WO2016011827A1 - 基于数字证书的信息安全实现方法及系统 - Google Patents

基于数字证书的信息安全实现方法及系统 Download PDF

Info

Publication number
WO2016011827A1
WO2016011827A1 PCT/CN2015/075143 CN2015075143W WO2016011827A1 WO 2016011827 A1 WO2016011827 A1 WO 2016011827A1 CN 2015075143 W CN2015075143 W CN 2015075143W WO 2016011827 A1 WO2016011827 A1 WO 2016011827A1
Authority
WO
WIPO (PCT)
Prior art keywords
cloud computing
certificate
digital certificate
virtual machine
cloud
Prior art date
Application number
PCT/CN2015/075143
Other languages
English (en)
French (fr)
Inventor
彭亦辉
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP15824515.9A priority Critical patent/EP3197121B1/en
Priority to US15/326,653 priority patent/US10411903B2/en
Publication of WO2016011827A1 publication Critical patent/WO2016011827A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3265—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate chains, trees or paths; Hierarchical trust model
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1001—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the embodiments of the present invention relate to the field of network communication technologies, and in particular, to a digital security-based information security implementation method and system in the field of mobile internet and cloud computing.
  • the traditional security measures are to start from the border protection access side, that is, to authenticate the user name and password when the user accesses, or to use the certificate authority certificate (CA) certificate to ensure the user and access channel.
  • CA certificate authority certificate
  • the cloud computing physical host and the cloud computing virtual machine are usually isolated by a virtual local area network (VLAN), and can be put into a network system through VLAN isolation technology.
  • the network device is divided into several virtual working groups, and the network devices between the groups and groups are isolated from each other on the second layer.
  • VLAN isolation technology is based on the isolation between Layer 2 and Layer 3
  • different network users can be grouped with network resources, and switches supporting VLAN technologies can be used to isolate data exchange between network devices in different groups.
  • This mode allows users on the same VLAN to communicate with each other. Users in different VLANs are disconnected at the data link layer and can only be accessed through Layer 3 routers.
  • the VLAN isolation technology can ensure the isolation between physical devices.
  • the same server can be opened to multiple VLAN groups at the same time or only to a certain VLAN group, but cannot be restricted for individual users.
  • a server serves multiple server roles and provides different services for multiple VLAN groups. This also brings certain security risks.
  • the cloud virtualization system is easy to be Malicious individuals or groups attack and crack, and even illegally create and control cloud computing virtual machines, thus threatening the security of the system.
  • an embodiment of the present invention provides a method and system for implementing information security based on a digital certificate, which can improve the security of the cloud virtualization system.
  • a digital certificate-based information security implementation method provided by an embodiment of the present invention includes:
  • the compliance authentication is performed according to the corresponding digital certificate.
  • the issuing the digital certificate for the cloud management host includes:
  • the CA center generates a cloud management host digital certificate according to the key attribute information of the cloud management host and manufactures a card.
  • the issuing the digital certificate for the cloud computing physical host includes:
  • the cloud management host obtains the key attribute information of the cloud computing physical host by using a certificate agent deployed on the corresponding cloud computing physical host, and accordingly initiates a cloud computing physical host digital certificate application to the CA center;
  • the CA center verifies the cloud management host digital certificate, and generates a cloud computing physical host digital certificate according to the cloud computing physical host key attribute information and manufactures the card when the verification is passed.
  • the separately issuing the digital certificate for the cloud computing virtual machine includes:
  • the cloud management host After verifying that the cloud computing physical host to which the cloud computing virtual machine belongs is normal, the cloud management host acquires key attribute information of the cloud computing virtual machine, and accordingly initiates a cloud computing virtual machine digital certificate application to the CA center;
  • the CA center verifies the cloud management host digital certificate, and generates a cloud computing virtual machine digital certificate file according to the key attribute information of the cloud computing virtual machine when the verification is passed;
  • the CA center returns the encrypted cloud computing virtual machine digital certificate file to the cloud management host;
  • the cloud management host returns an encrypted cloud computing virtual machine digital certificate file to the cloud computing physical host to which the cloud computing virtual machine belongs, and the cloud computing physical host verifies the encrypted cloud computing virtual machine digital certificate file by using an agent deployed thereon, according to The cloud computing virtual machine key attribute information creates an isolated certificate container in the certificate key, and writes the cloud computing virtual machine digital certificate into the certificate container.
  • each of the certificate keys is configured to store a separate digital certificate.
  • performing compliance authentication according to the corresponding digital certificate includes:
  • the certificate agent deployed on the cloud management host initiates an online or offline authentication request to the CA center and generates the current authentication random number Ra; the CA center responds to the request and returns the authentication random number Rb;
  • the certificate agent of the cloud management host reads the digital certificate of the cloud management host from the certificate key according to the key attribute information of the cloud management host, and digitally signs the current authentication random number Ra and the authentication random number Rb by using the digital certificate, and The signature result, the digital certificate of the cloud management host, and the current authentication random number Ra are sent to the CA center; the CA center authenticates the received information, and after the authentication succeeds, notifies the cloud management host to continue the startup process.
  • performing compliance authentication according to the corresponding digital certificate includes:
  • the certificate agent deployed on the cloud computing physical host reads the digital certificate of the cloud computing physical host from the certificate key according to the key attribute information of the cloud computing physical host, initiates an online or offline authentication request to the CA center, and generates the current authentication. a random number Ra; the CA center responds to the request and returns an authentication random number Rb;
  • the certificate agent of the cloud computing physical host reads the digital certificate of the cloud computing physical host from the certificate key according to the key attribute information of the cloud computing physical host, and digitally signs the current authentication random number Ra and the authentication random number Rb by using the digital certificate. And sending the signature result, the digital certificate of the cloud computing physical host, and the current authentication random number Ra to the CA center; the CA center authenticates the received information, and after the authentication succeeds, notifies the cloud computing physical host Continue to start the process.
  • performing compliance authentication according to the corresponding digital certificate includes:
  • the certificate agent on the cloud computing physical host to which the cloud computing virtual machine belongs reads the cloud computing virtual machine digital certificate from the corresponding certificate container in the certificate key according to the key attribute information of the cloud computing virtual machine, and initiates online or offline to the CA center. Authenticating the request and generating the current authentication random number Ra; the CA center responds to the request and returns the authentication random number Rb;
  • the authentication random number Ra and the authentication random number Rb are digitally signed, and the signature result, the cloud computing virtual machine digital certificate, and the current authentication random number Ra are sent to the CA center; the CA center authenticates the received information, and After the authentication succeeds, the cloud computing virtual machine is notified to continue the startup process.
  • performing compliance authentication according to the corresponding digital certificate includes:
  • the certificate agent of the cloud management host acquires key attribute information of the cloud management host, and accordingly reads the digital certificate of the cloud management host from the certificate key and initiates online or to the CA center.
  • Offline authentication request When the CA center authentication passes, the cloud management host continues to run.
  • performing compliance authentication according to the corresponding digital certificate includes:
  • the certificate agent of the cloud computing physical host acquires key attribute information of the cloud computing physical host, and accordingly reads the digital certificate of the cloud computing physical host from the certificate key and sends the digital certificate to the CA center.
  • Initiating an online or offline authentication request When the CA center passes the authentication, the cloud computing physical host continues to run.
  • performing compliance authentication according to the corresponding digital certificate includes:
  • the certificate agent of the cloud computing physical host to which the cloud computing virtual machine belongs acquires key attribute information of the cloud computing virtual machine, and reads from the corresponding certificate container in the certificate key accordingly.
  • the cloud computing virtual machine digital certificate is taken and an online or offline authentication request is initiated to the CA center: when the CA center authentication passes, the cloud computing virtual machine continues to run.
  • An information security implementation system based on a digital certificate comprising: a CA center, a cloud management host, a cloud computing physical host, and at least one cloud computing virtual machine created according to the cloud computing physical host;
  • the CA center is configured to issue digital certificates for the cloud management host, the cloud computing physical host, and the cloud computing virtual machine respectively under the management control of the cloud management host;
  • the cloud management host is set to perform compliance authentication according to the corresponding digital certificate during startup or during operation;
  • Cloud computing physical host set to be based on the corresponding digital certificate at startup or during operation Conduct compliance certification;
  • the cloud computing virtual machine is set to perform compliance authentication according to the corresponding digital certificate at startup or during operation.
  • the digital certificate-based information security implementation method provided by the embodiment of the present invention utilizes the technology of the digital certificate trust chain, and combines with the cloud management system to implement a trusted system of the cloud management system, the physical host, and the virtual machine, focusing on the system host platform itself. Security protection improves the security of the cloud virtualization platform.
  • FIG. 1 is a flowchart of a digital certificate issuance of a cloud management host in an embodiment of the present invention
  • FIG. 2 is a flowchart of a digital certificate issuing of a cloud computing physical host in an embodiment of the present invention
  • FIG. 3 is a flowchart of a digital certificate issuing of a cloud computing virtual machine in an embodiment of the present invention
  • FIG. 4 is a flowchart of performing online authentication by a cloud management host according to a digital certificate according to an embodiment of the present invention
  • FIG. 5 is a flowchart of performing online authentication by a cloud computing physical host according to a digital certificate according to an embodiment of the present invention
  • FIG. 6 is a flowchart of performing online authentication according to a digital certificate when a cloud computing virtual machine is manually started according to an embodiment of the present invention
  • FIG. 7 is a flowchart of performing online authentication according to a digital certificate when the cloud computing virtual machine is automatically started in the embodiment of the present invention.
  • the CA center that is, the certificate authority, or the certificate authority, as the trusted third party in the e-commerce transaction, assumes the responsibility for verifying the legality of the public key in the public key system.
  • the CA Center issues digital certificates for cloud management hosts, cloud computing physical hosts, and cloud computing virtual machines.
  • the CA center architecture includes public key infrastructure (PKI) structure, high-strength anti-attack public encryption and decryption algorithm, digital signature technology, identity authentication technology, operational security management technology, and reliable trust responsibility system. From the roles involved in the business process, including certification bodies, digital certificate and blacklist libraries, key escrow processing systems, certificate directory services, certificate approval and invalidation processing systems.
  • PKI public key infrastructure
  • CA digital certificate business mainly includes: application, issuance and issuance of digital certificates; inquiry, invalidation, update, and archiving of certificates, and provision of online certificate status inquiry service; key management, mainly key generation and storage Storage, update, backup and recovery.
  • CA certification and online authentication are usually separate physical devices.
  • the cloud management host is a management node that functions as a management and scheduling function in the cloud virtualization platform, and can monitor the running status of the virtualized resources such as the cloud computing physical host (computing node) and the storage node, and operate according to the cloud computing host. The status is scheduled.
  • the resources can be maintained, including the virtual machine management described in the embodiment of the present invention, and the online application for sending and managing the digital certificate of the cloud computing physical host and the cloud computing virtual machine.
  • the cloud computing physical host acts as a physical machine of the cloud virtualization computing node, and is mainly responsible for providing computing power for the virtualization system, which is a bearer of the virtual machine.
  • the cloud management host virtualizes the cloud computing physical host
  • the virtual CPU resource, the memory resource, the network resource, and the like may be extracted into the cloud computing virtual machine according to the requirement.
  • a cloud computing physical host can create multiple cloud computing virtual machines based on their resources and business applications.
  • the certificate key is a physical entity responsible for storing the digital certificate. Including but It is not limited to the form of USBkey, Bluetooth KEY, and TF (Trans-flash) card key of mobile terminal.
  • the USB key of the cloud computing physical host USB port is used to store the digital certificate of the cloud computing physical host itself, and also stores the digital certificate of the cloud computing virtual machine that depends on the host.
  • the certificate agent is a background software for performing digital certificate reading and authentication for the cloud computing physical host and the cloud computing virtual machine, and is usually deployed on each cloud computing physical host.
  • Digital certificates are issued for cloud management hosts, cloud computing physical hosts, and cloud computing virtual machines. Compliance authentication is performed according to the corresponding digital certificates when these network elements are started or running.
  • the digital certificates respectively issued for the cloud management host, the cloud computing physical host, and the cloud computing virtual machine are stored in a certificate key, and the certificate key supports storing multiple digital certificates and is isolated from each other by the certificate container.
  • Each certificate container in the certificate key is configured to store a separate digital certificate, and the reader of each digital certificate can only read the digital certificate within its own authority according to the authority.
  • the digital certificate-based information security implementation method provided by the embodiment of the present invention utilizes the technology of the digital certificate trust chain, and combines with the cloud management system to implement a trusted system of the cloud management system, the physical host, and the virtual machine, focusing on the system host platform itself. Security protection improves the security of the cloud virtualization platform.
  • digital certificates are issued for the cloud management host, the cloud computing physical host, and the cloud computing virtual machine respectively, and the compliance authentication is performed according to the corresponding digital certificate when these network elements are started or in operation.
  • a cloud computing virtual machine is created by using a cloud management host
  • a digital certificate is applied to the CA center by using a virtual attribute such as a virtual MAC address and a virtual CPU information of the virtual machine device, and the CA center is based on a key of the cloud computing virtual machine.
  • the attribute value generates a corresponding digital certificate and encrypts it to the certificate agent on the cloud computing physical host where the cloud computing virtual machine is located.
  • the certificate agent on the cloud computing physical host creates an isolated certificate container in the certificate key according to the key attributes of different cloud computing virtual machines, and writes the digital certificate of the cloud computing virtual machine into the certificate container.
  • the cloud computing virtual machine When the cloud computing virtual machine starts, it needs to read the corresponding encrypted digital certificate from the certificate key according to its key attribute information, and perform CA authentication. After the verification is successful, the subsequent startup is allowed.
  • the cloud computing virtual machine periodic automatic authentication by certificate agent is adopted.
  • the mechanism ensures the security in the running state of the cloud platform.
  • the certificate chains are mutually authenticated, for example, the CA center verifies the cloud management host signature, the cloud management host verifies the cloud computing physical host signature, and the cloud computing physical host verifies the cloud computing virtual machine signature, thereby ensuring each in the system.
  • the nodes are all reliable.
  • issuing a digital certificate for the cloud management host includes:
  • the S101 and the CA center use the hash algorithm to generate a unique character string according to the key attribute information of the cloud management host (the cloud management node), and generate the certificate as the input of the cloud management host digital certificate generation and write the certificate key to complete the card making process.
  • the cloud management host key attribute information includes, but is not limited to, a MAC address and a CPU number of the cloud management host.
  • issuing a digital certificate for a cloud computing physical host includes:
  • S102 Collecting attribute information of a specified cloud computing physical host (cloud computing node), so as to apply for a device certificate for the specified cloud computing node.
  • the cloud management host acquires the cloud computing physical host by using a certificate agent deployed on the corresponding cloud computing physical host.
  • Key attribute information (such as MAC address, CPU number and other key information), and accordingly initiate a cloud computing physical host digital certificate application to the CA center;
  • the CA center verifies the cloud management node, so as to generate a digital certificate for the designated cloud computing node and manufacture a card. Specifically, the CA center verifies the cloud management host digital certificate, and generates a cloud computing according to the key attribute information of the cloud computing physical host when the verification passes. Physical host digital certificate and card.
  • separately issuing digital certificates for the cloud computing virtual machine includes:
  • the cloud management host first selects a resource pool, and creates a cloud computing virtual machine of the cloud computing physical host, and obtains a key attribute of the cloud computing virtual machine after the cloud management host verifies that the cloud computing physical host to which the cloud computing virtual machine belongs is normal. Information, and accordingly initiate a cloud computing virtual machine digital certificate application to the CA center;
  • the CA center verifies the cloud management host digital certificate, and generates a cloud computing virtual machine digital certificate file according to the key attribute information of the cloud computing virtual machine when the verification is passed;
  • the CA center returns an encrypted cloud computing virtual machine digital certificate file to the cloud management host.
  • the cloud management host returns an encrypted cloud computing virtual machine digital certificate file to the cloud computing physical host to which the cloud computing virtual machine belongs, and the cloud computing physical host passes the agent program deployed thereon. Encrypting the cloud computing virtual machine digital certificate file, creating an isolated certificate container in the certificate key according to the cloud computing virtual machine key attribute information, and writing the cloud computing virtual machine digital certificate into the certificate container.
  • the compliance authentication according to the corresponding digital certificate includes:
  • the certificate proxy deployed on the cloud management host initiates an online or offline authentication request to the CA center and generates the current authentication random number Ra to request the random number Rb.
  • the CA center responds to the request and returns an authentication random number Rb;
  • the certificate agent of the cloud management host reads the digital certificate of the cloud management host from the certificate key according to the key attribute information of the cloud management host, and digitally signs the current authentication random number Ra and the authentication random number Rb by using a digital certificate, and Sending the signature result, the digital certificate CerA of the cloud management host, and the current authentication random number Ra to the CA center;
  • S204 The CA center authenticates the received information, and after the authentication succeeds, notifies the cloud management host to continue the startup process. How to certify the well-known technologies belonging to those skilled in the art, and details are not described herein.
  • the compliance authentication according to the corresponding digital certificate includes:
  • the certificate agent deployed on the cloud computing physical host reads the digital certificate of the cloud computing physical host from the certificate key according to the key attribute information of the cloud computing physical host, and initiates online or to the CA center. Offline authentication request and generate the authentication random number Ra to apply for the random number Rb;
  • the CA center responds to the request and returns an authentication random number Rb;
  • the certificate agent of the cloud computing physical host reads the digital certificate of the cloud computing physical host from the certificate key according to the key attribute information of the cloud computing physical host, and performs the current authentication random number Ra and the authentication random number Rb by using the digital certificate. Digital signature, and sending the signature result, the digital certificate CerA of the cloud computing physical host, and the current authentication random number Ra to the CA center;
  • S208 The CA center authenticates the received information, and after the authentication succeeds, notifies the cloud computing physical host to continue the startup process.
  • Conducting compliance certification includes:
  • the certificate agent on the cloud computing physical host to which the cloud computing virtual machine belongs is read from the corresponding certificate container in the certificate key according to key attribute information (such as MAC address, CPU number, etc.) of the cloud computing virtual machine.
  • the cloud computing virtual machine digital certificate initiates an online or offline authentication request to the CA center and generates the authentication random number Ra;
  • the CA center responds to the request and returns an authentication random number Rb;
  • the certificate agent on the cloud computing physical host digitally signs the current authentication random number Ra and the authentication random number Rb according to the cloud computing virtual machine digital certificate, and the signature result, the cloud computing virtual machine digital certificate, and the present
  • the secondary authentication random number Ra is sent to the CA center;
  • S212 The CA center authenticates the received information, and after the authentication succeeds, notifies the cloud computing virtual machine to continue the startup process.
  • the cloud computing virtual machine can be started by the administrator to log in to the cloud management host node, and the corresponding cloud computing virtual machine can be manually started.
  • the startup policy can also be pre-configured, and the corresponding cloud computing virtual machine is automatically started by the system.
  • FIG. 6 shows a schematic diagram of a process of manually starting a cloud computing virtual machine, which specifically includes:
  • Step 61 The administrator manually starts a cloud computing virtual machine, and the manner of manually starting the cloud computing virtual machine is the prior art in the field;
  • Step 62 After the cloud computing virtual machine is started, the cloud computing physical host to which it belongs reads the cloud computing virtuality from the corresponding certificate container in the certificate key according to the key attribute information (such as the MAC address, the CPU number, and the like) of the cloud computing virtual machine.
  • Machine digital certificate initiate an online or offline authentication request to the CA center and generate the authentication random number Ra to apply for the random number Rb;
  • Step 63 the CA center responds to the request and returns an authentication random number Rb;
  • Step 64 The certificate agent on the cloud computing physical host digitally signs the current authentication random number Ra and the authentication random number Rb according to the cloud computing virtual machine digital certificate, and signs the result, the cloud computing virtual machine digital certificate CerA And the authentication random number Ra is sent to the CA center;
  • Step 65 The CA center authenticates the received information, and after the authentication succeeds, notifies the cloud computing virtual machine to continue the startup process.
  • FIG. 7 shows a schematic flowchart of automatically starting a cloud computing virtual machine, which includes:
  • Step 71 A cloud computing virtual machine automatically restarts according to a preset automatic startup policy, where the The automatic startup strategy is prior art in the art;
  • Step 72 After the cloud computing virtual machine is started, the cloud computing physical host to which it belongs reads the cloud computing virtuality from the corresponding certificate container in the certificate key according to the key attribute information (such as the MAC address, the CPU number, and the like) of the cloud computing virtual machine.
  • Machine digital certificate initiate an online or offline authentication request to the CA center and generate the authentication random number Ra to apply for the random number Rb;
  • Step 73 the CA center responds to the request and returns an authentication random number Rb;
  • Step 74 The certificate agent on the cloud computing physical host digitally signs the current authentication random number Ra and the authentication random number Rb according to the cloud computing virtual machine digital certificate, and signs the result, the cloud computing virtual machine digital certificate CerA And the authentication random number Ra is sent to the CA center;
  • Step 75 The CA center authenticates the received information, and after the authentication succeeds, notifies the cloud computing virtual machine to continue the startup process.
  • the specificity of the compliance authentication according to the corresponding digital certificate includes:
  • the certificate agent of the cloud management host periodically checks the compliance of the certificate.
  • the certificate agent obtains the key attribute information of the cloud management host, and reads the digital certificate of the cloud management host from the certificate key and sends it to the CA.
  • the center initiates an online or offline authentication request: when the CA center passes the authentication, the cloud management host continues to run; otherwise, the CA center generates an alarm and sends a notification message to notify the administrator for processing.
  • the compliance authentication is performed periodically according to the corresponding digital certificate.
  • the step of performing compliance authentication according to the corresponding digital certificate includes:
  • the certificate agent of the cloud physical host periodically checks the compliance of the certificate.
  • the certificate agent obtains the key attribute information of the cloud computing physical host, and reads the digital certificate of the cloud computing physical host from the certificate key accordingly.
  • Initiating an online or offline authentication request to the CA center When the CA center passes the authentication, the cloud computing physical host continues to run; otherwise, the CA center generates an alarm and sends a notification message to notify the administrator for processing.
  • the compliance authentication is performed periodically according to the corresponding digital certificate.
  • the step of performing compliance authentication according to the corresponding digital certificate includes:
  • Compliance of the certificate agent loop inspection certificate of the cloud computing physical host to which the cloud computing virtual machine belongs When the monitoring timer expires, the certificate agent obtains the key attribute information of the cloud computing virtual machine, and accordingly obtains the corresponding certificate from the certificate key.
  • the cloud computing virtual machine digital certificate is read in the container and an online or offline authentication request is initiated to the CA center: when the CA center passes the authentication, the cloud computing virtual machine continues to run; otherwise, the CA center generates an alarm and sends a notification message to notify the administrator. Process it.
  • the compliance authentication is performed periodically according to the corresponding digital certificate.
  • the above description is directed to the cloud environment. It should be understood that the method provided by the embodiments of the present invention is not only applicable to a cloud environment, but also to a non-cloud environment.
  • the embodiment of the present invention is used to associate a virtual digital certificate with a docker, and configure corresponding digital certificates for other network elements, and then start and run in a subsequent manner. In the process, the digital certificates of these configurations are used to perform corresponding compliance certifications to ensure the information security of the system.
  • an embodiment of the present invention further provides a digital certificate-based information security implementation system, including: a CA center, a cloud management host, a cloud computing physical host, and at least one created according to the cloud computing physical host.
  • Cloud computing virtual machine including: a CA center, a cloud management host, a cloud computing physical host, and at least one created according to the cloud computing physical host. Cloud computing virtual machine; among them,
  • the CA center is configured to issue digital certificates for the cloud management host, the cloud computing physical host, and the cloud computing virtual machine respectively under the management control of the cloud management host;
  • the cloud management host is set to perform compliance authentication according to the corresponding digital certificate during startup or during operation;
  • the cloud computing physical host is set to perform compliance authentication according to the corresponding digital certificate during startup or during operation;
  • the cloud computing virtual machine is set to perform compliance authentication according to the corresponding digital certificate at startup or during operation.
  • the CA center is specifically configured to: generate a cloud management host digital certificate according to the key attribute information of the cloud management host, and manufacture a card;
  • the cloud management host digital certificate is verified, and the cloud computing physical host digital certificate is generated and the card is generated according to the key attribute information of the cloud computing physical host when the verification is passed.
  • the cloud management host is further configured to obtain key attribute information (such as MAC address, CPU number, and the like) of the cloud computing physical host through a certificate agent deployed on the corresponding cloud computing physical host, and initiate cloud computing physics to the CA center according to the configuration.
  • key attribute information such as MAC address, CPU number, and the like
  • the cloud computing physical host is further configured to verify the encrypted cloud computing virtual machine digital certificate file by the agent deployed thereon, create an isolated certificate container in the certificate key according to the cloud computing virtual machine key attribute information, and create the isolated certificate container
  • the compute virtual machine digital certificate is written to the certificate container.
  • each certificate container in the certificate key is configured to store an independent digital certificate, and the reader of each digital certificate can only read the digital certificate within its own authority according to the authority.
  • the compliance authentication according to the corresponding digital certificate specifically includes:
  • the cloud management host is specifically set to:
  • the certificate agent deployed on the cloud management host initiates an online or offline authentication request to the CA center and generates the current authentication random number Ra; receives the authentication random number Rb from the CA center in response to the request and returns; the cloud management host
  • the certificate agent reads the digital certificate of the cloud management host from the certificate key according to the key attribute information of the cloud management host, digitally signs the current authentication random number Ra and the authentication random number Rb by using the digital certificate, and signs the signature result.
  • the digital certificate of the cloud management host and the random number Ra of the authentication are sent to the CA center; and the notification that the received information is successfully authenticated from the CA center is received, and the process is continued.
  • the cloud computing physical host is specifically set to:
  • the certificate agent deployed on the cloud computing physical host reads the digital certificate of the cloud computing physical host from the certificate key according to the key attribute information of the cloud computing physical host, and initiates an online or offline authentication request to the CA center and generates the local certificate.
  • Secondary authentication random number Ra receiving response from CA center
  • the certificate agent of the cloud computing physical host reads the digital certificate of the cloud computing physical host from the certificate key according to the key attribute information of the cloud computing physical host, and uses the digital certificate to authenticate the current certificate.
  • the random number Ra and the authentication random number Rb are digitally signed, and the signature result, the digital certificate of the cloud computing physical host, and the current authentication random number Ra are sent to the CA center; and the received information from the CA center is successfully authenticated.
  • the notification continues to start the process.
  • the cloud computing virtual machine is specifically set to:
  • the certificate agent on the cloud computing physical host to which it belongs reads the cloud computing virtual machine digital certificate from the corresponding certificate container in the certificate key according to the key attribute information of the cloud computing virtual machine, and initiates online or offline authentication to the CA center.
  • the number Ra and the authentication random number Rb are digitally signed, and the signature result, the cloud computing virtual machine digital certificate, and the current authentication random number Ra are sent to the CA center; receiving the notification from the CA center that the received information is successfully authenticated, and continuing to start Process.
  • the cloud computing virtual machine can be started by the administrator to log in to the cloud management host node, and the corresponding cloud computing virtual machine can be manually started.
  • the startup policy can also be pre-configured, and the corresponding cloud computing virtual machine is automatically started by the system.
  • FIG. 6, which shows a schematic diagram of a process of manually starting a cloud computing virtual machine
  • FIG. 7 shows a schematic flowchart of automatically starting a cloud computing virtual machine.
  • the cloud management host, the cloud computing physical host, and the cloud computing virtual machine perform the compliance authentication according to the corresponding digital certificate during the running process, and specifically includes:
  • the cloud management host is specifically configured to: when the preset first timer expires, the certificate agent of the cloud management host obtains the key attribute information of the cloud management host, and reads the digital certificate of the cloud management host from the certificate key according to the The CA Center initiates an online or offline authentication request: when it receives the notification of the certification from the CA center, it continues to run;
  • the CA Center is also set to: generate an alert and send a notification message to notify the administrator to process.
  • the cloud computing physical host is specifically set to: when the preset second timer expires, the certificate agent of the cloud computing physical host obtains the key attribute information of the cloud computing physical host, and according to the certificate from the certificate The key reads the digital certificate of the cloud computing physical host and initiates an online or offline authentication request to the CA center: when receiving the authentication notification notification from the CA center, the operation continues;
  • the CA Center is also set to: generate an alert and send a notification message to notify the administrator to process.
  • the cloud computing virtual machine is specifically configured to: when the preset third timer expires, the certificate agent of the cloud computing physical host to which the cloud computing virtual machine belongs acquires the key attribute information of the cloud computing virtual machine, and according to the certificate key Reading the cloud computing virtual machine digital certificate in the corresponding certificate container and initiating an online or offline authentication request to the CA center: when receiving the authentication approval notification from the CA center, continuing to run;
  • the CA Center is also set to: generate an alert and send a notification message to notify the administrator to process.
  • a digital certificate-based information security implementation method and system includes: separately issuing a digital certificate for a cloud management host, a cloud computing physical host, and a cloud computing virtual machine; and the cloud management host and the cloud computing The physical host and the cloud computing virtual machine are authenticated according to the corresponding digital certificate during startup or during operation.
  • the digital certificate-based information security implementation method and system provided by the embodiments of the present invention draws on the technology of the digital certificate trust chain, and combines with the cloud management system to implement a trusted system of the cloud management system, the physical host, and the virtual machine, focusing on the system host.
  • the security protection of the platform itself improves the security of the cloud virtualization platform.

Abstract

一种基于数字证书的信息安全实现方法及系统，所述方法包括：为云管理主机、云计算物理主机以及云计算虚拟机分别发放数字证书；在所述云管理主机、云计算物理主机以及云计算虚拟机启动时或运行过程中，依据相应的数字证书进行合规性认证。本发明实施例提供的基于数字证书的信息安全实现方法及系统借鉴数字证书信任链的技术，与云管理系统结合，实现了云管理系统、物理主机、虚拟机的可信系统,着重于系统主机平台自身的安全防护，提高了云虚拟化平台的安全性。

Description

基于数字证书的信息安全实现方法及系统 技术领域
本发明实施例涉及网络通讯技术领域，尤指一种移动互联与云计算领域中的基于数字证书的信息安全实现方法及系统。
背景技术
随着互联网技术的快速进步，计算资源虚拟化系统被逐渐提出和发展起来，由于虚拟化技术能够给企业带来资源共享以及降低运营成本等实际利益，因此当前越来越多的企业选择云虚拟化平台作为自身业务的承载。
随着虚拟化技术的大规模应用，系统的安全性问题也开始被大量关注。传统的安全措施是从边界防护接入侧上入手，即在用户接入时进行用户名、口令认证，或采用证书授权中心(CA，Certificate Authority)证书的认证方式，以保证用户和接入通道的安全。
而在实际应用当中，云虚拟化平台的内部，其云计算物理主机、云计算虚拟机之间通常采用虚拟局域网(VLAN，Virtual Local Area Network)隔离，通过VLAN隔离技术，可以把一个网络系统中的网络设备分成若干个虚拟的工作组，组和组之间的网络设备在二层上相互隔离。由于VLAN隔离技术是基于二层和三层之间的隔离，因此，可以将不同的网络用户与网络资源进行分组，并通过支持VLAN技术的交换机来实现隔离不同组内网络设备间的数据交换，以此来达到网络安全的目的。这种方式允许同一VLAN上的用户互相通信，而处于不同VLAN的用户之间在数据链路层上是断开的，只能通过三层路由器才能访问。
VLAN隔离技术可以保证物理设备之间的隔离，但是对于同一台服务器，只能做到同时向多个VLAN组全面开放或者是只向某个VLAN组开放，而不能针对个别用户进行限制。并且在实际应用中，一台服务器担当多种服务器角色，同时为多个VLAN组用户提供不同的服务，这也带来了一定的安全隐患，基于该隔离技术使得云虚拟化系统易于被某些恶意个人或团体攻击破解，甚至被其非法创建以及控制云计算虚拟机，从而威胁到系统的安全。
发明内容
为了解决上述技术问题，本发明实施例提供了一种基于数字证书的信息安全实现方法及系统，能够提高云虚拟化系统的安全性。
为了实现上述技术目的，本发明实施例提供的一种基于数字证书的信息安全实现方法，包括：
为云管理主机、云计算物理主机以及云计算虚拟机分别发放数字证书；
在所述云管理主机、云计算物理主机以及云计算虚拟机启动时或运行过程中，依据相应的数字证书进行合规性认证。
可选地，所述为云管理主机发放数字证书包括：
CA中心根据云管理主机关键属性信息生成云管理主机数字证书并制卡。
可选地，所述为云计算物理主机发放数字证书包括：
云管理主机通过部署于相应云计算物理主机上的证书代理获取该云计算物理主机关键属性信息，并据此向CA中心发起云计算物理主机数字证书申请；
CA中心验证云管理主机数字证书，在验证通过时根据云计算物理主机关键属性信息生成云计算物理主机数字证书并制卡。
可选地，所述为云计算虚拟机分别发放数字证书包括：
所述云管理主机在验证云计算虚拟机所归属的云计算物理主机正常后，获取该云计算虚拟机关键属性信息，并据此向CA中心发起云计算虚拟机数字证书申请；
CA中心验证云管理主机数字证书，在验证通过时根据云计算虚拟机关键属性信息生成云计算虚拟机数字证书文件；
CA中心向云管理主机返回加密的云计算虚拟机数字证书文件；
云管理主机向云计算虚拟机所归属的云计算物理主机返回加密的云计算虚拟机数字证书文件,云计算物理主机通过部署于其上的代理程序验证加密的云计算虚拟机数字证书文件，根据云计算虚拟机关键属性信息在证书key中创建隔离的证书容器，并将所述云计算虚拟机数字证书写入证书容器中。
可选地，所述证书key中的每个证书容器被配置为用于存储独立的数字证书。
可选地，在所述云管理主机启动时，依据相应的数字证书进行合规性认证包括：
部署于所述云管理主机上的证书代理向CA中心发起在线或离线认证请求并生成本次认证随机数Ra；CA中心响应所述请求并返回认证随机数Rb；
云管理主机的证书代理根据云管理主机关键属性信息从证书key中读取云管理主机的数字证书，使用数字证书对所述本次认证随机数Ra以及认证随机数Rb进行数字签名，并将所述签名结果、云管理主机的数字证书以及本次认证随机数Ra发送给CA中心；CA中心对接收到的信息进行认证，并在认证成功后，通知所述云管理主机继续启动流程。
可选地，在所述云计算物理主机启动时，依据相应的数字证书进行合规性认证包括：
部署于所述云计算物理主机上的证书代理根据其云计算物理主机关键属性信息从证书key中读取该云计算物理主机的数字证书，向CA中心发起在线或离线认证请求并生成本次认证随机数Ra；CA中心响应所述请求并返回认证随机数Rb；
云计算物理主机的证书代理根据云计算物理主机关键属性信息从证书key中读取该云计算物理主机的数字证书，使用数字证书对所述本次认证随机数Ra以及认证随机数Rb进行数字签名，并将所述签名结果、云计算物理主机的数字证书以及本次认证随机数Ra发送给CA中心；CA中心对接收到的信息进行认证，并在认证成功后，通知所述云计算物理主机继续启动流程。
可选地，在所述云计算虚拟机启动时，依据相应的数字证书进行合规性认证包括：
所述云计算虚拟机所归属的云计算物理主机上的证书代理根据云计算虚拟机关键属性信息从证书key中的相应证书容器中读取云计算虚拟机数字证书，向CA中心发起在线或离线认证请求并生成本次认证随机数Ra；CA中心响应所述请求并返回认证随机数Rb；
云计算物理主机上的证书代理根据所述云计算虚拟机数字证书对所述 本次认证随机数Ra以及认证随机数Rb进行数字签名，并将签名结果、云计算虚拟机数字证书以及本次认证随机数Ra发送给CA中心；CA中心对接收到的信息进行认证，并在认证成功后，通知所述云计算虚拟机继续启动流程。
可选地，在所述云管理主机运行过程中，依据相应的数字证书进行合规性认证包括：
在预先设置的第一定时器时间到时，所述云管理主机的证书代理获取云管理主机关键属性信息，并据此从证书key中读取云管理主机的数字证书并向CA中心发起在线或离线认证请求：当CA中心认证通过时，所述云管理主机继续运行。
可选地，在所述云计算物理主机运行过程中，依据相应的数字证书进行合规性认证包括：
在预先设置的第二定时器时间到时，所述云计算物理主机的证书代理获取云计算物理主机关键属性信息，并据此从证书key中读取云计算物理主机的数字证书并向CA中心发起在线或离线认证请求：当CA中心认证通过时，所述云计算物理主机继续运行。
可选地，在所述云计算虚拟机运行过程中，依据相应的数字证书进行合规性认证包括：
在预先设置的第三定时器时间到时，所述云计算虚拟机所归属的云计算物理主机的证书代理获取云计算虚拟机关键属性信息，并据此从证书key中的相应证书容器中读取云计算虚拟机数字证书并向CA中心发起在线或离线认证请求：当CA中心认证通过时，所述云计算虚拟机继续运行。
一种基于数字证书的信息安全实现系统，其包括：CA中心、云管理主机、云计算物理主机，以及，根据所述云计算物理主机而创建的至少一个云计算虚拟机；其中，
CA中心，设置为在云管理主机的管理控制下为云管理主机、云计算物理主机以及云计算虚拟机分别发放数字证书；
云管理主机，设置为在启动时或运行过程中，依据相应的数字证书进行合规性认证；
云计算物理主机，设置为在启动时或运行过程中，依据相应的数字证书 进行合规性认证；
云计算虚拟机，设置为在启动时或运行过程中，依据相应的数字证书进行合规性认证。
本发明实施例提供的基于数字证书的信息安全实现方法借鉴数字证书信任链的技术，与云管理系统结合，实现了云管理系统、物理主机、虚拟机的可信系统,着重于系统主机平台自身的安全防护，提高了云虚拟化平台的安全性。
附图概述
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是本发明实施例中云管理主机数字证书发放的流程图；
图2是本发明实施例中云计算物理主机数字证书发放的流程图；
图3是本发明实施例中云计算虚拟机数字证书发放的流程图；
图4是本发明实施例中云管理主机依据数字证书进行在线认证的流程图；
图5是本发明实施例中云计算物理主机依据数字证书进行在线认证的流程图；
图6是本发明实施例中云计算虚拟机在手工启动时依据数字证书进行在线认证的流程图；
图7是本发明实施例中云计算虚拟机在自动启动时依据数字证书进行在线认证的流程图。
本发明目的的实现、功能特点及优异效果，下面将结合具体实施例以及附图做进一步的说明。
本发明的较佳实施方式
为使本发明实施例的目的、技术方案和优点更加清楚明白，下文中将结合附图对本发明的实施例进行详细说明。需要说明的是，在不冲突的情况下， 本申请中的实施例及实施例中的特征可以相互任意组合。
应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
在本发明实施例中，CA中心即证书授权中心，或称证书授权机构，作为电子商务交易中受信任的第三方，承担公钥体系中公钥的合法性检验的责任。
CA中心分别为云管理主机、云计算物理主机以及云计算虚拟机颁发数字证书。CA中心架构包括公钥基础设施(PKI，Public Key Infrastructure)结构、高强度抗攻击的公开加解密算法、数字签名技术、身份认证技术、运行安全管理技术、可靠的信任责任体系等。从业务流程涉及的角色看，包括认证机构、数字证书库和黑名单库、密钥托管处理系统、证书目录服务、证书审批和作废处理系统。
目前提供的CA数字证书业务主要包括：数字证书的申请、签发和发布；证书的查询、作废、更新、存档，并提供在线证书状态查询服务；密钥的管理，主要是密钥的产生、存贮、更新、备份和恢复。
在本发明实施例中，CA发证和在线认证通常是分离的物理设备。
在本发明实施例中，云管理主机为云虚拟化平台中起管理及调度作用的管理节点，可以监控云计算物理主机(计算节点)、存储节点等虚拟化资源的运行状况，并根据其运行状态进行调度；另外还可以对资源进行维护，包括本发明实施例中所述的虚机管理，云计算物理主机、云计算虚拟机的数字证书的在线申请发送和管理。
在本发明实施例中，云计算物理主机作为云虚拟化计算节点的物理机，主要负责为虚拟化系统提供计算能力，它是虚机的承载。
在本发明实施例中，对于所述云计算虚拟机，云管理主机对云计算物理主机虚拟化后，可以根据需要，将虚拟CPU资源、内存资源、网络资源等抽取组成云计算虚拟机。通常，一个云计算物理主机可以根据其资源和业务应用情况创建多个云计算虚拟机。
在本发明实施例中，证书key为负责存放数字证书的物理实体。包括但 不限于USBkey、蓝牙KEY、移动终端的TF(Trans-flash)卡Key等形态。
例如在某些实施例中，云计算物理主机USB口插的USB key即用于存放云计算物理主机自身的数字证书，也存放依赖于该主机的云计算虚拟机的数字证书。
在本发明实施例中，证书代理为负责云计算物理主机、云计算虚拟机进行数字证书读取、认证的后台软件，通常其部署于各云计算物理主机上。
本发明实施例提供的基于数字证书的信息安全实现方法，包括：
为云管理主机、云计算物理主机以及云计算虚拟机分别发放数字证书；在这些网元启动时或运行过程中，依据相应的数字证书进行合规性认证。
在本实施例中，为云管理主机、云计算物理主机以及云计算虚拟机分别发放的数字证书被存放于证书key之中，所述证书key支持存放多个数字证书，并通过证书容器相互隔离，证书key中的每个证书容器被配置为用于存储独立的数字证书，每个数字证书的读取者只能根据权限读取到自己权限内的数字证书。
本发明实施例提供的基于数字证书的信息安全实现方法借鉴数字证书信任链的技术，与云管理系统结合，实现了云管理系统、物理主机、虚拟机的可信系统,着重于系统主机平台自身的安全防护，提高了云虚拟化平台的安全性。
在本发明实施例中，需要分别为云管理主机、云计算物理主机以及云计算虚拟机发放数字证书，并在这些网元启动时或运行过程中，依据相应的数字证书进行合规性认证。具体地，例如通过云管理主机创建云计算虚拟机时，以云计算虚拟机设备的虚拟MAC地址、虚拟CPU信息等组成的关键属性向CA中心申请数字证书,CA中心根据云计算虚拟机的关键属性值生成相应的数字证书并加密传送给云计算虚拟机所在的云计算物理主机上的证书代理。云计算物理主机上的证书代理根据不同的云计算虚拟机的关键属性在证书key中创建隔离的证书容器，并将云计算虚拟机的数字证书写入证书容器中。
在云计算虚拟机启动时，需根据其关键属性信息从证书key中读取相应的加密的数字证书，并进行CA认证，验证成功后才容许继续后续启动。
另外，在云计算虚拟机运行过程中，采用通过证书代理定期自动认证的 机制，保证了云平台运行态中的安全。且在认证过程中，其证书链相互验证，例如CA中心验证云管理主机签名，云管理主机验证云计算物理主机签名，云计算物理主机验证云计算虚拟机签名，以此来保证系统中每个节点都是可靠的。
具体地，在本实施例中，如图1所示，为云管理主机发放数字证书包括：
S101、CA中心根据云管理主机(云管理节点)关键属性信息采用hash算法生成唯一的字符串，作为云管理主机数字证书生成的输入来生成证书并写入证书key中完成制卡，在本实施例中，所述云管理主机关键属性信息包括但不限于云管理主机的MAC地址、CPU号。
具体地，参考图2所示，在本实施例中，为云计算物理主机发放数字证包括：
S102、收集指定云计算物理主机(云计算节点)属性信息，从而为指定云计算节点申请设备证书，具体地，云管理主机通过部署于相应云计算物理主机上的证书代理获取该云计算物理主机关键属性信息(如MAC地址、CPU号等关键信息)，并据此向CA中心发起云计算物理主机数字证书申请；
S103、CA中心验证云管理节点，从而为指定的云计算节点生成数字证书并制卡，具体地，CA中心验证云管理主机数字证书，在验证通过时根据云计算物理主机关键属性信息生成云计算物理主机数字证书并制卡。
具体地，参考图3所示，在本实施例中，为云计算虚拟机分别发放数字证书包括：
S104、云管理主机首先选择资源池，并创建云计算物理主机的云计算虚拟机，并在云管理主机验证云计算虚拟机所归属的云计算物理主机正常后，获取该云计算虚拟机关键属性信息，并据此向CA中心发起云计算虚拟机数字证书申请；
S105、CA中心验证云管理主机数字证书，在验证通过时根据云计算虚拟机关键属性信息生成云计算虚拟机数字证书文件；
S106、CA中心向云管理主机返回加密的云计算虚拟机数字证书文件；
S107、云管理主机向云计算虚拟机所归属的云计算物理主机返回加密的云计算虚拟机数字证书文件,云计算物理主机通过部署于其上的代理程序验 证加密的云计算虚拟机数字证书文件，根据云计算虚拟机关键属性信息在证书key中创建隔离的证书容器，并将所述云计算虚拟机数字证书写入证书容器中。
具体地，如图4所示，在本实施例中，在云管理主机启动时，依据相应的数字证书进行合规性认证包括：
S201、在云管理主机启动时，部署于云管理主机上的证书代理向CA中心发起在线或离线认证请求并生成本次认证随机数Ra，以请求随机数Rb；
S202、CA中心响应所述请求并返回认证随机数Rb；
S203、云管理主机的证书代理根据云管理主机关键属性信息从证书key中读取云管理主机的数字证书，使用数字证书对所述本次认证随机数Ra以及认证随机数Rb进行数字签名，并将所述签名结果、云管理主机的数字证书CerA以及本次认证随机数Ra发送给CA中心；
S204、CA中心对接收到的信息进行认证，并在认证成功后，通知云管理主机继续启动流程。其中如何认证属于本领域技术人员的公知技术，这里不再赘述。
具体地，如图5所示，在本实施例中，在云计算物理主机启动时，依据相应的数字证书进行合规性认证包括：
S205、在云计算物理主机启动时，部署于云计算物理主机上的证书代理根据其云计算物理主机关键属性信息从证书key中读取该云计算物理主机的数字证书，向CA中心发起在线或离线认证请求并生成本次认证随机数Ra，以申请随机数Rb；
S206、CA中心响应所述请求并返回认证随机数Rb；
S207、云计算物理主机的证书代理根据云计算物理主机关键属性信息从证书key中读取该云计算物理主机的数字证书，使用数字证书对所述本次认证随机数Ra以及认证随机数Rb进行数字签名，并将所述签名结果、云计算物理主机的数字证书CerA以及本次认证随机数Ra发送给CA中心；
S208、CA中心对接收到的信息进行认证，并在认证成功后，通知云计算物理主机继续启动流程。
具体地，在本实施例中，在云计算虚拟机启动时，依据相应的数字证书 进行合规性认证包括：
S209、在云计算虚拟机启动时，其所归属的云计算物理主机上的证书代理根据云计算虚拟机关键属性信息(例如MAC地址、CPU号等)从证书key中的相应证书容器中读取云计算虚拟机数字证书，向CA中心发起在线或离线认证请求并生成本次认证随机数Ra；
S210、CA中心响应所述请求并返回认证随机数Rb；
S211、云计算物理主机上的证书代理根据所述云计算虚拟机数字证书对所述本次认证随机数Ra以及认证随机数Rb进行数字签名，并将签名结果、云计算虚拟机数字证书以及本次认证随机数Ra发送给CA中心；
S212、CA中心对接收到的信息进行认证，并在认证成功后，通知云计算虚拟机继续启动流程。
当然，所述云计算虚拟机可以由管理员登录云管理主机节点后，手工启动相应的云计算虚拟机，也可以预先配置启动策略，并由系统自动启动相应的云计算虚拟机。如图6所示，其示出了手工启动云计算虚拟机流程示意图，其具体包括：
步骤61、管理员手工启动某云计算虚拟机，其手工启动云计算虚拟机的方式为本领域的现有技术；
步骤62、在云计算虚拟机启动后，其所归属的云计算物理主机根据云计算虚拟机关键属性信息(例如MAC地址、CPU号等)从证书key中的相应证书容器中读取云计算虚拟机数字证书，向CA中心发起在线或离线认证请求并生成本次认证随机数Ra，以申请随机数Rb；
步骤63、CA中心响应所述请求并返回认证随机数Rb；
步骤64、云计算物理主机上的证书代理根据所述云计算虚拟机数字证书对所述本次认证随机数Ra以及认证随机数Rb进行数字签名，并将签名结果、云计算虚拟机数字证书CerA以及本次认证随机数Ra发送给CA中心；
步骤65、CA中心对接收到的信息进行认证，并在认证成功后，通知云计算虚拟机继续启动流程。
如图7所示，其示出了自动启动云计算虚拟机的流程示意图，其包括：
步骤71、某云计算虚拟机依据预设的自动启动策略自动重启，其中所述 自动启动策略为本领域的现有技术；
步骤72、在云计算虚拟机启动后，其所归属的云计算物理主机根据云计算虚拟机关键属性信息(例如MAC地址、CPU号等)从证书key中的相应证书容器中读取云计算虚拟机数字证书，向CA中心发起在线或离线认证请求并生成本次认证随机数Ra，以申请随机数Rb；
步骤73、CA中心响应所述请求并返回认证随机数Rb；
步骤74、云计算物理主机上的证书代理根据所述云计算虚拟机数字证书对所述本次认证随机数Ra以及认证随机数Rb进行数字签名，并将签名结果、云计算虚拟机数字证书CerA以及本次认证随机数Ra发送给CA中心；
步骤75、CA中心对接收到的信息进行认证，并在认证成功后，通知云计算虚拟机继续启动流程。
具体地，在本实施例中，在云管理主机运行过程中，依据相应的数字证书进行合规性认证的具体包括：
云管理主机的证书代理循环检验证书的合规性，在监控定时器时间到时，证书代理获取云管理主机关键属性信息，并据此从证书key中读取云管理主机的数字证书并向CA中心发起在线或离线认证请求：当CA中心认证通过时，云管理主机继续运行；否则，CA中心生成告警，并发送通知消息以通知管理员进行处理。其中，依据所述第一定时器，实现在云管理主机运行过程中，定时地依据相应的数字证书进行合规性认证。
具体地，在本实施例中，在云计算物理主机运行过程中，依据相应的数字证书进行合规性认证的步骤包括：
云物理主机的证书代理循环检验证书的合规性，在监控定时器时间到时，证书代理获取云计算物理主机关键属性信息，并据此从证书key中读取云计算物理主机的数字证书并向CA中心发起在线或离线认证请求：当CA中心认证通过时，云计算物理主机继续运行；否则，CA中心生成告警，并发送通知消息以通知管理员进行处理。其中，依据所述第二定时器，实现在云计算物理主机运行过程中，定时地依据相应的数字证书进行合规性认证。
具体地，在本实施例中，在云计算虚拟机运行过程中，依据相应的数字证书进行合规性认证的步骤包括：
云计算虚拟机所归属的云计算物理主机的证书代理循环检验证书的合规性在监控定时器时间到时，证书代理获取云计算虚拟机关键属性信息，并据此从证书key中的相应证书容器中读取云计算虚拟机数字证书并向CA中心发起在线或离线认证请求：当CA中心认证通过时，云计算虚拟机继续运行；否则，CA中心生成告警，并发送通知消息以通知管理员进行处理。其中，依据所述第三定时器，实现在云计算虚拟机运行过程中，定时地依据相应的数字证书进行合规性认证。
当然，上文均以运用于云环境予以阐述本发明的要旨，应当理解，本发明实施例提供的所述方法非仅仅适用于云环境，非云环境也同样可以适用本发明。例如在基于docker容器方式而不是基于虚机方式的系统中，采用本发明实施例，对于一个docker关联一个虚拟数字证书，并对其他网元均配置相对应的数字证书，在后续的启动、运行过程中，均采取这些配置的数字证书执行相应的合规认证，从而确保系统的信息安全。
相应地，本发明实施例还提供了一种基于数字证书的信息安全实现系统，其包括：CA中心、云管理主机、云计算物理主机，以及，根据所述云计算物理主机而创建的至少一个云计算虚拟机；其中，
CA中心，设置为在云管理主机的管理控制下为云管理主机、云计算物理主机以及云计算虚拟机分别发放数字证书；
云管理主机，设置为在启动时或运行过程中，依据相应的数字证书进行合规性认证；
云计算物理主机，设置为在启动时或运行过程中，依据相应的数字证书进行合规性认证；
云计算虚拟机，设置为在启动时或运行过程中，依据相应的数字证书进行合规性认证。
具体地，在本实施例中，CA中心具体设置为：根据云管理主机关键属性信息生成云管理主机数字证书并制卡；
验证云管理主机数字证书，在验证通过时根据云计算物理主机关键属性信息生成云计算物理主机数字证书并制卡。
验证云管理主机数字证书，在验证通过时根据云计算虚拟机关键属性信 息生成云计算虚拟机数字证书文件；向云管理主机返回加密的云计算虚拟机数字证书文件；
相应地，
云管理主机，还设置为通过部署于相应云计算物理主机上的证书代理获取该云计算物理主机关键属性信息(如MAC地址、CPU号等关键信息)，并据此向CA中心发起云计算物理主机数字证书申请；
在验证云计算虚拟机所归属的云计算物理主机正常后，获取该云计算虚拟机关键属性信息，并据此向CA中心发起云计算虚拟机数字证书申请；向云计算虚拟机所归属的云计算物理主机返回加密的云计算虚拟机数字证书文件；
云计算物理主机，还设置为通过部署于其上的代理程序验证加密的云计算虚拟机数字证书文件，根据云计算虚拟机关键属性信息在证书key中创建隔离的证书容器，并将所述云计算虚拟机数字证书写入证书容器中。其中，在本实施例中，证书key中的每个证书容器被配置为用于存储独立的数字证书，每个数字证书的读取者只能根据权限读取到自己权限内的数字证书。
具体地，在本实施例中，云管理主机、云计算物理主机以及云计算虚拟机在在启动时，依据相应的数字证书进行合规性认证具体包括：
云管理主机具体设置为：
在启动时，部署于云管理主机上的证书代理向CA中心发起在线或离线认证请求并生成本次认证随机数Ra；接收来自CA中心响应所述请求并返回的认证随机数Rb；云管理主机的证书代理根据云管理主机关键属性信息从证书key中读取云管理主机的数字证书，使用数字证书对所述本次认证随机数Ra以及认证随机数Rb进行数字签名，并将所述签名结果、云管理主机的数字证书以及本次认证随机数Ra发送给CA中心；接收到来自CA中心对接收到的信息进行认证成功的通知，继续启动流程。
云计算物理主机具体设置为：
在启动时，部署于云计算物理主机上的证书代理根据其云计算物理主机关键属性信息从证书key中读取该云计算物理主机的数字证书，向CA中心发起在线或离线认证请求并生成本次认证随机数Ra；接收来自CA中心响应 所述请求并返回的认证随机数Rb；云计算物理主机的证书代理根据云计算物理主机关键属性信息从证书key中读取该云计算物理主机的数字证书，使用数字证书对所述本次认证随机数Ra以及认证随机数Rb进行数字签名，并将所述签名结果、云计算物理主机的数字证书以及本次认证随机数Ra发送给CA中心；接收来自CA中心对接收到的信息进行认证成功的通知，继续启动流程。
在云计算虚拟机具体设置为：
在启动时，其所归属的云计算物理主机上的证书代理根据云计算虚拟机关键属性信息从证书key中的相应证书容器中读取云计算虚拟机数字证书，向CA中心发起在线或离线认证请求并生成本次认证随机数Ra；接收来自CA中心响应所述请求并返回的认证随机数Rb；云计算物理主机上的证书代理根据所述云计算虚拟机数字证书对所述本次认证随机数Ra以及认证随机数Rb进行数字签名，并将签名结果、云计算虚拟机数字证书以及本次认证随机数Ra发送给CA中心；接收来自CA中心对接收到的信息认证成功的通知，继续启动流程。
当然，所述云计算虚拟机可以由管理员登录云管理主机节点后，手工启动相应的云计算虚拟机，也可以预先配置启动策略，并由系统自动启动相应的云计算虚拟机。继续参考图6所示，其示出了手工启动云计算虚拟机流程示意图，继续参考图7所示，其示出了自动启动云计算虚拟机的流程示意图。
具体地，在本实施例中，云管理主机、云计算物理主机以及云计算虚拟机在在运行过程中，依据相应的数字证书进行合规性认证具体包括：
云管理主机具体设置为：在预先设置的第一定时器时间到时，云管理主机的证书代理获取云管理主机关键属性信息，并据此从证书key中读取云管理主机的数字证书并向CA中心发起在线或离线认证请求：当接收到来自CA中心的认证通过通知时，继续运行；
否则，CA中心还设置为：生成告警，并发送通知消息以通知管理员进行处理。
云计算物理主机具体设置为：在预先设置的第二定时器时间到时，云计算物理主机的证书代理获取云计算物理主机关键属性信息，并据此从证书 key中读取云计算物理主机的数字证书并向CA中心发起在线或离线认证请求：当接收到来自CA中心的认证通过通知时，继续运行；
否则，CA中心还设置为：生成告警，并发送通知消息以通知管理员进行处理。
云计算虚拟机具体设置为：在预先设置的第三定时器时间到时，云计算虚拟机所归属的云计算物理主机的证书代理获取云计算虚拟机关键属性信息，并据此从证书key中的相应证书容器中读取云计算虚拟机数字证书并向CA中心发起在线或离线认证请求：当接收到来自CA中心的认证通过通知时，继续运行；
否则，CA中心还设置为：生成告警，并发送通知消息以通知管理员进行处理。
以上所述仅为本发明的优选实施例，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。
工业实用性
本发明实施例提出的基于数字证书的信息安全实现方法及系统，所述方法包括：为云管理主机、云计算物理主机以及云计算虚拟机分别发放数字证书；在所述云管理主机、云计算物理主机以及云计算虚拟机启动时或运行过程中，依据相应的数字证书进行合规性认证。本发明实施例提供的基于数字证书的信息安全实现方法及系统借鉴数字证书信任链的技术，与云管理系统结合，实现了云管理系统、物理主机、虚拟机的可信系统,着重于系统主机平台自身的安全防护，提高了云虚拟化平台的安全性。

Claims (12)

  1. 一种基于数字证书的信息安全实现方法，其特征在于，包括：
    为云管理主机、云计算物理主机以及云计算虚拟机分别发放数字证书；
    在所述云管理主机、云计算物理主机以及云计算虚拟机启动时或运行过程中，依据相应的数字证书进行合规性认证。
  2. 如权利要求1所述的信息安全实现方法，其特征在于，所述为云管理主机发放数字证书包括：
    证书授权CA中心根据所述云管理主机关键属性信息生成云管理主机数字证书并制卡。
  3. 如权利要求1所述的信息安全实现方法，其特征在于，所述为云计算物理主机发放数字证书包括：
    云管理主机通过部署于相应云计算物理主机上的证书代理获取该云计算物理主机关键属性信息，并据此向CA中心发起云计算物理主机数字证书申请；
    CA中心验证云管理主机数字证书，在验证通过时根据云计算物理主机关键属性信息生成云计算物理主机数字证书并制卡。
  4. 如权利要求1所述的信息安全实现方法，其特征在于，所述为云计算虚拟机分别发放数字证书包括：
    所述云管理主机在验证云计算虚拟机所归属的云计算物理主机正常后，获取该云计算虚拟机关键属性信息，并据此向CA中心发起云计算虚拟机数字证书申请；
    CA中心验证云管理主机数字证书，在验证通过时根据云计算虚拟机关键属性信息生成云计算虚拟机数字证书文件；
    CA中心向云管理主机返回加密的云计算虚拟机数字证书文件；
    云管理主机向云计算虚拟机所归属的云计算物理主机返回加密的云计算虚拟机数字证书文件,云计算物理主机通过部署于其上的代理程序验证加密的云计算虚拟机数字证书文件，根据云计算虚拟机关键属性信息在证书 key中创建隔离的证书容器，并将所述云计算虚拟机数字证书写入证书容器中。
  5. 如权利要求4所述的信息安全实现方法，其特征在于，所述证书key中的每个证书容器被配置为用于存储独立的数字证书。
  6. 如权利要求2所述的信息安全实现方法，其特征在于，在所述云管理主机启动时，依据相应的数字证书进行合规性认证包括：
    部署于所述云管理主机上的证书代理向CA中心发起在线或离线认证请求并生成本次认证随机数Ra；CA中心响应所述请求并返回认证随机数Rb；
    云管理主机的证书代理根据云管理主机关键属性信息从证书key中读取云管理主机的数字证书，使用数字证书对所述本次认证随机数Ra以及认证随机数Rb进行数字签名，并将所述签名结果、云管理主机的数字证书以及本次认证随机数Ra发送给CA中心；CA中心对接收到的信息进行认证，并在认证成功后，通知所述云管理主机继续启动流程。
  7. 如权利要求3所述的信息安全实现方法，其特征在于，在所述云计算物理主机启动时，依据相应的数字证书进行合规性认证的包括：
    部署于所述云计算物理主机上的证书代理根据其云计算物理主机关键属性信息从证书key中读取该云计算物理主机的数字证书，向CA中心发起在线或离线认证请求并生成本次认证随机数Ra；CA中心响应所述请求并返回认证随机数Rb；
    云计算物理主机的证书代理根据云计算物理主机关键属性信息从证书key中读取该云计算物理主机的数字证书，使用数字证书对所述本次认证随机数Ra以及认证随机数Rb进行数字签名，并将所述签名结果、云计算物理主机的数字证书以及本次认证随机数Ra发送给CA中心；CA中心对接收到的信息进行认证，并在认证成功后，通知所述云计算物理主机继续启动流程。
  8. 如权利要求4所述的信息安全实现方法，其特征在于，在所述云计算虚拟机启动时，依据相应的数字证书进行合规性认证包括：
    所述云计算虚拟机所归属的云计算物理主机上的证书代理根据云计算虚拟机关键属性信息从证书key中的相应证书容器中读取云计算虚拟机数字证 书，向CA中心发起在线或离线认证请求并生成本次认证随机数Ra；CA中心响应所述请求并返回认证随机数Rb；
    云计算物理主机上的证书代理根据所述云计算虚拟机数字证书对所述本次认证随机数Ra以及认证随机数Rb进行数字签名，并将签名结果、云计算虚拟机数字证书以及本次认证随机数Ra发送给CA中心；CA中心对接收到的信息进行认证，并在认证成功后，通知所述云计算虚拟机继续启动流程。
  9. 如权利要求1所述的信息安全实现方法，其特征在于，在所述云管理主机运行过程中，依据相应的数字证书进行合规性认证包括：
    在预先设置的第一定时器时间到时，所述云管理主机的证书代理获取云管理主机关键属性信息，并据此从证书key中读取云管理主机的数字证书并向CA中心发起在线或离线认证请求：当CA中心认证通过时，所述云管理主机继续运行。
  10. 如权利要求1所述的信息安全实现方法，其特征在于，在所述云计算物理主机运行过程中，依据相应的数字证书进行合规性认证包括：
    在预先设置的第二定时器时间到时，所述云计算物理主机的证书代理获取云计算物理主机关键属性信息，并据此从证书key中读取云计算物理主机的数字证书并向CA中心发起在线或离线认证请求：当CA中心认证通过时，所述云计算物理主机继续运行。
  11. 如权利要求1所述的信息安全实现方法，其特征在于，在所述云计算虚拟机运行过程中，依据相应的数字证书进行合规性认证包括：
    在预先设置的第三定时器时间到时，所述云计算虚拟机所归属的云计算物理主机的证书代理获取云计算虚拟机关键属性信息，并据此从证书key中的相应证书容器中读取云计算虚拟机数字证书并向CA中心发起在线或离线认证请求：当CA中心认证通过时，所述云计算虚拟机继续运行。
  12. 一种基于数字证书的信息安全实现系统，其特征在于，包括：CA中心、云管理主机、云计算物理主机，以及，根据所述云计算物理主机而创建的至少一个云计算虚拟机；其中，
    CA中心，设置为在云管理主机的管理控制下为云管理主机、云计算物 理主机以及云计算虚拟机分别发放数字证书；
    云管理主机，设置为在启动时或运行过程中，依据相应的数字证书进行合规性认证；
    云计算物理主机，设置为在启动时或运行过程中，依据相应的数字证书进行合规性认证；
    云计算虚拟机，设置为启动时或运行过程中，依据相应的数字证书进行合规性认证。
PCT/CN2015/075143 2014-07-22 2015-03-26 基于数字证书的信息安全实现方法及系统 WO2016011827A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP15824515.9A EP3197121B1 (en) 2014-07-22 2015-03-26 Information security realizing method and system based on digital certificate
US15/326,653 US10411903B2 (en) 2014-07-22 2015-03-26 Information security realizing method and system based on digital certificate

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410350559.7A CN105282122B (zh) 2014-07-22 2014-07-22 基于数字证书的信息安全实现方法及系统
CN201410350559.7 2014-07-22

Publications (1)

Publication Number Publication Date
WO2016011827A1 true WO2016011827A1 (zh) 2016-01-28

Family

ID=55150457

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/075143 WO2016011827A1 (zh) 2014-07-22 2015-03-26 基于数字证书的信息安全实现方法及系统

Country Status (4)

Country Link
US (1) US10411903B2 (zh)
EP (1) EP3197121B1 (zh)
CN (1) CN105282122B (zh)
WO (1) WO2016011827A1 (zh)

Families Citing this family (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9992024B2 (en) * 2012-01-25 2018-06-05 Fujitsu Limited Establishing a chain of trust within a virtual machine
US11310050B2 (en) * 2018-09-17 2022-04-19 Microsoft Technology Licensing, Llc Verifying a computing device after transport
CN106357820A (zh) * 2016-11-10 2017-01-25 济南浪潮高新科技投资发展有限公司 一种云环境下ca基础设施资源分配系统及方法
CN107968816B (zh) * 2017-11-13 2020-10-27 国云科技股份有限公司 一种利用移动终端搭建云平台的方法
CN108322311B (zh) * 2018-01-29 2021-01-22 深圳市华德安科技有限公司 数字证书的生成方法及装置
US11681781B2 (en) * 2018-02-21 2023-06-20 Comcast Cable Communications, Llc Systems and methods for content security
CN108494562A (zh) * 2018-03-28 2018-09-04 湖南东方华龙信息科技有限公司 在云端创建私有ca的方法和数字签名认证方法
EP3585027B1 (de) 2018-06-20 2021-11-03 Siemens Aktiengesellschaft Verfahren zur anbindung eines endgerätes an eine vernetzbare rechner-infrastruktur
EP3624413A1 (de) * 2018-09-13 2020-03-18 Siemens Aktiengesellschaft Automatisiertes zertifikatsmanagement für automatisierungsanlagen
US20200210244A1 (en) * 2018-12-30 2020-07-02 Nokia Solutions And Networks Oy Virtual resource placement
SG11201910061RA (en) * 2019-01-11 2019-11-28 Alibaba Group Holding Ltd A distributed multi-party security model training framework for privacy protection
DK3633952T3 (da) * 2019-10-21 2022-03-14 Xertified Ab Systemer og fremgangsmåder til at modtage og udsende kommunikationssignaler
KR20210141188A (ko) * 2020-05-15 2021-11-23 삼성에스디에스 주식회사 분산형 키 관리 시스템 및 방법
CN113114658B (zh) * 2021-04-08 2023-02-28 深圳十方数链科技有限公司 一种基于云平台主机的传输加密证书自动管理系统
CN112995206B (zh) * 2021-04-13 2021-07-30 北京电信易通信息技术股份有限公司 一种基于可信技术实现多型工作单元安全联动的方法
CN113541935B (zh) * 2021-06-08 2022-06-03 西安电子科技大学 一种支持密钥托管的加密云存储方法、系统、设备、终端
CN113965376B (zh) * 2021-10-21 2023-09-19 合肥城市云数据中心股份有限公司 一种基于数据隔离平台的云主机远程数据通信方法
CN113791872B (zh) * 2021-11-11 2022-03-22 北京信安世纪科技股份有限公司 基于云计算的认证方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102932459A (zh) * 2012-11-05 2013-02-13 广州杰赛科技股份有限公司 一种虚拟机的安全控制方法
CN103248479A (zh) * 2012-02-06 2013-08-14 中兴通讯股份有限公司 云存储安全系统、数据保护以及共享方法
CN103312691A (zh) * 2013-04-19 2013-09-18 无锡成电科大科技发展有限公司 一种云平台的认证与接入方法及系统
WO2013165859A1 (en) * 2012-05-02 2013-11-07 Microsoft Corporation Certificate based connection to cloud virtual machine

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101809584B (zh) * 2007-09-25 2014-01-01 日本电气株式会社 证书生成/分发系统、证书生成/分发方法和证书生成/分发程序
EP2329391A1 (en) * 2008-08-13 2011-06-08 Secure Exchange Solutions, Llc Trusted card system using secure exchange
ES2620962T3 (es) * 2009-11-25 2017-06-30 Security First Corporation Sistemas y procedimientos para asegurar datos en movimiento
US8505003B2 (en) * 2010-04-28 2013-08-06 Novell, Inc. System and method for upgrading kernels in cloud computing environments
US8990562B2 (en) * 2010-10-08 2015-03-24 Microsoft Technology Licensing, Llc Secure deployment of provable identity for dynamic application environments
US8799997B2 (en) 2011-04-18 2014-08-05 Bank Of America Corporation Secure network cloud architecture
WO2014160479A1 (en) * 2013-03-13 2014-10-02 Arizona Board Of Regents, A Body Corporate Of The State Of Arizona, Acting For And On Behalf Of Arizone State University Systems and apparatuses for a secure mobile cloud framework for mobile computing and communication
US9158913B2 (en) 2012-07-09 2015-10-13 Ca, Inc. Managing virtual machines using owner digital signatures
US9961073B2 (en) * 2013-09-30 2018-05-01 Digicert, Inc. Dynamic certificate generation on a certificate authority cloud
US9306935B2 (en) * 2014-02-25 2016-04-05 Amazon Technologies, Inc. Provisioning digital certificates in a network environment
US9215231B1 (en) * 2014-02-25 2015-12-15 Amazon Technologies, Inc. Using a fraud metric for provisioning of digital certificates

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103248479A (zh) * 2012-02-06 2013-08-14 中兴通讯股份有限公司 云存储安全系统、数据保护以及共享方法
WO2013165859A1 (en) * 2012-05-02 2013-11-07 Microsoft Corporation Certificate based connection to cloud virtual machine
CN102932459A (zh) * 2012-11-05 2013-02-13 广州杰赛科技股份有限公司 一种虚拟机的安全控制方法
CN103312691A (zh) * 2013-04-19 2013-09-18 无锡成电科大科技发展有限公司 一种云平台的认证与接入方法及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3197121A4 *

Also Published As

Publication number Publication date
CN105282122B (zh) 2019-07-12
EP3197121A1 (en) 2017-07-26
EP3197121B1 (en) 2021-02-17
CN105282122A (zh) 2016-01-27
EP3197121A4 (en) 2017-07-26
US20170257221A1 (en) 2017-09-07
US10411903B2 (en) 2019-09-10

Similar Documents

Publication Publication Date Title
WO2016011827A1 (zh) 基于数字证书的信息安全实现方法及系统
US11695757B2 (en) Fast smart card login
CN110537346B (zh) 安全去中心化域名系统
EP3661120B1 (en) Method and apparatus for security authentication
WO2022262078A1 (zh) 基于零信任安全的访问控制方法、设备及存储介质
US11032252B2 (en) Distributed authentication between network nodes
JP6684930B2 (ja) ブロックチェーンに基づくアイデンティティ認証方法、装置、ノード及びシステム
US11711222B1 (en) Systems and methods for providing authentication to a plurality of devices
WO2018214165A1 (zh) 通信方法、装置、系统、电子设备及计算机可读存储介质
US10122703B2 (en) Federated full domain logon
WO2020062668A1 (zh) 一种身份认证方法、身份认证装置及计算机可读介质
JP6154413B2 (ja) ルート証明書の無効化
JP2010531516A (ja) 安全でないネットワークを介する装置のプロビジョニング及びドメイン加入エミュレーション
US10516653B2 (en) Public key pinning for private networks
CA3117713A1 (en) Authorization with a preloaded certificate
TW202044085A (zh) 鑑別使用區塊鏈使用者方法、系統及媒介
JP2018511952A (ja) 組織ユーザ識別管理を使用した自動鍵管理
JP2022534677A (ja) ブロックチェーンを使用するオンラインアプリケーションおよびウェブページの保護
US20220164790A1 (en) Systems and Methods for Improved Hot Wallet Security
WO2013067792A1 (zh) 智能卡的访问方法、装置及系统
CN115242471A (zh) 信息传输方法、装置、电子设备及计算机可读存储介质
JP2021533599A (ja) コンピューティング環境でオンプレミスの秘密を複製する安全な方法
US20240012933A1 (en) Integration of identity access management infrastructure with zero-knowledge services
US11520937B2 (en) NVMe over fabrics authentication system
JP2024510461A (ja) 接続回復力のある多要素認証

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15824515

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2015824515

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2015824515

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 15326653

Country of ref document: US