WO2011015007A1 - Procédé d'authentification de sécurité à distance - Google Patents

Procédé d'authentification de sécurité à distance Download PDF

Info

Publication number
WO2011015007A1
WO2011015007A1 PCT/CN2009/075392 CN2009075392W WO2011015007A1 WO 2011015007 A1 WO2011015007 A1 WO 2011015007A1 CN 2009075392 W CN2009075392 W CN 2009075392W WO 2011015007 A1 WO2011015007 A1 WO 2011015007A1
Authority
WO
WIPO (PCT)
Prior art keywords
entity
key
secure channel
remote
nonce
Prior art date
Application number
PCT/CN2009/075392
Other languages
English (en)
Chinese (zh)
Inventor
肖跃雷
曹军
黄振海
葛莉
Original Assignee
西安西电捷通无线网络通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 西安西电捷通无线网络通信有限公司 filed Critical 西安西电捷通无线网络通信有限公司
Publication of WO2011015007A1 publication Critical patent/WO2011015007A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/305—Authentication, i.e. establishing the identity or authorisation of security principals by remotely controlling device operation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/33—User authentication using certificates
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/42—User authentication using separate channels for security data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H04L9/0841—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols
    • H04L9/0844—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2101—Auditing as a secondary aspect
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2103—Challenge-response
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security

Definitions

  • the present invention relates to the field of network security, and in particular to a secure remote proof method. Background technique
  • the remote proof method means that an entity proves its platform configuration status to a remote entity; the Trusted Computing Group (TCG) Trusted Network Connect (TNC) architecture is enhanced based on remote proof methods.
  • TCG Trusted Computing Group
  • TAC Trusted Network Connect
  • the current remote proof methods are mainly:
  • Step 1) Entity A and entity B perform a user authentication process, in which a secure channel between entity A and entity B is established in the user authentication process, such as: Performing a Transport Layer Security (TLS) to implement user authentication and Establish a safe passage;
  • TLS Transport Layer Security
  • Step 2) Entity A sends a remote certificate to entity B in the secure channel established in step 1), such as: random number nonce;
  • Step 3) After receiving the remote attestation challenge in step 2) in the secure channel established in step 1), entity B first obtains the remote attestation data of the platform used by entity B, and then establishes the security established in step 1). Send these remote proof data to entity A in the channel, such as: Platform ID The Attestation Identity Key (AIK) certificate, the Platform Configuration Register (PCR) value, the Stored Measurement Log (SML), and the private key AIKpriv to nonce corresponding to the public key in the AIK certificate. Signature of PCR value Sign ⁇ PCR, nonce; AIKpriv ⁇ , etc.
  • AIK Platform ID The Attestation Identity Key
  • PCR Platform Configuration Register
  • SML Stored Measurement Log
  • Step 4) After receiving the remote proof data of step 3) in the secure channel established in step 1), entity A verifies the remote proof data, such as: verifying the nonce, verifying the AIK certificate, verifying the signature ⁇ PCR, nonce; AIKpriv ⁇ and use the PCR value to verify the SML, so that the platform configuration status of the entity B can be known.
  • entity A verifies the remote proof data, such as: verifying the nonce, verifying the AIK certificate, verifying the signature ⁇ PCR, nonce; AIKpriv ⁇ and use the PCR value to verify the SML, so that the platform configuration status of the entity B can be known.
  • the present invention provides a secure remote proof method.
  • a secure remote attestation method comprising the following steps:
  • Entity A and entity B perform a user authentication process, which includes establishing a secure channel between entity A and entity B;
  • step 1) If step 1) has completed the establishment of the secure channel, proceed to step 3); if step 1) does not complete the establishment of the secure channel, entity A and entity B negotiate between entity A and entity B through temporary key exchange. The session key, complete the establishment of the secure channel, and then proceed to step 3);
  • Entity A sends a remote attestation challenge to Entity B in the established secure channel
  • the entity B After receiving the remote attestation challenge of step 3), the entity B obtains the remote attestation data of the entity B, and sends the remote attestation data to the entity A in the secure channel that has been established; 5) After receiving the remote proof data of step 4), the entity A verifies the remote proof data, thereby obtaining the platform configuration status of the entity B.
  • the user authentication process in step 1) above is the TLS authentication process.
  • step 1) if the user authentication process establishes a master key between the entity A and the entity B, the user authentication process includes a session key negotiation process performed by the entity A and the entity B by using the master key. To negotiate the key of the established secure channel in step 1).
  • Entity A and entity B in the above step 2) negotiate the session key between entity A and entity B through temporary key exchange, and use Diffie-Hellman key exchange to negotiate the session key between entity A and entity B. .
  • the remote proof challenge in step 3 above is the random number nonce.
  • the platform signature in the remote proof data of the entity B contains the key of the secure channel established in step 1).
  • the remote proof data of the above entity B includes: AIK certificate, PCR value, SML and signature of the private key AIKpriv corresponding to the public key in the AIK certificate to SHA1 (nonce, sk), PCR value Sign ⁇ PCR, SHA1 (nonce, ski AIKpriv ⁇ , where SHA1 ( nonce , ski ) is the hash value calculated by the hash function SHA1 for the random number nonce and the key ski of the secure channel established in step 1).
  • the platform signature in the remote proof data of the entity B contains the user secret information and the key of the secure channel established in step 2). .
  • the remote proof data of the above entity B includes: AIK certificate, PCR value, SML and the private key AIKpriv corresponding to the public key in the AIK certificate.
  • the user secret information userk is secret information related only to the entity B or secret information shared by the entity A and the entity B.
  • the above-mentioned secret information relating only to the entity B is the user name and password registered by the entity B at the entity A; the secret information shared by the entity A and the entity B is the shared key of the entity A and the entity B.
  • the remote attestation method of the present invention binds the secure channel key to the remote attestation data, and enhances the security of the remote proof; and the secure channel of the required binding can be established before the remote proof, or can be performed in the remote attestation process.
  • the establishment was completed and the scope of application was expanded. detailed description
  • the present invention binds the key of the secure channel established in the user authentication process, or binds the user secret information and the key of the secure channel established by the non-user authentication process, and the specific method is remotely.
  • the key of the secure channel established by the user authentication process, or the user secret information and the key of the secure channel established by the non-user authentication process are used as input of the platform signature (a signature that can prove the identity of the platform, such as: AIK signature). parameter.
  • the remote attestation method provided by the present invention specifically includes the following steps:
  • Entity A and Entity B perform a user authentication process, such as: TLS authentication process. If the user authentication process establishes a master key between the entity A and the entity B, the user authentication process further includes a session key negotiation process performed by the entity A and the entity B, that is, a key of the secure channel is negotiated;
  • step 1) establishes a secure channel between entity A and entity B, step 3); if step 1) fails to establish a secure channel between entity A and entity B, entity A and entity B pass Temporary key exchange to negotiate the session key between them, that is, to negotiate the key of the secure channel, such as: D Diffie-Hellman key exchange to negotiate the key of the secure channel.
  • Temporary key exchange to negotiate the session key between them, that is, to negotiate the key of the secure channel, such as: D Diffie-Hellman key exchange to negotiate the key of the secure channel.
  • Entity A sends a remote proof challenge to entity B in the secure channel established in step 1) or step 2), such as: random number nonce;
  • entity B After receiving the information of step 3), entity B obtains the remote proof data of entity B, and then sends it to entity A in the secure channel established in step 1) or step 2). If the secure channel is the secure channel established in step 1), the platform signature in the remote proof data of entity B contains the key of the secure channel established in step 1).
  • the remote proof data of entity B is: AIK certificate, PCR value, SML and the private key AIKpriv corresponding to the public key in the AIK certificate.
  • the secure channel, the platform signature in the remote proof data of entity B contains the user secret information and the key of the secure channel established in step 2).
  • the remote proof data of entity B is: AIK certificate, PCR value, SML and the private key AIKpriv corresponding to the public key in the AIK certificate.
  • the hash value may be secret information related only to the entity B, such as: the user name and password registered by the entity B at the entity A, and may also be secret information shared by the entity A and the entity B, such as: a shared key.
  • entity A After receiving the information of step 4), entity A verifies the remote proof data, so as to know the platform configuration status of entity B.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

La présente invention concerne un procédé d'authentification de sécurité à distance ; le procédé comprend les étapes suivantes : 1) une entité A et une entité B exécutent le procédé d'authentification utilisateur, qui comprend l'établissement d'un canal de sécurité entre l'entité A et l'entité B ; 2) si l'étape 1) a achevé l'établissement du canal de sécurité, une étape 3) est mise en œuvre ; si l'étape 1) n'a pas achevé l'établissement du canal de sécurité, l'entité A et l'entité B négocient une clé de session entre l'entité A et l'entité B par un échange de clé temporelle et établissent la clé du canal de sécurité ; 3) l'entité A envoie une question d'authentification distante à l'entité B dans le canal de sécurité ; 4) l'entité B obtient les données d'authentification distante de l'entité B après avoir reçu les informations de l'étape 3) et envoie les données d'authentification à l'entité A dans le canal de sécurité ; 5) l'entité A vérifie les données d'authentification distante après avoir reçu les informations de l'étape 4), la condition de configuration de la plate-forme de l'entité B est donc obtenue. Le procédé améliore la sécurité de l'authentification distante et étend sa plage d'application.
PCT/CN2009/075392 2009-08-03 2009-12-08 Procédé d'authentification de sécurité à distance WO2011015007A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200910305127.3 2009-08-03
CN2009103051273A CN101610273B (zh) 2009-08-03 2009-08-03 一种安全的远程证明方法

Publications (1)

Publication Number Publication Date
WO2011015007A1 true WO2011015007A1 (fr) 2011-02-10

Family

ID=41483854

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2009/075392 WO2011015007A1 (fr) 2009-08-03 2009-12-08 Procédé d'authentification de sécurité à distance

Country Status (2)

Country Link
CN (1) CN101610273B (fr)
WO (1) WO2011015007A1 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103560887A (zh) * 2013-11-04 2014-02-05 深圳数字电视国家工程实验室股份有限公司 智能终端远程证明方法和系统
WO2020125942A1 (fr) * 2018-12-18 2020-06-25 Telefonaktiebolaget Lm Ericsson (Publ) Attestation d'une entité de plateforme

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101989990A (zh) * 2010-11-10 2011-03-23 西安西电捷通无线网络通信股份有限公司 一种适合可信连接架构的安全远程证明方法及系统
US11895240B2 (en) * 2016-12-15 2024-02-06 Nec Corporation System, apparatus, method and program for preventing illegal distribution of an access token
CN112134692B (zh) * 2019-06-24 2022-02-15 华为技术有限公司 一种远程证明方式的协商方法及装置
CN112688782B (zh) * 2019-10-17 2023-09-08 华为技术有限公司 一种组合式设备的远程证明方法及设备
CN114500085B (zh) * 2022-02-21 2023-03-07 河南科技大学 一种面向多媒体边缘云安全的远程证明方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1668005A (zh) * 2005-02-21 2005-09-14 西安西电捷通无线网络通信有限公司 一种适合有线和无线网络的接入认证方法
CN1972306A (zh) * 2006-12-01 2007-05-30 浙江大学 安全套接层协议安全代理多重认证的实现方法
WO2007104923A1 (fr) * 2006-03-16 2007-09-20 British Telecommunications Public Limited Company Procédés, appareils et logiciel d'authentification de dispositifs temporairement pourvus d'un module sim pour enregistrer une question-réponse
CN101075874A (zh) * 2007-06-28 2007-11-21 腾讯科技（深圳）有限公司 认证方法和认证系统

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100583768C (zh) * 2007-04-27 2010-01-20 中国科学院软件研究所 基于安全需求的远程证明方法及其系统
CN101344903A (zh) * 2008-09-02 2009-01-14 中国科学院软件研究所 基于tpm的多实例动态远程证明方法
CN101477602A (zh) * 2009-02-10 2009-07-08 浪潮电子信息产业股份有限公司 一种可信计算环境中远程证明的方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1668005A (zh) * 2005-02-21 2005-09-14 西安西电捷通无线网络通信有限公司 一种适合有线和无线网络的接入认证方法
WO2007104923A1 (fr) * 2006-03-16 2007-09-20 British Telecommunications Public Limited Company Procédés, appareils et logiciel d'authentification de dispositifs temporairement pourvus d'un module sim pour enregistrer une question-réponse
CN1972306A (zh) * 2006-12-01 2007-05-30 浙江大学 安全套接层协议安全代理多重认证的实现方法
CN101075874A (zh) * 2007-06-28 2007-11-21 腾讯科技（深圳）有限公司 认证方法和认证系统

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103560887A (zh) * 2013-11-04 2014-02-05 深圳数字电视国家工程实验室股份有限公司 智能终端远程证明方法和系统
CN103560887B (zh) * 2013-11-04 2016-09-28 深圳数字电视国家工程实验室股份有限公司 智能终端远程证明方法和系统
WO2020125942A1 (fr) * 2018-12-18 2020-06-25 Telefonaktiebolaget Lm Ericsson (Publ) Attestation d'une entité de plateforme
US11818124B2 (en) 2018-12-18 2023-11-14 Telefonaktiebolaget Lm Ericsson (Publ) Attestation of a platform entity

Also Published As

Publication number Publication date
CN101610273B (zh) 2011-12-28
CN101610273A (zh) 2009-12-23

Similar Documents

Publication Publication Date Title
CN108111301B (zh) 基于后量子密钥交换实现ssh协议的方法及其系统
Chen et al. Server-aided public key encryption with keyword search
ES2509040T3 (es) Método para una conexión de red fiable basada en autenticación entre tres elementos del mismo nivel
US8533806B2 (en) Method for authenticating a trusted platform based on the tri-element peer authentication(TEPA)
JP5259724B2 (ja) ３エレメントピア認証に基づく信頼されているネットワークアクセス制御方法
CN101741842B (zh) 一种基于可信计算实现可信ssh的方法
US8826368B2 (en) Platform authentication method suitable for trusted network connect architecture based on tri-element peer authentication
JP2019519987A (ja) ブロックチェーンに基づくアイデンティティ認証方法、装置、ノード及びシステム
CN110603783A (zh) 采用可信硬件的安全动态阈值签名方案
WO2011015007A1 (fr) Procédé d'authentification de sécurité à distance
CN108173827B (zh) 基于区块链思维的分布式sdn控制平面安全认证方法
US10050789B2 (en) Kerberos preauthentication with J-PAKE
KR101739203B1 (ko) 일회용 개인키 기반 전자 서명과 동형 암호를 이용한 패스워드 기반 사용자 인증 방법
WO2011063744A1 (fr) Procédé, système et dispositif d'authentification d'identité dans l'authentification par protocole d'authentification extensible (eap)
WO2022143935A1 (fr) Procédé et système basés sur une chaîne de blocs pour un contrôle d'accès sdp
WO2022143498A1 (fr) Procédé et appareil de commande d'accès, et dispositif côté réseau, terminal et nœud de chaîne de blocs
US8356175B2 (en) Methods and apparatus to perform associated security protocol extensions
Tanwar et al. A proposed scheme for remedy of man-in-the-middle attack on certificate authority
US10797888B1 (en) Methods for secured SCEP enrollment for client devices and devices thereof
CN107979466B (zh) 基于Diffie-Hellman协议的iSCSI协议安全增强方法
JP6266170B2 (ja) ３層セキュリティおよび算出アーキテクチャ
CN102098397A (zh) 一种基于ZRTP密钥交换的VoIP媒体流可信传输的实现方法
Lai et al. Design and analysis on trusted network equipment access authentication protocol
CN103139218B (zh) 分离机制网络中可信域间映射更新认证方法
Song et al. Hardening password-based credential databases

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 09847985

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 09847985

Country of ref document: EP

Kind code of ref document: A1