A browser remote secure access method

Abstract

The invention discloses a browser remote secure access method, comprising: constructing a software CSP module, the software CSP module is used to provide a session-level temporary certificate for the browser to implement TLS with client verification, and the private key corresponding to the temporary certificate is saved in the system memory; establishing a client system service as a management program of the software CSP module, which is used to operate the relevant private interface of the software CSP module; and when the user accesses the browser, the client system service starts with the operating system, and completes the TLS / SSL two-way authentication by calling the relevant private interface of the software CSP module through the client system service. The invention is more convenient, safer, more efficient and easier to use.

Description

Technical Field

[0001] The present invention relates to the technical field of browser remote access security, and in particular to a browser remote security access method for remotely accessing https services by using a two-way authenticated security channel. Background Art

[0002] For browsers to access two-way authenticated https servers, client certificates (SSL certificates) lack a relatively easy-to-use and secure usage environment. Currently, there are several ways to use certificates:

[0003] 1. See Figure 1 , the certificate and private key are placed in traditional hardware media (such as USBKEY), and the hardware media provides secure storage of private keys and cryptographic operations. The advantage is good security, but the disadvantage is that USBKEY is not easy to carry, the medium has low computing efficiency, and the insertion and removal of hardware media can easily cause computer jams;

[0004] 2. See Figure 2 Before using the soft certificate in PFX format, you need to import the PFX into the system certificate library, and the private key is stored in the system's software CSP (Cryptographic Service Provider) key storage. The disadvantage is that the security is not high, the PFX file is easy to be copied, and the PIN code protecting the private key is easy to be cracked by brute force, which makes the private key easy to leak;

[0005] 3. See Figure 3 , a soft media module using collaborative signature technology, part of the certificate and private key is stored in the encrypted file of the soft media module. When accessing the https server, the certificate is used by forwarding the browser traffic to the local security agent. The disadvantage is that the browser cannot be used directly, and a special client must be installed. The security agent is easily intercepted by terminal security software or conflicts with the network agent of other applications. And because collaborative signature is required over the network when establishing a secure connection, the performance is lower than the above two methods.

[0006] Due to the above shortcomings, the current browser remote security access solution mainly uses a one-way https + login ticket method, such as Figure 4 However, this solution has the risk of cookies being hijacked and identities being forged.

[0007] Therefore, the applicant has found a solution to the above-mentioned problem through beneficial exploration and research, and the technical solution to be introduced below is produced in this context. Summary of the invention

[0008] The technical problem to be solved by the present invention is: to provide a browser remote security access method in view of the deficiencies of the prior art, so as to solve the problem that it is difficult to achieve both security and ease of use when using a browser certificate, as well as the problems of session cookie hijacking and identity spoofing.

[0009] The technical problem to be solved by the present invention can be achieved by adopting the following technical solutions:

[0010] A browser remote secure access method, comprising:

[0011] Construct a software CSP module, wherein the software CSP module is used to provide a session-level temporary certificate to the browser to implement TLS with client authentication, and the private key corresponding to the temporary certificate is saved in the system memory;

[0012] Establishing a client system service as a management program of the software CSP module to operate the relevant private interfaces of the software CSP module; and

[0013] When the user accesses the website through a browser, the client system service starts up along with the operating system and completes TLS / SSL two-way authentication by calling the relevant private interface of the software CSP module through the client system service.

[0014] In a preferred embodiment of the present invention, the method of completing TLS / SSL two-way authentication by calling the relevant private interface of the software CSP module through the client system service includes:

[0015] The client system service calls the software CSP module's interface acquisition method to acquire the private interface;

[0016] Call the authentication method of the private interface through the client system service to implement the management program authentication of the software CSP module;

[0017] The application process information that can call the software CSP module is added to the software CSP module by calling the method of adding the authorized process of the private interface through the client system service;

[0018] The client system service calls the private interface's issuance method to publish the session certificate to the memory container of the software CSP module;

[0019] The session certificate in the memory container is installed into the operating system by calling the installation certificate method of the private interface through the client system service;

[0020] When a user accesses a two-way authenticated https website, select the operating system's session certificate in the pop-up certificate selection box and enter the protection password for the private key corresponding to the access certificate; and

[0021] The browser loads the software CSP module through cryptoAPI based on the information of the session certificate. The software CSP module verifies the browser process. If the verification passes, it returns a virtual CSP handle. The browser uses the data and algorithms of the software CSP module to perform cryptographic operations in the memory container based on the virtual CSP handle to complete TLS / SSL two-way authentication.

[0022] In a preferred embodiment of the present invention, the software CSP module includes:

[0023] kvcsp-shell module, which is used to provide a standard interface for the software CSP module so that the software CSP module can be called by the application using the cryptoAPI interface;

[0024] kvcsp-core module, which is used to customize the processing logic of the standard interface exposed by the kvcsp-shell module;

[0025] kvcsp-reg module, the kvcsp-reg module is used to provide a COM registration interface called by RegSrv32.exe to register the software CSP module to the registry of the system CSP module;

[0026] The certEnrool module is used to implement the certification method of the private interface;

[0027] memDevice module, which is used to provide the kvcsp-core module with various data structures that support its core capabilities and the ability to share data across processes;

[0028] The cipherHelper module is used to provide various cryptographic operations capabilities to the kvcsp-core module;

[0029] The toolHelper module is used to provide tool method support to each module in the software CSP module.

[0030] In a preferred embodiment of the present invention, the software CSP module provides a private management interface.

[0031] In a preferred embodiment of the present invention, after the client system service is established, the software CSP module is registered in the operating system using the regsvr32 command.

[0032] In a preferred embodiment of the present invention, when the client system service is used for the first time, a collaborative signature module is used to issue a collaborative signature certificate to the client system service, which serves as a credential for the client system service to call the session certificate issuance interface in the future.

[0033] In a preferred implementation of the present invention, when the system is shut down, the uninstall certificate method of the private interface is called through the client system service to uninstall the session certificate installed in the operating system.

[0034] Due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0035] 1. The present invention is more convenient than hardware media. It provides a private certificate issuance interface, supports applications to quickly issue certificates, install certificates, and uninstall certificates. Applications (including browsers) can directly use certificates and keys in KVCSP using standard interfaces.

[0036] 2. The present invention is more secure than PFX and the CSP that comes with the operating system. It generates and uses keys in memory, and the keys are "not on the ground". Compared with the traditional CSP soft library persistent keys and PFX files, the security is better;

[0037] 3. The present invention is more efficient than hardware media and collaborative signature module operations. It is more efficient than CSP and collaborative signature module operations based on hardware media, operates completely locally, has higher performance than collaborative signature cryptographic operations, and will not experience frequent freezes like USBKEY drivers.

[0038] 4. The present invention is more secure and easier to use than the one-way https+login ticket method, and it is difficult for the identity to be forged. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 This is a flowchart of the existing use of hardware media (USBKEY) to access the HTTPS server.

[0041] Figure 2 This is the existing flowchart for using a PFX soft certificate to access an HTTPS server.

[0042] Figure 3 It is a flowchart of the existing collaborative signature technology for accessing the HTTPS server.

[0043] Figure 4 This is a flowchart of the existing method of using https+login ticket to access the HTTPS server.

[0044] Figure 5 It is a flow chart of the browser remote secure access method of the present invention.

[0045] Figure 6 It is a flow chart of the present invention for completing TLS / SSL two-way authentication by calling the relevant private interface of the software CSP module through the client system service.

[0046] Figure 7 It is a schematic diagram of the structure of the software CSP module (KVCSP) of the present invention. DETAILED DESCRIPTION

[0047] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the present invention is further explained below with reference to specific diagrams.

[0048] See also Figure 5 , the figure shows a browser remote secure access method, including the following steps:

[0049] Step S10, construct a software CSP module (hereinafter referred to as KVCSP), which is used to provide a session-level temporary certificate for the browser to implement TLS with client verification (mTLS). The private key corresponding to the temporary certificate is saved in the system memory, and the private key is "not on the ground", reducing the risk of private key leakage. The session information in the cookie is replaced with a temporary certificate to prevent the possibility of identity counterfeiting through cookie hijacking.

[0050] Step S20, establish a client system service (abbreviated as KVCSP-Srv) as the management program of the software CSP module, which is used to operate the relevant private interfaces of the software CSP module. The client system service monitors the startup and shutdown of the operating system, initializes KVCSP when the operating system starts, and issues and installs session certificates. When the operating system is shut down, the installed certificate will be uninstalled and the container related to the certificate will be released. After the client system service is established, use the regsvr32 command to register the software CSP module with the operating system. At the same time, in order to ensure the security of KVCSP when issuing session certificates, KVCSP-Srv uses a collaborative signature cryptographic module (optional) when it is used for the first time to issue a collaborative signature certificate to KVCSP-Srv as the credential for KVCSP-Srv to call the session certificate issuance interface in the future.

[0051] Step S30, when the user accesses the browser, the client system service starts with the operating system, and completes the TLS / SSL two-way authentication by calling the relevant private interface of the software CSP module through the client system service. The key "does not land" during the entire secure channel establishment process, and no additional network requests are required.

[0052] In step S30, see Figure 6 , through the client system service calling the relevant private interface of the software CSP module to complete TLS / SSL two-way authentication, including the following steps:

[0053] Step S31, the client system service calls the software CSP module's interface acquisition method (GetDCSPInterface method) to acquire the private interface (DCSPInterface interface).

[0054] Step S32, calling the authentication method (Auth method) of the private interface through the client system service to implement the management program authentication of the software CSP module.

[0055] Step S33, the client system service calls the private interface (DCSPInterface interface) to add the authorized process method (addProcess method) to add the application process information (chrome.exe) that can call the software CSP module to the software CSP module. If there is no process added through this interface, the software CSP module cannot be called.

[0056] Step S34, the client system service calls the issuing method (issueCert method) of the private interface (DCSPInterface interface) to publish the session certificate to the memory container.

[0057] Step S35, the client system service calls the installation certificate method (installCert method) of the private interface (DCSPInterface interface) to install the session certificate in the memory container into the operating system.

[0058] Step S36, when the user visits a two-way authenticated https website, select the session certificate of the operating system in the certificate selection box that pops up, and enter the protection password (PIN code) of the private key corresponding to the access certificate.

[0059] Step S37: The browser loads the software CSP module through cryptoAPI according to the information of the session certificate. The software CSP module verifies the browser process. If the verification passes, it returns the virtual CSP handle. The browser uses the data and algorithm of the software CSP module to perform cryptographic operations in the memory container according to the virtual CSP handle to complete the TLS / SSL two-way authentication. The key does not "fall to the ground" during the establishment process of the entire secure channel, and no additional network requests are required.

[0060] Step S38, when the system is shut down, the uninstall certificate method (uninstallCert method) of the private interface (DCSPInterface interface) is called through the client system service to uninstall the session certificate installed in the operating system.

[0061] In step S10, see Figure 7 ,The software CSP modules include kvcsp-shell module, kvcsp-core module, kvcsp-reg module, certEnrool module, memDevice module, cipherHelper module and toolHelper module.

[0062] The kvcsp-shell module is used to provide a standard interface for the software CSP module so that the software CSP module can be called by the application using the cryptoAPI interface.

[0063] The kvcsp-core module is used to customize the processing logic of the standard interface exposed by the kvcsp-shell module to realize the core capabilities of KVCSP. For the non-core cryptographic computing capabilities of KVCSP, they can be forwarded to the default CSP module of the operating system for processing in this module.

[0064] The kvcsp-reg module is used to provide a COM registration interface called by RegSrv32.exe to register the software CSP module to the registry of the system CSP module.

[0065] The certEnrool module is used to implement the issuance method of the private interface. First, the cipherHelper module is called to generate a key pair. Then, the key protection key is calculated through the PIN code and key derivation algorithm passed in by the issuance method. The key protection password is used to encrypt the key pair, and the encrypted key pair is saved in the virtual container of memDevice. Then, the certificate request data is generated, the external network issuance interface is called for issuance, and the returned certificate and the container information in the software CSP module are registered in the system certificate library.

[0066] The memDevice module is used to provide the kvcsp-core module with various data structures (such as data structures of virtual key containers, keys, hash objects, etc.) that support its core capabilities, as well as the ability to share data across processes. The structures of the core objects HCRYPTPROV, HCRYPTHASH, and HCRYPTKEY in CSP do not need to be shared across processes, and data management is only required within a single process. For container data and process data that can use KVCSP, cross-process sharing is performed using shared memory. Each time the module is called for the first time, a symmetric key (such as AES256) is generated based on a key derivation algorithm using a random number as a key factor, and the data is encrypted and decrypted in the two operations of reading and writing shared memory to ensure that the data in the shared memory is encrypted data. The memDevice object in each process will increase the reference count when the process enters, and decrease the reference count when the process exits. When the reference count is zero, memDevice will clean up the memory data, including the data in the shared memory, and automatically uninstall all certificates installed to the system through KVCSP.

[0067] The cipherHelper module is used to provide the kvcsp-core module with various cryptographic operations. Before each cryptographic operation, the symmetric key for the container data is calculated, the key data in the shared memory is decrypted, and then the cryptographic operation is performed. After the cryptographic operation is completed, the key data in the memory is cleared.

[0068] The toolHelper module is used to provide tool method support to each module in the software CSP module.

[0069] Each module in the software CSP module is a logical module, which can be implemented in the form of multiple dynamic libraries in actual implementation.

[0070] In addition to providing the standard interface of CSP, the software CSP module also provides a private management interface. In order to protect the real interface method definition, the explicit interface method has only one method to obtain the interface object. This method can hide the private method of KVCSP, making it unclear to the attacker about the definition of the interface and thus unable to call the interface method. At the same time, the authentication method is defined in the DCSPInterface interface. The management interface can call other private methods only after authentication, which further ensures the security of interface access. The pseudo code of the DCSPInterface interface method is as follows:

[0071] METHOD BOOLEAN GetDCSPInterface(INTEGER VERSION,DCSPInterface dcsp);

[0072] (1) The pseudo code definition of the DCSPInterface interface is as follows:

[0073] INTERFACE DCSPInterface=

[0074] {

[0075] METHOD STRING getVersion();

[0076] METHOD BOOLEAN Auth(INTEGER authType,BYTEARRY authData);

[0077] METHOD BOOLEAN addProcess(STRING name);

[0078] METHOD BOOLEAN issueCert(STRING conName, CERTREQ csr);

[0079] METHOD BOOLEAN installCert(STRING conName, CERTTYPE certType);

[0080] METHOD BOOLEAN unInstallCert(STRING conName, CERTTYPE certType);

[0081] }

[0082] (2) Method description:

[0083] 1) Get version number: Return the version number of KVCSP.

[0084] METHOD STRING getVersion();

[0085] 2) Management program authentication: Management program authentication. If the management program authentication fails, the program cannot call other private interfaces of KVCSP (except getVersion).

[0086] METHOD BOOLEAN Auth(INTEGER authType,BYTEARRY authData);

[0087] authType refers to the authentication type. The authentication type can be extended, such as code signing certificate authentication, which means that the KVCSP and the management program are signed by the same code signing certificate (which can be considered to be issued by the same manufacturer).

[0088] authData refers to the authentication credentials. Depending on the authType, enter the authentication data of the response.

[0089] 3) Adding a process: When loading KVCSP, the process added through this interface will check whether the process has the permission to load KVCSP. If the process is not added by the hypervisor, or the code signing certificate verification fails, KVCSP cannot be called, and the API provided by the system to load dynamic libraries will return failure.

[0090] METHOD BOOLEAN addProcess(STRING name);

[0091] Name refers to the name of the process that needs to call KVCSP. For example, if it is the Chrome browser, just add "chrome.exe".

[0092] 4) Issue certificate: Issue the certificate to the container.

[0093] METHOD BOOLEAN issueCert(STRING conName,STRING pinCode,CERTREQ csr);

[0094] conName refers to the container name, which cannot be repeated. The certificate and key are encrypted and stored in the container, and the data in the container can be used across processes.

[0095] pinCode is the protection password of the container, which is used to protect the private key in the memory virtual container.

[0096] CSR is a composite data structure, which refers to the relevant data required for certificate issuance, such as certificate type, certificate CN, certificate extensions, session certificate life cycle, and network callback method data for issuing certificates. This data structure can be expanded according to actual needs.

[0097] 5) Install the certificate: Install the certificate issued by the certificate issuance method into the operating system certificate library.

[0098] METHOD BOOLEAN installCert(STRING conName,CERTTYPE certType);

[0099] conName refers to the container name, provided that the issueCert method has issued a certificate to the container.

[0100] certType refers to the certificate type, such as signing certificate, encryption certificate, etc.

[0101] 6) Uninstall certificate: Uninstall the certificate installed in the operating system certificate library.

[0102] METHOD BOOLEAN unInstallCert(STRING conName,CERTTYPE type);

[0103] conName refers to the container name, provided that the issueCert method has issued a certificate to the container.

[0104] certType refers to the certificate type, such as signature certificate, encryption certificate, etc.

[0105] The interface methods in the present invention are all pseudo codes, and the method names, method parameter names, parameters, etc. can be modified according to the implementation without affecting the logical structure design and problem-solving effect of the invention.

[0106] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A browser remote secure access method, characterized in that: include: Construct a software CSP module, wherein the software CSP module is used to provide a session-level temporary certificate to the browser to implement TLS with client authentication, and the private key corresponding to the temporary certificate is saved in the system memory; Establish a client system service as a management program of the software CSP module to operate the relevant private interfaces of the software CSP module; as well as When the user accesses the website through a browser, the client system service starts up along with the operating system and completes TLS / SSL two-way authentication by calling the relevant private interface of the software CSP module through the client system service.

2. The browser remote secure access method according to claim 1, characterized in that: The client system service calls the relevant private interface of the software CSP module to complete the TLS / SSL two-way authentication, including: The client system service calls the software CSP module's interface acquisition method to acquire the private interface; Call the authentication method of the private interface through the client system service to implement the management program authentication of the software CSP module; The application process information that can call the software CSP module is added to the software CSP module by calling the method of adding the authorized process of the private interface through the client system service; The client system service calls the private interface's issuance method to publish the session certificate to the memory container of the software CSP module; The session certificate in the memory container is installed into the operating system by calling the installation certificate method of the private interface through the client system service; When a user accesses a two-way authenticated https website, select the operating system's session certificate in the pop-up certificate selection box and enter the protection password for the private key corresponding to the access certificate; and The browser loads the software CSP module through cryptoAPI based on the information of the session certificate. The software CSP module verifies the browser process. If the verification passes, it returns a virtual CSP handle. The browser uses the data and algorithms of the software CSP module to perform cryptographic operations in the memory container based on the virtual CSP handle to complete TLS / SSL two-way authentication.

3. The browser remote secure access method according to claim 1, characterized in that: The software CSP module includes: kvcsp-shell module, which is used to provide a standard interface for the software CSP module so that the software CSP module can be called by the application using the cryptoAPI interface; kvcsp-core module, which is used to customize the processing logic of the standard interface exposed by the kvcsp-shell module; kvcsp-reg module, the kvcsp-reg module is used to provide a COM registration interface called by RegSrv32.exe to register the software CSP module to the registry of the system CSP module; The certEnrool module is used to implement the certification method of the private interface; memDevice module, which is used to provide the kvcsp-core module with various data structures that support its core capabilities and the ability to share data across processes; The cipherHelper module is used to provide various cryptographic operations capabilities to the kvcsp-core module; The toolHelper module is used to provide tool method support to each module in the software CSP module.

4. The browser remote secure access method according to claim 3, characterized in that: The software CSP module provides a private management interface.

5. The browser remote secure access method according to claim 2, characterized in that: After the client system service is established, use the regsvr32 command to register the software CSP module in the operating system.

6. The browser remote secure access method according to claim 5, characterized in that: When the client system service is used for the first time, a collaborative signature module is used to issue a collaborative signature certificate to the client system service, which serves as the credential for the client system service to call the session certificate issuance interface in the future.

7. The browser remote secure access method according to any one of claims 2 to 6, characterized in that: When the system is shut down, the uninstall certificate method of the private interface is called through the client system service to uninstall the session certificate installed in the operating system.

Images