Security enhancement method of iscsi protocol based on diffie-hellman protocol

Abstract

The invention discloses an iSCSI protocol security enhancement method based on the Diffie-Hellman protocol, which includes: the originating end sends its own public key certificate, request and digital signature to the authentication server; the authentication server identifies the originating end by Authenticate and authorize the request; the authentication server sends the ciphertext encrypted by the public key of the originator to the private part of the certificate together with the public part of the certificate to the originator of the request; the originator calculates the message authentication code and combines it with the certificate by The public part is sent together with the specified target; the target receives the authentication code and certificate from the public part and then authorizes and authenticates the originator’s request; the target responds to the originator’s request according to the authorization and authentication results; regularly refreshes the shared secrets used one by one key.

Description

technical field [0001] The invention relates to the technical field of data security, in particular to an iSCSI protocol security enhancement method based on the Diffie-Hellman protocol. Background technique [0002] Currently, the iSCSI protocol mostly uses the CHAP authentication protocol to control access to storage resources. However, in CHAP authentication, the user name and password are stored on the target side in plain text, which may be illegally obtained by insiders or hackers. In addition, this authentication method uses periodic authentication to resist channel insertion attacks, but it usually encounters difficulties in choosing a specific period interval. Too long a period interval will leave opportunities for intruders; too short a period interval will increase the calculation of both authentication parties. quantity. At the same time, when fine-grained access control is to be implemented for each originator, the administrator needs to manually create a user...

AI Technical Summary

Problems solved by technology

Although the above two access control mechanisms extended by the iSCSI protocol solve the problem of password leakage in CHAP authentication, these two mechanisms require multiple encryption and decryption operations on the target side to determine whether to allow the login request from the originating side.

In addition, neither of these two mechanisms can revoke the originator's access to logged-in storage resources, and it is difficult to implement fine-grained access control for each originator

Images