Authentication key negotiation method for access of user in PKI domain to resource in IBC domain

Abstract

The invention discloses an authentication key negotiation method for the access of a user in a PKI domain to a resource in an IBC domain, and the method comprises the main steps: A, applying for the access: a user in the PKI domain sends a request for access to the resource in the IBC domain to an authentication server in the domain, and the authentication server in the PKI domain transmits the access request of the user to an authentication server in the IBC domain after the identity of the user is determined to be legal; B, generating a user index and transmitting the user index; C, carrying out the bidirectional identity authentication and negotiation of a session key, wherein the session key is obtained by the XOR processing of an authentication server part of the session key and a filled user part; D, carrying out the re-authentication: carrying out the quick re-authentication when the user part of the session key exceeds a life cycle but the authentication server part of the session key is still in the life cycle if the user in the PKI domain still needs to access to the resource in the IBC domain; E, ending the session. The method can effectively achieve the authentication key negotiation for the user in the PKI domain for the access to the resource in the IBC domain, is small in consumed resources, and is high in safety.

Description

technical field [0001] The invention belongs to the technical field of cross-heterogeneous domain authentication and key agreement in information communication. Background technique [0002] For various applications in a distributed network environment, such as virtual enterprises, instant messaging systems, etc., users and the information resources they want to access are often in different trust domains. Different trust domains may be based on different cryptosystems, such as Kerberos-based cryptosystems, PKI (Public Key Infrastructure)-based cryptosystems, and IBC (Identity-Based Cryptography)-based cryptosystems. The authentication key agreement method between homogeneous domains has been researched a lot, and has been standardized and widely used. There are also many researches on the authentication key agreement method used between two domains of PKI and Kerberos. However, the authentication key agreement method when users in the PKI domain access resources in the IB...

AI Technical Summary

Problems solved by technology

However, a large number of certificates are used many times in this document. The certificates will consume a lot of resources in the process of transmission and storage, which is inconsistent with the original intention of people to design the IBC cryptographic system; the way of identity mapping is not direct, and it is feasible in real applications. Sex is not high

Moreover, this document only uses identity mapping and trust transfer to realize the idea of ​​authentication. There is no specific solution process, and it can only be regarded as a new idea of ​​cross-domain authorization rather than a solution that can be directly realized.