WO2012062136A1

WO2012062136A1 - Method and system for secure remote attestation in a trusted connection architecture

Info

Publication number: WO2012062136A1
Application number: PCT/CN2011/077900
Authority: WO
Inventors: 肖跃雷; 曹军; 王珂; 张国强
Original assignee: 西安西电捷通无线网络通信股份有限公司
Priority date: 2010-11-10
Filing date: 2011-08-02
Publication date: 2012-05-18
Also published as: CN101989990A

Abstract

A method, system and access controller for secure remote attestation suitable for a trusted connection architecture. Binding is performed between the platform signature of a platform authentication process and correlation information from each previously-executed authentication protocol; correlation information from each previously-executed authentication protocol is used as the input parameter to generate a platform signature; then, during a platform authentication process, the multiple protocols executed during a remote attestation process are bound together, thus preventing tampering by intermediary parties and improving remote attestation security.

Description

Secure remote identification method and system suitable for trusted connection architecture This application claims to be submitted to the Chinese Patent Office on November 10, 2011, application number 201010539124.9, and the invention name is "a secure remote certification method and access suitable for trusted connection architecture" The priority of the Chinese patent application of the "controller" is incorporated herein by reference. Technical field

The present invention relates to communication technologies, and in particular, to a secure remote attestation method, system and access controller suitable for a trusted connection architecture. Background technique

With the development of information technology, the problems of malware such as viruses and worms are extremely prominent. More than 35,000 malware have emerged, and more than 40 million computers are infected every year. To contain such attacks, not only through secure transmission and inspection when data is entered, but also from the source, that is, from each terminal connected to the network. Traditional security defense technologies are no longer able to defend against a wide variety of malicious attacks.

TCG (Trusted Computing Group, International Trusted Computing Group) has developed a Trusted Network Connect (TNC) based on Trusted Computing Technology (TCC), which is a TCG-TNC. It includes an open terminal integrity architecture and a set of standards to ensure secure interoperability. See Figure 1 for the TCG-TNC architecture. The TCG-TNC architecture shown in Figure 1 includes three entities: access requester, policy enforcement point, and policy decision point. The TCG-TNC architecture is divided into three levels: the network access layer, the integrity assessment layer, and the integrity measurement layer. The components included in the access requester are: integrity collector, TNC client, and network access requester, where one or more integrity collectors are located at the upper end of the TNC client. The components included in the policy decision point are: integrity checker, TNC server and network access licensor, where one or more integrity checkers are on the upper end of the TNC server. IF-PEP (Policy Enforcement Point Interface) is the interface between the policy enforcement point and the network access licensor. IF-T (Network Authorization Transport Protocol Interface) is a network access requester and network. Network access to the interface between the licensors. IF-TNCCS (TNC Client-Server Interface, TNC Client-TNC Server Interface) is the interface between the TNC client and the TNC server. IF-M

( Vendor-Specific IMC-IMV Messages Interface, vendor-specific integrity collector - integrity checker message interface) is the interface between the integrity collector and the integrity checker. IF-IMC

(Integrity Measurement Collector Interface) is the interface between the TNC client and the integrity collector. The IF-IMV (Integrity Measurement Verifier Interface) is the interface between the TNC server and the integrity checker.

Remote proof means that an entity proves its platform configuration information to another entity remotely. In the TCA architecture shown in Figure 2, the access requester can prove its platform configuration information to the access controller based on the policy manager, and the access controller can also prove its platform configuration information to the access requester based on the policy manager. TCA's remote attestation function is implemented using the platform authentication process performed by TCA, where each platform authentication process can include one or more rounds of platform authentication protocols.

During a trusted network connection, the TCA may also perform one or more authentication protocols, such as: User Authentication Protocol and TLS (Transport Layer Security), when performing the platform authentication process, when performing multiple authentication protocols. At the time, there will be a man-in-the-middle attack. The present invention provides a specific method for solving this problem in the TCA--the authentication protocol before the execution of the password-binding platform authentication process in the platform authentication protocol in the platform authentication process. Therefore, the remote proof in the platform authentication process is not safe, and it is easy to cause a man-in-the-middle attack. For example, the user A does not use the platform A owned by the user A for remote authentication, but uses the remote proof data of the platform B owned by the intercepted user B. Conducting a remote proof will result in a man-in-the-middle attack. In the Chinese wireless LAN standard, the user authentication protocol is a certificate-based WAI (Wide Authentication Infrastructure) protocol or a pre-shared key based WAI protocol, wherein the certificate-based WAI protocol includes a certificate authentication process, The broadcast key negotiation process and the multicast key negotiation process, the WAI protocol based on the pre-shared key includes a unicast key negotiation process and a multicast key negotiation process. TLS (Transport Layer Security) includes the TLS handshake protocol and the TLS record protocol. The TLS handshake protocol has a full anonymous mode and a non-full anonymous mode. Summary of the invention

The present invention provides a secure remote certification method, system and access controller that enhance the security of remote attestation during platform authentication.

A secure remote proof method suitable for a trusted connection architecture, including:

After accessing the controller to initiate a trusted network connection, accessing the controller and accessing the requestor, or accessing the controller, accessing the requestor, and the policy manager to perform the relevant authentication protocol prior to the platform authentication process; accessing the controller, accessing the requestor, and managing the policy The platform performs a platform authentication process, wherein the platform signature in the platform authentication protocol in the platform authentication process is bound to one related information in each related authentication protocol that has been executed.

An access controller suitable for a trusted connection architecture, including:

a first protocol execution unit, configured to initiate a trusted network connection, and to access the requestor, or to access the requester and the policy manager to perform a related authentication protocol prior to the platform authentication process;

a second protocol execution unit, configured to perform a platform authentication process with the access requester and the policy manager, wherein the platform signature in the platform authentication protocol in the platform authentication process is tied to one related information in each related authentication protocol that has been executed set.

A secure remote attestation system suitable for a trusted connection architecture, comprising: an access controller, an access requester, and a policy manager;

The secure remote attestation method for the trusted connection architecture provided by the embodiment of the present invention binds the platform signature in the platform authentication process with a related information in each of the previously executed authentication protocols, that is, each authentication protocol that is executed before A related information in the platform is used as an input parameter for generating the platform signature, so that multiple protocols executed in the remote proof process are bound together during the platform authentication process, which prevents the man-in-the-middle attack and improves the security of the remote certificate. DRAWINGS

1 is a schematic diagram of a TCG-TNC architecture in the prior art;

2 is a schematic diagram of a TCA architecture in the prior art;

FIG. 3 is a schematic flowchart of a secure remote attestation method suitable for a trusted connection architecture according to an embodiment of the present invention; FIG.

4 is a schematic structural diagram of a secure remote attestation system suitable for a trusted connection architecture according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an access controller according to an embodiment of the present invention. detailed description

The secure remote attestation method for the trusted connection architecture provided by the embodiment of the present invention binds the platform signature in the platform authentication process with a related information in each of the previously executed authentication protocols, that is, each authentication protocol that is executed before A related information in the platform is used as an input parameter for generating the platform signature, so that multiple protocols executed in the remote proof process are bound together during the platform authentication process, which prevents the man-in-the-middle attack and improves the security of the remote certificate.

As shown in FIG. 3, the secure remote authentication method suitable for the trusted connection architecture provided by the embodiment of the present invention includes the following steps:

Step 301: After the access controller initiates the trusted network connection, access the controller and the access requester, or access the controller, the access requester, and the policy manager to perform the relevant authentication protocol before the platform authentication process;

Step 302: The access controller, the access requester, and the policy manager perform a platform authentication process, wherein the platform signature in the platform authentication protocol in the platform authentication process is bound to one related information in each related authentication protocol that has been executed.

In step 301, according to different application scenarios, before performing the platform authentication process, the related authentication protocols that may need to be executed are one or more, and when the relevant authentication protocols are executed, each round of the platform authentication process The platform signature in the authentication protocol needs to be executed before each A related information in a related authentication protocol is bound.

In the embodiment of the present invention, the related information may be key information generated in the relevant authentication protocol, or may be a specific data item of a specific data packet, etc., and as long as the binding operation is performed, multiple executions in the remote attestation process may be determined. The protocol is a complete process to prevent man-in-the-middle attacks and improve the security of remote proofs.

For example: if the relevant authentication protocol to be executed is an authentication protocol that generates a master key between the access controller and the access requester, the related information is a master key. If the relevant authentication protocol to be executed is an authentication protocol that generates a unicast key between the access controller and the access requester, the related information is a unicast key. The related information may also be a specific data item of a specific data packet in the relevant authentication protocol that needs to be executed, wherein the platform signature binding generated by the access requester in each round of the platform authentication protocol can only be used by the access requester in the authentication protocol. The particular data item of the particular data packet sent; the platform signature generated by the access controller binds a particular data item that can only be sent by the access controller in the particular protocol. When the tunnel authentication protocol is executed and a tunnel key between the access controller and the access requester is established, the related information may also be the tunnel key.

The details will be described in detail below with reference to specific embodiments.

Example 1:

Step 11) After the access controller initiates the trusted network connection, the access controller, the access requester, and the policy manager execute the certificate authentication process in the certificate-based WAI protocol and generate a master key between the access controller and the access requester. .

Step 12) The access controller and the access requester perform a TLS handshake protocol based on the full anonymous mode and establish a TLS tunnel key and associated cipher suite between the access controller and the access requester.

Step 13) The access controller, the access requester, and the policy manager perform the platform authentication process under the protection of the TLS tunnel key established in step 12) and the associated cipher suite, wherein each round of the platform authentication process in the platform authentication process The platform identification binds the master key in step 11), and binds the TLS tunnel key in step 12), such as: access controller or access requester in each round of platform authentication process in the computing platform authentication process In the platform identification, the TLS tunnel key in step 12) is used as the input parameter. In step 13), the data of each round of the platform authentication protocol in the platform authentication process between the access controller and the access requester is transmitted using the TLS record protocol.

In step 13), the platform signature may be an AIK (Attestation Identity Key) signature stored in a TPM (Trusted Platform Module).

In the first embodiment, before performing the platform authentication process, the relevant authentication protocols that need to be executed include the following two:

Accessing the certificate authentication process in the certificate-based WAI protocol executed by the controller, the access requester, and the policy manager. The related information in the certificate authentication process is: the access controller and the access requester generated during the execution of the certificate authentication process. Master key between

The TLS handshake protocol based on the full anonymous mode executed by the access controller and the access requester. The related information of the TLS handshake protocol is: a TLS tunnel key between the access controller and the access requester established in the execution of the TLS handshake protocol.

In the first embodiment, the key information is only a preferred embodiment, and the specific data item of the specific data packet in the related protocol may be bound as the related information and the platform signature. In this case, the platform authentication process is performed. The platform signature generated by the access requester in each round of the platform authentication protocol is bound to a data item that can only be sent by the access requester in the authentication protocol, and the platform signature binding generated by the access controller can only be Accessing data items sent by the controller in the authentication protocol. The specific data item of the specific data packet as the related information needs to be recorded by the access controller and the access requester in the process of executing the relevant authentication protocol as the basis for verifying the signature of the counterpart platform in the platform authentication process. A person skilled in the art can select a specific data item of a specific data packet as related information according to a specific application scenario.

In the first embodiment, the certificate authentication process in the certificate-based WAI protocol is taken as an example to describe an authentication protocol that can generate a master key, and other authentication protocols that can generate a master key are no longer enumerated.

Example 2:

Step 21) After the access controller initiates the trusted network connection, the access controller and the access requester perform a unicast key negotiation process in the WAI protocol based on the pre-shared key and generate a single between the access controller and the access requester. Broadcast key. Step 22) The access controller and the access requester perform a TLS handshake protocol based on the full anonymous mode and establish a TLS tunnel key and an associated cipher suite between the access controller and the access requester.

Step 23) The access controller, the access requester, and the policy manager perform the platform authentication process under the protection of the TLS tunnel key established in step 22) and the associated cipher suite, wherein each round of the platform authentication process in the platform authentication process The platform identification binding unicast key in step 21), and the TLS tunnel key in the binding step 22), such as: access controller or access requester in each round of platform authentication in the computing platform authentication process The platform identification in the protocol takes the unicast key in step 21), the TLS tunnel key in step 22) as an input parameter.

The unicast key generated in step 21) is bound to each round of platform authentication protocol in the platform authentication process, but is not used to protect the platform authentication process. Only the tunnel key and related cipher suite in step 22) are also used to protect each round of platform authentication protocol data in the platform authentication process in the platform authentication process.

In step 23), the data of each round of the platform authentication protocol in the platform authentication process between the access controller and the access requester is transmitted using the TLS recording protocol.

In step 23), the platform signature may be an AIK (Attestation Identity Key) signature stored in a TPM (Trusted Platform Module).

In the second embodiment, before performing the platform authentication process, the relevant authentication protocols that need to be executed include the following two:

The unicast key negotiation process in the pre-shared key-based WAI protocol performed by the access controller and the access requester, and the related information in the unicast key negotiation process is: generated during the unicast key negotiation process Accessing a unicast key between the controller and the access requester;

In the second embodiment, the key information as the related information is also only a preferred embodiment, and the specific data item of the specific data packet in the related protocol may be bound as the related information and the platform signature.

In the second embodiment, the WAI protocol of the pre-shared key is used as an example to describe that a unicast key can be generated. An embodiment of the authentication protocol, other authentication protocols that can generate a unicast key are no longer - enumerated.

Example three:

Step 31) After the access controller initiates the trusted network connection, the access controller, the access requester, and the policy manager perform a tunnel authentication protocol and establish a tunnel key and associated cipher suite between the access controller and the access requester.

Step 32) The access controller, the access requester, and the policy manager perform the platform authentication process under the protection of the tunnel key established in step 31) and the associated cipher suite, wherein each round of the platform authentication process in the platform authentication process The tunnel key in the platform signature binding step 31), such as: the access controller or the access requester uses the tunnel key in step 31) in the platform signature in each round of the platform authentication protocol in the computing platform authentication process. Input parameters.

In step 31), the tunnel authentication protocol may be composed of a certificate authentication process in the certificate-based WAI protocol and a unicast key negotiation process, a cipher suite negotiation process in the TLS handshake protocol, and a TLS other than the TLS handshake protocol.

In step 32), the data of each round of the platform authentication protocol in the platform authentication process between the access controller and the access requester is transmitted using the TLS recording protocol.

In step 32), the platform signature can be an AIK signature stored in the TPM.

In the third embodiment, before performing the platform authentication process, a related authentication protocol needs to be executed: a tunnel authentication protocol executed by the access controller, the access requester, and the policy manager, and the information about the tunnel authentication protocol is: The tunnel key between the access controller and the access requester established in the authentication protocol.

In the third embodiment, the key information as the related information is also only a preferred embodiment. It is also possible to bind the specific data item of the specific data packet in the relevant authentication protocol as the related information and the platform signature.

It should be noted that, in the relevant authentication protocol that needs to be executed before the platform authentication process, if the key information cannot be generated, the specific data item of the specific data packet is used as the related information.

In the above three embodiments, the access controller, the access requester, and the policy manager perform the platform authentication process under the protection of the established TLS tunnel key and the associated cipher suite, specifically referring to the use of TLS. The tunnel key and associated cipher suite protects the information transmitted between the access controller and the access requester.

As shown in FIG. 4, an embodiment of the present invention further provides a secure remote attestation system suitable for a trusted connection architecture, the system comprising: an access controller 401, an access requester 402, and a policy manager 403;

After the access controller 401 initiates the trusted network connection, the access controller 401 and the access requester 402, or the access controller 401, the access requester 402, and the policy manager 403 perform the relevant authentication protocol prior to the platform authentication process;

The access controller 401, the access requester 402, and the policy manager 403 perform a platform authentication process in which the platform signature in the platform authentication protocol in the platform authentication process is bound to one of each related authentication protocol that has been executed.

The access controller, the access requester, and the policy manager perform the platform authentication process. The platform signature in each round of the platform authentication protocol is bound to each authentication protocol executed by the access controller and the access requester before performing the platform authentication process. .

In each specific application scenario, detailed operations performed by the access controller, access requester, and policy manager are described in the previous description, and the description is not repeated here.

As shown in FIG. 5, an embodiment of the present invention further provides an access controller, including the following structure: a first protocol execution unit 501, configured to initiate a trusted network connection, and access a requestor, or an access requester, and a policy. The relevant authentication protocol before the manager performs the platform authentication process;

The second protocol execution unit 502 is configured to perform a platform authentication process with the access requester and the policy manager, where the platform signature in the platform authentication protocol in the platform authentication process is performed with one related information in each related authentication protocol that has been executed. Bind.

For detailed operations performed by each unit in each specific application scenario, refer to the previous description, and the description is not repeated here. The spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and the modifications of the invention Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can be embodied in the form of one or more computer program products embodied on a computer-usable storage medium (including but not limited to disk storage, CD-ROM, optical storage, etc.) in which computer usable program code is embodied.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowcharts and/or block diagrams, and combinations of flow and/or blocks in the flowcharts and/or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Although the preferred embodiment of the invention has been described, it will be apparent to those skilled in the art that, Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and the modifications and The spirit and scope of the embodiments of the present invention are departed. Thus, if these modifications and changes are made to the embodiments of the present invention The type of the invention is intended to be included within the scope of the appended claims and the appended claims.

Claims

Rights request

A secure remote attestation method suitable for a trusted connection architecture, comprising: accessing a controller to initiate a trusted network connection, accessing a controller and accessing a requestor, or accessing a controller, accessing a requestor, and managing a policy The relevant authentication protocol before the platform authentication process is performed; the access controller, the access requester and the policy manager perform a platform authentication process, wherein the platform signature in the platform authentication process in the platform authentication process and each related authentication protocol that has been executed A related information is bound.

2. The method according to claim 1, wherein if the relevant authentication protocol to be executed is an authentication protocol that generates a master key between an access controller and an access requester, the related information is a primary secret. key.

3. The method according to claim 2, wherein the related authentication protocol to be executed comprises: a certificate authentication process in a certificate-based WAI protocol executed by an access controller, an access requester, and a policy manager.

The method according to claim 1, wherein if the relevant authentication protocol to be executed is an authentication protocol that generates a unicast key between the access controller and the access requester, the related information is a single Broadcast key.

The method according to claim 4, wherein the related authentication protocol and related information that needs to be executed include: a unicast secret in a pre-shared key-based WAI protocol executed by an access controller and an access requester Key negotiation process.

6. The method according to claim 1, wherein the related information is a specific data item of a specific data packet in a related authentication protocol that needs to be executed, wherein each round of platform authentication protocol generates a platform generated by an access requester. The signature binds a specific data item of a specific data packet that can only be sent by the access requester in the authentication protocol; the platform signature generated by the access controller binds a specific data that can only be sent by the access controller in the authentication protocol. The specific data item of the package.

The method according to claim 3, 4 or 6, wherein the related authentication protocol and related information that needs to be performed further include: The access controller and the access requester perform a full-anonymous mode-based TLS handshake protocol, and the related information of the TLS handshake protocol is: a TLS tunnel key between the access controller and the access requester established in the execution of the TLS handshake protocol.

8. The method according to claim 7, wherein when the access controller and the access requester perform a TLS handshake protocol based on the full anonymous mode, a cipher suite between the access controller and the access requester is also established.

9. The method of claim 8, wherein the platform authentication process is performed under the protection of a tunnel key and an associated cipher suite.

The method according to claim 1, wherein the related authentication protocol and related information that needs to be performed include:

A tunnel authentication protocol executed by the access controller, the access requester, and the policy manager. The information about the tunnel authentication protocol is: a tunnel key between the access controller and the access requestor established in the tunnel authentication protocol.

The method according to claim 7, wherein when the access controller and the access requester perform the tunnel authentication protocol, a password suite between the access controller and the access requester is also established.

12. The method of claim 11, wherein the platform authentication process is performed under the protection of a tunnel key and an associated cipher suite.

13. An access controller, comprising:

14. A secure remote attestation system suitable for a trusted connection architecture, comprising: an access controller, an access requester, and a policy manager; wherein:

After the access controller initiates a trusted network connection, access the controller and access the requestor, or access The controller, the access requester, and the policy manager perform a related authentication protocol before the platform authentication process; the access controller, the access requester, and the policy manager perform a platform authentication process, wherein the platform signature in the platform authentication process in the platform authentication process A related information in each of the relevant authentication protocols that have been executed is bound.