Ssh-based data security protection method and device

Abstract

The invention belongs to the technical field of data security and encryption, relates to an ssh-based data security protection method and device. The method comprises the following steps: establishingan encryption channel using a one-time password, storing a used six-bit short password in a remote host in advance in the form of a configuration file to generate a secret key, configuring the one-time six-bit short password, and using SHA-1 value of the short password to encrypt an encrypted channel by using an ECC algorithm, encrypting a secret key, transmitting the secret key to a client through the encrypted channel, transmitting the secret key, deploying a plurality of one-time passwords, completing the deployment of the secret key, and setting password-based ssh remote login protection; using the encryption channel to protect key exchange, so that the risk of man-in-the-middle attacks is blocked to a great extent. The encryption channel is established based on the Linux upper portforwarding function, establishment is easy and the reliability is high, the one-time key can defend password attacks based on password blasting and password guessing, and the safety of the encryptionchannel is improved.

Description

Technical field [0001] The invention belongs to the technical field of data security and encryption, and specifically relates to an SSH-based data security protection method and device. Background technique [0002] Since SSHv1.0, symmetric and asymmetric encryption algorithms including DES and RSA 256 have been used. The whole process is: [0003] (1) When the remote host receives the user's initial login request, it uses the RSA256 algorithm to generate a public key and a private key, and sends the public key to the client. [0004] (2) The user uses this public key to encrypt the login password and send it to the remote host. [0005] (3) The remote host uses its own private key to decrypt the login password and verify it. If the password is correct, it agrees to log in, and at the same time uses DES encryption to protect the subsequent communication process. [0006] (4) Identify the public key fingerprint of the remote host during the second login to prevent identity forgery and ...

AI Technical Summary

Problems solved by technology

Although the officially issued key certificate is used in SSH v2.0, the feasibility is not strong in the case of a local area network or a private remote host, and the certificate issued by an individual cannot be reliably authenticated, making the whole process face a problem when logging in for the first time. Risk of "Man in the middle attack"

Images