Identity authentication offloading method and system based on smart network card

Abstract

The present invention relates to the field of network security, and discloses an identity authentication unloading method based on a smart network card and its system. The method includes: pre-setting a master key in the smart network card; pre-setting a master key in the smart network card; receiving client request data forwarded by the application layer and extracting a service identifier; generating a private key for the corresponding service through the service identifier and the master key; obtaining a local authentication message, signing the local authentication information with a private key, generating a server signature value, and sending the server signature value to the client through the application layer to trigger the client authentication process; receiving client certificate data forwarded by the application layer and extracting the certificate signature value; verifying the certificate signature value with a preset certificate authority public key and generating a verification result, and outputting feedback information based on the verification result. The present invention implements the hardware-level unloading function of the identity authentication process through a smart network card, solving the problems of high computational overhead and poor scalability of traditional TLS two-way authentication.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to an identity authentication offloading method based on a smart network card and a system thereof. Background Art

[0002] With the development of cloud computing and microservice architecture, the frequency of internal communication in data centers has increased. Security protocols such as TLS, QUIC, and IPSec are usually used to achieve encrypted transmission and identity authentication. However, the two-way authentication in the traditional TLS handshake process in a multi-service concurrent environment puts a lot of pressure on the host CPU resources, accounting for 60% to 78% of the handshake delay, limiting the scalability and response efficiency of the microservice system. Although the industry has proposed methods to offload part of the encryption or handshake process to SmartNIC (smart network card), existing solutions mostly focus on message encryption / decryption, lack support for heterogeneous computing loads, and have not made detailed design for the use of SmartNIC (smart network card) resources. Therefore, there is an urgent need for a scalable, efficient, and modular authentication offload solution to improve data center communication performance.

[0003] Therefore, the existing technology still needs to be improved and developed. Summary of the Invention

[0004] The main purpose of this invention is to realize the hardware-level offloading function of the identity authentication process through the smart network card, so as to solve the problems of high computational overhead, high host CPU resource usage and poor scalability of traditional TLS two-way authentication in multi-service concurrent scenarios in data centers.

[0005] The first aspect of the present invention provides an identity authentication unloading method based on a smart network card, comprising: pre-setting a master key in the smart network card; when executing a server-side authentication process, receiving client request data forwarded by an application layer, and extracting a service identifier of the client request data; generating a private key for the corresponding service through the service identifier and the master key; obtaining a local authentication message, signing the local authentication information with the private key, generating a server-side signature value, and sending the server-side signature value to the client through the application layer to trigger the client authentication process; when executing the client authentication process, receiving client certificate data forwarded by the application layer, and extracting a certificate signature value of the client certificate data; verifying the certificate signature value using a preset certificate authority public key and generating a verification result, and outputting feedback information based on the verification result.

[0006] Optionally, in a first implementation method of the first aspect of the present invention, in the step of pre-setting a master key in the smart network card, the master key is stored in a secure storage module of the smart network card, and the secure storage module is a tamper-proof non-volatile memory built into the smart network card.

[0007] Optionally, in a second implementation method of the first aspect of the present invention, client request data forwarded by the application layer is received; traffic classification is performed on the client request data, non-authentication type messages in the client request data are filtered out, and target client request data is generated; the target client request data is parsed according to preset protocol parsing rules, and a service identifier is extracted from the target client request data.

[0008] Optionally, in a third implementation of the first aspect of the present invention, a key derivation mechanism is used to associate the service identifier with the master key to generate an intermediate key corresponding to the service identifier; based on the intermediate key, combined with a random factor generated by the built-in security module of the smart network card, a private key corresponding to the service identifier is generated.

[0009] Optionally, in a fourth implementation method of the first aspect of the present invention, a pre-stored authentication credential is obtained from the security storage module of the smart network card; a hash calculation is performed on the authentication credential to generate local authentication information to be signed; the local authentication information to be signed is signed using the private key to generate a server signature value, and the server signature value is sent to the client through the application layer to trigger the client certificate verification process.

[0010] Optionally, in a fifth implementation of the first aspect of the present invention, client certificate data forwarded by the application layer is received; traffic classification is performed on the client certificate data, non-certificate type messages in the client certificate data are filtered, and target client certificate data is generated; the target client certificate data is parsed according to preset certificate format rules, and a certificate signature value is extracted from the target client certificate data.

[0011] Optionally, in a sixth implementation method of the first aspect of the present invention, a preset certificate authority public key is called from the security storage module of the smart network card; the certificate signature value is decrypted using the preset certificate authority public key to obtain the original hash value, and the certificate content of the client certificate data is hashed to obtain the current hash value; the original hash value and the current hash value are compared, and if they are consistent, a verification pass result is generated; if they are inconsistent, a verification failure result is generated.

[0012] Optionally, in a seventh implementation of the first aspect of the present invention, when it is determined based on the verification result that the verification is passed, the certificate legitimacy information is output; when it is determined based on the verification result that the verification is not passed, error warning information is output.

[0013] Optionally, in an eighth implementation manner of the first aspect of the present invention, in a data center scenario with a higher security level, the transmission process of the client request data and the client certificate data is protected in the following manner: the smart network card performs transmission protection on the client request data and the client certificate data through an internally set encryption module, and the transmission protection mechanism includes at least one of the following implementation manners: utilizing the built-in symmetric encryption engine of the smart network card to perform tunnel encapsulation on the client request data and the client certificate data; utilizing the host interacting with the smart network card to perform encryption processing on the client request data and the client certificate data.

[0014] The second aspect of the present invention provides an identity authentication unloading system based on a smart network card, comprising: a setting module for pre-setting a master key in the smart network card; a traffic management module for receiving client request data forwarded by the application layer, and receiving client certificate data forwarded by the application layer; an information extraction module for extracting the service identifier of the client request data, and extracting the certificate signature value of the client certificate data; a private key derivation module for generating a private key for the corresponding service through the service identifier and the master key; a public key acceleration module for obtaining a local authentication message, signing the local authentication information with the private key, generating a server signature value, and verifying the certificate signature value with a preset certificate authority public key and generating a verification result; an output module for sending the server signature value to the client through the application layer to trigger the client authentication process, and outputting feedback information based on the verification result.

[0015] Beneficial effect: In the technical solution of the present invention, the master key is first pre-stored in the smart network card. When the client request arrives, the server authentication process is executed. The smart network card extracts the service identifier from the application layer data, combines the master key to generate the private key of the corresponding service, completes the server signature and triggers the client authentication; when executing the client authentication process, the client certificate data is received, and the certificate signature is verified using the preset CA public key, and the verification result is finally fed back to the application layer. In this process, the smart network card independently completes key operations such as key derivation, signature generation and verification without the participation of the host CPU. On the one hand, the present invention improves authentication efficiency through hardware acceleration and reduces processing delays when multiple services are concurrent in the data center; on the other hand, it decouples the authentication logic from the host and reduces system resource usage. At the same time, it enhances security through hierarchical key management, avoids the risks brought by frequent reading and writing of private keys, and improves the scalability and reliability of the overall system. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A first flow chart of the identity authentication offloading method based on a smart network card provided in an embodiment of the present invention;

[0017] Figure 2 A first flow chart of the identity authentication offloading method based on a smart network card provided in an embodiment of the present invention;

[0018] Figure 3 A second flow chart of the identity authentication offloading method based on a smart network card provided in an embodiment of the present invention;

[0019] Figure 4 A third flow chart of the identity authentication offloading method based on a smart network card provided in an embodiment of the present invention;

[0020] Figure 5 A fourth flow chart of the identity authentication offloading method based on a smart network card provided in an embodiment of the present invention;

[0021] Figure 6 A fifth flow chart of the identity authentication offloading method based on a smart network card provided in an embodiment of the present invention;

[0022] Figure 7 A sixth flow chart of the identity authentication offloading method based on a smart network card provided in an embodiment of the present invention;

[0023] Figure 8 A seventh flow chart of the identity authentication offloading method based on a smart network card provided in an embodiment of the present invention;

[0024] Figure 9 An eighth flow chart of the identity authentication offloading method based on a smart network card provided in an embodiment of the present invention;

[0025] Figure 10 This is a structural diagram of the identity authentication offload system based on the smart network card provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0026] An embodiment of the present invention provides an identity authentication offloading method based on a smart network card. The identity authentication offloading method based on a smart network card significantly improves system performance and security by offloading the TLS two-way authentication process to the smart network card. First, the master key is pre-stored in the smart network card. When the client request arrives, the server authentication process is executed. The smart network card extracts the service identifier from the application layer data, combines the master key to generate the private key of the corresponding service, completes the server signature and triggers the client authentication; when executing the client authentication process, the client certificate data is received, and the certificate signature is verified using the preset CA public key, and finally the verification result is fed back to the application layer. The present invention solves the problems of high computational overhead, high host CPU resource usage and poor scalability of traditional TLS two-way authentication in multi-service concurrent scenarios in data centers. The hardware-level offloading and key hierarchical management of the identity authentication process are realized through the smart network card, thereby improving communication efficiency and reducing system load.

[0027] The terms "first," "second," "third," "fourth," and so on (if any) in the description and claims of the present invention and in the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that shown or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus that includes a series of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, product, or apparatus.

[0028] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 The first embodiment of the identity authentication offloading method based on the smart network card in the embodiment of the present invention includes:

[0029] S100: pre-setting a master key in the smart network card;

[0030] In this embodiment, a master key is pre-set in the security storage module of the smart network card. The security storage module is a tamper-proof non-volatile memory built into the smart network card, which is used to ensure the secure storage of the master key. As an example: when the smart network card leaves the factory, a master key with a length of 256 bits is stored in the security storage module through a dedicated burning tool. The master key is used for subsequent key derivation operations.

[0031] S200, when executing the server authentication process, receiving client request data forwarded by the application layer, and extracting the service identifier of the client request data;

[0032] In this embodiment, when executing the server-side authentication process, the smart network card receives the client request data forwarded by the application layer, classifies the data, filters out non-authentication type messages, generates target authentication request data, and then extracts the service identifier from it according to the preset protocol parsing rules; as an example: when the client sends a ClientHello message of the TLS protocol, the application layer forwards the message to the smart network card, and the smart network card identifies the protocol type field in the message as an authentication request, filters out the non-authentication data transmitted at the same time, and parses the service identifier from the message, such as "payment service-001".

[0033] S300, generating a private key for the corresponding service using the service identifier and the master key;

[0034] In this embodiment, the service identifier and the master key are associated with each other using a key derivation mechanism to generate an intermediate key corresponding to the service identifier; based on the intermediate key, a private key corresponding to the service identifier is generated in combination with a random factor generated by the built-in security module of the smart network card; as an example: the service identifier "Financial Transaction Service-012" is associated with the master key through a key derivation mechanism to generate an intermediate key, and then combined with the random factor generated by the built-in security module, a 256-bit service-specific private key is generated through an elliptic curve algorithm, and the private key is stored in the secure storage area of ​​the smart network card.

[0035] S400: Obtain a local authentication message, sign the local authentication message using the private key to generate a server-side signature value, and send the server-side signature value to the client through the application layer to trigger a client authentication process;

[0036] In this embodiment, a pre-stored authentication credential is obtained from the security storage module of the smart network card, a hash calculation is performed on the authentication credential to generate local authentication information to be signed, the private key is used to sign the credential to generate a server signature value, and the server signature value is sent to the client through the application layer to trigger the client authentication process; as an example: the server's X.509 certificate is obtained from the security storage module as the authentication credential, the certificate content is hashed using the SHA-256 algorithm to obtain a 256-bit hash value, and the hash value is ECDSA signed with the generated service private key to generate a server signature value, which is encapsulated into the TLS CertVerify message through the application layer and sent to the client, triggering the client to return the certificate for authentication.

[0037] S500, when executing the client authentication process, receiving the client certificate data forwarded by the application layer, and extracting the certificate signature value of the client certificate data;

[0038] In this embodiment, when executing the client authentication process, the client certificate data forwarded by the application layer is received, the data is classified, non-certificate type messages are filtered out, target certificate verification data is generated, and the certificate signature value is extracted from it according to the preset certificate format rules; as an example: when the client returns a TLS message containing an X.509 certificate, the application layer forwards the message to the smart network card. After the smart network card filters out other data in the message, it parses the certificate signature value according to the X.509 certificate format. The signature value is the signature result of the certificate authority using its private key to sign the certificate content.

[0039] S600: Use a preset public key of a certificate authority to verify the certificate signature value and generate a verification result, and output feedback information based on the verification result.

[0040] In this embodiment, the preset certificate authority public key is called from the security storage module of the smart network card, the certificate signature value is decrypted using the public key to obtain the original hash value, and the certificate content in the certificate verification data is hashed to obtain the current hash value. The two are compared, and if they are consistent, a verification pass result is generated, otherwise a verification failure result is generated, and feedback information is output based on the verification result; as an example: the stored certificate authority RSA2048-bit public key is called, the certificate signature value is decrypted to obtain the original SHA-256 hash value, and the client certificate content is hashed to obtain the current hash value. If the two are consistent, the "certificate is legal" information is output, otherwise an error alarm information is output and the connection is terminated.

[0041] This embodiment provides a Smart NIC-based authentication offload method. By pre-storing a master key in the Smart NIC, when a client request arrives, the Smart NIC extracts the service identifier from the application layer data, combines it with the master key to generate the corresponding service's private key, completes the server-side signature, and triggers client authentication. During the client authentication process, the Smart NIC receives the client certificate data, verifies the certificate signature using the preset CA public key, and ultimately feeds the verification result back to the application layer. This method addresses the high computational overhead, high host CPU resource usage, and poor scalability of traditional TLS two-way authentication in data center scenarios with multiple concurrent services.

[0042] See also Figure 2 A second embodiment of the identity authentication offloading method based on a smart network card in the embodiment of the present invention includes:

[0043] S110. In the step of pre-setting a master key in the smart network card, the master key is stored in a secure storage module of the smart network card, and the secure storage module is a tamper-proof non-volatile memory built into the smart network card.

[0044] In this embodiment, a master key is pre-set in the security storage module of the smart network card. The security storage module is a tamper-proof non-volatile memory built into the smart network card, which is used to ensure the secure storage of the master key. As an example: when the smart network card leaves the factory, a master key with a length of 256 bits is stored in the security storage module through a dedicated burning tool. The master key is used for subsequent key derivation operations.

[0045] See also Figure 3 A third embodiment of the identity authentication offloading method based on a smart network card in the embodiment of the present invention includes:

[0046] S210, receiving client request data forwarded by the application layer;

[0047] S220: Classify the client request data by traffic classification, filter non-authentication type messages in the client request data, and generate target client request data;

[0048] S230: Parse the target client request data according to a preset protocol parsing rule, and extract a service identifier from the target client request data.

[0049] In this embodiment, when receiving client request data forwarded by the application layer and extracting the service identifier, the data is first classified into traffic categories, non-authentication messages are filtered to generate target data, and then the service identifier is parsed according to the protocol rules. As an example: when the application layer forwards the ClientHello message of the TLS protocol, the smart network card identifies the protocol type field in the message, such as the protocol type field with a value of 0x16, and confirms it as an authentication request. The client request data may contain authentication-related messages such as TLS handshake messages and non-authentication HTTP data. After filtering out the HTTP data transmitted at the same time, the service identifier "Online Payment Service-003" is parsed from the extension field in the message to avoid interference from irrelevant data such as HTTP and improve authentication efficiency. In addition, filtering non-authentication data can reduce the processing load of the smart network card, allowing it to focus on core operations such as key derivation and signing.

[0050] See also Figure 4 The fourth embodiment of the identity authentication offloading method based on the smart network card in the embodiment of the present invention includes:

[0051] S310: Utilize a key derivation mechanism to associate the service identifier with the master key to generate an intermediate key corresponding to the service identifier;

[0052] S320: Generate a private key corresponding to the service identifier based on the intermediate key and a random factor generated by the built-in security module of the smart network card.

[0053] In this embodiment, when generating the private key corresponding to the service using the service identifier and the master key, the two are first associated using a key derivation mechanism to generate an intermediate key, and then the private key is generated by combining the random factor of the built-in security module. As an example: the service identifier "Financial Transfer Service-015" and the master key are processed through a key derivation function to generate an intermediate key, and then combined with the true random number seed generated by the built-in hardware security module (HSM) of the smart network card, a 256-bit service-specific private key is generated using an elliptic curve algorithm and stored in the secure storage area of ​​the smart network card.

[0054] See also Figure 5 The fifth embodiment of the identity authentication offloading method based on the smart network card in the embodiment of the present invention includes:

[0055] S410: Obtain pre-stored authentication credentials from the secure storage module of the smart network card;

[0056] S420: Perform hash calculation on the authentication credential to generate local authentication information to be signed;

[0057] S430: Sign the local authentication information to be signed using the private key to generate a server signature value, and send the server signature value to the client through the application layer to trigger the client certificate verification process.

[0058] In this embodiment, a pre-stored authentication credential, such as the server's X.509 digital certificate, is first read from the secure storage module of the smart network card. A hash calculation is then performed on the authentication credential, such as using the SHA-256 algorithm to generate a 256-bit hash value, which serves as the local authentication information to be signed. The hash value is then signed using the service-specific private key previously generated using the service identifier and the master key, such as using the Elliptic Curve Digital Signature Algorithm (ECDSA) to generate a server-side signature value. Finally, the signature value is encapsulated into a CertVerify message of the TLS protocol through the application layer and sent to the client to trigger the client certificate verification process. For example, the server's X.509 certificate is read from the secure storage module as the authentication credential, the certificate content is hashed using the SHA-256 algorithm to obtain a 256-bit hash value, and then the ECDSA signature is performed using the service private key to generate a server-side signature value. This signature value is then encapsulated into a CertVerify message of the TLS protocol and sent through the application layer, triggering the client certificate verification process.

[0059] See also Figure 6 The sixth embodiment of the identity authentication offloading method based on the smart network card in the embodiment of the present invention includes:

[0060] S510, receiving client certificate data forwarded by the application layer;

[0061] S520: Classify the client certificate data, filter non-certificate type messages in the client certificate data, and generate target client certificate data;

[0062] S530: Parse the target client certificate data according to a preset certificate format rule, and extract a certificate signature value from the target client certificate data.

[0063] In this embodiment, the application layer first receives a message containing a client certificate, such as a Certificate message of the TLS protocol, and then classifies the message traffic. By identifying the message type field, such as a TLS record type value of 0x0B indicating a certificate message, non-certificate data such as HTTP response packets are filtered out to generate target certificate data. Finally, according to the X.509 certificate format rules, the certificate signature value is extracted from the signature algorithm and signature value fields at the end of the certificate, such as the byte string after the RSA signature. As an example: When the application layer forwards a TLS message containing a client X.509 certificate, the smart network card filters out the handshake data in the message, parses it according to the X.509 certificate format, and extracts the certificate signature value from the signature algorithm field. This value is the result of the certificate authority signing the certificate content with its private key.

[0064] See also Figure 7 The seventh embodiment of the identity authentication offloading method based on the smart network card in the embodiment of the present invention includes:

[0065] S610: Retrieve a preset public key of a certificate authority from the secure storage module of the smart network card;

[0066] S620: Decrypt the certificate signature value using a preset public key of the certificate issuing authority to obtain an original hash value, and perform hash calculation on the certificate content of the client certificate data to obtain a current hash value;

[0067] S630: Compare the original hash value and the current hash value. If they are consistent, generate a verification pass result; if they are inconsistent, generate a verification fail result.

[0068] In this embodiment, the pre-stored CA public key, such as an RSA 2048-bit public key, is first called from the smart network card security storage module. The certificate signature value is then decrypted using the public key to obtain the original hash value, such as a SHA-256 hash result. Simultaneously, a SHA-256 hash calculation is performed on the client certificate content in the client certificate data to obtain the current hash value. Finally, the two hash values ​​are compared. If they are consistent, a verification pass result is generated; otherwise, a verification failure result is generated. As an example: the stored RSA 2048-bit CA public key is called, the certificate signature value is decrypted to obtain the original SHA-256 hash value, and the client certificate content is hashed to obtain the current hash value. If the two are consistent, a verification pass result is generated; otherwise, a verification failure result is generated.

[0069] See also Figure 8 The eighth embodiment of the identity authentication offloading method based on the smart network card in the embodiment of the present invention includes:

[0070] S640: When the verification is determined to be successful based on the verification result, output certificate validity information;

[0071] S650: When it is determined based on the verification result that the verification fails, output an error warning message.

[0072] In this embodiment, if the verification result is passed, the Smart NIC outputs a plaintext "Certificate Valid" message or a status code such as 0x00 to the application layer. If the verification result is failed, an alarm message containing an error type, such as "Certificate Signature Invalid" or a status code such as 0x01, is output, and a disconnect instruction is triggered. As an example: After verification is passed, the Smart NIC returns a "Certificate Verification Successful" status message to the host application layer through the interface. If verification fails, an alarm containing the "INVALID_SIGNATURE" error code is generated, and the TLS handshake process is terminated.

[0073] See also Figure 9 The ninth embodiment of the identity authentication offloading method based on the smart network card in the embodiment of the present invention includes:

[0074] S700: The smart network card performs transmission protection on the client request data and the client certificate data through an internal encryption module, wherein the transmission protection mechanism includes at least one of the following implementation methods:

[0075] S800: Use the built-in symmetric encryption engine of the smart network card to tunnel encapsulate the client request data and the client certificate data;

[0076] S900: Utilize a host interacting with the smart network card to encrypt the client request data and the client certificate data.

[0077] In this embodiment, in a data center scenario with a higher security level, when the client request data and client certificate data are tunnel-encapsulated using the built-in symmetric encryption engine of the smart network card, the specific process is as follows: after the smart network card completes the service identifier extraction or the certificate signature value extraction, it calls the built-in AES-256 symmetric encryption engine and adds an ESP (Encapsulating Security Payload) header at the IP layer (network layer). The ESP header contains a security parameter index (SPI) and a serial number associated with the service identifier, which are used to identify the encryption key and data sequence. Subsequently, the original data such as the server signature value and the client certificate data are encrypted, and then encapsulated through the GRE (Generic Routing Encapsulation) tunnel to form a new IP data packet for transmission to prevent plaintext leakage.

[0078] The above describes the identity authentication offloading method based on the smart network card in the embodiment of the present invention. The following describes the identity authentication offloading system based on the smart network card in the embodiment of the present invention. Figure 10 In one embodiment of the present invention, an identity authentication offloading system based on a smart network card includes:

[0079] A setting module 10, configured to pre-set a master key in the smart network card;

[0080] Traffic management module 20, configured to receive client request data forwarded by the application layer, and receive client certificate data forwarded by the application layer;

[0081] An information extraction module 30 is configured to extract a service identifier from the client request data and a certificate signature value from the client certificate data;

[0082] A private key derivation module 40, configured to generate a private key corresponding to a service using the service identifier and the master key;

[0083] The public key acceleration module 50 is used to obtain a local authentication message, sign the local authentication message using the private key to generate a server-side signature value, and verify the certificate signature value using a preset certificate authority public key and generate a verification result;

[0084] The output module 60 is configured to send the server signature value to the client through the application layer to trigger the client authentication process, and output feedback information based on the verification result.

[0085] In this embodiment, a master key is pre-set in a security storage module of the smart network card through a setting module 10 (not shown in the figure), and the security storage module is a tamper-proof non-volatile memory built into the smart network card; when executing the server-side authentication process, the client request data forwarded by the application layer is received through the traffic management module 20; the client request data is traffic-classified through the information extraction module 30, non-authentication type messages are filtered out, target authentication request data is generated, and then a service identifier is extracted from it according to a preset protocol parsing rule; the service identifier is associated with the master key by using a key derivation mechanism through the private key derivation module 40 to generate an intermediate key corresponding to the service identifier; based on the intermediate key, combined with a random factor generated by the built-in security module of the smart network card, a private key corresponding to the service identifier is generated; the pre-stored authentication credential is obtained from the security storage module of the smart network card through the public key acceleration module 50, and the authentication credential is hashed to generate a signature to be signed The server-side signature value is generated by signing the local authentication information of the name with a private key. The output module 60 sends the server-side signature value to the client through the application layer to trigger the client authentication process. When executing the client authentication process, the client certificate data forwarded by the application layer is received by the traffic management module 20. The information extraction module 30 classifies the client certificate data, filters out non-certificate type messages, generates target certificate verification data, and then extracts the certificate signature value from it according to the preset certificate format rules. The public key acceleration module 50 calls the preset certificate authority public key from the secure storage module of the smart network card, uses the public key to decrypt the certificate signature value to obtain the original hash value, and hashes the certificate content in the certificate verification data to obtain the current hash value. The two are compared and, if they are consistent, a verification pass result is generated; otherwise, a verification fail result is generated, and feedback information is output based on the verification result. The output module 60 outputs feedback information based on the verification result. This embodiment solves the problems of high computational overhead, high host CPU resource usage, and poor scalability of traditional TLS two-way authentication in multi-service concurrent scenarios in data centers. The smart network card is used to implement hardware-level offload and key hierarchical management of the identity authentication process, thereby improving communication efficiency and reducing system load.

[0086] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions described in the above embodiments can still be modified, or some of the technical features thereof can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identity authentication offloading based on a smart network card, characterized in that: The identity authentication offloading method based on the smart network card includes: Presetting a master key in the smart network card; When executing the server authentication process, receiving the client request data forwarded by the application layer and extracting the service identifier of the client request data; Generate a private key for the corresponding service using the service identifier and the master key; Obtain local authentication information, sign the local authentication information using the private key to generate a server-side signature value, and send the server-side signature value to the client through the application layer to trigger the client authentication process; When executing the client authentication process, receiving the client certificate data forwarded by the application layer and extracting the certificate signature value of the client certificate data; The certificate signature value is verified using a preset certificate authority public key to generate a verification result, and feedback information is output based on the verification result.

2. The identity authentication offloading method based on smart network card according to claim 1, characterized in that: In the step of pre-setting the master key in the smart network card, the master key is stored in a secure storage module of the smart network card, and the secure storage module is a tamper-proof non-volatile memory built into the smart network card.

3. The identity authentication offloading method based on smart network card according to claim 1, characterized in that: The step of receiving the client request data forwarded by the application layer and extracting the service identifier of the client request data includes: Receive client request data forwarded by the application layer; Performing traffic classification on the client request data, filtering non-authentication type messages in the client request data, and generating target client request data; The target client request data is parsed according to a preset protocol parsing rule, and a service identifier is extracted from the target client request data.

4. The identity authentication offloading method based on smart network card according to claim 1, characterized in that: The step of generating a private key corresponding to the service using the service identifier and the master key includes: Using a key derivation mechanism, the service identifier is associated with the master key to generate an intermediate key corresponding to the service identifier; Based on the intermediate key and in combination with a random factor generated by the built-in security module of the smart network card, a private key corresponding to the service identifier is generated.

5. The identity authentication offloading method based on smart network card according to claim 1, characterized in that: The steps of obtaining a local authentication message, signing the local authentication information using the private key, generating a server signature value, and sending the server signature value to the client through the application layer to trigger the client authentication process include: Obtaining pre-stored authentication credentials from the secure storage module of the smart network card; Performing hash calculation on the authentication credential to generate local authentication information to be signed; The private key is used to sign the local authentication information to be signed to generate a server signature value, which is sent to the client through the application layer to trigger the client certificate verification process.

6. The identity authentication offloading method based on smart network card according to claim 1, characterized in that: The step of receiving the client certificate data forwarded by the application layer and extracting the certificate signature value of the client certificate data includes: Receive client certificate data forwarded by the application layer; Performing traffic classification on the client certificate data, filtering non-certificate type messages in the client certificate data, and generating target client certificate data; The target client certificate data is parsed according to a preset certificate format rule, and a certificate signature value is extracted from the target client certificate data.

7. The identity authentication offloading method based on smart network card according to claim 1, characterized in that: The step of verifying the certificate signature value using a preset certificate authority public key and generating a verification result includes: Retrieving a preset public key of a certificate authority from a secure storage module of the smart network card; Decrypting the certificate signature value using a preset certificate authority public key to obtain an original hash value, and performing a hash calculation on the certificate content of the client certificate data to obtain a current hash value; The original hash value is compared with the current hash value. If they are consistent, a verification pass result is generated; if they are inconsistent, a verification fail result is generated.

8. The identity authentication offloading method based on smart network card according to claim 1, characterized in that: The step of outputting feedback information based on the verification result includes: When the verification is determined to be successful based on the verification result, outputting the certificate validity information; When it is determined based on the verification result that the verification fails, an error warning message is output.

9. The identity authentication offloading method based on smart network card according to claim 1, characterized in that: In a higher security data center scenario, the transmission of the client request data and client certificate data is protected in the following ways: The smart network card uses an internal encryption module to protect the transmission of the client request data and the client certificate data. The transmission protection mechanism includes at least one of the following implementation methods: Using the built-in symmetric encryption engine of the smart network card, tunnel encapsulates the client request data and the client certificate data; The client request data and the client certificate data are encrypted using a host interacting with the smart network card.

10. An identity authentication offloading system based on a smart network card, characterized in that: The identity authentication offloading system based on the smart network card includes: A setting module, configured to pre-set a master key in the smart network card; The traffic management module is used to receive client request data forwarded by the application layer and receive client certificate data forwarded by the application layer; An information extraction module, configured to extract a service identifier from the client request data and a certificate signature value from the client certificate data; A private key derivation module, configured to generate a private key corresponding to a service using the service identifier and the master key; A public key acceleration module, configured to obtain local authentication information, sign the local authentication information using the private key, generate a server-side signature value, and verify the certificate signature value using a preset certificate authority public key and generate a verification result; The output module is used to send the server signature value to the client through the application layer to trigger the client authentication process, and output feedback information based on the verification result.

Images