WO2011069355A1

WO2011069355A1 - Network transmission method adapted for tri-element peer authentication trusted network connection architecture

Info

Publication number: WO2011069355A1
Application number: PCT/CN2010/073133
Authority: WO
Inventors: 肖跃雷; 曹军; 黄振海; 铁满霞; 葛莉
Original assignee: 西安西电捷通无线网络通信股份有限公司
Priority date: 2009-12-11
Filing date: 2010-05-24
Publication date: 2011-06-16
Also published as: CN101707621A; CN101707621B

Abstract

A network transmission method adapted for tn-element peer authentication trusted network connection architecture is provided. The method includes: 1) a requester, an authentication access controller and an authentication server execute a Tri-element Authentication Extensible Protocol (TAEP) authentication method, which includes: 1.1) the authentication access controller obtains the TAEP authentication method identity of the requester using the Request packets and the Response packets of TAEP; 1.2) the authentication access controller obtains the TAEP authentication method type from the authentication server using the Request packets and the Response packets of TAEP; 1.3) the authentication access controller selects a TAEP authentication method and executes a TAEP authentication method process with the requester and the authentication server; 1.4) the authentication access controller finishes the authentication process using the Success packets or the Failure packets of TAEP The TAEP authentication method and the inner TAEP authentication method adopted by the embodiments of the invention are both extensible authentication architectures, thus enhance the extensibility, applicability and security and have a good forward compatibility.

Description

Network transmission method suitable for ternary peer-to-peer authentication trusted network connection architecture The application claims to be submitted to the Chinese Patent Office on December 11, 2009, the application number is 200910311270.3, and the invention name is "a suitable for ternary peer identification. Priority of the Chinese Patent Application for the Network Transmission Method of the Network Connection Architecture, the entire contents of which are hereby incorporated by reference. Technical field

The present invention relates to the field of communications technologies, and in particular, to a network transmission method for a ternary peer-to-peer authentication trusted network connection architecture.

Background technique

With the development of information technology, the problems of malware such as viruses and worms are extremely prominent. More than 35,000 malware have been reported, and more than 40 million computers are infected every year. To contain such attacks, not only security transmissions and data entry checks, but also defenses from the source, from each terminal connected to the network. Traditional security defense technologies are no longer able to defend against a wide variety of malicious attacks.

In response to this problem, the Trusted Computing Group (TCG) has developed a network connection specification based on trusted computing technology—Trusted Network Connect (TNC), which is labeled TCG-TNC. It includes an open terminal integrity architecture and a set of standards to ensure secure interoperability. See Figure 1 for the TCG-TNC architecture.

Since the policy enforcement point in the TCG-TNC architecture is at the edge of the network, and the access requester does not take countermeasures to perform platform authentication, the architecture has a problem that the policy enforcement point cannot be trusted. To understand this problem, a TNC architecture based on Tri-element Peer Authentication (TePA) was proposed. See Figure 2 for the TePA-based TNC architecture.

The Extensible Authentication Protocol (EAP) is an authentication framework that is used for point-to-point authentication and supports multiple authentication mechanisms. EAP does not specify the authentication method during the link control phase, but defers the process to the authentication phase. This allows the discriminator to request more information before deciding which authentication method to use. This mechanism allows a "back-end" authentication server to be used to actually perform the authentication mechanism, while the discriminator simply passes the authentication exchange information.

Since EAP is only an authentication framework suitable for point-to-point authentication protocols, EAP is not suitable for implementing three-party authentication protocols, such as: ternary peer-to-peer authentication protocol—the authentication is based on trusted third parties to implement two-way authentication. In order to meet the needs of the three-party authentication protocol, an authentication box suitable for the three-party authentication protocol Architecture Tri-element Authentication Extensible Protocol

TAEP is proposed, in which the format of the TAEP packet is the same as that of the EAP packet, but the hierarchical model of TAEP is different from EAP.

The format of the TAEP package is as follows:

Among them, the meaning of each field is as follows:

The Code field is 1 octet long and indicates the type of TAEP packet:

1 Request

2 Response

3 Success

4 Failure

The Identifier field is one octet long and is used to match the Request and Response packets. The Length field is 2 octets in length and represents the total number of octets in the entire TAEP packet, which is the sum of the lengths of all fields including Code, Identifier, Length, and Data.

The Data field is variable in length, and the packet contains zero or more octets, the format of which is determined by the value of the Code field. If the value of the Code field is Request or Response, the Bell 'J Data field contains a Type field and a Type-Date field, and the Type field may be Identity and TP Authentication. If the value of the Code field is Success or Failure, the Data field does not exist.

The TAEP reuse model is shown in Figure 3:

Based on this model, the steps for TAEP message interaction are as follows:

1) The authentication access controller sends a Request packet to the requester to request to start the authentication, and the Request has a Tpye field indicating the type of the request, and the Type field is Identity, indicating the identity;

2) The requester sends a Response packet to the authentication access controller to respond to a valid Request, and the Response packet includes a Type field corresponding to the Type field in the Request packet, and the Type-Data field contains the identity of the peer;

3) The authentication access controller sends a Request packet to the authentication server, and the Request has a Type field indicating the type of the request, and Type is TP Authentication, which is used to request the authentication method type from the authentication server; 4) the authentication server sends a Response packet to the authentication access controller, and the Response packet includes a Type field corresponding to the Type field in the Request packet;

5) The authentication access controller selects an authentication method to start the authentication process according to the type of authentication method returned by the authentication server. The Request packet is sent to the requester, and the requester responds to the Response packet to the authentication access controller, and the sequence of Request and Response continues to interact as needed. The authentication access controller sends a Request packet to the authentication server, and the authentication server responds to the Authentication Access Controller with a Response packet. The sequence of this Request and Response will continue to be the required length. The authentication access controller is responsible for retransmitting the Request packet;

6) The conversation continues until the authentication access controller cannot authenticate the requester, the authentication access controller will send the Failure packet to the requester; or the authentication access controller determines that the successful authentication has been completed, authenticates the access controller or stops sending the Request packet, and ends The message interacts, or sends a Success packet to the requester.

In some cases, when the authentication method is determined or otherwise determined by the authentication method and identity, the above steps 3), 4) may be selectively performed.

In the TePA-based TNC architecture shown in FIG. 2, since the network access control layer transmits the above two layers of platform authentication protocol data in addition to the user authentication protocol data, and the platform authentication protocol data is in the access requester and the access controller. There is a need to use a secure tunnel for transmission, so the ternary authentication scalable protocol cannot complete the network transmission of the TePA-based TNC architecture.

Summary of the invention

Embodiments of the present invention provide a network transmission method suitable for a ternary peer-to-peer authentication trusted network connection architecture to implement network transmission based on a TePA-based TNC architecture.

The embodiment of the invention provides a network transmission method suitable for a ternary peer-to-peer authentication trusted network connection architecture, the method comprising:

1) the requester, the authentication access controller, and the authentication server perform a TAEP authentication method;

1.1) The authentication access controller uses the Request packet and the Response packet of the TAEP to obtain the identity of the TAEP authentication method of the requester;

1.2) using TAEP Request packet and Response packet to obtain the TAEP authentication method type from the authentication server;

1.3) Select a TAEP authentication method and perform the TAEP authentication method with the requester and the authentication service server. Legal process

1.4) End the authentication process with TAEP's Success packet or Failure packet.

Step 1) further includes the step 2) the requester, the authentication access controller, and the authentication server performing the TAEP tunnel authentication method;

2.1) The requester and the authentication access controller perform a tunneling method to establish a secure tunnel between the requester and the authentication access controller;

2.2) The requester, the authentication access controller, and the authentication server perform the internal TAEP authentication method in the secure tunnel established in step 2.1).

In the above method, if the session key between the requester and the authentication access controller has been established in step 1), the data between the requester and the authentication access controller can be used by the session key after the authentication process ends. Security protection, the session key and the established secure tunnel in step 2) may be used to secure data between the requester and the authentication access controller; if the requester and the authentication access control are not established in step 1) The session key between the devices, after the authentication process is completed, the data between the requester and the authentication access controller can be secured by using the established secure tunnel in step 2).

Embodiments of the invention have the following advantages:

1. The TAEP authentication method and the internal TAEP authentication method adopted by the embodiments of the present invention are all extensible authentication frameworks, thereby enhancing scalability and applicability;

2. The TAEP authentication method used in the embodiment of the present invention is transmitted before the establishment of the security tunnel, and the internal TAEP authentication method is transmitted after the security tunnel is established, so that the method has good forward compatibility. The intra-TAEP authentication method message is transmitted in the secure tunnel, thereby enhancing security.

DRAWINGS

1 is a schematic diagram of a TCG-TNC architecture in the prior art;

2 is a TePA-based TNC architecture in the prior art;

3 is a diagram of a TAEP multiplexing model in the prior art;

4 is a hierarchical diagram of a tunnel TAEP encapsulation in an embodiment of the present invention.

detailed description

The specific implementation steps of the network transmission method suitable for the ternary peer-to-peer authentication trusted network connection architecture in the embodiment of the present invention are as follows: 1) The requester, the authentication access controller, and the authentication server perform a TAEP authentication method, such as: performing a user authentication protocol. The TAEP authentication method can also establish a session key between the requester and the authentication access controller;

1.1) The authentication access controller uses the TAEP Request packet and the Response packet to obtain the requester's TAEP authentication method identity, such as: obtaining the requester's user identity;

1.1.1) The authentication access controller sends a TAEP Request packet to the requester, where the value of the Type field is Identity;

1.1.2) The requester sends a Response packet of the TAEP to the authentication access controller, where the Type field corresponds to the Type field in the Request packet of the TAEP in step 1.1.1), and the Type-Data field includes the identity of the TAEP authentication method of the requester. Such as: including the identity of the requester's user;

1.2) The authentication access controller uses the Request packet and the Response packet of the TAEP to obtain the TAEP authentication method type from the authentication server, such as: the user authentication method type;

1.2.1) The authentication access controller sends a TAEP Request packet to the authentication server, wherein the value of the Type field is TP Authentication, and the Type-Data field contains the identity of the TAEP authentication method of the requester and the authentication access controller, such as: The identity of the user accessing the requester and accessing the controller;

1.2.2) The authentication server sends a TAEP Response packet to the authentication access controller, where the Type field corresponds to the Type field in the TAEP Request packet in step 1.2.1), and the Type-Data field contains the TAEP authentication method type, such as: 2 user authentication protocol type;

1.3) The authentication access controller selects a TAEP authentication method and the requester and the authentication service server to perform the TAEP authentication method, such as: performing a user authentication protocol;

1.3.1) Identifying a series of TAEP Request packets and Response packets between the access controller and the requester, and between the authentication access controller and the authentication server, wherein the Type field is the TAEP authentication selected by the authentication access controller in step 1.3) Method type, the Type-Data field contains a TAEP authentication method message corresponding to the value of the Type field, such as: a user authentication protocol message;

If the TAEP tunnel authentication method needs to be performed after step 1.3), perform step 2), otherwise, perform step 1.4);

1.4) The authentication access controller ends the authentication process by using the TAEP Success packet or the Failure packet;

1.4.1) If the access controller is successfully authenticated during the TAEP authentication method in step 1.3.1) The authentication requester, for example, the identity of the user who successfully authenticates the requester, sends a Success packet of the TAEP to the requester;

1.4.2) If the authentication controller fails to successfully authenticate the requester during the TAEP authentication method in step 1.3.1), for example, the user identity of the requester cannot be successfully authenticated, and the TAEP Failure packet is sent to the requester.

2) The requester, the authentication access controller and the authentication server perform the TAEP tunnel authentication method; 2.1) the requester and the authentication access controller perform a tunneling method, establishing a secure tunnel between the requester and the authentication access controller, such as: performing a secure transmission The Transport Layer Security (TLS) protocol establishes a secure tunnel between the requester and the authentication access controller. Since the two-way user authentication between the requester and the authentication access controller has been implemented in step 1), a full anonymous mode of the TLS protocol can be executed to establish a secure tunnel between the requester and the authentication access controller;

2.2.1) The authentication access controller sends a request packet of the TAEP to the requester, where the value of the Type field is the TAEP tunnel authentication method type, and the value of the Type-Data field is the TAEP tunnel authentication method start flag, Start;

2.2.2) The requester and the authentication access controller interact with a series of TAEP Request packets and

The Response packet, where the value of the Type field is the TAEP tunnel authentication method type in step 2.2.1), and the value of the Type-Data field is the tunnel method message corresponding to the value of the Type field, such as: TLS protocol message, until the requester is established and Identifying a secure tunnel between access controllers;

2.2) The requester, the authentication access controller and the authentication server perform the internal TAEP authentication method in the secure tunnel established in step 2.1), for example, using the recording protocol of the TLS protocol to securely transmit the internal TAEP authentication method message;

2.2.1) The authentication access controller uses the Request packet and the Response packet of the TAEP to obtain the identity of the requester's internal TAEP authentication method, such as: obtaining the platform identity of the requester;

2.2.1.1) The authentication access controller sends a TAEP Request packet to the requester, where the value of the Type field is the TAEP tunnel authentication method type in step 2.2.1), and the value of the Type-Data field is established in step 2.1). An internal TAEP authentication method package for secure tunnel protection. The value of the Code field of the inner TAEP authentication method packet is Request, and the value of the Type field is Identity;

2.2.1.2) The requester sends a Response packet of the TAEP to the authentication access controller, wherein the Type field corresponds to the Type field in the Request packet of TAEP in step 2.2.1.1), Type-Data word The value of the segment is the inner TAEP authentication method packet protected by the secure tunnel established in step 2.1). The value of the Code field of the inner TAEP authentication method packet is Response, the Type field corresponds to the Type field in the Request packet of the TAEP authentication method packet in step 2.2.1.1, and the Type-Data field contains the identity of the inner TAEP authentication method of the requester, such as : contains the platform identity of the requester;

2.2.2) The authentication access controller uses the Request packet and the Response packet of the TAEP to obtain the type of the internal TAEP authentication method from the authentication server, such as: the platform authentication protocol type;

2.2.2.1) The authentication access controller sends a TAEP Request packet to the authentication server, wherein the value of the Type field is TP Authentication, and the Type-Data field contains the identity of the internal TAEP authentication method of the requester and the authentication access controller, such as: And the identity of the platform that authenticates the access controller;

2.2.2.2) The authentication server sends a TAEP Response packet to the authentication access controller, wherein the Type field corresponds to the Type field in the TAEP Request packet in step 2.2.2.1), and the Type-Data field contains the internal TAEP authentication method type, such as: Contains the type of platform authentication protocol;

2.2.3) The authentication access controller selects an internal TAEP authentication method and the requester and the authentication server perform the internal TAEP authentication method, such as: performing a platform authentication protocol;

2.2.3.1) The request between the access controller and the requester, the authentication access controller and the authentication server interact with a series of TAEP Request packets and Response packets until the internal TAEP authentication method is completed. For a series of TAEP Request packets and Response packets for authenticating the interaction between the access controller and the requester, where the value of the Type field is the TAEP tunnel authentication method type in step 2.2.1), and the value of the Type-Data field is the inner TAEP. Identification method package. The value of the Type field of the inner TAEP authentication method packet is the type of the inner TAEP authentication method selected by the authentication access controller in step 2.2.3), and the Type-Data field contains the inner TAEP authentication method message corresponding to the value of the Type field, such as: Platform authentication protocol message;

2.2.4) The authentication access controller terminates the authentication process using TAEP's Success packet or Failure packet;

2.2.4.1) If the access controller successfully authenticates the requestor during the intra-TAEP authentication method in step 2.2.3.1), such as: successfully authenticating the requestor's platform (including platform identity and platform integrity), then to the requester Send the Success packet of TAEP;

2.2.4.2) If the access controller is authenticated during the internal TAEP authentication method in step 2.2.3.1) The requester cannot be successfully authenticated, such as: The platform of the unsuccessful authentication requester (including platform identity and platform integrity) sends the TAEP's Failure packet to the requester.

In the step 2.2.2), the authentication access controller may also use the TAEP Request packet and the Response packet to obtain the auxiliary data of the internal TAEP authentication method from the authentication server, such as: platform authentication protocol policy information (including platform protection policy) And platform evaluation strategies, etc.).

If the session key between the requester and the authentication access controller is established in the above step 1), the session key can be used to secure the data between the requester and the authentication access controller after the authentication process ends. The session key and the established secure tunnel in step 2) may be used to secure data between the requester and the authentication access controller, such as: the session key and the established security tunnel in step 2) Tunneling performs an exclusive OR operation; if the session key between the requester and the authentication access controller is not established in step 1), the requester and the authentication access may be utilized after the authentication process ends using the established secure tunneling in step 2) Data between controllers is secured.

Referring to FIG. 4, when the solution of the embodiment of the present invention is applied to the TePA-based TNC architecture shown in FIG. 2, the access requester, the access controller, and the policy manager respectively correspond to the requester and the authentication access in the solution of the embodiment of the present invention. Controller and authentication server. In addition, when the access requester and the access controller calculate the platform signature, if a session key is established between the access requester and the access controller, the platform signature, such as: Attestation Identity Key (AIK) signature, The session key between the access requester and the access controller and the secure tunnel established by the tunnel method in the TAEP tunnel authentication method need to be bound; if the session key is not established between the access requester and the access controller, the platform signature needs to be tied. A secret value that can authenticate the identity of the other party and a secure tunnel established by the tunnel method in the TAEP tunnel authentication method.

Claims

Rights request

1. A network transmission method suitable for the ternary peer-to-peer authentication trusted network connection architecture, which is characterized by: The method includes:

1) The requester, the authentication access controller and the authentication server execute the TAEP authentication method, including: 1.1) The authentication access controller uses the Request packet and the Response packet of TAEP to obtain the TAEP authentication method identity of the requester;

1.2) Use TAEP's Request packet and Response packet to obtain the TAEP authentication method type from the authentication server;

1.3) Select a TAEP authentication method and execute the TAEP authentication method process with the requester and authentication server;

1.4) Use the Success packet or Failure packet of TAEP to end the authentication process.

2. A network transmission method suitable for a three-element peer-to-peer authentication trusted network connection architecture according to claim 1, characterized in that: the step 1.1) includes:

1.1.1) The authentication access controller sends a TAEP Request packet to the requester, in which the value of the Type field is Identity;

1.1.2) The requester sends the TAEP Response packet to the authentication access controller, where the Type field corresponds to the Type field in the TAEP Request packet in step 1.1.1), and the Type-Data field contains the TAEP authentication method identity of the requester.

3. A network transmission method suitable for a three-element peer-to-peer authentication trusted network connection architecture according to claim 2, characterized in that: the step 1.2) includes:

1.2.1) The authentication access controller sends a TAEP Request packet to the authentication server, in which the value of the Type field is TP Authentication, and the Type-Data field contains the TAEP authentication method identities of the requester and the authentication access controller;

1.2.2) The authentication server sends the TAEP Response packet to the authentication access controller, where the Type field corresponds to the Type field in the TAEP Request packet in step 1.2.1), and the Type-Data field contains the TAEP authentication method type.

4. A network transmission method suitable for a three-element peer-to-peer authentication trusted network connection architecture according to claim 3, characterized in that: the step 1.3) includes:

The interaction between the authentication access controller and the requestor, and between the authentication access controller and the authentication server The Request group and the Response group of the series TAEP, in which the Type field is the TAEP authentication method type selected by the authentication access controller, and the Type-Data field contains the TAEP authentication method message corresponding to the value of the Type field.

5. A network transmission method suitable for a three-element peer-to-peer authentication trusted network connection architecture according to claim 4, characterized in that: the step 1.4) includes:

1.4.1) If the authentication access controller successfully authenticates the requester during the TAEP authentication method in step 1.3), the TAEP Success packet is sent to the requester;

1.4.2) If the authentication access controller cannot successfully authenticate the requester during the TAEP authentication method in step 1.3), it will send a TAEP Failure packet to the requester.

6. A network transmission method suitable for a three-element peer-to-peer authentication trusted network connection architecture according to any one of claims 1 to 5, characterized in that: the step 1) further includes:

2) The requester, authentication access controller and authentication server execute the TAEP tunnel authentication method, including:

2.1) Establish a secure tunnel between the authenticated access controller and the requester;

2.2) Execute the inner TAEP authentication method in the established security tunnel.

7. A network transmission method suitable for a three-element peer-to-peer authentication trusted network connection architecture according to claim 6, characterized in that: the step 2.1) includes:

2.1.1) The authentication access controller sends a TAEP Request packet to the requester, in which the value of the Type field is the TAEP tunnel authentication method type, and the value of the Type-Data field is the TAEP tunnel authentication method start flag;

2.1.2) A series of TAEP Request packets and Response packets are exchanged between the authentication access controller and the requester, where the value of the Type field is the TAEP tunnel authentication method type in step 2.1.1), and the value of the Type-Data field is The value of the Type field corresponds to the tunnel method message until the establishment of a secure tunnel between the authenticated access controller and the requestor is completed.

8. A network transmission method suitable for a three-element peer-to-peer authentication trusted network connection architecture according to claim 6, characterized in that: the step 2.2) includes:

2.2.1) The authentication access controller uses the Request packet and the Response packet of TAEP to obtain the requester's internal TAEP authentication method identity;

2.2.2) The authentication access controller uses the Request packet and Response packet of TAEP to communicate with the authentication The authentication server obtains the internal TAEP authentication method type;

2.2.3) The authentication access controller selects an internal TAEP authentication method and executes the internal TAEP authentication method process with the requester and the authentication server;

2.2.4) The authentication access controller uses the Success packet or Failure packet of TAEP to end the authentication process.

9. A network transmission method suitable for a three-element peer-to-peer authentication trusted network connection architecture according to claim 8, characterized in that: the step 2.2.1) includes:

2.2.1.1) The authentication access controller sends a TAEP Request packet to the requester, in which the value of the Type field is the TAEP tunnel authentication method type in step 2.2.1), and the value of the Type-Data field is the one established in step 2.1) The inner TAEP authentication method package protected by the secure tunnel, the value of the Code field in the inner TAEP authentication method package is Request, and the value of the Type field is Identity;

2.2.1.2) The requester sends the TAEP Response packet to the authentication access controller, in which the Type field corresponds to the Type field in the TAEP Request packet in step 2.2.1.1), and the value of the Type-Data field is the value established in step 2.1) The value of the Code field in the inner TAEP authentication method package protected by the secure tunnel is Response. The Type field corresponds to the Type field and the Type-Data field in the Request packet of the inner TAEP authentication method package in step 2.2.1.1. Contains the requester's internal TAEP authentication method identity.

10. A network transmission method suitable for a three-element peer-to-peer authentication trusted network connection architecture according to claim 9, characterized in that: the step 2.2.2) includes:

2.2.2.1) The authentication access controller sends a TAEP Request packet to the authentication server, where

The value of the Type field is TP Authentication, and the Type-Data field contains the identity of the requester and the authentication access controller's internal TAEP authentication method;

2.2.2.2) The authentication server sends the TAEP Response packet to the authentication access controller, where the Type field corresponds to the Type field in the TAEP Request packet in step 2.2.2.1), and the Type-Data field contains the TAEP authentication method type.

11. A network transmission method suitable for a three-element peer-to-peer authentication trusted network connection architecture according to claim 10, characterized in that: the step 2.2.3) includes:

A series of TAEP Request packets and Response packets are exchanged between the authentication access controller and the requester, and between the authentication access controller and the authentication server, until the internal TAEP authentication method process is completed. For a series of TAEP Request packets and Response packets that authenticate the interaction between the access controller and the requester, the value of the Type field is the TAEP tunnel authentication method type in step 2.2.1), and the value of the Type-Data field is the inner TAEP Authentication method package, the value of the Type field in the TAEP authentication method package is the TAEP authentication method type selected by the authentication access controller in step 2.2.3), and the Type-Data field contains the TAEP authentication method message corresponding to the value of the Type field. .

12. A network transmission method suitable for a three-element peer-to-peer authentication trusted network connection architecture according to claim 11, characterized in that: the step 2.2.4) includes:

2.2.4.1) If the authentication access controller successfully authenticates the requester during the internal TAEP authentication method in step 2.2.3), then the TAEP Success packet is sent to the requester;

2.2.4.2) If the authentication access controller cannot successfully authenticate the requester during the internal TAEP authentication method in step 2.2.3), then send a TAEP Failure packet to the requester.

13. A network transmission method suitable for ternary peer authentication trusted network connection architecture according to claim 10, characterized in that: in step 2.2.2), the authentication access controller uses the Request group of TAEP and Response packet to obtain auxiliary data for the TAEP authentication method from the authentication server.