 2013-06-24 2017-08-01 Red Hat, Inc. System wide root of trust chaining via signed applications
US9208318B2 (en) * 2010-08-20 2015-12-08 Fujitsu Limited Method and system for device integrity authentication
CN101917438A (zh) * 2010-08-23 2010-12-15 浪潮(北京)电子信息产业有限公司 在网络通信系统中访问控制方法和系统
CN101984577B (zh) * 2010-11-12 2013-05-01 西安西电捷通无线网络通信股份有限公司 匿名实体鉴别方法及系统
CN102571729A (zh) * 2010-12-27 2012-07-11 方正宽带网络服务股份有限公司 Ipv6网络接入认证方法、装置及系统
US8863256B1 (en) 2011-01-14 2014-10-14 Cisco Technology, Inc. System and method for enabling secure transactions using flexible identity management in a vehicular environment
CN102184111B (zh) * 2011-04-29 2015-08-19 杭州海康威视数字技术股份有限公司 操作系统在线升级方法及带操作系统的设备
US9992024B2 (en) * 2012-01-25 2018-06-05 Fujitsu Limited Establishing a chain of trust within a virtual machine
US9510194B2 (en) * 2013-06-28 2016-11-29 Intel Corporation Open and encrypted wireless network access
US10097513B2 (en) * 2014-09-14 2018-10-09 Microsoft Technology Licensing, Llc Trusted execution environment extensible computing device interface
CN105119940A (zh) * 2015-09-16 2015-12-02 北京博维亚讯技术有限公司 基于本地认证802.1x认证系统认证方法及认证设备
CN106375301B (zh) * 2016-08-30 2020-01-03 成都源知信息技术有限公司 一种网络设备认证方法及认证设备
CN109547400A (zh) * 2017-09-22 2019-03-29 三星电子株式会社 通信方法、完整性验证方法和客户端的服务器注册方法
CN109861824A (zh) * 2018-12-25 2019-06-07 航天信息股份有限公司 一种用于物联网的可信装置
US12406063B2 (en) * 2020-07-30 2025-09-02 Hewlett-Packard Development Company, L.P. BIOS action request for authorized application
CN115238259B (zh) * 2021-04-22 2025-10-17 华为技术有限公司 一种设备认证方法以及相关装置
CN113946814B (zh) * 2021-10-13 2025-07-15 合肥移瑞通信技术有限公司 Mbb设备认证方法、装置、mbb及主设备、介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2003090402A1 (en) * 2002-04-18 2003-10-30 International Business Machines Corporation Initializing, maintaining, updating and recovering secure operation within an integrated system employing a data access control function
WO2004044687A2 (en) * 2002-11-12 2004-05-27 Millipore Corporation Instrument access control system
US20040128518A1 (en) * 2002-05-29 2004-07-01 Cavers F. Mervyn Information access system, device and method
US20040250121A1 (en) * 2003-05-06 2004-12-09 Keith Millar Assessing security of information technology

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6185678B1 (en) * 1997-10-02 2001-02-06 Trustees Of The University Of Pennsylvania Secure and reliable bootstrap architecture
US7409546B2 (en) * 1999-10-20 2008-08-05 Tivo Inc. Cryptographically signed filesystem
GB0020441D0 (en) * 2000-08-18 2000-10-04 Hewlett Packard Co Performance of a service on a computing platform
EP1187415A1 (de) * 2000-09-05 2002-03-13 Siemens Aktiengesellschaft Verfahren zur Identifikation von Internet-Nutzern
TW480444B (en) * 2000-11-29 2002-03-21 Mitac Technology Corp Computer system boot-up method capable of completing the startup procedure even the system BIOS code is damaged
JP3989197B2 (ja) 2001-07-06 2007-10-10 日本電信電話株式会社 パケット廃棄装置
JP2003079483A (ja) 2001-09-13 2003-03-18 Tm:Kk クッション
CN1200532C (zh) * 2001-12-05 2005-05-04 上海卓扬科技有限公司 一种宽带接入网络的用户识别方法
US7661134B2 (en) * 2001-12-21 2010-02-09 Cybersoft, Inc. Apparatus, methods and articles of manufacture for securing computer networks
CN1180566C (zh) * 2002-08-26 2004-12-15 联想(北京)有限公司 一种实现网络设备间安全可靠互连的方法
JP4399704B2 (ja) * 2003-03-27 2010-01-20 ソニー株式会社 情報処理装置および方法、プログラム、並びに記録媒体
US7591017B2 (en) * 2003-06-24 2009-09-15 Nokia Inc. Apparatus, and method for implementing remote client integrity verification
US7475427B2 (en) * 2003-12-12 2009-01-06 International Business Machines Corporation Apparatus, methods and computer programs for identifying or managing vulnerabilities within a data processing network
KR20070098835A (ko) * 2004-11-29 2007-10-05 시그나서트, 인크. 정보 시스템 구성요소 분석에 의해 계산된 트러스트스코어에 기초하여 네트워크 단말간의 액세스를 제어하는방법
US7603422B2 (en) * 2004-12-27 2009-10-13 Microsoft Corporation Secure safe sender list

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2003090402A1 (en) * 2002-04-18 2003-10-30 International Business Machines Corporation Initializing, maintaining, updating and recovering secure operation within an integrated system employing a data access control function
US20040128518A1 (en) * 2002-05-29 2004-07-01 Cavers F. Mervyn Information access system, device and method
WO2004044687A2 (en) * 2002-11-12 2004-05-27 Millipore Corporation Instrument access control system
US20040250121A1 (en) * 2003-05-06 2004-12-09 Keith Millar Assessing security of information technology

Also Published As

Publication number Publication date
DE112005003479T5 (de) 2008-03-27
GB0718493D0 (en) 2007-10-31
CN1703004A (zh) 2005-11-30
CN1703004B (zh) 2010-08-25
US8037306B2 (en) 2011-10-11
GB2439240A (en) 2007-12-19
US20090019528A1 (en) 2009-01-15
JP2008532124A (ja) 2008-08-14
GB2439240B (en) 2009-12-02
DE112005003479B4 (de) 2015-06-03

Similar Documents

Publication Publication Date Title
WO2006089473A1 (en) A method for realizing network access authentication
KR101904177B1 (ko) 데이터 처리 방법 및 장치
JP6896940B2 (ja) 第１のアプリケーションと第２のアプリケーションとの間の対称型相互認証方法
US8868909B2 (en) Method for authenticating a communication channel between a client and a server
US8037295B2 (en) Hardware-bonded credential manager method and system
CN107040513B (zh) 一种可信访问认证处理方法、用户终端和服务端
US7069438B2 (en) Establishing authenticated network connections
US7945779B2 (en) Securing a communications exchange between computers
US8452954B2 (en) Methods and systems to bind a device to a computer system
US20160072787A1 (en) Method for creating secure subnetworks on a general purpose network
CN109729523B (zh) 一种终端联网认证的方法和装置
CN101741842B (zh) 一种基于可信计算实现可信ssh的方法
CN112714053B (zh) 通信连接方法及装置
CN106612180A (zh) 实现会话标识同步的方法及装置
WO2018014760A1 (zh) 图形码信息提供、获取方法、装置及终端
CN116707961A (zh) 用户认证方法、计算机设备及计算机存储介质
CN101204067A (zh) 安全计算两个设备之间的基于时间的长度的方法和设备
EP4443927B1 (en) Trusted measurement-integrated communication method and apparatus
CN119255238A (zh) 一种基于小程序与蓝牙设备的认证通信方法及系统
CN118573483A (zh) 一种网络安全的管理方法及相关设备
US8356175B2 (en) Methods and apparatus to perform associated security protocol extensions
JP2003224562A (ja) 個人認証システム及びプログラム
Yanan¹ et al. A Security Reinforcement Technology
CN116915473A (zh) Sslvpn隧道建立方法、装置、系统、设备及介质
Protocol Network Working Group N. Cam-Winget Internet-Draft D. McGrew Intended status: Informational J. Salowey Expires: March 9, 2008 H. Zhou Cisco Systems

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application
WWE Wipo information: entry into national phase

Ref document number: 1120050034798

Country of ref document: DE

WWE Wipo information: entry into national phase

Ref document number: 2007556479

Country of ref document: JP

ENP Entry into the national phase

Ref document number: 0718493

Country of ref document: GB

Kind code of ref document: A

Free format text: PCT FILING DATE = 20051208

WWE Wipo information: entry into national phase

Ref document number: 0718493.0

Country of ref document: GB

122 Ep: pct application non-entry in european phase

Ref document number: 05804962

Country of ref document: EP

Kind code of ref document: A1

WWW Wipo information: withdrawn in national office

Ref document number: 5804962

Country of ref document: EP

RET De translation (de og part 6b)

Ref document number: 112005003479

Country of ref document: DE

Date of ref document: 20080327

Kind code of ref document: P

WWE Wipo information: entry into national phase

Ref document number: 11817189

Country of ref document: US