SSH identity authentication method and system supporting universal extensible cryptographic equipment

Abstract

The invention discloses an SSH identity authentication method and system supporting universal extensible cryptographic equipment, and the method comprises the steps: generating a key pair for SSH authentication in the cryptographic equipment, and exporting a public key; storing the exported public key or a digital certificate obtained by packaging the public key in an SSH server, and taking an authentication mode of the public key or the digital certificate as an authentication factor; when the SSH client requests to log in, the login information of a user calls password equipment by using a local SSH agent module to generate signature data, and the signature data is sent to the SSH server; the SSH server performs signature verification on the signature data by using a public key or a digital certificate, authenticates the login information of the user if the verification is successful, and establishes SSH connection with the SSH client if the authentication is passed; otherwise, refusing to establish the SSH connection with the SSH client. According to the invention, the identity authentication of the SSH software can be conveniently expanded to different types of hardware password equipment.

Description

Technical Field

[0001] The present invention relates to SSH identity authentication technology in the computer field, and in particular to an SSH identity authentication method and system supporting a universal extensible cryptographic device. Background Art

[0002] SSH (Secure Shell), also known as the Secure Shell Protocol in Chinese, is an encryption protocol used for secure communication in an insecure network. It is mainly used to remotely log in to the system and execute commands to ensure that data is not eavesdropped, tampered with, or disguised during transmission.

[0003] SSH Agent Protocol is a part of SSH (Secure Shell) protocol, which is used to manage and proxy private key authentication information. Specifically, SSH Agent Protocol allows users to store private keys in a secure agent process or have the agent agent be responsible for performing private key related operations. The process performs signing operations on behalf of the user when needed, without directly using the user's private key every time. This can improve security because the private key is not exposed to the client every time a connection is made.

[0004] In network communications, especially in security protocols like SSH, authentication factors refer to the means or evidence used to verify the identity of a user. Authentication factors are usually divided into the following three categories:

[0005] 1) Knowledge factor (Something you know): information that the user knows, such as a password or PIN code;

[0006] 2) Possession factor (Something you have): Items owned by the user, such as smart cards, authentication applications on mobile phones, USB keys, etc.;

[0007] 3) Biometric factors (Something you are): The user’s biological characteristics, such as fingerprints, facial recognition, iris scans, etc.

[0008] In short, authentication factors are the key to ensuring the security of network communications. By combining two / multiple authentication factors, the security of identity authentication can be significantly improved and the risk of identity theft can be reduced.

[0009] OpenSSH (Open Secure Shell) is an open source network connection tool suite that implements the SSH protocol. It was originally developed by the OpenBSD project to provide secure remote access and other network services, replacing insecure protocols such as Telnet and rlogin. OpenSSH is widely used in modern computing environments and has become a standard tool for secure remote access and management. In OpenSSH, the implementation of SSH Agent Protocol is reflected in the following aspects:

[0010] 1)SSH agent process (ssh-agent)

[0011] OpenSSH comes with ssh-agent by default, which runs as a daemon process that saves private keys in memory and provides them to SSH clients when needed. Users can start ssh-agent when starting a session and manage private keys through the agent.

[0012] 2) Adding and removing keys (ssh-add)

[0013] The ssh-add command is used to add private keys to the ssh-agent, and keys can be removed from the agent when required.

[0014] 3) SSH client uses proxy key

[0015] When a user connects using an SSH client, the client automatically requests the private key from ssh-agent for authentication instead of reading the private key directly from the file system.

[0016] 4) Environment variables

[0017] ssh-agent sets some environment variables, such as SSH_AUTH_SOCK and SSH_AGENT_PID, which are used to instruct the SSH client how to communicate with the SSH agent.

[0018] In summary, OpenSSH implements the SSH Agent Protocol through the ssh-agent and ssh-add commands, allowing users to securely store or manage private keys in memory, thereby simplifying the authentication process of SSH connections. This mechanism is particularly suitable for users who need to use SSH connections frequently, such as system administrators and developers.

[0019] In the prior art, the ssh client of OpenSSH can use the cryptographic device of the PKCS#11 interface for identity authentication through the -I parameter, but can only support the cryptographic device of the PKCS#11 interface and cannot use the cryptographic device of other cryptographic interfaces, which has great limitations.

[0020] The Chinese patent application with publication number CN118174921A discloses a multi-factor SSH login authentication method based on the national secret algorithm and supporting two-way authentication, using the GMT 0017-2012 smart password key (i.e., the password device of the SKF interface) and the national secret algorithm for two-way authentication of the SSH server and client. However, it can only support the password device of the SKF interface, and cannot use the password devices of other password interfaces, which has great limitations.

[0021] The Chinese patent application with publication number CN114070571B discloses a method, device, terminal and storage medium for establishing a connection. The user password information is signed with a private key through a TEE device, and then the SSH server uses the corresponding public key to verify the signature data, providing two-factor authentication. At the same time, the person who performs the connection operation can be identified and audited through biometric identity features. However, it requires the computer device to have a TEE trusted execution environment and cannot use cryptographic devices with other cryptographic interfaces, which has great limitations. Summary of the invention

[0022] The technical problem to be solved by the present invention is as follows: In view of the above-mentioned problems in the prior art, an SSH identity authentication method and system supporting universal and extensible cryptographic devices are provided. The authentication factors are based on asymmetric public and private keys, and the identity authentication of SSH software can be conveniently extended to different types of hardware cryptographic devices.

[0023] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0024] An SSH identity authentication method supporting a universal extensible password device comprises the following steps:

[0025] S1, generate a key pair for SSH authentication in the cryptographic device and export the public key;

[0026] S2: Save the exported public key or the digital certificate obtained by encapsulating the public key on the SSH server, and use the public key or digital certificate authentication method as an authentication factor in the SSH authentication process;

[0027] S3, start the SSH client and SSH server, and when the SSH client requests to log in, use the local SSH agent module to call the password device to generate signature data with the user's login information and send it to the SSH server; the SSH server uses the public key or digital certificate to verify the signature data. If the verification is successful, the user's login information is authenticated. If the authentication is successful, an SSH connection is established with the SSH client; otherwise, the SSH connection with the SSH client is refused.

[0028] Furthermore, the authentication method of the public key or digital certificate in step S2 refers to a method of authentication through a key file or a method of authentication through a cryptographic device.

[0029] Furthermore, the method of authenticating through a key file refers to the SSH agent module using a private key file to generate a digital signature required for authentication; the method of authenticating through a cryptographic device refers to the SSH client using a cryptographic device module through the SSH agent module to call the corresponding cryptographic device driver, and calling the interface of the cryptographic device through the cryptographic device driver to generate the digital signature required for authentication.

[0030] Furthermore, the interface of the cryptographic device includes a standard cryptographic interface, which includes part or all of the PKCS#11 interface, SKF interface, SDF interface and tss interface, as well as other standard interfaces of cryptographic devices, and the cryptographic device module corresponding to the standard cryptographic interface is a program module built into the SSH agent module, or the cryptographic device module corresponding to the standard cryptographic interface is a dynamic link library that is dynamically loaded and called when the SSH agent module is running.

[0031] Furthermore, the interface of the cryptographic device also includes a non-standard cryptographic interface, and the cryptographic device module corresponding to the non-standard cryptographic interface registers its callback function in the SSH agent module by registration, so that the SSH agent module calls the cryptographic device module corresponding to the non-standard cryptographic interface through the registered callback function, and then calls the corresponding cryptographic device interface through the driver corresponding to the non-standard cryptographic interface to realize authentication.

[0032] Further, step S3 includes:

[0033] S3.1, the SSH client obtains the user's login information;

[0034] S3.2, the SSH client sends the user's login information to the local SSH agent module based on the SSH agent protocol;

[0035] S3.3, the SSH agent module calls the cryptographic device by calling the cryptographic device module corresponding to the cryptographic device to sign the user's login information using the private key in the cryptographic device, and returns the signed data to the SSH client;

[0036] S3.4, the SSH client sends the signature data to the SSH server;

[0037] S3.5, the SSH server uses the saved public key or digital certificate to verify the signature data. If the verification is successful, the user's login information is authenticated. If the authentication is successful, an SSH connection is established with the SSH client; otherwise, the SSH connection is refused to be established with the SSH client.

[0038] Furthermore, the cryptographic device module in step S3.3 is integrated into the main program of the SSH agent module through static linking, or is dynamically called by the main program of the SSH agent module in the form of a dynamic library.

[0039] The present invention also provides an SSH identity authentication system supporting a universal extensible cryptographic device, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute any one of the SSH identity authentication methods supporting a universal extensible cryptographic device.

[0040] The present invention also provides a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute any one of the SSH identity authentication methods supporting a universal extensible cryptographic device through a processor.

[0041] The present invention also provides a computer program product, including a computer program or an instruction, wherein the computer program or the instruction is programmed or configured to execute any one of the SSH identity authentication methods supporting a universal extensible cryptographic device through a processor.

[0042] Compared with the prior art, the present invention mainly has the following advantages:

[0043] When the SSH client requests to log in, the present invention uses the local SSH agent module to call the password device to generate signature data using the user's login information and sends it to the SSH server for signature authentication. There is no need to modify the SSH software program. Only the SSH agent module is needed to extend the identity authentication of the SSH software to different types of hardware password devices (such as smart password keys UKey, password card devices, trusted computing modules TPM / TCM, etc.). It not only ensures the physical security of the SSH software identity authentication, but also greatly improves the convenience and flexibility of SSH identity authentication. In addition, for password devices using non-standard interfaces, the present invention can realize customized extensions by registering callback functions, so that such password devices are connected and become an identity authentication factor for building SSH connections. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A schematic diagram of modifying the SSH program itself to adapt to access different hardware password devices.

[0045] Figure 2 A schematic diagram of using different SSH agent modules for different password devices.

[0046] Figure 3 The present invention is a schematic diagram of the design of an SSH proxy module that supports a universal and extensible cryptographic device in an embodiment of the present invention.

[0047] Figure 4 The figure is a flow chart of a method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0048] Before introducing the specific embodiments of the present invention, related abbreviations and key terms are explained first.

[0049] SSH:

[0050] SSH (Secure Shell), a secure shell protocol, is an encryption protocol used for secure communication in an insecure network. It is mainly used for remote login systems and command execution to ensure that data is not eavesdropped, tampered with, or disguised during transmission. The design goal of SSH is to replace traditional insecure remote login protocols (such as Telnet, rlogin, etc.).

[0051] Main Features

[0052] 1) Encrypted communication: SSH uses symmetric encryption, asymmetric encryption, and hash algorithms to ensure that data is encrypted during transmission, thereby preventing third-party eavesdropping or attacks.

[0053] 2) Authentication: SSH supports multiple authentication methods, including password-based authentication, public key authentication, two-factor authentication, etc. Public key authentication is considered to be a more secure method. Users can generate a public and private key pair, deploy the public key on the remote server, and log in through the private key.

[0054] 3) Data integrity: SSH uses message authentication code (MAC) to ensure data integrity and prevent data from being tampered with during transmission.

[0055] 4) Port forwarding: SSH supports port forwarding (also known as tunneling), which allows users to tunnel traffic through a secure SSH connection, often used to access resources behind a firewall or NAT.

[0056] 5) Secure file transfer: SSH includes two main file transfer protocols: SCP (Secure Copy Protocol) and SFTP (Secure File Transfer Protocol). They are both based on SSH and provide secure file transfer functions.

[0057] Common application scenarios

[0058] 1) Remote login: Administrators can log in to the remote server securely through SSH and perform command line operations.

[0059] 2) Remote command execution: Users can execute scripts or commands on remote machines through SSH connection.

[0060] 3) Secure File Transfer: Transfer files over SSH using SCP or SFTP.

[0061] 4) Port forwarding: Establish a tunnel through SSH to securely access remote services.

[0062] How it works

[0063] The working principle of SSH mainly includes the following steps:

[0064] 1) Establish a connection: The client establishes a connection with the server and negotiates the encryption algorithm and key exchange method to be used.

[0065] 2) Authentication: The client authenticates using methods such as a password or public key.

[0066] 3) Encrypted communication: Once identity authentication is passed, both parties use the negotiated encryption algorithm to encrypt the communication data to ensure the security of the data during transmission.

[0067] Main Implementation

[0068] 1) OpenSSH: The most commonly used SSH implementation, an open source project, is widely used in various Unix-like operating systems.

[0069] 2) PuTTY: A commonly used SSH client, especially widely used on Windows platform.

[0070] SSH Agent Protocol:

[0071] SSH Agent Protocol is a part of SSH protocol, which is used to manage and proxy private key authentication information. The basic functions of SSH Agent Protocol include:

[0072] 1) Private key management: SSH Agent can load multiple private keys, which may be stored in memory during the session. If the private key is in the cryptographic device hardware, SSH Agent is responsible for interacting with the cryptographic device and performing the relevant operations involving the private key in the SSH Agent Protocol.

[0073] 2) Authentication Agent: SSH Agent can use the stored private key to perform digital signature operations when requested by the client, thereby performing identity authentication;

[0074] 3) Communication protocol: SSH Agent Protocol defines a set of protocols for communication between the client and the agent process, usually through Unix sockets.

[0075] A typical workflow using SSH Agent Protocol is as follows:

[0076] 1) Start the SSH Agent process.

[0077] 2) Use the ssh-add command to load the private key into the SSH Agent.

[0078] 3) When authentication is required, the SSH client communicates with the SSH Agent through a Unix socket and requests a signing operation using a specific private key.

[0079] 4) After receiving the request, the SSH Agent uses the corresponding private key to generate a signature and returns it to the client.

[0080] By using SSH Agent Protocol, you can improve the security and convenience of SSH connections, especially in scenarios where SSH connections are frequently required.

[0081] OpenSSH:

[0082] OpenSSH (Open Secure Shell) is an open source network connection tool suite that implements the SSH protocol. It was originally developed by the OpenBSD project to provide secure remote access and other network services, replacing insecure protocols such as Telnet and rlogin. The main features include:

[0083] 1) Secure remote login: Use encryption technology to protect login sessions and prevent information from being eavesdropped and tampered with.

[0084] 2) Secure file transfer: Provides two secure file transfer protocols: SCP (Secure Copy Protocol) and SFTP (SSH File Transfer Protocol).

[0085] 3) Port forwarding: Encrypt and transmit data streams of other protocols such as HTTP, SMTP, etc. through SSH tunnel.

[0086] 4) Authentication mechanism: supports multiple authentication methods, including password authentication, key-based authentication, authentication based on two or more factors, etc.

[0087] 5) X11 forwarding: allows secure use of X11 graphical interface applications in remote sessions.

[0088] 6) Proxy forwarding: allows users to connect to the target host through an intermediary host, enhancing security and flexibility.

[0089] The components of OpenSSH mainly include:

[0090] 1)ssh: client program used to connect to the SSH server.

[0091] 2)sshd: server program that accepts and processes connection requests from SSH clients.

[0092] 3) scp: A secure copy tool used for file transfer via SSH.

[0093] 4)sftp: Secure File Transfer Protocol tool for file transfer and management via SSH.

[0094] 5)ssh-keygen: key generation tool used to generate and manage SSH key pairs.

[0095] 6)ssh-agent: A daemon used to manage private keys, supporting automated key management.

[0096] 7)ssh-add: A tool used to add private keys to ssh-agent.

[0097] OpenSSH has the following advantages:

[0098] 1) High security: Protect data transmission through encryption to prevent eavesdropping and man-in-the-middle attacks.

[0099] 2) Flexibility: Supports multiple authentication methods and configuration options to adapt to different usage scenarios.

[0100] 3) Cross-platform: supports multiple operating systems, including Linux, Unix, macOS, and Windows.

[0101] 4) Open source: The source code is public and users can freely view, modify and distribute it.

[0102] PKCS#11: The full name is "Public-Key Cryptography Standards#11", which is a set of standards developed by RSA Laboratories to define a common programming interface for cryptographic devices. Its goal is to provide a cross-platform, cross-vendor standardized interface that enables applications to interact with different cryptographic hardware devices, such as smart cards, hardware security modules (HSMs), and USB keys.

[0103] SKF interface: SKF interface is a set of standard interface specifications in China, which aims to standardize the interface for interacting with commercial cryptographic equipment and realize a unified, standardized and secure commercial cryptographic application environment.

[0104] SDF interface: SDF interface is a set of standard interface specifications in China, mainly used for cryptographic operations and management of security devices. SDF interface is widely used in various security devices, such as hardware security modules (HSM), smart cards and USB dongles.

[0105] Trusted Computing Module (TPM2.0 / TCM2.0): TPM (Trusted Platform Module) is a dedicated security chip, usually integrated on the motherboard of a computer, used to provide hardware-level security. TPM2.0 is the latest standard of this technology, developed by the Trusted Computing Group (TCG).

[0106] TCM (Trusted Cryptographic Module) is a security chip designed by the China National Cryptography Administration to provide hardware-level cryptographic protection and security services. TCM 2.0 is its latest version, designed to enhance the security of information systems. Similar to the international TPM (Trusted Platform Module), TCM 2.0 provides a series of standardized functions and interfaces and is widely used in fields that require high security.

[0107] Two-Factor Authentication: Two-Factor Authentication (2FA) is an authentication method that improves security by requiring users to provide two different types of verification information to confirm their identity.

[0108] Example

[0109] SSH software (such as OpenSSH) that implements the SSH Agent Protocol can generally provide multiple identity authentication methods, such as supporting authentication based on user passwords, authentication based on asymmetric public and private keys, or authentication that combines the two authentication methods.

[0110] For authentication methods based on asymmetric public and private keys, in addition to storage in the form of key files, you can also use asymmetric keys in hardware cryptographic devices with key storage capabilities (such as smart password keys UKey, hardware password cards, hardware password modules, etc.) to implement identity authentication for SSH software. For such hardware cryptographic devices with key storage capabilities, private keys can only be used by calling the device's interface and cannot be exported outside the device. Therefore, using asymmetric keys stored in hardware cryptographic devices as authentication keys for SSH software can improve the security of the authentication process itself.

[0111] However, in reality, there are large differences between the interfaces of different cryptographic devices. For example, smart cryptographic key UKey devices generally provide PKCS#11 interfaces or SKF interfaces, hardware cryptographic cards or hardware cryptographic modules generally provide PKCS#11 interfaces or SDF interfaces, trusted cryptographic modules TPM or TCM's trusted software stack generally provide tss interfaces, and even many cryptographic hardware devices provide non-standard interfaces defined by the manufacturer. Therefore, if the SSH software authentication process needs to access hardware cryptographic devices with different interface types, it is necessary to either modify its own program to adapt to the corresponding hardware cryptographic devices (such as Figure 1 ), or it is necessary to develop an SSH agent module Agnet for the password device, and when using it, it is also necessary to use different SSH agent modules Agent for different password devices, which is not flexible (such as Figure 2 ).

[0112] In order to solve the above problems, this embodiment designs a universal and extensible SSH identity authentication component, and its overall architecture is as follows: Figure 3 As shown, the SSH Agent Protocol is implemented by an SSH agent module Agent, which receives interaction requests from the SSH client (SSH Client) upward and provides it with the key operation capabilities required by the protocol; it interacts with various cryptographic device modules downward and calls the key functions of the cryptographic devices through them.

[0113] like Figure 3 As shown, in the SSH agent module of this embodiment, various cryptographic device modules include:

[0114] (1) Processing module for standard interface cryptographic devices

[0115] These processing modules are called by the SSH agent module Agent, and each processing module implements the following functions: by using a certain standard password interface to operate the corresponding password device, so as to meet the key operation requirements of the SSH agent module Agent when implementing authentication-related operations of the SSH Agent Protocol.

[0116] This embodiment does not limit the scope of standard interfaces corresponding to these processing modules, such as: PKCS#11 interface specification, SKF interface specification, SDF interface specification, tss interface specification and other standard interface specifications, etc. In addition, in order to be compatible with the traditional way of using key files in SSH, a key file processing module is also provided in the design of this embodiment, which can be compatible with the traditional way of storing SSH private keys in files.

[0117] This embodiment does not limit the specific implementation of these processing modules. For example, they may be part of the SSH agent module Agent program (or integrated into the SSH agent module Agent main program through static linking), or they may be dynamically called in the SSH agent module Agent running process in the form of a dynamic library, etc.

[0118] (2) Extensibility points for non-standard interface cryptographic devices

[0119] For cryptographic devices that provide non-standard interfaces, the SSH agent module Agent has the ability to be extended to these cryptographic devices. Cryptographic device manufacturers or third-party developers can develop corresponding extension modules based on the extension interface requirements of the SSH agent module Agent. In the extension module, the main implementation is to use the corresponding non-standard cryptographic interface to operate the cryptographic device to meet the key operation requirements of the SSH agent module Agent when implementing authentication-related operations of the SSH Agent Protocol. Therefore, when the SSH agent module Agent is started, the callback function of the interface implemented in the extension module is registered in the SSH agent module Agent, and the interface of the extension module is called back when the Agent is running.

[0120] Based on the SSH identity authentication component of this embodiment, this embodiment proposes an SSH identity authentication method that supports universal extensible cryptographic devices, such as Figure 4 As shown, the following steps are included:

[0121] S1, generate a key pair for SSH authentication in the cryptographic device and export the public key;

[0122] S2: Save the exported public key or the digital certificate obtained by encapsulating the public key on the SSH server, and use the public key or digital certificate authentication method as an authentication factor in the SSH authentication process;

[0123] S3, start the SSH client and SSH server, and when the SSH client requests to log in, use the local SSH agent module to call the password device to generate signature data with the user's login information and send it to the SSH server; the SSH server uses the public key or digital certificate to verify the signature data. If the verification is successful, the user's login information is authenticated. If the authentication is successful, an SSH connection is established with the SSH client; otherwise, the SSH connection with the SSH client is refused.

[0124] Each step is described in detail below.

[0125] Step S1 of this embodiment is to generate the key required for authentication, generate a key pair for SSH authentication in the cryptographic device by using relevant tools (not limited in this embodiment), and export the public key. According to the actual needs of the SSH software for authenticating the public key or digital certificate, it is determined whether the public key needs to be encapsulated and issued as a digital certificate, which is not limited in this embodiment.

[0126] Step S2 of this embodiment is intended to configure the SSH software. On the one hand, the public key or certificate generated in step S1 is configured according to the provisions of the SSH software (generally placed in a specified location of the SSH server system), and on the other hand, in the authentication configuration of the SSH software, the authentication method of the public key or digital certificate is enabled. In this embodiment, the authentication method of the public key or digital certificate refers to a method of authentication through a key file or a method of authentication through a cryptographic device.

[0127] Specifically, the method of authentication through key files refers to that the SSH agent module uses the private key file to generate the digital signature required for authentication; and the method of authentication through cryptographic devices refers to that the SSH agent module uses the cryptographic device module to call the corresponding cryptographic device driver, and calls the interface of the cryptographic device through the cryptographic device driver to generate the digital signature required for authentication.

[0128] In this embodiment, the interface of the cryptographic device includes a standard cryptographic interface, which includes part or all of the PKCS#11 interface, SKF interface, SDF interface and tss interface, as well as other standard interfaces of cryptographic devices, and the cryptographic device module corresponding to the standard cryptographic interface is a program module built into the SSH agent module, or the cryptographic device module corresponding to the standard cryptographic interface is a dynamic link library that is dynamically loaded and called when the SSH agent module is running.

[0129] In this embodiment, the interface of the cryptographic device also includes a non-standard cryptographic interface. The cryptographic device module corresponding to the non-standard cryptographic interface registers its callback function in the SSH agent module through registration, so that the SSH agent module calls the cryptographic device module corresponding to the non-standard cryptographic interface through the registered callback function, and then calls the corresponding cryptographic device interface through the driver corresponding to the non-standard cryptographic interface to realize authentication.

[0130] In this embodiment, there is no limit on the number of authentication factors configured in the authentication configuration of the SSH software. Only one authentication factor can be enabled (in this case, the public key or digital certificate authentication method is used as the only authentication factor in the SSH authentication link), or two / multiple authentication factors can be enabled (in this case, the public key or certificate authentication method is used as one of the authentication factors in the SSH authentication link).

[0131] Step S3 of this embodiment is to start related programs and initiate an SSH connection, and start SSH software, such as an SSH server, an SSH client, etc. The SSH agent module Agent of the embodiment is started in the SSH client system, and then the following steps are performed:

[0132] S3.1, the SSH client obtains the user's login information;

[0133] S3.2, the SSH client sends the user's login information to the local SSH agent module Agent based on the SSH agent protocol;

[0134] S3.3, the SSH agent module Agent calls the password device by calling the password device module corresponding to the password device to sign the user's login information using the private key in the password device, and returns the signature data to the SSH client. The password device module is integrated into the main program of the SSH agent module through static linking, or is dynamically called by the main program of the SSH agent module in the form of a dynamic library;

[0135] S3.4, the SSH client sends the signature data to the SSH server;

[0136] S3.5, the SSH server uses the saved public key or digital certificate to verify the signature data. If the verification is successful, the user's login information is authenticated. If the authentication is successful, an SSH connection is established with the SSH client; otherwise, the SSH connection is refused to be established with the SSH client.

[0137] This embodiment also provides an SSH identity authentication system supporting a universal extensible cryptographic device, including a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the SSH identity authentication method supporting a universal extensible cryptographic device described in this embodiment.

[0138] This embodiment further provides a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute the SSH identity authentication method supporting a universal extensible cryptographic device described in this embodiment through a processor.

[0139] This embodiment further provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the SSH identity authentication method supporting a universal extensible cryptographic device described in this embodiment through a processor.

[0140] In summary, the present invention proposes a universal and extensible SSH authentication component. In the process of initiating an SSH connection request, performing SSH identity authentication and finally establishing an SSH connection, there is no need to change the upper-layer SSH software itself. By using the SSH agent module Agent, SSH authentication can be extended to various hardware cryptographic devices, which can not only call various standard interface cryptographic devices, but also access non-standard interface hardware cryptographic devices. Therefore, the physical security of SSH software identity authentication is guaranteed, and the convenience and flexibility of SSH identity authentication are greatly improved. In addition, for cryptographic devices using non-standard interfaces, the authentication component designed by the present invention also retains extensibility-such cryptographic devices can be accessed by the SSH agent module Agent designed by the present invention by implementing a customized extension module, thereby becoming an identity authentication factor for building an SSH connection.

[0141] In addition, the identity authentication component proposed in the present invention can also be used in combination with other authentication methods of SSH software (such as authentication based on user passwords, etc.) to implement dual-factor authentication and multi-factor authentication of SSH software.

[0142] Those skilled in the art will appreciate that the technical solutions provided by the embodiments of the present application may be in the form of methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0143] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. An SSH identity authentication method supporting universal extensible cryptographic devices, characterized in that: The steps include: S1, generate a key pair for SSH authentication in the cryptographic device and export the public key; S2: Save the exported public key or the digital certificate obtained by encapsulating the public key on the SSH server, and use the public key or digital certificate authentication method as an authentication factor in the SSH authentication process; S3, start the SSH client and SSH server, and when the SSH client requests to log in, use the local SSH agent module to call the password device to generate signature data with the user's login information and send it to the SSH server; the SSH server uses the public key or digital certificate to verify the signature data. If the verification is successful, the user's login information is authenticated. If the authentication is successful, an SSH connection is established with the SSH client; otherwise, the SSH connection with the SSH client is refused.

2. The SSH identity authentication method supporting universal extensible cryptographic devices according to claim 1, characterized in that: The authentication method of the public key or digital certificate in step S2 refers to a method of authentication through a key file or a method of authentication through a cryptographic device.

3. The SSH identity authentication method supporting universal extensible cryptographic devices according to claim 2, characterized in that: The method of authentication through key files means that the SSH agent module uses the private key file to generate the digital signature required for authentication; the method of authentication through cryptographic devices means that the SSH client uses the cryptographic device module through the SSH agent module to call the corresponding cryptographic device driver, and calls the interface of the cryptographic device through the cryptographic device driver to generate the digital signature required for authentication.

4. The SSH identity authentication method supporting universal extensible cryptographic devices according to claim 3, characterized in that: The interface of the cryptographic device includes a standard cryptographic interface, which includes part or all of a PKCS#11 interface, an SKF interface, an SDF interface, and a tss interface, and the cryptographic device module corresponding to the standard cryptographic interface is a program module built into the SSH agent module, or the cryptographic device module corresponding to the standard cryptographic interface is a dynamic link library that is dynamically loaded and called when the SSH agent module is running.

5. The SSH identity authentication method supporting universal extensible cryptographic devices according to claim 3, characterized in that: The interface of the cryptographic device also includes a non-standard cryptographic interface. The cryptographic device module corresponding to the non-standard cryptographic interface registers its callback function in the SSH agent module by registration, so that the SSH agent module calls the cryptographic device module corresponding to the non-standard cryptographic interface through the registered callback function, and then calls the corresponding cryptographic device interface through the driver corresponding to the non-standard cryptographic interface to realize authentication.

6. The SSH identity authentication method supporting universal extensible cryptographic devices according to claim 1, characterized in that: Step S3 includes: S3.1, the SSH client obtains the user's login information; S3.2, the SSH client sends the user's login information to the local SSH agent module based on the SSH agent protocol; S3.3, the SSH agent module calls the cryptographic device by calling the cryptographic device module corresponding to the cryptographic device to sign the user's login information using the private key in the cryptographic device, and returns the signed data to the SSH client; S3.4, the SSH client sends the signature data to the SSH server; S3.5, the SSH server uses the saved public key or digital certificate to verify the signature data. If the verification is successful, the user's login information is authenticated. If the authentication is successful, an SSH connection is established with the SSH client; otherwise, the SSH connection is refused to be established with the SSH client.

7. The SSH identity authentication method supporting universal extensible cryptographic devices according to claim 6, characterized in that: The cryptographic device module in step S3.3 is integrated into the main program of the SSH agent module through static linking, or is dynamically called by the main program of the SSH agent module in the form of a dynamic library.

8. An SSH identity authentication system supporting a universal extensible cryptographic device, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the SSH identity authentication method supporting a universal extensible cryptographic device as claimed in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the SSH identity authentication method supporting a general extensible cryptographic device as claimed in any one of claims 1 to 7 through a processor.

10. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the SSH identity authentication method supporting a general extensible cryptographic device as claimed in any one of claims 1 to 7 through a processor.

Images