Method and device for integrity authentication of virtual client device

Abstract

The present invention provides a method and apparatus for integrity authentication of a virtual client device, the method comprising: an SD-WAN controller sends an integrity challenge signaling to a virtual client device; receiving a first integrity measurement list sent by the virtual client device, the first integrity measurement list being generated by the virtual client device using an integrity measurement architecture and signed using a virtual trusted computing chip; performing integrity authentication on the virtual client device according to the first integrity measurement list; if the integrity authentication of the virtual client device passes, sending indication information to the virtual client device, the indication information being used to indicate the trustworthiness of the physical client device where the virtual client device is located. In the present invention, the SD-WAN controller performs integrity authentication on the virtual client device, which can ensure that the virtual operating system of the virtual client device has not been tampered with, ensure the predictability of its behavior, and improve the security of the system.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of information security technology, and in particular to a method and device for authenticating the integrity of a virtual client device. Background Art

[0002] SD-WAN (Software Defined WAN) is a service formed by applying SDN (Software Defined Network) technology to wide area network scenarios. This service is used to connect enterprise networks, data centers, Internet applications and cloud services in a wide geographical range, aiming to help users reduce wide area network expenses (low cost) and improve network connection flexibility. Through software definition, it provides intelligent routing, convenient deployment and simple maintenance of wide area networks.

[0003] CPE (Customer Premise Equipment) is a key device of SD-WAN. This device is deployed on the user side to provide users with software-defined virtual WAN services. Under current circumstances, dedicated CPE devices in SD-WAN are transforming into virtual CPE. Although dedicated CPE devices are easy to deploy, they have many disadvantages. For example, the device functions cannot be updated and lack flexibility. Different network functions require a variety of network devices to implement, resulting in a large number of user-side devices and rising costs. Virtual CPE uses general white box hardware + virtualization to implement various network functions. In virtual CPE, network functions are abstracted into modular software and deployed on a standard hardware platform to provide users with more flexible services. Virtual CPE can provide a variety of functions, such as routing, network address translation, VPN (Virtual Private Network), firewall, etc.

[0004] Under this trend, the security of general equipment and systems that carry virtual CPE will become critical. As software systems become more complex, virtual CPEs are exposed more and more, and their security will also be challenged. Once the virtual CPE is attacked, the security of the entire SD-WAN network cannot be guaranteed. Summary of the invention

[0005] The embodiments of the present invention provide a method and apparatus for authenticating the integrity of a virtual client device, which are used to solve the problem that the security of a virtual CPE under the current SD-WAN architecture cannot be guaranteed.

[0006] In order to solve the above-mentioned technical problems, the present invention is achieved as follows:

[0007] In a first aspect, an embodiment of the present invention provides a method for authenticating the integrity of a virtual client device, which is executed by an SD-WAN controller, comprising:

[0008] Receiving identity information of a virtual client device created by a physical client device and sent by the physical client device, wherein the identity information is signed by the physical client device using an identity authentication key created by the physical client device;

[0009] Sending an integrity challenge signaling to the virtual client device according to the identity information;

[0010] Receiving a first integrity measurement list sent by the virtual client device, where the first integrity measurement list is generated by the virtual client device using an integrity measurement architecture and signed using a virtual trusted computing chip;

[0011] Performing integrity authentication on the virtual client device according to the first integrity metric list;

[0012] If the integrity authentication of the virtual client device passes, indication information is sent to the virtual client device, where the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

[0013] Optionally, before receiving the identity information of the virtual client device created by the physical client device, the method further includes:

[0014] Sending integrity challenge signaling to the physical client device;

[0015] receiving a second integrity measurement list sent by the physical client device, where the second integrity measurement list is generated by the physical client device using an integrity measurement architecture and signed by a trusted computing chip;

[0016] performing integrity authentication on the physical client device according to the second integrity metric list;

[0017] If the integrity authentication of the physical client device passes, an integrity challenge result is sent to the physical client device, wherein the integrity challenge result carries an indication of allowing the physical client device to create a virtual client device.

[0018] Optionally, after sending the indication information to the virtual client device, the method further includes:

[0019] Receiving security capability request information sent by the virtual client device;

[0020] The security capability is issued to the virtual client device according to the security capability request information.

[0021] Optionally, before sending the integrity challenge signaling to the virtual client device, the method further includes:

[0022] Establish a connection with the virtual client device via VxLAN VPN.

[0023] In a second aspect, an embodiment of the present invention provides a method for authenticating the integrity of a virtual client device, which is executed by the client device and includes:

[0024] The physical client device creates a virtual client device and an authentication key pair for the virtual client device;

[0025] The physical client device signs the identity information of the virtual client device using the authentication key and sends the signed identity information to the SD-WAN controller;

[0026] The virtual client device receives the integrity challenge signaling sent by the SD-WAN controller;

[0027] The virtual client device generates a first integrity measurement list using the integrity measurement architecture according to the received integrity challenge signaling, and signs the first integrity measurement list using the virtual trusted computing chip;

[0028] The virtual client device sends the first integrity metric list to the SD-WAN controller;

[0029] The virtual client device receives indication information sent by the SD-WAN controller, where the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

[0030] Optionally, before the physical client device creates the virtual client device and the authentication key pair of the virtual client device, the process further includes:

[0031] The physical client device receives the integrity challenge signaling sent by the SD-WAN controller;

[0032] The physical client device generates a second integrity measurement list using the integrity measurement architecture according to the received integrity challenge signaling, and signs the second integrity measurement list using the trusted computing chip;

[0033] The physical client device sends the second integrity metric list to the SD-WAN controller;

[0034] The physical client device receives an integrity challenge result sent by the SD-WAN controller, wherein the integrity challenge result carries an indication allowing the physical client device to create a virtual client device.

[0035] Optionally, after the virtual client device receives the indication information sent by the SD-WAN controller, the step further includes:

[0036] Sending security capability request information to the SD-WAN controller;

[0037] Receive security capabilities issued by the SD-WAN controller.

[0038] Optionally, before the virtual client device receives the integrity challenge signaling sent by the SD-WAN controller, the process further includes:

[0039] A connection is established between the virtual client device and the SD-WAN controller via VxLAN VPN.

[0040] In a third aspect, an embodiment of the present invention provides an SD-WAN controller, including:

[0041] A first receiving module, configured to receive identity information of a virtual client device created by a physical client device and sent by the physical client device, wherein the identity information is signed by the physical client device using an identity authentication key created by the physical client device;

[0042] A first sending module, configured to send an integrity challenge signaling to the virtual client device according to the identity information;

[0043] A second receiving module is used to receive a first integrity measurement list sent by the virtual client device, where the first integrity measurement list is generated by the virtual client device using an integrity measurement architecture and signed using a virtual trusted computing chip;

[0044] A first authentication module, configured to perform integrity authentication on the virtual client device according to the first integrity metric list;

[0045] The second sending module is configured to send indication information to the virtual client device if the integrity authentication of the virtual client device passes, wherein the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

[0046] Optionally, the SD-WAN controller further includes:

[0047] A third sending module, configured to send an integrity challenge signaling to the physical client device;

[0048] A third receiving module is configured to receive a second integrity measurement list sent by the physical client device, where the second integrity measurement list is generated by the physical client device using an integrity measurement architecture and signed by a trusted computing chip;

[0049] a second authentication module, configured to perform integrity authentication on the physical client device according to the second integrity metric list;

[0050] The fourth sending module is used to send an integrity challenge result to the physical client device if the integrity authentication of the physical client device passes, wherein the integrity challenge result carries an indication of allowing the physical client device to create a virtual client device.

[0051] Optionally, the SD-WAN controller further includes:

[0052] A fourth receiving module, configured to receive security capability request information sent by the virtual client device;

[0053] A fifth sending module is used to send security capabilities to the virtual client device according to the security capability request information.

[0054] Optionally, the SD-WAN controller further includes:

[0055] A connection module is used to establish a connection with the virtual client device via a VxLAN VPN.

[0056] In a fourth aspect, an embodiment of the present invention provides an SD-WAN controller, including: a transceiver and a processor;

[0057] The transceiver is used to receive the identity information of the virtual client device created by the physical client device and sent by the physical client device, wherein the identity information is signed by the physical client device using the identity authentication key created by the physical client device;

[0058] The transceiver is further configured to send an integrity challenge signaling to the virtual client device according to the identity information;

[0059] The transceiver is further used to receive a first integrity measurement list sent by the virtual client device, wherein the first integrity measurement list is generated by the virtual client device using an integrity measurement architecture and signed using a virtual trusted computing chip;

[0060] The processor is configured to perform integrity authentication on the virtual client device according to the first integrity metric list;

[0061] The transceiver is further used to send indication information to the virtual client device if the integrity authentication of the virtual client device passes, wherein the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

[0062] Optionally, the transceiver is further used to send integrity challenge signaling to the physical client device;

[0063] The transceiver is further configured to receive a second integrity measurement list sent by the physical client device, wherein the second integrity measurement list is generated by the physical client device using an integrity measurement architecture and signed using a trusted computing chip;

[0064] The processor is further configured to perform integrity authentication on the physical client device according to the second integrity metric list;

[0065] The transceiver is further configured to send an integrity challenge result to the physical client device if the integrity authentication of the physical client device passes, wherein the integrity challenge result carries an indication of allowing the physical client device to create a virtual client device.

[0066] Optionally, the transceiver is further used to receive security capability request information sent by the virtual client device;

[0067] The transceiver is further configured to send security capabilities to the virtual client device according to the security capability request information.

[0068] Optionally, the processor is also used to establish a connection with the virtual client device via VxLAN VPN.

[0069] In a fifth aspect, an embodiment of the present invention provides a client device, including:

[0070] A creation module, used to create a virtual client device and an authentication key pair of the virtual client device;

[0071] A first sending module, configured to sign the identity information of the virtual client device using an identity authentication key, and send the signed identity information to the SD-WAN controller;

[0072] A first receiving module, configured to receive an integrity challenge signaling sent by the SD-WAN controller to the virtual client device;

[0073] A first generating module, configured to generate a first integrity measurement list using an integrity measurement architecture according to the received integrity challenge signaling, and to sign the first integrity measurement list using a virtual trusted computing chip;

[0074] A second sending module is used to send the first integrity metric list to the virtual client device to the SD-WAN controller;

[0075] The second receiving module is used to receive indication information sent by the SD-WAN controller to the virtual client device, where the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

[0076] Optionally, the client device further includes:

[0077] A third receiving module is used to receive the integrity challenge signaling sent by the SD-WAN controller to the physical client device;

[0078] A second generating module, configured to generate a second integrity measurement list using the integrity measurement architecture according to the received integrity challenge signaling, and sign the second integrity measurement list using the trusted computing chip;

[0079] A third sending module is used to send the second integrity measurement list to the SD-WAN controller;

[0080] The fourth receiving module is used to receive the integrity challenge result sent by the SD-WAN controller, and the integrity challenge result carries an indication allowing the physical client device to create a virtual client device.

[0081] Optionally, the client device further includes:

[0082] A fourth sending module, configured to send security capability request information to the SD-WAN controller;

[0083] The fifth sending module is used to receive the security capabilities sent by the SD-WAN controller.

[0084] Optionally, the client device further includes:

[0085] A connection module is used to establish a connection between the virtual client device and the SD-WAN controller through a VxLAN VPN.

[0086] In a sixth aspect, an embodiment of the present invention provides a client device, including: a transceiver and a processor;

[0087] The processor is configured to create a virtual client device and an authentication key pair for the virtual client device;

[0088] The transceiver is used to sign the identity information of the virtual client device using the identity authentication key and send the signed identity information to the SD-WAN controller;

[0089] The transceiver is further configured to receive an integrity challenge signaling sent by the SD-WAN controller to the virtual client device;

[0090] The processor is further configured to generate a first integrity measurement list using the integrity measurement architecture according to the received integrity challenge signaling, and sign the first integrity measurement list using the virtual trusted computing chip;

[0091] The transceiver is further configured to send the first integrity metric list to the virtual client device to the SD-WAN controller;

[0092] The transceiver is also used to receive indication information sent by the SD-WAN controller to the virtual client device, where the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

[0093] Optionally, the transceiver is further used to receive an integrity challenge signaling sent by the SD-WAN controller to the physical client device;

[0094] The processor is further configured to generate a second integrity measurement list using the integrity measurement architecture according to the received integrity challenge signaling, and sign the second integrity measurement list using the trusted computing chip;

[0095] The transceiver is further configured to send the second integrity metric list to the SD-WAN controller;

[0096] The transceiver is also used to receive an integrity challenge result sent by the SD-WAN controller, wherein the integrity challenge result carries an indication allowing the physical client device to create a virtual client device.

[0097] Optionally, the transceiver is further used to send security capability request information to the SD-WAN controller;

[0098] The transceiver is also used to receive security capabilities issued by the SD-WAN controller.

[0099] Optionally, the processor is also used to establish a connection between the virtual client device and the SD-WAN controller via VxLAN VPN.

[0100] In the seventh aspect, an embodiment of the present invention provides an SD-WAN controller, comprising: a processor, a memory, and a program stored on the memory and executable on the processor, wherein when the program is executed by the processor, the steps of the integrity authentication method for a virtual client device as described in the first aspect above are implemented.

[0101] In an eighth aspect, an embodiment of the present invention provides a client device, comprising: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of the integrity authentication method for a virtual client device as described in the second aspect above are implemented.

[0102] In a ninth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the integrity authentication method for a virtual client device described in the first aspect are implemented; or, when the computer program is executed by a processor, the steps of the integrity authentication method for a virtual client device described in the second aspect are implemented.

[0103] In the embodiment of the present invention, the SD-WAN controller is the central functional module of the SD-WAN system. The operation and maintenance of the SD-WAN controller are performed by professional network management personnel. Relative to the virtual client device, the SD-WAN controller is equivalent to a trusted center. The SD-WAN controller performs integrity authentication on the virtual client device, which can ensure that the virtual operating system of the virtual client device has not been tampered with, ensure the predictability of its behavior, and improve the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0104] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0105] Figure 1 A schematic diagram of a flow chart of a method for authenticating the integrity of a virtual client device according to a first embodiment of the present invention;

[0106] Figure 2 A schematic diagram of a flow chart of a method for authenticating the integrity of a virtual client device according to a second embodiment of the present invention;

[0107] Figure 3 A schematic diagram of a flow chart of a method for authenticating the integrity of a virtual client device according to a third embodiment of the present invention;

[0108] Figure 4 A schematic diagram of a flow chart of a method for authenticating the integrity of a virtual client device according to a fourth embodiment of the present invention;

[0109] Figure 5 A flowchart of a method for authenticating the integrity of a virtual client device according to a fifth embodiment of the present invention;

[0110] Figure 6A schematic diagram of a framework of an integrity measurement system architecture according to an embodiment of the present invention;

[0111] Figure 7 This is a schematic diagram of the structure of the SD-WAN controller according to the sixth embodiment of the present invention;

[0112] Figure 8 This is a schematic diagram of the structure of the SD-WAN controller according to the seventh embodiment of the present invention;

[0113] Fig. 9 This is a schematic diagram of the structure of a client device according to Embodiment 8 of the present invention;

[0114] Fig.10 This is a schematic diagram of the structure of a client device according to Embodiment 9 of the present invention;

[0115] Fig.11 This is a schematic diagram of the structure of the SD-WAN system according to an embodiment of the present invention;

[0116] Fig.12 This is a schematic diagram of the structure of the SD-WAN controller according to the tenth embodiment of the present invention;

[0117] Fig.13 This is a schematic diagram of the structure of a client device according to the eleventh embodiment of the present invention. DETAILED DESCRIPTION

[0118] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0119] Please refer to Figure 1 , Embodiment 1 of the present invention provides a method for authenticating the integrity of a virtual client device, which is executed by an SD-WAN controller, and includes:

[0120] Step 11: receiving identity information of a virtual client device created by the physical client device and sent by the physical client device, wherein the identity information is signed by the physical client device using an identity authentication key created by the physical client device;

[0121] The physical client device is the host machine that hosts the virtual client device.

[0122] Step 12: Sending an integrity challenge signaling to the virtual client device according to the identity information;

[0123] The integrity challenge signaling is used to challenge the integrity of the operating system of the virtual client device.

[0124] Step 13: Receive a first integrity measurement list sent by the virtual client device, where the first integrity measurement list is generated by the virtual client device using IMA (Integrity Measurement Architecture) and signed using a virtual trusted computing chip;

[0125] Step 14: Performing integrity authentication on the virtual client device according to the first integrity metric list;

[0126] Step 15: If the integrity authentication of the virtual client device passes, send indication information to the virtual client device, where the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

[0127] In the embodiment of the present invention, the SD-WAN controller is the central functional module of the SD-WAN system. The operation and maintenance of the SD-WAN controller are performed by professional network management personnel. Relative to the virtual client device, the SD-WAN controller is equivalent to a trusted center. The SD-WAN controller performs integrity authentication on the virtual client device, which can ensure that the virtual operating system of the virtual client device has not been tampered with, ensure the predictability of its behavior, and improve the security of the system.

[0128] Please refer to Figure 2 , Embodiment 2 of the present invention provides a method for authenticating the integrity of a virtual client device, which is executed by an SD-WAN controller, and includes:

[0129] Step 21: Sending integrity challenge signaling to the physical client device;

[0130] The integrity challenge signaling is used to challenge the integrity of the operating system of the physical client device.

[0131] Step 22: Receive a second integrity measurement list sent by the physical client device, where the second integrity measurement list is generated by the physical client device using an integrity measurement architecture and signed by a trusted computing chip;

[0132] Step 23: Perform integrity authentication on the physical client device according to the second integrity metric list;

[0133] Step 24: If the integrity authentication of the physical client device passes, sending an integrity challenge result to the physical client device, wherein the integrity challenge result carries an indication of allowing the physical client device to create a virtual client device;

[0134] Step 25: receiving identity information of the virtual client device created by the physical client device and sent by the physical client device, wherein the identity information is signed by the physical client device using the identity authentication key created by the physical client device;

[0135] Step 26: Sending an integrity challenge signaling to the virtual client device according to the identity information;

[0136] Step 27: Receive a first integrity measurement list sent by the virtual client device, where the first integrity measurement list is generated by the virtual client device using an integrity measurement architecture and signed by a virtual trusted computing chip;

[0137] Step 28: Perform integrity authentication on the virtual client device according to the first integrity metric list;

[0138] Step 29: If the integrity authentication of the virtual client device passes, send indication information to the virtual client device, where the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

[0139] In the embodiment of the present invention, the SD-WAN controller performs integrity authentication on the physical client device and the virtual client device, which can ensure that the virtual operating systems of the physical client device and the virtual client device have not been tampered with, ensure the predictability of their behavior, and improve the security of the system. At the same time, through the signature of the SD-WAN controller, the mutual identification between the integrity status of the physical client device and the virtual client device can be achieved, further improving the security of the system.

[0140] In the above embodiment of the present invention, optionally, after sending the indication information to the virtual client device, the method further includes:

[0141] Receiving security capability request information sent by the virtual client device;

[0142] The security capability is issued to the virtual client device according to the security capability request information.

[0143] In the embodiment of the present invention, the security capabilities are stored in the SD-WAN controller, which can realize customized empowerment of security capabilities for virtual client devices and improve the deployment flexibility of the system.

[0144] In an embodiment of the present invention, a security capability pool may be set in the SD-WAN controller to store security capabilities. The security capabilities may adopt a security capability mirroring method, and the security capabilities may include information such as security capability applications (APPs).

[0145] In the above embodiment of the present invention, optionally, before sending the integrity challenge signaling to the virtual client device, it also includes: establishing a connection with the virtual client device through a VxLAN (Virtual eXtensible Local Area Network) VPN.

[0146] Please refer to Figure 3 Embodiment 3 of the present invention provides a method for authenticating the integrity of a virtual client device, which is executed by the client device and includes:

[0147] Step 31: The physical client device creates a virtual client device and an authentication key pair of the virtual client device;

[0148] In the embodiment of the present invention, a physical client device creates a virtual client instance, and the instance includes information such as the virtual client device and an identity authentication key pair of the virtual client device.

[0149] In the embodiment of the present invention, a physical client device may create one or more virtual client devices, and create an identity authentication key pair for each virtual client device.

[0150] The authentication key pair consists of a public authentication key (PubvA) and a private authentication key (PrivA).

[0151] Step 32: The physical client device signs the identity information of the virtual client device using the authentication key, and sends the signed identity information to the SD-WAN controller;

[0152] In the embodiment of the present invention, the physical client device uses a public authentication key (PubvA) to sign the identity information of the virtual client device, and the obtained identity information can be expressed as {SigA(PubvA)};

[0153] Step 33: The virtual client device receives the integrity challenge signaling sent by the SD-WAN controller;

[0154] If the physical client device includes multiple virtual client devices, the integrity challenge of each virtual client device is performed independently.

[0155] Step 34: The virtual client device generates a first integrity measurement list using the integrity measurement architecture according to the received integrity challenge signaling, and signs the first integrity measurement list using the virtual trusted computing chip;

[0156] The integrity of the virtual client device is measured through a virtual trusted computing chip and an integrity measurement architecture, making the integrity measurement more accurate.

[0157] Step 35: The virtual client device sends the first integrity metric list to the SD-WAN controller;

[0158] Step 36: The virtual client device receives indication information sent by the SD-WAN controller, where the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

[0159] In the embodiment of the present invention, the SD-WAN controller is the central functional module of the SD-WAN system. The operation and maintenance of the SD-WAN controller are performed by professional network management personnel. Relative to the virtual client device, the SD-WAN controller is equivalent to a trusted center. The SD-WAN controller performs integrity authentication on the virtual client device, which can ensure that the virtual operating system of the virtual client device has not been tampered with, ensure the predictability of its behavior, and improve the security of the system.

[0160] Please refer to Figure 4 Embodiment 4 of the present invention provides a method for authenticating the integrity of a virtual client device, which is executed by the client device and includes:

[0161] Step 41: The physical client device receives the integrity challenge signaling sent by the SD-WAN controller;

[0162] Step 42: The physical client device generates a second integrity measurement list using the integrity measurement architecture according to the received integrity challenge signaling, and signs the second integrity measurement list using the trusted computing chip;

[0163] The integrity of the virtual client device is measured through a trusted computing chip and an integrity measurement architecture, making the integrity measurement more accurate.

[0164] Step 43: The physical client device sends the second integrity metric list to the SD-WAN controller;

[0165] Step 44: The physical client device receives the integrity challenge result sent by the SD-WAN controller, where the integrity challenge result carries an indication of allowing the physical client device to create a virtual client device;

[0166] Step 45: The physical client device creates a virtual client device and an authentication key pair of the virtual client device;

[0167] In the embodiment of the present invention, a physical client device may create one or more virtual client devices, and create an identity authentication key pair for each virtual client device.

[0168] The authentication key pair consists of a public authentication key (PubvA) and a private authentication key (PrivA).

[0169] Step 46: The physical client device signs the identity information of the virtual client device using the authentication key, and sends the signed identity information to the SD-WAN controller;

[0170] In the embodiment of the present invention, the physical client device uses a public authentication key (PubvA) to sign the identity information of the virtual client device, and the obtained identity information can be expressed as {SigA(PubvA)};

[0171] Step 47: The virtual client device receives the integrity challenge signaling sent by the SD-WAN controller;

[0172] If the physical client device includes multiple virtual client devices, the integrity challenge of each virtual client device is performed independently.

[0173] Step 48: The virtual client device generates a first integrity measurement list using the integrity measurement architecture according to the received integrity challenge signaling, and signs the first integrity measurement list using the virtual trusted computing chip;

[0174] Step 49: The virtual client device sends the first integrity metric list to the SD-WAN controller;

[0175] Step 410: The virtual client device receives indication information sent by the SD-WAN controller, where the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

[0176] In the embodiment of the present invention, the SD-WAN controller performs integrity authentication on the physical client device and the virtual client device, which can ensure that the virtual operating systems of the physical client device and the virtual client device have not been tampered with, ensure the predictability of their behavior, and improve the security of the system. At the same time, through the signature of the SD-WAN controller, the mutual identification between the integrity status of the physical client device and the virtual client device can be achieved, further improving the security of the system.

[0177] In the above embodiment of the present invention, optionally, after the virtual client device receives the indication information sent by the SD-WAN controller, the step further includes:

[0178] Sending security capability request information to the SD-WAN controller;

[0179] Receive security capabilities issued by the SD-WAN controller.

[0180] In the above embodiment of the present invention, optionally, before the virtual client device receives the integrity challenge signaling sent by the SD-WAN controller, it also includes: establishing a connection between the virtual client device and the SD-WAN controller through VxLAN VPN.

[0181] Please refer to Figure 5 Embodiment 5 of the present invention provides a method for authenticating the integrity of a virtual client device, comprising:

[0182] Step 51: The SD-WAN controller sends an integrity challenge signaling to CPE A to challenge the integrity of the operating system of CPE A;

[0183] Step 52: CPE A generates a second integrity measurement list (Measurement List, ML) using IMA (Integrity Measurement Architecture) according to the received integrity challenge signaling, and signs the second integrity measurement list using a trusted computing chip to obtain {SigA(ML)}, and sends {SigA(ML)} to the SD-WAN controller;

[0184] In the embodiment of the present invention, the framework of the integrity measurement system architecture can be found in the attached Figure 6 ,from Figure 6 As can be seen, the integrity measurement list (Measurement List) can include: the integrity of application (Application, APP) code, the integrity of kernel (real-time operating system) code and the integrity of loader (loader) code.

[0185] Step 53: The SD-WAN controller receives the second integrity metric list sent by CPE A; performs integrity authentication on CPE A according to the second integrity metric list; if the integrity authentication of CPE A passes, sends an integrity challenge result to CPE A, wherein the integrity challenge result carries an indication of allowing CPE A to create a virtual client device;

[0186] Step 54: CPE A creates a vCPE (vA) instance, which includes an authentication key pair of the vCPE. The authentication key pair includes a public authentication key (PubvA) and a private authentication key (PrivA).

[0187] Step 55: CPE A signs the identity information of the vCPE using the public authentication key (PubvA) to obtain {SigA(PubvA)}, and sends it to the SD-WAN controller;

[0188] Step 56: The SD-WAN controller sends an integrity challenge signaling to the vCPE according to the identity information of the vCPE to perform an integrity challenge on the operating system of the vCPE;

[0189] Step 57: The vCPE generates a first integrity measurement list using the integrity measurement architecture according to the received integrity challenge signaling, signs the first integrity measurement list using the virtual trusted computing chip to obtain {SigvA(ML)}, and sends {SigvA(ML)} to the SD-WAN controller;

[0190] Step 58: The SD-WAN controller performs integrity authentication on the vCPE according to the first integrity metric list; if the integrity authentication of the vCPE passes, an indication message {Sig CA (PubvA+trust result), the indication information is used to indicate the credibility of CPE A where the vCPE is located.

[0191] Step 59: The vCPE sends a security capability request message to the SD-WAN controller;

[0192] Step 510: The SD-WAN controller sends security capabilities to the vCPE.

[0193] Please refer to Figure 7 , Embodiment 6 of the present invention further provides an SD-WAN controller 70, including:

[0194] A first receiving module 71 is used to receive identity information of a virtual client device created by a physical client device and sent by the physical client device, wherein the identity information is signed by the physical client device using an identity authentication key created by the physical client device;

[0195] A first sending module 72, configured to send an integrity challenge signaling to the virtual client device according to the identity information;

[0196] A second receiving module 73 is configured to receive a first integrity measurement list sent by the virtual client device, wherein the first integrity measurement list is generated by the virtual client device using an integrity measurement architecture and signed by a virtual trusted computing chip;

[0197] A first authentication module 74, configured to perform integrity authentication on the virtual client device according to the first integrity metric list;

[0198] The second sending module 75 is configured to send indication information to the virtual client device if the integrity authentication of the virtual client device passes, wherein the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

[0199] Optionally, the SD-WAN controller further includes:

[0200] A third sending module, configured to send an integrity challenge signaling to the physical client device;

[0201] A third receiving module is configured to receive a second integrity measurement list sent by the physical client device, where the second integrity measurement list is generated by the physical client device using an integrity measurement architecture and signed by a trusted computing chip;

[0202] a second authentication module, configured to perform integrity authentication on the physical client device according to the second integrity metric list;

[0203] The fourth sending module is used to send an integrity challenge result to the physical client device if the integrity authentication of the physical client device passes, wherein the integrity challenge result carries an indication of allowing the physical client device to create a virtual client device.

[0204] Optionally, the SD-WAN controller further includes:

[0205] A fourth receiving module, configured to receive security capability request information sent by the virtual client device;

[0206] A fifth sending module is used to send security capabilities to the virtual client device according to the security capability request information.

[0207] Optionally, the SD-WAN controller further includes:

[0208] A connection module is used to establish a connection with the virtual client device via a VxLAN VPN.

[0209] Please refer to Figure 8 , Embodiment 7 of the present invention further provides an SD-WAN controller 80, including: a transceiver 81 and a processor 82;

[0210] The transceiver 81 is used to receive the identity information of the virtual client device created by the physical client device and sent by the physical client device, wherein the identity information is signed by the physical client device using the identity authentication key created by the physical client device;

[0211] The transceiver 81 is further configured to send an integrity challenge signaling to the virtual client device according to the identity information;

[0212] The transceiver 81 is further configured to receive a first integrity measurement list sent by the virtual client device, wherein the first integrity measurement list is generated by the virtual client device using an integrity measurement architecture and signed using a virtual trusted computing chip;

[0213] The processor 82 is configured to perform integrity authentication on the virtual client device according to the first integrity metric list;

[0214] The transceiver 81 is further configured to send indication information to the virtual client device if the integrity authentication of the virtual client device passes, wherein the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

[0215] Optionally, the transceiver 81 is further configured to send an integrity challenge signaling to the physical client device;

[0216] The transceiver 81 is further configured to receive a second integrity measurement list sent by the physical client device, wherein the second integrity measurement list is generated by the physical client device using an integrity measurement architecture and signed by a trusted computing chip;

[0217] The processor 82 is further configured to perform integrity authentication on the physical client device according to the second integrity metric list;

[0218] The transceiver 81 is further configured to send an integrity challenge result to the physical client device if the integrity authentication of the physical client device passes, wherein the integrity challenge result carries an instruction to allow the physical client device to create a virtual client device.

[0219] Optionally, the transceiver 81 is further configured to receive security capability request information sent by the virtual client device;

[0220] The transceiver 81 is further configured to send security capabilities to the virtual client device according to the security capability request information.

[0221] Optionally, the processor 82 is further used to establish a connection with the virtual client device via VxLAN VPN.

[0222] Please refer to Fig. 9 Embodiment 8 of the present invention further provides a client device 90, including:

[0223] A creation module 91, used to create a virtual client device and an authentication key pair of the virtual client device;

[0224] A first sending module 92 is used to sign the identity information of the virtual client device using an identity authentication key and send the signed identity information to the SD-WAN controller;

[0225] A first receiving module 93 is used to receive the integrity challenge signaling sent by the SD-WAN controller to the virtual client device;

[0226] A first generating module 94, configured to generate a first integrity metric list using the integrity metric architecture according to the received integrity challenge signaling, and to sign the first integrity metric list using the virtual trusted computing chip;

[0227] A second sending module 95 is configured to send the first integrity metric list to the virtual client device to the SD-WAN controller;

[0228] The second receiving module 96 is used to receive indication information sent by the SD-WAN controller to the virtual client device, where the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

[0229] Optionally, the client device further includes:

[0230] A third receiving module is used to receive the integrity challenge signaling sent by the SD-WAN controller to the physical client device;

[0231] A second generating module, configured to generate a second integrity measurement list using the integrity measurement architecture according to the received integrity challenge signaling, and sign the second integrity measurement list using the trusted computing chip;

[0232] A third sending module is used to send the second integrity measurement list to the SD-WAN controller;

[0233] The fourth receiving module is used to receive the integrity challenge result sent by the SD-WAN controller, and the integrity challenge result carries an indication allowing the physical client device to create a virtual client device.

[0234] Optionally, the client device further includes:

[0235] A fourth sending module, configured to send security capability request information to the SD-WAN controller;

[0236] The fifth sending module is used to receive the security capabilities sent by the SD-WAN controller.

[0237] Optionally, the client device further includes:

[0238] A connection module is used to establish a connection between the virtual client device and the SD-WAN controller through a VxLAN VPN.

[0239] Please refer to Fig.10 , Embodiment 8 of the present invention further provides a client device 100, including: a transceiver 101 and a processor 102;

[0240] The processor 102 is configured to create a virtual client device and an authentication key pair for the virtual client device;

[0241] The transceiver 101 is used to sign the identity information of the virtual client device using the identity authentication key and send the signed identity information to the SD-WAN controller;

[0242] The transceiver 101 is further configured to receive an integrity challenge signaling sent by the SD-WAN controller to the virtual client device;

[0243] The processor 102 is further configured to generate a first integrity measurement list using the integrity measurement architecture according to the received integrity challenge signaling, and sign the first integrity measurement list using the virtual trusted computing chip;

[0244] The transceiver 101 is further configured to send the first integrity metric list to the virtual client device to the SD-WAN controller;

[0245] The transceiver 101 is further used to receive indication information sent by the SD-WAN controller to the virtual client device, where the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

[0246] Optionally, the transceiver 101 is further configured to receive an integrity challenge signaling sent by the SD-WAN controller to the physical client device;

[0247] The processor 102 is further configured to generate a second integrity measurement list using the integrity measurement architecture according to the received integrity challenge signaling, and sign the second integrity measurement list using the trusted computing chip;

[0248] The transceiver 101 is further configured to send the second integrity metric list to the SD-WAN controller;

[0249] The transceiver 101 is further configured to receive an integrity challenge result sent by the SD-WAN controller, wherein the integrity challenge result carries an indication allowing the physical client device to create a virtual client device.

[0250] Optionally, the transceiver 101 is further used to send security capability request information to the SD-WAN controller;

[0251] The transceiver 101 is also used to receive security capabilities sent by the SD-WAN controller.

[0252] Optionally, the processor 102 is further used to establish a connection between the virtual client device and the SD-WAN controller via VxLAN VPN.

[0253] Please refer to Fig.11 , Fig.11 The structural diagram of the SD-WAN system of an embodiment of the present invention includes: an SD-WAN controller and a CPE. The SD-WAN controller includes: a security capability pool, a Private CA (private certificate authentication authority) and a trusted management center, wherein: the security capability pool includes multiple security capability images, and when the security capability images are loaded into the operating system, relevant security functions can be executed. Private CA is used for the functions of providing CA-related signature and authentication services to the CPE in the SD-WAN system in the above embodiment. The trusted management center is used to perform the functions of performing a trusted assessment on the CPE, judging its integrity status, and issuing relevant integrity status certificates through the Private CA in the above embodiment. In this embodiment, two vCPEs are carried on the CPE. The SD-WAN controller can perform integrity authentication on the host operating system, virtual machine operating system 1 and virtual machine operating system 2 of the CPE respectively according to the integrity authentication method of the virtual client device in the above embodiment.

[0254] Please refer to Fig.12 An embodiment of the present invention further provides an SD-WAN controller 120, including a processor 121, a memory 122, and a computer program stored in the memory 122 and executable on the processor 121. When the computer program is executed by the processor 121, the various processes of the above-mentioned embodiment of the integrity authentication method for the virtual client device executed by the SD-WAN controller are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0255] Please refer to Fig.13 The embodiment of the present invention further provides a client device 130, including a processor 131, a memory 132, and a computer program stored in the memory 132 and executable on the processor 131. When the computer program is executed by the processor 131, the various processes of the embodiment of the integrity authentication method of the virtual client device executed by the client device are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0256] The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned virtual client device integrity authentication method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0257] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0258] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0259] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

Claims

1. A method for authenticating the integrity of a virtual client device, characterized in that: Performed by the SD-WAN controller, including: Receiving identity information of a virtual client device created by a physical client device and sent by the physical client device, wherein the identity information is signed by the physical client device using an identity authentication key created by the physical client device; Sending an integrity challenge signaling to the virtual client device according to the identity information; Receiving a first integrity measurement list sent by the virtual client device, where the first integrity measurement list is generated by the virtual client device using an integrity measurement architecture and signed using a virtual trusted computing chip; Performing integrity authentication on the virtual client device according to the first integrity metric list; If the integrity authentication of the virtual client device passes, indication information is sent to the virtual client device, where the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

2. The method according to claim 1, characterized in that Before receiving the identity information of the virtual client device created by the physical client device, the method further includes: Sending integrity challenge signaling to the physical client device; receiving a second integrity measurement list sent by the physical client device, where the second integrity measurement list is generated by the physical client device using an integrity measurement architecture and signed by a trusted computing chip; performing integrity authentication on the physical client device according to the second integrity metric list; If the integrity authentication of the physical client device passes, an integrity challenge result is sent to the physical client device, wherein the integrity challenge result carries an indication of allowing the physical client device to create a virtual client device.

3. The method according to claim 1, characterized in that After sending the instruction information to the virtual client device, the method further includes: Receiving security capability request information sent by the virtual client device; The security capability is issued to the virtual client device according to the security capability request information.

4. The method according to claim 1, characterized in that Before sending the integrity challenge signaling to the virtual client device, the method further includes: Establish a connection with the virtual client device via VxLAN VPN.

5. A method for authenticating the integrity of a virtual client device, characterized in that: Executed by the client device, including: The physical client device creates a virtual client device and an authentication key pair for the virtual client device; The physical client device signs the identity information of the virtual client device using the authentication key and sends the signed identity information to the SD-WAN controller; The virtual client device receives the integrity challenge signaling sent by the SD-WAN controller; The virtual client device generates a first integrity measurement list using the integrity measurement architecture according to the received integrity challenge signaling, and signs the first integrity measurement list using the virtual trusted computing chip; The virtual client device sends the first integrity metric list to the SD-WAN controller; The virtual client device receives indication information sent by the SD-WAN controller, where the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

6. The method according to claim 5, characterized in that Before the physical client device creates the virtual client device and the authentication key pair of the virtual client device, the method further includes: The physical client device receives the integrity challenge signaling sent by the SD-WAN controller; The physical client device generates a second integrity measurement list using the integrity measurement architecture according to the received integrity challenge signaling, and signs the second integrity measurement list using the trusted computing chip; The physical client device sends the second integrity metric list to the SD-WAN controller; The physical client device receives an integrity challenge result sent by the SD-WAN controller, wherein the integrity challenge result carries an indication allowing the physical client device to create a virtual client device.

7. The method according to claim 5, characterized in that After the virtual client device receives the indication information sent by the SD-WAN controller, the method further includes: Sending security capability request information to the SD-WAN controller; Receive security capabilities issued by the SD-WAN controller.

8. The method according to claim 5, characterized in that Before the virtual client device receives the integrity challenge signaling sent by the SD-WAN controller, the method further includes: A connection is established between the virtual client device and the SD-WAN controller via VxLAN VPN.

9. An SD-WAN controller, characterized in that: include: A first receiving module, configured to receive identity information of a virtual client device created by a physical client device and sent by the physical client device, wherein the identity information is signed by the physical client device using an identity authentication key created by the physical client device; A first sending module, configured to send an integrity challenge signaling to the virtual client device according to the identity information; A second receiving module is used to receive a first integrity measurement list sent by the virtual client device, where the first integrity measurement list is generated by the virtual client device using an integrity measurement architecture and signed using a virtual trusted computing chip; A first authentication module, configured to perform integrity authentication on the virtual client device according to the first integrity metric list; The second sending module is configured to send indication information to the virtual client device if the integrity authentication of the virtual client device passes, wherein the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

10. An SD-WAN controller, characterized in that: include: transceivers and processors; The transceiver is used to receive the identity information of the virtual client device created by the physical client device and sent by the physical client device, wherein the identity information is signed by the physical client device using the identity authentication key created by the physical client device; The transceiver is further configured to send an integrity challenge signaling to the virtual client device according to the identity information; The transceiver is further used to receive a first integrity measurement list sent by the virtual client device, wherein the first integrity measurement list is generated by the virtual client device using an integrity measurement architecture and signed using a virtual trusted computing chip; The processor is configured to perform integrity authentication on the virtual client device according to the first integrity metric list; The transceiver is further used to send indication information to the virtual client device if the integrity authentication of the virtual client device passes, wherein the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

11. A client device, characterized in that: include: A creation module, used to create a virtual client device and an authentication key pair of the virtual client device; A first sending module, configured to sign the identity information of the virtual client device using an identity authentication key, and send the signed identity information to the SD-WAN controller; A first receiving module, configured to receive an integrity challenge signaling sent by the SD-WAN controller to the virtual client device; A first generating module, configured to generate a first integrity measurement list using an integrity measurement architecture according to the received integrity challenge signaling, and to sign the first integrity measurement list using a virtual trusted computing chip; A second sending module is used to send the first integrity metric list to the virtual client device to the SD-WAN controller; The second receiving module is used to receive indication information sent by the SD-WAN controller to the virtual client device, where the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

12. A client device, characterized in that: include: transceivers and processors; The processor is configured to create a virtual client device and an authentication key pair for the virtual client device; The transceiver is used to sign the identity information of the virtual client device using the identity authentication key and send the signed identity information to the SD-WAN controller; The transceiver is further configured to receive an integrity challenge signaling sent by the SD-WAN controller to the virtual client device; The processor is further configured to generate a first integrity measurement list using the integrity measurement architecture according to the received integrity challenge signaling, and sign the first integrity measurement list using the virtual trusted computing chip; The transceiver is further configured to send the first integrity metric list to the virtual client device to the SD-WAN controller; The transceiver is also used to receive indication information sent by the SD-WAN controller to the virtual client device, where the indication information is used to indicate the credibility of the physical client device where the virtual client device is located.

13. An SD-WAN controller, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of the integrity authentication method for a virtual client device as claimed in any one of claims 1 to 4 are implemented.

14. A client device, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of the integrity authentication method for a virtual client device as claimed in any one of claims 5 to 8 are implemented.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the integrity authentication method for a virtual client device as described in any one of claims 1 to 4; or, when executed by a processor, implements the steps of the integrity authentication method for a virtual client device as described in any one of claims 5 to 8.

Images