Method and system for establishing credible virtual special network connection

Abstract

A method for setting up reliable connection of virtual special network includes activating AIK certificate at client end, collecting completeness value of local computer and sending completeness value of AIK certificate by client end when connection is launched, verifying AIK certificate completeness value sent from client end by gateway, sending AIK certificate and completeness value of gateway itself to client end if verification is passed, verifying gateway AIK certificate and completeness value sent from gateway by client end then setting up connection between client end and gateway if verification is passed.

Description

technical field [0001] The present invention generally relates to the field of computer system security and network security, in particular, to a method and system for establishing trusted virtual private network connections, said method and system rely on public computer networks for reliable and secure data transmission, and Realize system integrity measurement and host system identity authentication. Background technique [0002] VPN is the abbreviation of (Virtual Private Network), which has been widely used in the field of enterprise network security interconnection in recent years. VPN technology is based on modern cryptography theory and digital signature, PKI system, tunnel transmission and other mature technologies in the security field. Currently, the most widely used VPN technology is the ipsec protocol organized by the IETF. Its main features are: [0003] 1. The IKE protocol is used to ensure the security of the key exchange, and the DH algorithm is used to ens...

AI Technical Summary

Problems solved by technology

[0007] However, ipsec itself still has some defects. The protocol itself does not confirm the identities of the communication parties. In the protocol extension, the X509 certificate can be used to authenticate the communication parties, but it is very difficult from the perspective of implementation and deployment. When users use There are also many obstacles such as bandwidth limitations

[0008] The application entitled "A Security Chip and Information Security Processing Device and Method Based on the Chip" submitted and accepted by Lenovo Group, the applicant of this application, provides a method for the security chip to verify the integrity of the firmware and the operating system, etc. , which does not give a specific method of how to use platform integrity information for trusted connections in the network environment. The TNC (Trusted Network Connection) specification of the International Trusted Computing TCG (Trusted Computing Group) organization describes trusted connections. framework and recommendations, but did not give specific methods and specifications for trusted connections using secure chips

Images