WO2007115495A1 - Procédé et appareil d'authentification de passerelle sur la base d'une clé publique combinée - Google Patents

Procédé et appareil d'authentification de passerelle sur la base d'une clé publique combinée Download PDF

Info

Publication number
WO2007115495A1
WO2007115495A1 PCT/CN2007/001130 CN2007001130W WO2007115495A1 WO 2007115495 A1 WO2007115495 A1 WO 2007115495A1 CN 2007001130 W CN2007001130 W CN 2007001130W WO 2007115495 A1 WO2007115495 A1 WO 2007115495A1
Authority
WO
WIPO (PCT)
Prior art keywords
gateway
certificate
file
user
cpk
Prior art date
Application number
PCT/CN2007/001130
Other languages
English (en)
French (fr)
Inventor
Xianghao Nan
Jianguo Zhao
Original Assignee
Beijing E-Henxen Authentication Technologies Co., Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Family has litigation
First worldwide family litigation filed litigation Critical https://patents.darts-ip.com/?family=36947298&utm_source=google_patent&utm_medium=platform_link&utm_campaign=public_patent_search&patent=WO2007115495(A1) "Global patent litigation dataset” by Darts-ip is licensed under a Creative Commons Attribution 4.0 International License.
Application filed by Beijing E-Henxen Authentication Technologies Co., Ltd. filed Critical Beijing E-Henxen Authentication Technologies Co., Ltd.
Publication of WO2007115495A1 publication Critical patent/WO2007115495A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities

Definitions

  • the present invention relates to the field of network security authentication technologies, and in particular, to a CPK-based gateway authentication apparatus and method. Background technique
  • network security certification is shifting from the passive defense of the private information network to the new era of network world security based on the active management of public networks (such as the Internet).
  • public networks such as the Internet.
  • the public network is characterized by large scale, many user terminals, up to tens of millions of classes, even hundreds of billions, and a wide geographical area, covering every corner of the world.
  • the basic security of the public network is the credibility of the network.
  • how to authenticate the source credibility of the network resources is the primary concern of the public whether to use the network.
  • the existing network security authentication can be divided into two types, namely, symmetric key technology and asymmetric key technology.
  • the asymmetric key technology is obtained in the network security authentication because it can avoid transmitting the decryption key, that is, the private key through the network. More and more widely used.
  • PKI Public Key Infrastructure
  • the public key system is currently the most widely used encryption system. In this system, the encryption key and the decryption key are different. The sender sends the encrypted information using the recipient's public key, and the receiver reuses himself. A proprietary private key is used for decryption. This method not only ensures the confidentiality of the information, but also ensures that the information is not reliable.
  • public key systems are widely used for CA authentication and digital signatures. And areas such as key exchange.
  • PKI Public key infrastructure
  • PKI is an important component of the information security infrastructure and a universally applicable network security infrastructure. PKI is a concept put forward by American scholars in the 1980s.
  • the digital certificate authority CA the registration authority RA (Registration Authority), and the key management center KM (Key Manager) are all key components of the PKI.
  • each entity in an IBE system, each entity also has an identity. This identifier can be any meaningful string. But the biggest difference from the traditional public key system is that in the IBE system, the identity of the entity itself is the public key of the entity. For example, an email address, name, title, time, etc., or even a combination thereof can be used as the identity and public key of the entity. This system greatly facilitates the management of public passwords. For example, if the sender wants to send an email to mike@network.com, he can directly use the email address as the recipient's public key for encryption. Even one party can send a message while specifying that the receiver can only decrypt at a specific time.
  • An object of the present invention is to provide a CPK-based gateway authentication apparatus and method for overcoming the above-mentioned drawbacks, which realizes that a plurality of user terminals between large-scale public network gateways obtain independent trusted authentication through a network.
  • a CPK-based gateway authentication apparatus provided for the purpose of the present invention includes a client, a certificate issuing machine, and a verification machine;
  • the user end is configured to perform a file by the authentication system, and send the file together with the application form to the issuing machine; the issuing machine is used for verifying the legality of the user and the file, and determining whether according to its legality Issued a gateway certificate;
  • the client includes an ID certificate and a public key matrix of the CPK.
  • the content of the application includes the integrity code of the transmitted file and the signature of the sending user.
  • the issuing machine includes an ID certificate and a public key matrix of the CPK.
  • the issuing machine includes a gateway certificate for checking whether the user is a legitimate user and the user is responsible for the file, and determining whether to send the gateway certificate according to the check result.
  • a CPK-based gateway authentication method which includes the following steps: Step 1) The client authentication system performs a file, and sends the file and the application together to the issuing machine; Step 2) The card verifies the legality of the user and the file, and decides whether to issue the gateway certificate according to its legality;
  • Step 3 The verification machine checks the legality of the gateway certificate and controls the entry and exit of the file.
  • the step 2) may include the following steps:
  • the gateway certificate is issued; otherwise, the gateway certificate will not be issued to the file.
  • the gateway certificate includes a signature of a gateway sample integrity code.
  • the step 3) may include the following steps:
  • the customs clearance is allowed. If there is no gateway certificate, the file cannot be cleared. '
  • the step 3) may further comprise the following steps:
  • the beneficial effects of the present invention are:
  • the CPK-based gateway authentication apparatus and method create a feasible technical method for realizing large-scale network-to-network trust.
  • a gateway is set between the internal network and the public network to authenticate Technology and verification technology implements trusted connections between internal networks or enterprise networks. It can implement authentication between any gateway and any gateway between tens of millions of intranets, and build a gateway for trusted connections between networks. .
  • the CPK-based gateway authentication method of the present invention does not need to maintain a database with a large amount of data, and only some common parameters occupy a small amount of storage space.
  • 1 is a schematic diagram of a gateway authentication transmission process according to the present invention
  • 2 is a schematic diagram of a gateway authentication acceptance process according to the present invention.
  • the Combined Public Key Algorithm is an identification-based public key algorithm, and its key management center generates private key calculation parameters (private key calculation base) and public key calculation parameters (public key calculation base) corresponding to each other; Calculating, according to the identifier provided by the first user, the private key of the first user by using the private key calculation parameter, and providing the generated private key to the first user; and publishing the public key calculation parameter to enable the second user After obtaining the identifier of the first user, the public key of the first user may be calculated according to the identifier of the first user by using the public key calculation parameter.
  • private key calculation base private key calculation base
  • public key calculation parameters public key calculation base
  • Gateway is also known as the network gateway, protocol converter.
  • the gateway is on the transport layer to implement network interconnection. It is the most complex network interconnection device and is only used for different network interconnections of two high-level protocols.
  • the structure of the gateway is similar to that of a router, except for the interconnect layer. Gateways can be used for both WAN and LAN interconnections.
  • the CPK-based gateway authentication apparatus in the embodiment of the present invention is composed of a client terminal 1, a certificate issuing machine 2, and an authentication machine 3.
  • Client 1 ID certificate and public key matrix having CPK, and the generation of the ID certificate and public key matrix with CPK in the present invention is specifically specified in the applicant's Chinese invention patent application 2005100021564 based on the identification key generation device and method The embodiments are described in the full text of the present invention.
  • the ID certificate provides all the parameters and protocols required for authentication, and the public key matrix can calculate the public key of any entity.
  • Set the user Y1 of the intranet A to send the file X to the user Y2 of the intranet B.
  • the client 1 is used for the defined authentication system (such as the CPK email authentication system) to make the file and send the file together with the application to the issuing machine 2.
  • the defined authentication system such as the CPK email authentication system
  • the format of the application can be defined by itself, because the application only works between the internal network issuing machine 2 and each user, as long as the internal network of the issuing machine 2 is approved.
  • the content of the application includes the integrity code MAC1 of the transmission file X and the signature of the sending user: SIG Y1 (MAC1), to confirm the legitimacy of the user Y1, and confirm that the file X is the result of the user Y1.
  • Issuance machine 2 ID certificate and public key matrix with CPK, used to verify the legality of user Y1 and file X.
  • Each intranet may have different security policies. For the secrecy system, there may be a connection between the secrecy system and the secrecy system. When the secret file is sent, the security system and the non-secure system may also occur. In the case of unified connections, each internal network needs to develop a reasonable security policy to meet different needs. The security policies of each intranet may be different, but the common basic requirement is to check whether the user is legitimate and the user is responsible for the file (the digital ID of the integrity code MAC1 and gateway A of the file X). If the file has a user permission range, whether the encrypted file is encrypted or the like. If the conditions are not met, the gateway certificate will not be issued for the file. Because the gateway certificate will work across the network, the gateway certificate must be standardized. There is only one core content of the gateway certificate: SIG A (MAC2);
  • MAC2 is the sample integrity code for a particular bit in file X.
  • the sample bits are given by the file length.
  • the file length be n
  • the first sampling bit be n*(l/3)
  • extract a packet length code the second sampling bit n*(2/3)
  • extract a packet length code MAC2 is the two Group HASH function (integrity code).
  • MAC2 provides proof of the integrity of the gateway and data.
  • the gateway certificate is mutually recognized in the whole network, and provides the certification of the integrity of the file and the gateway certificate, the legitimacy of the internal gateway, and the responsibility of the gateway to the file.
  • Verifier 3 Can be implemented on the current firewall, only the public key matrix is configured, no private key is configured, and the gateway certificate from any gateway is checked.
  • the main task of the verification machine 3 is to check the legality of the gateway certificate and control the entry and exit of the file. For the customs clearance documents, if there is a legal gateway certificate, the customs clearance is allowed. If there is no gateway certificate, the file cannot be cleared. In the case of imported documents, if there is a legal gateway certificate, the normal entry is allowed, and without the gateway certificate, it is stored in the standby server and is awaiting further processing. In order to improve the processing efficiency of the verification machine 3, the verification machine 3 only checks the sample integrity code MAC2 and the digital signature of the gateway.
  • the verification machine 3 of the present invention adapts to various security policies, handles various relationships, and does not affect the order of the existing system, and is applicable to: an intranet having an authentication gateway to an intranet having an authentication gateway; an intranet having an authentication gateway To an intranet or stand-alone without an authentication gateway; a single-machine to an authentication gateway; a single-machine with a CPK authentication system and no CPK authentication system.
  • Step 1) The client 1 authentication system prepares the file, and sends the file and the application together to the issuing machine.
  • Client 1 has a CPK ID certificate and a public key matrix.
  • the ID certificate provides all the parameters and protocols required for authentication.
  • the public key matrix can calculate the public key of any entity.
  • the client 1 authentication system (such as the CPK email authentication system) prepares the file and sends the file together with the application to the issuing machine 2.
  • the format of the application can be defined by itself, because the application only works between the internal network issuing machine 2 and each user, as long as the application The certification machine 2 of the Ministry of the Internet will be approved.
  • the content of the application includes sending the integrity code MAC1 of the file X and the signature of the sending user: SIG Y1 (MAC1) to confirm the legitimacy of the user Y1, and confirming that the file X is the result of the user Y1.
  • Step 2) The issuing machine 2 verifies the legality of the user and the file, and decides whether to issue the gateway certificate according to its legality;
  • the issuing machine 2 has a CPK ID certificate and a public key matrix, and verifies the legality of the user Y1 and the file X.
  • the issuing machine 2 checks whether the user is a legitimate user and the user is responsible for the file (the digital identification of the integrity code MAC1 of the file X and the gateway A). If the file has a user permission range, whether the encrypted file is encrypted or the like. If the conditions are not met, the gateway certificate will not be issued for the file.
  • SIG A MAC2
  • MAC2 is the sample integrity code for a particular bit in file X.
  • the sample bits are given by the file length.
  • the file length be n
  • the first sampling bit be n*(l/3)
  • extract a packet length code the second sampling bit n*(2/3)
  • extract a packet length code MAC2 is the two Group HASH function (integrity code).
  • MAC2 provides proof of the integrity of the gateway and data.
  • the gateway certificate is issued; otherwise, the gateway certificate will not be issued to the file.
  • Step 3 The verification machine 3 checks the legality of the gateway certificate and controls the entry and exit of the file.
  • the verification machine 3 is implemented on a firewall, and only the public key matrix is configured, and the private key is not configured, which checks the gateway certificate from any gateway.
  • the verification machine 3 checks the legality of the gateway certificate and controls the entry and exit of the file.
  • For the customs clearance document if there is a legal gateway certificate, the customs clearance is allowed. If there is no gateway certificate, the document cannot be cleared.
  • the verification machine 3 In the case of imported documents, if they have a legal gateway certificate, they are allowed to enter normally, and if there is no customs certificate, they are stored in the standby server for further processing.
  • the verification machine 3 only checks the sample integrity code MAC2 and the digital signature of the gateway.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Description

基于 GPK的网关认证装置及方法 技术领域
本发明涉及网络安全认证技术领域， 特别是涉及一种基于 CPK的网关认证 装置及方法。 背景技术
20世纪 90年代中期， 随着互联网的引进， 外国的防火墙技术也开始流入中 国。 当时中国就提出在防火墙的基础上， 构建进出都能控制的保密网关的设想， 并为保密系统研制出我国第一代保密网关。但是在防火墙产生的网关证与终端所 产生的文件捆绑技术和规模化认证技术上碰到难点，一直搁置下来。这个问题已 经成为防火墙保密网关中的瓶颈问题，成为保密网关在实际中能否投入应用的关 键问题。 但是， 很遗憾的是， 直到目前业界还没有可行的理想产品。
同时，随着网络技术的发展，网络安全认证正从专用信息网的被动防御为主 过渡到以公众网 （如国际互联网 Internet) 的主动管理为主的网络世界安全的新 时代。与专用信息网比较起来， 公众网的特点是规模大， 用户终端多， 高达几千 万级， 甚至千亿级， 地域广， 遍布世界每个角落。
一般地，随着公众网使用人员的增加， 良莠不齐的网络资源也逐渐进入公众 网络中， 病毒、木马、恶意代码如 ROOTKIT等常常出现在公众用户所使用的网 络资源中， 甚至干扰用户使用， 成为用户是否使用网络资源的主要原因。
公众网对网络的基本安全是网络的可信性， 终端在使用网络资源的过程中， 如何对网络资源的来源可信性认证， 是公众是否使用网络的首要关心的问题。
现有的网络安全认证可分为两类，即对称密钥技术和非对称密钥技术，其中， 非对称密钥技术由于可以避免通过网络传递解密密钥即私钥而在网络安全认证 中得到越来越广泛的应用。
非对称密钥中较为常用的安全认证技术是公钥基础设施 （Pubic Key Infrastructure, PKI)。 公钥体制是目前应用最广泛的一种加密体制， 在这一体制 中，加密密钥与解密密钥各不相同，发送信息的人利用接收者的公钥发送加密信 息， 接收者再利用自己专有的私钥进行解密。 这种方式既保证了信息的机密性， 又能保证信息具有不可氏赖性。 目前， 公钥体制广泛地用于 CA认证、数字签名 和密钥交换等领域。 公钥基础设施 (PKI)是信息安全基础设施的一个重要组成部 分， 是一种普遍适用的网络安全基础设施。 PKI是 20世纪 80年代由美国学者提 出来了的概念， 实际上， 授权管理基础设施、可信时间戳服务系统、安全保密管 理系统、统一的安全电子政务平台等的构筑都离不幵它的支持。数字证书认证中 心 CA、审核注册中心 RA(Registration Authority)、密钥管理中心 KM(Key Manager) 都是组成 PKI的关键组件。
另一种较为具有应用前景的网络安全认证技术是基于标识的密码技术
(Identity-Based Encryption, IBE),在 IBE系统中，每个实体同样具有一个标识。 该标识可以是任何有意义的字符串。 但和传统公钥系统最大的不同是， 在 IBE 系统中，实体的标识本身就是实体的公开密钥。例如，可以用 Email地址、姓名、 职位、时间等甚至它们的组合作为实体的标识和公钥。该系统极大的方便了公开 密码的管理。 例如， 发送方想发送一封 Email到 mike@network.com,他可以直接 使用该 Email地址作为接收方的公钥进行加密。甚至， 一方可以发信的同时指定 接收方只能在特定的时间才能解密。
但是，现有的这些非对称网络安全认证加密技术都需要维护具有大量数据的 数据库存在， 占用大量的存储空间， 运行时的效率不高， 处理速度很慢， 无法在 公众网络网关这样的网络设备中使用。 发明内容
本发明的目的在于克服上述缺陷而提供的一种基于 CPK的网关认证装置及 方法， 其实现大规模的公众网网关之间多个用户终端通过网络获得独立可信认 证。
为实现本发明目的而提供的一种基于 CPK的网关认证装置， 包括用户端、 发证机和验证机；
所述用户端，用于认证系统做好文件，并将文件和申请书一并发送到发证机； 所述发证机，用于验证用户和文件的合法性，并根据其合法性决定是否发给 网关证；
验证机， 检查网关证的合法性， 控制文件进出。
所述用户端包括 CPK的 ID证书和公钥矩阵。
所述申请书的内容包括发送文件的完整性码和发送用户的签名。 所述发证机包括 CPK的 ID证书和公钥矩阵。
所述发证机包括网关证， 用于检査用户是否合法用户和用户对文件的负责 性， 并根据检查结果判断是否发给网关证。
为实现本发明目的又提供了一种基于 CPK的网关认证方法，包括下列步骤： 步骤 1 ) 用户端认证系统做好文件， 并将文件和申请书一并发送到发证机； 步骤 2)发证机验证用户和文件的合法性， 并根据其合法性决定是否发给网 关证；
步骤 3 )验证机检查网关证的合法性， 并控制进出文件。
所述步骤 2)可以包括下列步骤：
如果发证机验证用户和文件合法， 则发放网关证； 否则， 将不给该文件发放 网关证。
所述网关证包括网关抽样完整性码的签名。
所述步骤 3)可以包括下列步骤：
对出关文 —具 合法网关证， 就允许出关， 如果没有网关证， 这个文 件就不能出关。 '
所述步骤 3)还可以包括下列步骤：
对进口文件来说， 如果带有合法网关证， 就允许正常进关， 而没有网关证， 则存储在备用服务器中， 等待进一步处理。
本发明的有益效果是： 基于 CPK的网关认证装置及方法， 为实现规模化的 网间可信创造了可行的技术方法，在公众网络中，在内部网与公众网之间设置网 关， 以认证技术和验证技术在各内部网或者企业网之间实现可信连接，可以在数 千万各内部网之间实现任何网关对任何网关之间的认证，构建网络间可信连接的 基础设施一网关。 本发明的基于 CPK的网关认证方法， 不需要维护具有大量数 据的数据库存在，而且只有一些公用参数占用小量的存储空间， 由于以标识生成 私钥， 并将公钥公开， 因此其运行时的效率很高， 处理速度很快， 在公众网络网 关这样的网络设备中可以得到广泛使用。其在可信网络世界的建设中，将同可信 计算、 可行应用一起组成网络技术影响全局发展的基础技术。 附图说明
图 1为本发明的网关认证发送过程示意图; 图 2为本发明的网关认证接受过程示意图。 具体实施方式
下面结合附图 1和 1进一步详细说明本发明的一种基于 CPK的网关认证装 置及方法。
组合公钥算法 （Combined Pubic Key, CPK) 是基于标识的公钥算法， 其密 钥管理中心生成彼此对应的私钥计算参数（私钥计算基）和公钥计算参数（公钥 计算基)； 根据第一用户提供的标识， 利用所述私钥计算参数计算第一用户的私 钥， 并将所产生的私钥提供给第一用户； 以及公布所述公钥计算参数， 以使得第 二用户在获得第一用户的标识后，可根据第一用户的标识，利用所述的公钥计算 参数， 计算第一用户的公钥。
网关 (Gateway)又称网间连接器、 协议转换器。 网关在传输层上以实现网络 互连， 是最复杂的网络互连设备， 仅用于两个高层协议不同的网络互连。 网关的 结构也和路由器类似， 不同的是互连层。 网关既可以用于广域网互连， 也可以用 于局域网互连。
本发明实施例中的基于 CPK的网关认证装置， 由用户端 1、 发证机 2和验 证机 3构成。
用户端 1 : 具有 CPK的 ID证书和公钥矩阵， 本发明中的具有 CPK的 ID证 书和公钥矩阵的产生，在申请人的中国发明专利申请 2005100021564基于标识的 密钥产生装置及方法中具体实施方式所述， 在本发明中全文引用。 ID证书提供 认证所需所有参数和协议， 公钥矩阵能计算任何实体的公钥。 设 ·. 内部网 A的 用户 Y1给内部网 B的用户 Y2发送文件 X。 用户端 1用于定义的认证系统 （如 CPK email认证系统） 做好文件， 并将文件和申请书一并发送到发证机 2。 申请 书的格式可以自行定义，因为申请书只在本内部网发证机 2和各个用户之间起作 用， 只要本内部网的发证机 2认可就行。 申请书的内容包括发送文件 X的完整 性码 MAC1和发送用户的签名： SIGY1 (MAC1 ), 以确认用户 Y1的合法性， 并 确认文件 X是用户 Y1的所为。
发证机 2: 具有 CPK的 ID证书和公钥矩阵， 用于验证用户 Y1和文件 X的 合法性。各内部网可能有不同的安全策略， 对保密系统而言， 可能发生保密系统 和保密系统相连接， 发送等级秘密文件的情况， 也可能发生保密系统和非保密系 统连接的情况， 因此， 各内部网需要制定满足不同需求的合理的安全策略。各内 部网的安全策略可能不相同，但其共同的基本要求是必须检查用户是否合法用户 和用户对文件的负责性 （对文件 X的完整性码 MAC1和网关 A的数字鉴名）。 如该文件是否用户权限范围， 该加密的文件是否加了密等。如果不符合条件， 则 不给该文件发放网关证。因为网关证将在全网范围起作用， 因此网关证必须标准 化。 网关证的核心内容只有一项： SIGA(MAC2);
MAC2是文件 X中特定位的抽样完整性码。 抽样位由文件长度给出。 设文 件长度为 n，第一个抽样位为 n*(l/3)，抽取一分组长度码，第二抽样位位 n*(2/3)， 再抽取一分组长度码， MAC2是这两组 HASH函数（完整性码）。 MAC2为网关 证和数据的一体性提供证明。
本发明的网关证的标准化设计， 网关证在全网互认，且提供文件和该网关证 的一体性、 该内部网关的合法性、 该网关对文件的负责性等证明。
验证机 3: 可以在目前的防火墙上实现， 只配置公钥矩阵， 不配置私钥， 用 于检査来自任何网关的网关证。验证机 3主要任务是检查网关证的合法性，并控 制进出文件。对出关文件来说，具有合法网关证，就允许出关，如果没有网关证， 这个文件就不能出关。就进口文件来说，如果带有合法网关证，就允许正常进关， 而没有网关证， 则存储在备用服务器中， 等待进一步处理。 为了提高验证机 3 的处理效率， 验证机 3只检查抽样完整性码 MAC2和网关的数字签名。
本发明的验证机 3适应各种不同安全策略，处理好各种关系，不影响现有系 统的秩序，适用于： 有认证网关的内部网到有认证网关的内部网； 有认证网关的 内部网到没有认证网关的内部网或单机； 单机到有认证网关； 单机分配备 CPK 认证系统和没有配备 CPK认证系统两种情况。
下面详细描述本发明的基于 CPK的网关认证方法， 其包括下列步骤： 步骤 1 )用户端 1认证系统做好文件， 并将文件和申请书一并发送到发证机
2;
用户端 1具有 CPK的 ID证书和公钥矩阵， ID证书提供认证所需所有参数 和协议，公钥矩阵能计算任何实体的公钥。用户端 1认证系统（如 CPK email认 证系统）做好文件， 并将文件和申请书一并发送到发证机 2。 申请书的格式可以 自行定义，因为申请书只在本内部网发证机 2和各个用户之间起作用，只要本内 部网的发证机 2认可就行。 申请书的内容包括发送文件 X的完整性码 MAC1和 发送用户的签名： SIGY1 (MAC1 ) , 以确认用户 Y1的合法性， 并确认文件 X是 用户 Y1的所为。
步骤 2 )发证机 2验证用户和文件的合法性， 并根据其合法性决定是否发给 网关证；
发证机 2具有 CPK的 ID证书和公钥矩阵,验证用户 Y1和文件 X的合法性。 发证机 2检查用户是否合法用户和用户对文件的负责性 （对文件 X的完整性码 MAC1和网关 A的数字鉴名）。 如该文件是否用户权限范围， 该加密的文件是否 加了密等。如果不符合条件， 则不给该文件发放网关证。 网关证的核心内容只有 一项： SIGA(MAC2);
MAC2是文件 X中特定位的抽样完整性码。 抽样位由文件长度给出。 设文 件长度为 n，第一个抽样位为 n*(l/3)，抽取一分组长度码，第二抽样位位 n*(2/3)， 再抽取一分组长度码， MAC2是这两组 HASH函数（完整性码）。 MAC2为网关 证和数据的一体性提供证明。
如果发证机 2验证用户和文件合法， 则发放网关证； 否则， 将不给该文件发 放网关证。
步骤 3 ) 验证机 3检查网关证的合法性， 并控制进出文件。
在本实施例中验证机 3是在防火墙上实现， 只配置公钥矩阵， 不配置私钥， 其检查来自任何网关的网关证。验证机 3检查网关证的合法性，并控制进出文件。 对出关文件来说， 具有合法网关证， 就允许出关， 如果没有网关证， 这个文件就 不能出关。就进口文件来说， 如果带有合法网关证， 就允许正常进关， 而没有网 关证，则存储在备用服务器中，等待进一步处理。为了提高验证机 3的处理效率， 验证机 3只检查抽样完整性码 MAC2和网关的数字签名。
本实施例是使本领域普通技术人员理解本发明，而对本发明所进行的详细描 述，但可以想到，在不脱离本发明的权利要求所涵盖的范围内还可以做出其它的 变化和修改， 这些变化和修改均在本发明的保护范围内。

Claims

权利要求书
1.一种基于 CPK的网关认证装置， 其特征在于， 包括用户端 (1)、发证机 (2) 和验证机 (3);
所述用户端 (1)， 用于认证系统做好文件， 并将文件和申请书一并发送到发 证机 (2);
所述发证机 (2)， 用于验证用户和文件的合法性， 并根据其合法性决定是否 发给网关证；
验证机 (3)， 检查网关证的合法性， 控制文件进出。
2. 根据权利要求 1所述的网关认证装置， 其特征在于， 所述用户端 (1)包括 CPK的 ID证书和公钥矩阵。
3. 根据权利要求 1所述的网关认证装置， 其特征在于， 所述申请书的内容 包括发送文件的完整性码和发送用户的签名。
4. 根据权利要求 1所述的网关认证装置， 其特征在于， 所述发证机 (2)包括 包括 CPK的 ID证书和公钥矩阵。
5. 根据权利要求 4所述的网关认证装置， 其特征在于， 所述发证机 (2)包括 网关证，用于检查用户是否合法用户和用户对文件的负责性， 并根据检査结果判 断是否发给网关证。
6. 一种基于 CPK的网关认证方法， 其特征在于， 包括下列步骤： 步骤 1 )用户端 (1)认证系统做好文件， 并将文件和申请书一并发送到发证机
(2);
步骤 2)发证机 (2)验证用户和文件的合法性， 并根据其合法性决定是否发给 网关证；
步骤 3 ) 验证机 (3)检查网关证的合法性， 并控制进出文件。
7. 根据权利要求 6所述的网关认证办法， 其特征在于， 所述步骤 2) 包括 下列步骤：
如果发证机 (2)验证用户和文件合法， 则发放网关证； 否则， 将不给该文件 发放网关证。
8. 根据权利要求 7所述的网关认证办法， 其特征在于， 所述网关证包括网 关抽样完整性码的签名。
9. 根据权利要求 6所述的网关认证办法， 其特征在于， 所述步骤 3 )包括 下列步骤：
对出关文件来说， 具有合法网关证， 就允许出关， 如果没有网关证， 这个文 件就不能出关。
10. 根据权利要求 9所述的网关认证办法， 其特征在于， 所述步骤 3 )还包 括下列步骤-
.对进口文件来说， 如果带有合法网关证， 就允许正常进关， 而没有网关证， 则存储在备用服务器中， 等待进一步处理。
PCT/CN2007/001130 2006-04-10 2007-04-09 Procédé et appareil d'authentification de passerelle sur la base d'une clé publique combinée WO2007115495A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2006100727473A CN1829150B (zh) 2006-04-10 2006-04-10 一种基于cpk的网关认证装置及方法
CN200610072747.3 2006-04-10

Publications (1)

Publication Number Publication Date
WO2007115495A1 true WO2007115495A1 (fr) 2007-10-18

Family

ID=36947298

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2007/001130 WO2007115495A1 (fr) 2006-04-10 2007-04-09 Procédé et appareil d'authentification de passerelle sur la base d'une clé publique combinée

Country Status (2)

Country Link
CN (1) CN1829150B (zh)
WO (1) WO2007115495A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103618607A (zh) * 2013-11-29 2014-03-05 北京易国信科技发展有限公司 一种数据安全传输和密钥交换方法
CN107204851A (zh) * 2017-06-15 2017-09-26 贵州大学 基于cpk的id证书私钥阵列的安全生成及存储容器及其使用方法

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101668009B (zh) * 2009-09-27 2012-12-12 北京联合智华微电子科技有限公司 路由地址的安全处理方法和系统
CN102195990A (zh) * 2011-06-27 2011-09-21 北京虎符科技有限公司 Cpk认证加密方法在voip上的应用
CN104753671A (zh) * 2013-12-27 2015-07-01 东方斯泰克信息技术研究院（北京）有限公司 网络实体间互联方法与装置和网际网的构建方法与装置
CN111556064B (zh) * 2020-05-06 2022-03-11 广东纬德信息科技股份有限公司 基于电力网关的密钥管理方法、装置、介质及终端设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2002015523A1 (en) * 2000-08-18 2002-02-21 Nokia Corporation Method and system for authentification of a mobile user via a gateway
CN1444386A (zh) * 2001-12-31 2003-09-24 西安西电捷通无线网络通信有限公司 宽带无线ip系统移动终端的安全接入方法
KR20050100952A (ko) * 2004-04-16 2005-10-20 주식회사 퓨쳐시스템 계층 권한 인증방법 및 이를 이용한 전자상거래 시스템
US6986460B2 (en) * 2001-12-31 2006-01-17 Bellsouth Intellectual Property Corporation Credit card validation for an interactive wireless network

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1262087C (zh) * 2005-01-14 2006-06-28 南相浩 基于标识的密钥产生方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2002015523A1 (en) * 2000-08-18 2002-02-21 Nokia Corporation Method and system for authentification of a mobile user via a gateway
CN1444386A (zh) * 2001-12-31 2003-09-24 西安西电捷通无线网络通信有限公司 宽带无线ip系统移动终端的安全接入方法
US6986460B2 (en) * 2001-12-31 2006-01-17 Bellsouth Intellectual Property Corporation Credit card validation for an interactive wireless network
KR20050100952A (ko) * 2004-04-16 2005-10-20 주식회사 퓨쳐시스템 계층 권한 인증방법 및 이를 이용한 전자상거래 시스템

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103618607A (zh) * 2013-11-29 2014-03-05 北京易国信科技发展有限公司 一种数据安全传输和密钥交换方法
CN103618607B (zh) * 2013-11-29 2016-07-06 北京信长城技术研究院 一种数据安全传输和密钥交换方法
CN107204851A (zh) * 2017-06-15 2017-09-26 贵州大学 基于cpk的id证书私钥阵列的安全生成及存储容器及其使用方法

Also Published As

Publication number Publication date
CN1829150B (zh) 2011-06-01
CN1829150A (zh) 2006-09-06

Similar Documents

Publication Publication Date Title
US8340283B2 (en) Method and system for a PKI-based delegation process
KR100872099B1 (ko) 컴퓨터 그리드에 대한 싱글-사인-온 액세스를 위한 방법 및시스템
JP4600851B2 (ja) コンピュータシステム間でメッセージを通信するための安全なコンテキストの確立
US9407617B2 (en) Pass-thru for client authentication
JP5021215B2 (ja) Ｗｅｂサービス用の信頼できる第三者認証
EP2404427B1 (en) Method and apparatus for securing network communications
JP4783340B2 (ja) 移動ネットワーク環境におけるデータトラフィックの保護方法
WO2007115495A1 (fr) Procédé et appareil d'authentification de passerelle sur la base d'une clé publique combinée
US8392703B2 (en) Electronic signature verification method implemented by secret key infrastructure
CN113329003B (zh) 一种物联网的访问控制方法、用户设备以及系统
KR20040002036A (ko) 보안성이 강화된 단순 인증 방법
Pranata et al. A distributed mechanism for secure collaboration in Digital Ecosystems
Wang et al. A Verified Secure Protocol Model of OAuth Dynamic Client Registration
Torrellas et al. An authentication protocol for agent platform security manager
Van Droogenbroeck Introduction to PKI-public key infrastructure
Thinn et al. Secure Framework for e-Government Application using Short-Lived Certificate and Hybrid Encryption
Infrastructure Introduction to PKI-Public Key Infrastructure
Karagodin Public key infrastructure-enabled services
Qiang et al. Research on Identification in E-commerce
Chen et al. Applied Cryptography in E-mail Services and Web Services
Leahu et al. Security Aspects in Virtual and Remote Laboratories-Implementations in the Virtual Electro Lab project.

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 07720703

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 07720703

Country of ref document: EP

Kind code of ref document: A1