WO2017036003A1

WO2017036003A1 - Trusted network identity management and authentication system and method

Info

Publication number: WO2017036003A1
Application number: PCT/CN2015/098467
Authority: WO
Inventors: 延志伟; 耿光刚; 傅瑜; 李晓东
Original assignee: 中国互联网络信息中心
Priority date: 2015-09-01
Filing date: 2015-12-23
Publication date: 2017-03-09
Also published as: CN105162602A; CN105162602B

Abstract

The present invention relates to a trusted network identity management and authentication system and method. A user identifier management unit maintains network identifier information of a user, and binds a network identifier of the user to public key information to register at a trusted identifier maintenance unit. A network service management unit manages an Internet service, and binds the corresponding public key information to a domain name to register at the trusted identifier maintenance unit. The trusted identifier maintenance unit deploys a DNSSEC protocol, and maintains identifiers of the user and the Internet service, and the binding public key information. An Internet user unit stores and manages private key information, and obtains trusted network service provider information via querying the trusted identifier maintenance unit. A network service provider unit stores and manages the private key information, and obtains user information via querying the trusted identifier maintenance unit. The invention can support functions between a service provider and an Internet user, such as mutual identity authentication, key agreement, secure communication, etc.

Description

Trusted network identity management and verification system and method

Technical field

The invention belongs to the technical field of network technology and information security, and particularly relates to a trusted network identity management and verification system and method.

Background technique

With the rapid development of information technology in the past two decades, the importance of the Internet in social production and personal life has become increasingly prominent, and its services and applications have penetrated into military, cultural, political, and economic fields. However, with the unprecedented application of the Internet, the security problems it faces are becoming more and more serious. Cases such as the "Prism Gate" incident, the "five-eye" intelligence alliance, and the "angry bird" spy storm have repeatedly attracted high attention from countries to the credible security of the network.

Since 2000, the United States, the European Union, Japan and other countries and regions have accelerated the introduction and deployment of a credible network strategic framework in information networks, strengthening identity management and building a credible environment. In the United States, for example, the White House released the National Strategy for Trustworthy Identity in Cyberspace as early as April 2011. It plans to build a network identity ecosystem in about 10 years to promote the safe and efficient use of individuals and organizations on the Internet. Easy to use trusted identity.

This means that the security and credibility of the Internet is becoming more and more important, and establishing two-way authentication between Internet users and service providers has become an urgent basis for building an Internet security and trusted environment.

The Domain Name System (DNS) is a distributed Internet service system that maps domain names to certain predefined types of resource records, such as IP addresses. As a resource addressing service for the Internet application layer, domain name service is the basis of other Internet application services. Common Internet application services (such as Web services, email services, FTP services, etc.) are implemented on the basis of domain name services. Addressing and location of resources.

The original protocol of DNS is a lightweight protocol that does not provide security guarantees for service data content; and DNS data is transmitted in clear text over the Internet, and data is easily hijacked or tampered with during transmission. Since the DNS protocol itself does not provide an integrity protection mechanism for data content, the receiver cannot determine whether the received message has been tampered with and the source is correct. In addition, the implementation of the DNS protocol is usually based on the UDP protocol and lacks communication reliability. This guarantees that this further increases the likelihood that the message will be tampered with or forged. It is precisely because of the above security flaws exposed by the DNS protocol that the emergence and development of DNS Security Extensions (DNSSEC).

The DNSSEC protocol is a security extension for the DNS protocol. It adds a digital signature based on the asymmetric encryption algorithm to the DNS reply message to ensure that the data has not been tampered with and the source is correct. Then the domain name system is stepped up to the parent from the bottom up. The domain submits its own public key to implement step-by-step security authentication of the entire domain name system. Specifically, DNSSEC is The DNS data provides three aspects of security: (1) source verification: ensuring that the DNS response message comes from the authorized authoritative server; (2) integrity verification: ensuring that the DNS response message has not been tampered with during transmission; (3) denying the existence Verification: When a user requests a domain name that does not exist, the DNS server can also give a negative response message containing a digital signature to ensure the reliability of this negative response.

DNSSEC is essentially based on the domain name system tree authorization system, and then establishes a set of signature/verification system based on cryptography, which is the trust chain system, ensuring DNS query results through step-by-step security verification on the trust chain. True and reliable (data integrity and non-repudiation).

Summary of the invention

The invention provides a trusted network identity management and verification system and method, which can realize functions of two-way identity authentication, key agreement, secure communication and the like between a service provider and an Internet user.

In order to achieve the above object, the technical solution adopted by the present invention is as follows:

A trusted network identity management and verification system includes a user identity management unit, a network service management unit, a trusted identity maintenance unit, an internet subscriber unit, and a network service provider unit;

The user identity management unit maintains network identity information of the user, and binds the network identity and public key information of the user to the trusted identity maintenance unit;

The network service management unit manages the Internet service, and registers the corresponding public key information and the domain name binding to the trusted identifier maintenance unit;

The trusted identifier maintenance unit deploys a DNSSEC protocol, and maintains identity and public key binding information of the user and the Internet service;

The Internet subscriber unit saves and manages the private key information, and obtains the information of the trusted network service provider by querying the trusted identifier maintenance unit;

The network service provider unit saves and manages the private key information, and obtains the user information by querying the trusted identifier maintenance unit.

A trusted network authentication and secure communication method using the above system includes the following steps:

1) The Internet user registers the real name with the user identification management unit;

2) The user identification management unit generates a network identifier for the user and creates a user identification management account for it;

3) The user generates an asymmetric key pair and uploads the public key information through the login account;

4) The user identity management unit registers the user network identity and its public key information to the trusted identity maintenance unit; at the same time, sends the user's network identity and its public key information to the local ISP, and the local ISP uses the user Network identity Binding information and online account information;

5) The Internet service provider performs real-name registration with the network service management unit;

6) The network service management unit performs network access license verification, performs security level division based on the service content, and creates a service identifier management account for it;

7) The Internet service provider generates an asymmetric key pair and uploads the public key information through the login account;

8) The network service management unit registers the service domain name and its public key information to the trusted identifier maintenance unit;

9) When a user wants to access the website of the network service provider, firstly, the trusted key maintenance unit searches for the public key information and the IP address corresponding to the website;

10) The user signs the network identifier and public key information using the public key of the network service provider;

11) The network service provider queries the trusted identifier maintenance unit, and verifies the user network identifier and public key information with its own private key;

12) The network service provider generates a symmetric key, which is encrypted by the user's public key and transmitted to the user;

13) After receiving the user, the user obtains the symmetric key by decrypting with his own private key, and the user and the network service provider use the symmetric key for secure communication.

The invention utilizes DNS and DNSSEC technologies to manage and verify the trusted identity of the Internet, and supports service management of different security levels, thereby supporting two-way authentication, key agreement, secure communication, etc. between the service provider and the Internet user. Features.

DRAWINGS

Figure 1 is a schematic diagram of the roles associated with the trusted network framework.

2 is a schematic diagram of key distribution and user identification registration.

Figure 3 is a schematic diagram of key distribution and service identification registration.

4 is a schematic diagram of a trusted identity maintenance domain.

Figure 5 is a flow chart of trusted identification verification.

detailed description

The above described objects, features and advantages of the present invention will become more apparent from the aspects of the appended claims.

The present invention specifically includes five functional roles: an organization that manages user identity information, an organization that manages Internet service providers, an organization that maintains user and service trusted identification information, Internet users, and network service providers. The above five functions The roles may be implemented by specific hardware devices or software modules, which may be referred to as user identification management units/devices/modules, network service management units/devices/modules, trusted identification maintenance units/devices/modules, Internet subscriber units/devices/ Modules and network service provider units/devices/modules. The name "unit" is used below, as shown in Figure 1.

The user identification management unit maintains unique identification information of Chinese citizens (and foreign inbound users), and binds its network identity and public key information to the trusted identity maintenance unit, and simultaneously sets the user's network identity information and public key. The information is shared with the local ISP (Internet Service Provider), enabling the ISP to bind the user's network identity to the user's online account information.

The network service management unit manages the Internet service registered domestically (and registered abroad but domestically operated), confirms its service security requirements, and registers the corresponding public key information and domain name binding to the trusted identity maintenance unit.

The trusted identity maintenance unit deploys the DNSSEC protocol to maintain massive user/service identity and public key binding information in a scalable and manageable mode, and supports efficient and accurate queries.

The Internet subscriber unit saves and manages its own private key information, and obtains trusted network service provider information by querying the trusted identifier maintenance unit.

The following describes each key function of each role separately.

1. User Identity Management Unit

The user identification management unit maintains a user identification database, which includes: 1) identity information of a citizen of China (such as an identity card number); 2) entry of foreign citizenship information (such as a passport number). All those who wish to obtain Internet services in China need to register their real identity in the user identification database and fill in more than one effective communication method (generally e-mail and mobile phone number). And generate an account for each registered user to manage the user's identity and public key information. At the same time, the user's identity information and public key information are sent to the local ISP for record through an out-of-band security method.

The user identity management unit generates a network identity of the registered user, and registers the identity and the public key information submitted by the user to the trusted identity maintenance unit, as shown in FIG. 2;

1.1 User registration: After the user fills in the relevant information in the user identification database, the user registration function is selected, and the user registers the public key in the generated key to the identification database. In order to avoid counterfeiting user registration, the registration identity and the registrant must be strictly consistent in this step. For details, refer to the CN personal domain name registration process and the user verification mechanism.

3.1 Identification registration: The user identification database submits a list of user registration information to the identification maintenance unit through a dedicated security interface (such as the CN domain name registration service), wherein the mandatory information includes at least:

● User identity information

●Affiliation or country

●Public key information

● Survival time

3.2 Identification registration confirmation: The identification maintenance unit first generates the corresponding domain name based on the inventory information, and its format is as follows:

U-ID.Location.USER.CN

USER is a domain under the CN that specifically protects user identification information, and Location identifies the geographical area to which the user belongs (for Chinese citizens by province, and for foreign nationals by country), U-ID is a user ID of no more than 13 digits. (such as ID card or passport number).

Then, the identifier maintenance unit generates a corresponding DNS resource record (the invention does not limit which resource record is used, and it is recommended to use the TLSA or TXT resource record), and adds to the corresponding CN subdomain, where the lifetime is not greater than the user registration information list. The lifetime.

Finally, the identification maintenance unit performs a registration confirmation to the user identification management unit.

1.2 User Registration Confirmation: After receiving the registration success confirmation message, the user identification management unit sends a registration success message and a corresponding user network identity (via the communication mode selected by the user) to the user.

2. Network Service Management Unit

The network service management unit maintains a network service provider filing management database, which includes: 1) a network service provider based on a domestic domain name (.CN, . China, a company, a network, etc.); 2) based on an overseas domain name but operating in the country Network service provider (eg www.baidu.com). Domain name owners who wish to provide secure and effective Internet services in China should register and file in the database and fill in more than one type of effective communication (usually email and mobile phone numbers). An account is generated for each registered service, and the management service corresponds to the domain name, IP, and public key information.

In addition, the network service management unit should also set its security level according to the type of service, which is currently divided into three types:

● Strong security requirements: There are certain requirements for user identity authenticity and user rights, and may have certain guarantees for session privacy;

● Medium security requirement service: only one-way authentication of the user to the network service provider is performed, and a secure session channel is established;

● Weak security requirement service: Only users need to perform one-way authentication on the identity of the network service provider.

In the network service provider registration process, the interaction between the network service provider unit, the network service management unit, and the trusted identifier maintenance unit is involved, as shown in FIG. 3;

2.1 Service registration: Internet service providers wish to provide certain services in the Internet environment. First, they need to register and file in the network service management unit. In order to avoid counterfeiting, the registration identity and registrant must be guaranteed at this step. Strict and consistent, please refer to CN company domain name registration process and formalities verification mechanism.

4.1 Identity registration: The network service management unit demarcates its service security level based on its registered information, and then receives the public key information of the key pair generated by the service provider. The network service management unit then submits the registered service provider information list to the identity maintenance unit through a dedicated security interface (such as the CN domain name registration service), wherein the mandatory information includes at least:

● The domain name of the network service provider

●Affiliation or country

●Business type and security level

Key algorithm and public key information

● Survival time

4.2 Identification of registration: For the domestically registered domain name, the identity maintenance unit generates a corresponding DNS resource record based on the inventory information, and adds a new resource type as the corresponding domestic domain name; for the domain name registered overseas but running in the territory, the identity maintenance unit is based on the The overseas domain name, with the SERVICE.CN suffix, generates a new domain name, and adds the corresponding resource record. For example, www.baidu.com will have a DNS resource record of the following domain name in the CN domain:

Www.baidu.com.service.cn

Finally, the identification maintenance unit performs a successful registration confirmation with the service management unit.

2.2 Service Registration Confirmation: After receiving the registration success confirmation message, the service identification management unit issues a registration success message to the service provider, and the domain name information in the new DNS record (the communication method selected by the service provider).

3. Trusted Logo Maintenance Unit

The trusted identity maintenance unit manages the trusted identity data and adds support for the DNSSEC protocol in the existing domain name system (at least the DNS zone that manages the network identity information supports DNSSEC). And the corresponding domain name area is divided to maintain trusted identification data. The specific plan is shown in Figure 4.

1) Personal identification maintenance domain: Create a .USER subdomain under .CN, and create corresponding subdomains according to the Pinyin abbreviation (or Alpha-3 country code) of each geographical area (such as Beijing as .BJ, Shanxi) For .SX, Shandong is .SD, and the US entry citizen is .USA). The domain name of the user based on the ID number is maintained under each subdomain.

Among them, the pinyin abbreviation of each geographical area can refer to the Chinese phonetic alphabet abbreviations of the names of provinces, municipalities and autonomous regions in China (http://www.pthyygf.org/guifanbiaozhun/guifanbiaozhun/2011-11-26/12.html); using Alpha -3 country code in order to avoid a conflict with China provinces Pinyin initials (such as Shandong abbreviated as SD, and Sudan's Alpha-2 country code is SD, but its Alpha-3 country code SDN), the specific code see: https: / /www.iso.org/obp/ui/#search .

2) Service ID Maintenance Domain: Create a .SERVICE subdomain under .CN, and generate and maintain an overseas registration under the subdomain. The service domain name that runs in the country.

Registration service: The trusted identity maintenance unit shall provide the interfaces and services corresponding to the identity registration unit (user identity management unit and network service management unit), with the following functions and performance guarantees:

● Register the clock synchronization between the server and the client

● The efficiency of mass identification and update

● Secure authentication of registrant identity and secure transmission of registration data

Query service: The trusted identity maintenance unit should also provide query interfaces and services for identification information for users and service providers, with the following features and performance guarantees:

●The efficiency of massive identification query

● Circumventing the impact of the underlying DNS service

4. User (Internet User Unit)

The user first needs to register and authenticate in the user identification management unit, and generates an asymmetric key by itself, and registers the public key information in the corresponding account of the user identification management unit.

5. Network Service Provider (Network Service Provider Unit)

The network service provider first needs to register before the service is started in the network service management unit, and generates a corresponding asymmetric key pair according to the security level assessed by the network service management unit, and registers the public key information in the corresponding account of the network service management unit. .

Based on the functions of the foregoing roles for network identity management, the network identity verification process shown in Figure 5 can be implemented, including the following steps:

(1) The Internet user performs real-name registration with the user identification management unit;

(2) The user identification management unit generates a network identifier for the user based on the verification structure, and creates a user identification management account for the user (if the ID card system is used, the ID number can be used as the user name, and the ID verification code can be used as the initial login password) ;

(3) The user generates an asymmetric key pair and uploads the public key information by logging in to the account;

(4) The user identity management unit registers the user network identity and its public key information to the trusted identity maintenance unit; at the same time, sends the user's network identity and its public key information to the local ISP, which will be The user's network identity information is bound to the online account information. Therefore, the user identity management unit can check the online time length of the user, the visited website information, the IP address (IPv4 public address information, IPv4 private address information, IPv6 address information), etc. according to the user's network identity information. Therefore, the user is subjected to legal network monitoring and network traceability through an IP address.

(1') The Internet Service Provider performs real-name registration with the Network Service Management Unit;

(2') the network service management unit performs network access license verification, and performs security level division based on the service content, and creates a service identifier management account for it;

(3') the Internet service provider generates an asymmetric key pair, and uploads the public key information by logging in to the account;

(4') the network service management unit registers the service domain name and its public key information to the trusted identifier maintenance unit;

(5) When a user wants to access the website of the network service provider, firstly, the public key information and the IP address corresponding to the website are inquired through the trusted identifier maintenance unit;

(6) The user signs the network identifier and public key information using the public key of the network service provider;

(7) The network service provider queries the trusted identifier maintenance unit and verifies the user network identifier and public key information with its own private key;

(8) The network service provider generates a symmetric key, which is encrypted by the user's public key and transmitted to the user;

(9) After receiving the user, the user obtains the symmetric key by decrypting with his own private key, and the user and the network service provider use the symmetric key for secure communication.

The invention defines the main logical roles of ensuring secure communication between the two parties of the Internet communication and the controllability of the network, and defines the key functions of each role and the verification process of the trusted identification. In order to support various practical applications, the following technical details are not limited, and those skilled in the art can implement the existing methods:

1) User network identity generation mechanism;

2) a key generation method for the user and the network service provider;

3) a secure communication interface for each role registration identification management data;

4) a verification mechanism for the signature record of the user and the service provider including the trusted identifier and the corresponding public key;

5) Traceability through the user's IP address.

The above embodiments are only used to illustrate the technical solutions of the present invention, and the present invention is not limited thereto, and those skilled in the art can modify or replace the technical solutions of the present invention without departing from the spirit and scope of the present invention. The scope of protection shall be as stated in the claims.

Claims

A trusted network identity management and verification system, comprising: a user identity management unit, a network service management unit, a trusted identity maintenance unit, an internet subscriber unit, and a network service provider unit;

The user identity management unit maintains network identity information of the user, and binds the network identity and public key information of the user to the trusted identity maintenance unit;

The network service management unit manages the Internet service, and registers the corresponding public key information and the domain name binding to the trusted identifier maintenance unit;

The trusted identifier maintenance unit deploys a DNSSEC protocol, and maintains identity and public key binding information of the user and the Internet service;

The Internet subscriber unit saves and manages the private key information, and obtains the information of the trusted network service provider by querying the trusted identifier maintenance unit;

The network service provider unit saves and manages the private key information, and obtains the user information by querying the trusted identifier maintenance unit.
The system according to claim 1, wherein said user identification management unit maintains a user identification database, which includes citizen identity information, inbound foreign citizenship information, and is used for identity registration of the user; said user identity management The unit generates a network identity of the registered user, and registers the identity and the public key information submitted by the user to the trusted identity maintenance unit.
The system according to claim 1, wherein said network service management unit maintains a network service provider filing management database, which includes a network service provider based on a domestic domain name, and a network service provider based on an overseas domain name but operating in the country. For registration and filing of domain name owners who provide Internet services.
The system according to claim 1, wherein said network service management unit sets its security level according to the type of service, and is classified into three types:

● Strong security requirements: There are certain requirements for user identity authenticity and user rights, and may have certain guarantees for session privacy;

● Medium security requirement service: only one-way authentication of the user to the network service provider is performed, and a secure session channel is established;

● Weak security requirement service: Only users need to perform one-way authentication on the identity of the network service provider.
The system of claim 1, wherein the trusted identity maintenance unit divides the corresponding domain name zone to maintain trusted identity data, including a personal identity maintenance domain and a service identity maintenance domain.
The system of claim 5 wherein said personal identification maintenance domain establishes a .USER subdomain under .CN. Under the sub-domain, the corresponding sub-domain is established according to the Pinyin abbreviation or Alpha-3 country code of each geographical area, and the user domain name based on the ID number is maintained under each sub-domain; the service identification maintenance domain is established under .CN. SERVICE subdomain, under which the domain name of the service registered overseas but running in the country is generated and maintained.
A trusted network authentication and secure communication method using the system of claim 1, comprising the steps of:

1) The Internet user registers the real name with the user identification management unit;

2) The user identification management unit generates a network identifier for the user and creates a user identification management account for it;

3) The user generates an asymmetric key pair and uploads the public key information through the login account;

4) The user identity management unit registers the user network identity and its public key information to the trusted identity maintenance unit; at the same time, sends the user's network identity and its public key information to the local ISP, and the local ISP uses the user Binding of network identity information and online account information;

5) The Internet service provider performs real-name registration with the network service management unit;

6) The network service management unit performs network access license verification, performs security level division based on the service content, and creates a service identifier management account for it;

7) The Internet service provider generates an asymmetric key pair and uploads the public key information through the login account;

8) The network service management unit registers the service domain name and its public key information to the trusted identifier maintenance unit;

9) When a user wants to access the website of the network service provider, firstly, the trusted key maintenance unit searches for the public key information and the IP address corresponding to the website;

10) The user signs the network identifier and public key information using the public key of the network service provider;

11) The network service provider queries the trusted identifier maintenance unit, and verifies the user network identifier and public key information with its own private key;

12) The network service provider generates a symmetric key, which is encrypted by the user's public key and transmitted to the user;

13) After receiving the user, the user obtains the symmetric key by decrypting with his own private key, and the user and the network service provider use the symmetric key for secure communication.
The method according to claim 7, wherein the method for registering the user network identity and its public key information in the trusted identity maintenance unit by the user identity management unit in step 4) is:

a) the user identification management unit submits a list of user registration information to the trusted identifier maintenance unit through a dedicated security interface, where the mandatory information includes at least: user identity identification information, the province or country, the public key information, and the survival time;

b) The trusted identifier maintenance unit generates a corresponding domain name based on the manifest information, and the format is: U-ID.Location.USER.CN; wherein USER is a domain under the CN dedicated to maintaining user identification information, and Location identifies the geographic region to which the user belongs. , U-ID is the user ID;

c) The trusted identifier maintenance unit generates a corresponding DNS resource record and adds it to the corresponding CN subdomain, wherein the lifetime is not greater than the lifetime in the user registration information list;

d) The trusted identification maintenance unit performs a successful registration confirmation with the user identification management unit.
The method according to claim 7 or 8, wherein the method for registering the service domain name and its public key information in the trusted identity maintenance unit by the network service management unit in step 8) is:

a) the network service management unit submits the registered service provider information list to the trusted identifier maintenance unit through the dedicated security interface, wherein the mandatory information includes at least: the domain name of the network service provider, the province or country to which it belongs, the service type and the security level, Key algorithm and public key information, survival time;

b) For the domestically registered domain name, the trusted identifier maintenance unit generates a corresponding DNS resource record based on the inventory information, and adds a new resource type as the corresponding domestic domain name; for the domain name registered overseas but running in the territory, the trusted identifier maintenance unit is based on the The overseas domain name, with the SERVICE.CN suffix, generates a new domain name, and adds the corresponding resource record;

c) The trusted identification maintenance unit successfully confirms the registration with the service management organization.