Security authentication method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a security authentication method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: receiving a key generation request sent by target equipment; if it is determined that the key generation request is legal, generating a trust identifier and a security certificate of the target device, obtaining an identifier verification request through the trust identifier, and sending the identifier verification request to an authentication server, so that the authentication server verifies the trust identifier to obtain an access token corresponding to the target device; receiving a message returned by the authentication server, and processing an access token carried by the message to obtain a trust identifier; and writing the security certificate into the target protection area, and sending the trust identifier and the security certificate to the target equipment, so that the target equipment is registered in the authentication server. By adopting the method, the identity verification of the equipment and the control of an encryption communication mechanism are realized, and the safety protection performance in a communication system is further improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a security authentication method and device, a computer device, a computer readable storage medium and a computer program product. BACKGROUND

[0002] RoCE (RDMA over Converged Ethernet) is a high-performance network protocol that allows computers to directly access remote memory (Remote Direct Memory Access, RDMA), which can greatly improve data transmission efficiency. However, the RoCE protocol relies on IP (Internet Protocol) or Ethernet to complete data transmission for communication, and the directly transmitted RDMA traffic itself is vulnerable to eavesdropping or tampering. In addition, the RoCE protocol only relies on QP (Queue Pair) to establish a communication connection, and the authentication link is relatively weak, and attackers can initiate a man-in-the-middle attack by forging MAC (Media Access Control) addresses or IP addresses. Therefore, there is a lack of security protection in the RDMA network, resulting in poor data security. SUMMARY

[0003] Therefore, it is necessary to provide a security authentication method, device, computer device, computer readable storage medium and computer program product that can improve the security of the system and the security of the communication.

[0004] In a first aspect, the present application provides a security authentication method applied to a first device, the method comprising:

[0005] receiving a key generation request sent by a target device;

[0006] if it is determined that the key generation request is legal, generating a trust identifier and a security certificate of the target device, and obtaining an identifier verification request through the trust identifier, and sending the identifier verification request to an authentication server, so that the authentication server verifies the trust identifier to obtain an access token corresponding to the target device;

[0007] receiving a message returned by the authentication server, processing the access token carried by the message to obtain a trust identifier, writing the security certificate into a target protection area, and sending the trust identifier and the security certificate to the target device, so that the target device is registered with the authentication server.

[0008] In one of the embodiments, the first device is a trusted device; the key generation request comprises an identity, a public key and a signature of the target device; and the generating the trust identity of the target device if it is determined that the key generation request is legal comprises:

[0009] decrypting the key generation request to obtain the identity, the public key and the signature of the target device; and obtaining the trust identity of the target device based on the master key of the trusted device, the identity of the target device and random data if it is determined that the key generation request is legal based on the public key of the target device and the signature.

[0010] In one of the embodiments, the message further carries a session key; the processing the access token carried by the message to obtain the trust identity; and the writing the security certificate into the target protection area and sending the trust identity and the security certificate to the target device comprises:

[0011] decrypting the access token carried by the message to obtain the trust identity, the session key and the access right of the target device;

[0012] obtaining security context information based on the session key; writing the security certificate into the target protection area through a write operation of a target communication protocol, and sending the trust identity and the security certificate to the target device through a communication message of the target communication protocol.

[0013] In one of the embodiments, the key generation request, the identity verification request and the message are all communication messages transmitted through a target communication protocol, and the trust identity is written into a reserved field in the communication message of the target communication protocol.

[0014] In a second aspect, the application provides a security authentication method applied to an authentication server, which comprises:

[0015] receiving an identity verification request sent by a first device, the identity verification request carrying a trust identity of a target device, the trust identity being generated by the first device based on a key generation request sent by the target device;

[0016] verifying the trust identity to obtain an access token corresponding to the target device, and returning a message to the first device, the message at least carrying the access token, the access token being used by the first device to obtain the trust identity and send the trust identity and a security certificate to the target device;

[0017] receiving a registration request sent by the target device based on the trust identity, and returning a registration response message.

[0018] In one of the embodiments, the verifying the trust identifier to obtain the access token corresponding to the target device comprises:

[0019] The source device of the trust identifier is verified to be trusted, and in a case where it is determined that the source device is trusted, it is judged based on a local database whether the trust identifier is available;

[0020] If the trust identifier is available, a session key corresponding to the target device and an access token are generated, the access token comprising the trust identifier, the session key and the access permission in an encrypted form, or the access token comprising the trust identifier, the session key and the access permission in a plaintext form.

[0021] In one of the embodiments, the receiving the registration request sent by the target device based on the trust identifier and returning a registration response message comprises:

[0022] The registration request sent by the target device is received, the registration request comprising an access token with a timestamp and a device identifier;

[0023] The validity and timeliness of the signature of the access token are verified, and in a case where a target condition is met, record data is created and a registration response message is returned to the target device, the registration response message comprising registration status data and a timestamp; the record data comprising a mapping relationship between the trust identifier and the device identifier in the access token, a hash value of the session key and a valid time, and the record data is used for synchronization between multiple servers.

[0024] In a third aspect, the application provides a secure authentication method applied to a target device, the method comprising:

[0025] A key generation request is sent to a first device, so that the first device generates a trust identifier and a security certificate of the target device in a case where it is determined that the key generation request is legal, and an identifier verification request is obtained through the trust identifier, and an access token corresponding to the target device is obtained through an authentication server;

[0026] The trust identifier and the security certificate returned by the first device are received, and the authentication server is registered based on the trust identifier and the security certificate, the trust identifier being returned by the authentication server to the first device.

[0027] In one of the embodiments, the method further comprises:

[0028] sending a data access request to a second device, the data access request comprising a trust identifier, the second device being a device storing data, the second device being configured to verify the target device based on the recorded data and return a data access response message to the target device after verification;

[0029] receiving a data response message returned by the second device, the data response message carrying data corresponding to the data access request.

[0030] In a fourth aspect, the present application further provides a security authentication apparatus applied to a first device, comprising:

[0031] a first receiving module configured to receive a key generation request sent by a target device;

[0032] a first determining module configured to generate a trust identifier and a security certificate of the target device if it is determined that the key generation request is legal, and to obtain an identifier verification request through the trust identifier and send the identifier verification request to an authentication server so that the authentication server verifies the trust identifier and obtains an access token corresponding to the target device;

[0033] a second receiving module configured to receive a message returned by the authentication server, process the access token carried by the message to obtain a trust identifier, write the security certificate into a target protection area, and send the trust identifier and the security certificate to the target device so that the target device is registered with the authentication server.

[0034] In a fifth aspect, the present application further provides a security authentication apparatus applied to an authentication server, comprising:

[0035] a third receiving module configured to receive an identifier verification request sent by a first device, the identifier verification request carrying a trust identifier of a target device, the trust identifier being generated by the first device based on a key generation request sent by the target device;

[0036] a first verifying module configured to verify the trust identifier to obtain an access token corresponding to the target device, and return a message to the first device, the message at least carrying the access token, the access token being used by the first device to obtain a trust identifier and send the trust identifier and a security certificate to the target device;

[0037] a fourth receiving module configured to receive a registration request sent by the target device based on the trust identifier and return a registration response message.

[0038] In a sixth aspect, the present application further provides a security authentication apparatus applied to a target device, comprising:

[0039] a first sending module, configured to send a key generation request to a first device, so that the first device generates a trust identifier and a security certificate of the target device if the key generation request is determined to be legal, and obtains an identification verification request through the trust identifier, and obtains an access token corresponding to the target device through an authentication server;

[0040] a fifth receiving module, configured to receive the trust identifier and the security certificate returned by the first device, and register in the authentication server based on the trust identifier and the security certificate, the trust identifier being returned by the authentication server to the first device.

[0041] In a seventh aspect, the present application further provides a computer device, comprising a memory and a processor, the memory stores a computer program, and the processor realizes the following steps when executing the computer program:

[0042] receiving a key generation request sent by a target device;

[0043] if the key generation request is determined to be legal, generating a trust identifier and a security certificate of the target device, obtaining an identification verification request through the trust identifier, and sending the identification verification request to an authentication server, so that the authentication server verifies the trust identifier and obtains an access token corresponding to the target device;

[0044] receiving a message returned by the authentication server, processing the access token carried by the message to obtain a trust identifier, writing the security certificate into a target protection area, and sending the trust identifier and the security certificate to the target device, so that the target device registers in the authentication server.

[0045] In an eighth aspect, the present application further provides a computer readable storage medium, which stores a computer program, and the computer program realizes the following steps when executed by a processor:

[0046] receiving a key generation request sent by a target device;

[0047] if the key generation request is determined to be legal, generating a trust identifier and a security certificate of the target device, obtaining an identification verification request through the trust identifier, and sending the identification verification request to an authentication server, so that the authentication server verifies the trust identifier and obtains an access token corresponding to the target device;

[0048] receive a message returned by the authentication server, process the access token carried by the message to obtain a trust identifier, write the security certificate into a target protection area, and send the trust identifier and the security certificate to the target device to enable the target device to register with the authentication server.

[0049] In a ninth aspect, the present application also provides a computer program product comprising a computer program which, when executed by a processor, implements the following steps:

[0050] receiving a key generation request sent by a target device;

[0051] if it is determined that the key generation request is legitimate, generating a trust identifier and a security certificate of the target device, and obtaining an identity verification request through the trust identifier and sending the identity verification request to an authentication server to enable the authentication server to verify the trust identifier and obtain an access token corresponding to the target device;

[0052] receiving a message returned by the authentication server, processing the access token carried by the message to obtain a trust identifier, writing the security certificate into a target protection area, and sending the trust identifier and the security certificate to the target device to enable the target device to register with the authentication server.

[0053] The above-mentioned security authentication method, device, computer device, computer readable storage medium and computer program product, wherein the method comprises: receiving a key generation request sent by a target device; if it is determined that the key generation request is legitimate, generating a trust identifier and a security certificate of the target device, and obtaining an identity verification request through the trust identifier and sending the identity verification request to an authentication server to enable the authentication server to verify the trust identifier and obtain an access token corresponding to the target device; receiving a message returned by the authentication server, processing the access token carried by the message to obtain a trust identifier, writing the security certificate into a target protection area, and sending the trust identifier and the security certificate to the target device to enable the target device to register with the authentication server. By adopting the method, a complete and secure device authentication and registration process is realized, the security of message transmission between different devices is ensured through a key and a signature, the identity verification of the device and the control of the encrypted communication mechanism of the device are realized through the authentication and authorization registration mechanism of the device, and the security protection performance in the communication system is further improved, thereby providing reliable security protection for communication in a high-performance computing environment. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the following will briefly introduce the drawings needed to be used in the description of the embodiments of the present application or the related art. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 An application environment diagram of the security authentication method in one embodiment;

[0056] Figure 2 A flowchart of the security authentication method in one embodiment;

[0057] Figure 3 A flowchart of the security authentication method in another embodiment;

[0058] Figure 4 A flowchart of the security authentication method in another embodiment;

[0059] Figure 5 A flowchart of the data access step of the security authentication method in one embodiment;

[0060] Figure 6 A schematic diagram of a communication architecture to which the security authentication method in one embodiment is applied;

[0061] Figure 7 A structure diagram of a message of a target communication protocol in the security authentication method in one embodiment;

[0062] Figure 8 A signaling diagram of the security authentication method in another embodiment;

[0063] Figure 9 A structure block diagram of the security authentication device in one embodiment;

[0064] Figure 10 A structure block diagram of the security authentication device in one embodiment;

[0065] Figure 11 A structure block diagram of the security authentication device in one embodiment;

[0066] Figure 12 An internal structure diagram of the computer device in one embodiment. DETAILED DESCRIPTION

[0067] In order to make the objects, technical solutions and advantages of the present application clearer, the following will further describe the present application with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not used to limit the present application.

[0068] It should be noted that the terms "first", "second", etc. used in the present application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "include" and "have" and any variations thereof used in the present application are intended to cover non-exclusive inclusion. The term "a plurality of" used in the present application refers to two or more. The term "and / or" used in the present application refers to one of the options or any combination of the options.

[0069] The security authentication method provided by the embodiments of the present application can be applied to the application environment as shown in Figure 1 The target device 100, the first device 200, and the authentication server 300 communicate with each other. The target device communicates with the first device through a network, and can also communicate with the authentication server through the network. The first device can communicate with the authentication server through the network. The target device can be a network device or a terminal device, i.e., a network node or a terminal device node. The first device can be a secure trusted device or a secure trusted anchor point. The secure trusted device refers to a device that has passed a security authentication process, such as a trusted device that has passed a security authentication process of the authentication server. The authentication server can be an authentication and authorization server, which is used to verify, register, and record trust identifiers. The terminal device can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, unmanned aerial vehicles, low-altitude aircraft, Internet of Things devices, and portable wearable devices. The Internet of Things device can be a smart speaker, a smart television, a smart air conditioner, a smart vehicle device, a projection device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The head-mounted device can be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server can be a standalone physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0070] In an exemplary embodiment, as shown in Figure 2 A security authentication method is provided. The method is applied to the first device in Figure 1 For example, the method includes the following steps.

[0071] In step 202, a key generation request sent by a target device is received.

[0072] The target device can be a device that accesses the communication system for the first time, and can be a terminal device or a network device, and can be determined based on a specific device type that accesses the communication system for the first time. For example, the target device can be a terminal node or a network node. The key generation request can be a communication message / control message sent by the target device to the first device through a target communication protocol. The first device can be a device that is secure and trusted with respect to the communication system, and can be referred to as a secure and trusted anchor point. The first device can be a secure and trusted terminal node or a network node, and the like. The device that is secure and trusted with respect to the communication system can be a device that has passed a security authentication process of the communication system and is registered in the communication system.

[0073] For example, when the target device accesses the communication system for the first time, the target device can generate a key generation request, and send the key generation request in the form of a communication message of the target communication protocol to the first device based on the target communication protocol. In this way, the first device can receive the communication message of the target communication protocol, which can be the key generation request sent by the target device.

[0074] Optionally, the target communication protocol can be a ROCE protocol.

[0075] In step 204, if it is determined that the key generation request is legal, a trust identifier and a security certificate of the target device are generated, and an identifier verification request is obtained through the trust identifier, and the identifier verification request is sent to an authentication server to enable the authentication server to verify the trust identifier and obtain an access token corresponding to the target device.

[0076] For example, after receiving the key generation request, the first device can decrypt the key generation request to obtain the public key and the signature information of the target device, and can verify the validity of the public key and the signature information. If the public key and the signature information are valid, it is determined that the key generation request is legal. In a case where it is determined that the public key and the signature information are legal, the first device can generate a security certificate and a trust identifier of the target device based on a master key of the first device, a device identifier of the target device, and a random number. In this way, the first device can encapsulate the trust identifier and the security certificate of the target device into a communication message of the target communication protocol to obtain an identifier verification request, and send the identifier verification request to an authentication server of the communication system. In this way, the authentication server can verify the trust identifier in the identifier verification request, and generate an access token corresponding to the target device after determining that the identifier verification request is verified. The authentication server can return a message carrying the access token to the first device.

[0077] In step 206, a message returned by the authentication server is received, the access token carried in the message is processed, and the trust identifier is obtained. The security certificate is written into the target protection area, and the trust identifier and the security certificate are sent to the target device to enable the target device to register with the authentication server.

[0078] The message returned by the authentication server can be a message of a target communication protocol, and the access token corresponding to the target device is carried in the message. The data contained in the access token can be plaintext data or encrypted data. The access token contains the trust identifier, the session key, and the permission data. The permission data can be the access permission level of the target device, or can be data describing the access permission of the target device.

[0079] The target protection area is a protected area in which data is stored.

[0080] Exemplarily, the first device can receive a message returned by the authentication server, unpack the message to obtain data carried in the message, and the data can contain an access token. In this way, the first device can write a security certificate into a target protection area, and return a trust identifier and the security certificate to the target device. The target device can register with the authentication server based on the received trust identifier.

[0081] In the above security authentication method, a key generation request sent by a target device is received. If it is determined that the key generation request is legal, a trust identifier and a security certificate of the target device are generated, an identifier verification request is obtained based on the trust identifier, and the identifier verification request is sent to an authentication server to enable the authentication server to verify the trust identifier and obtain an access token corresponding to the target device. A message returned by the authentication server is received, the access token carried in the message is processed, and the trust identifier is obtained. The security certificate is written into the target protection area, and the trust identifier and the security certificate are sent to the target device to enable the target device to register with the authentication server. By using the method, in an exemplary embodiment, the first device is a trusted device. The key generation request includes an identifier corresponding to the target device, a public key, and a signature. Specifically, the trusted device can be a communication device / terminal node / network node / trusted anchor point, etc. that has passed the security authentication of the communication system. The identifier corresponding to the target device can be a device identifier IMEI, or a device name, etc. The public key can be a public key in a non-symmetric key pair generated by a hardware security module in the target device. The signature can be a random signature of the target device.

[0082] Correspondingly, the specific implementation process of the step "if it is determined that the key generation request is legal, generating a trust identifier of the target device" can include:

[0083] The key generation request is decrypted to obtain the identity, public key and signature of the target device. If the key generation request is determined to be legal based on the public key and signature of the target device, the trust identity of the target device is obtained based on the master key of the trusted device, the identity of the target device and random data.

[0084] The master key of the trusted device can be a private key randomly determined by the trusted device within a key data range. The key data range can be a data range pre-configured for the trusted device. The master key of the trusted device can be a master key of a trusted anchor point. The random data can be a random number generated by the first device.

[0085] For example, after receiving the key generation request sent by the target device, the first device verifies the legality of the key generation request, decrypts the key generation request to obtain the identity, public key and random signature of the target device. The first device judges the legality of the random signature and public key of the target device. If the random signature and public key of the target device are determined to be legal, the key generation request is determined to be valid. Thus, the first device can generate a corresponding trust identity for the target device based on the master key of the first device, the identity of the target device and the randomly generated random number.

[0086] Optionally, the legality verification process can include: the first device can determine whether the signature authority of the public key is a trusted authority. If it is determined that the signature authority is a trusted authority, the public key is determined to be legal. The first device can decrypt the random signature through the public key to obtain a decryption result, and judge whether the decryption result is consistent with the hash value of the original random signature. If they are consistent, the signature is determined to be legal. If both the public key and the random signature are legal, it can be determined that the key generation request is legal.

[0087] In one example, the first device generates an identity verification request based on the trust identity and the private key of the first device, and sends the identity verification request to the authentication server. After receiving the identity verification request, the authentication server can verify whether the source device of the identity verification request is a trusted device. If the source device is determined to be trusted, the authentication server determines whether the trust identity is available based on a local database. If the trust identity is available, the authentication server generates a session key corresponding to the target device and an access token. The access token includes an encrypted trust identity, a session key and an access permission, or the access token includes a trust identity in plaintext form, a session key and an access permission. In this way, the authentication server can return a message containing the access token and the session key to the first device.

[0088] In this embodiment, the trust identity is generated after the legality of the request is verified, which can ensure the security and trustworthiness of the node for generating the trust identity in the secure authentication process, and further improve the authenticity of the identity.

[0089] In an exemplary embodiment, the message also carries a session key. The specific implementation process of the step "processing the access token carried by the message to obtain a trust identifier, writing the security certificate to the target protection area, and sending the trust identifier and the security certificate to the target device" can include:

[0090] Decrypting the access token carried by the message to obtain the trust identifier corresponding to the target device, the session key, and the access permission. Based on the session key, the security context information is obtained. The security certificate is written to the target protection area through the write operation of the target communication protocol, and the trust identifier and the security certificate are sent to the target device through the communication message of the target communication protocol.

[0091] Among them, the access token contains the trust identifier, the session key and the access permission.

[0092] Exemplarily, the first device performs decapsulation processing on the message to obtain the access token carried in the message, and performs decryption processing on the access token to obtain the trust identifier, the session key and the access permission carried in the access token; the first device can construct complete security context information based on the session key, and write the security certificate to the target protection area based on the write operation of the RDMA communication protocol, wherein the target protection area can be a protected memory area pre-registered by the target device; the first device can issue the trust identifier and the security certificate of the target device to the target device through the communication message of the RDMA communication protocol.

[0093] In this embodiment, the trust identifier is securely authenticated by the authentication server, further improving the security level of the device.

[0094] In an exemplary embodiment, the key generation request, the identifier verification request, and the message are all communication messages transmitted through the target communication protocol, and the trust identifier is written to the reserved field in the communication message of the target communication protocol.

[0095] Exemplarily, when transmitting the trust identifier between the first device, the target device and the authentication server through the communication message of the target communication protocol, the trust identifier can be written to the reserved field in the communication message of the RDMA.

[0096] In an exemplary embodiment, as shown in Figure 3 , a secure authentication method is provided, which is applied to the authentication server in Figure 1 for example, and includes:

[0097] Step 302, receiving the identifier verification request sent by the first device.

[0098] The identification verification request carries a trust identification of the target device, and the trust identification is generated by the first device based on a key generation request sent by the target device.

[0099] The target device sends a key generation request to the first device. If the first device determines that the key generation request is legal, the first device generates a trust identification and a security certificate of the target device, generates an identification verification request based on the trust identification, and sends the identification verification request to the authentication server.

[0100] In step 304, the trust identification is verified, an access token corresponding to the target device is obtained, and a message is returned to the first device.

[0101] The message carries at least the access token, and the access token is used by the first device to obtain the trust identification and send the trust identification and the security certificate to the target device.

[0102] The authentication server can verify the trust identification in the identification verification request after receiving the identification verification request sent by the first device, and generate an access token corresponding to the target device after determining that the identification verification request is verified. The authentication server can return a message carrying the access token to the first device.

[0103] In step 306, a registration request sent by the target device based on the trust identification is received, and a registration response message is returned.

[0104] The target device can generate a registration request based on the trust identification and the access token before accessing the target protection area, and send the registration request to the authentication server. The authentication server can verify the validity and timeliness of the access token in the registration request, and return a registration response message corresponding to the registration request to the target device after verification, the registration response message carrying registration status data and a timestamp.

[0105] In this embodiment, a complete and secure device authentication and registration process is implemented. The security of message transmission between different devices is ensured through keys and signatures. The identity verification of the device and the control of the encryption communication mechanism are realized through the authentication and authorization registration mechanism of the device, which further improves the security protection performance in the communication system and provides reliable security protection for communication in a high-performance computing environment.

[0106] In an exemplary embodiment, the specific implementation process of the step "verifying the trust identification to obtain an access token corresponding to the target device" can include:

[0107] The source device of the trust identification is verified for trustworthiness. If the source device is determined to be trustworthy, it is determined whether the trust identification is available based on a local database. If the trust identification is available, a session key and an access token corresponding to the target device are generated.

[0108] The access token includes the encrypted trust identifier, the session key, and the access permission, or the access token includes the trust identifier, the session key, and the access permission in plaintext.

[0109] Exemplarily, after receiving the identifier verification request, the authentication server can verify whether the source device of the identifier verification request is a trusted device, and determine that the source device is trusted. Then, the authentication server can determine whether the trust identifier is available based on a local database. If the trust identifier is available, the authentication server can generate a session key corresponding to the target device and an access token. The access token includes the encrypted trust identifier, the session key, and the access permission, or the access token includes the trust identifier, the session key, and the access permission in plaintext. In this way, the authentication server can return a message including the access token and the session key to the first device.

[0110] In the embodiment, the security of the generated trust identifier is further improved through the trusted verification path of the device and the available verification process of the identifier.

[0111] In an exemplary embodiment, the specific implementation process of the step of "receiving a registration request sent by the target device based on the trust identifier, and returning a registration response message" can include:

[0112] The registration request sent by the target device includes the access token with a timestamp and a device identifier. The validity and timeliness of the signature of the access token are verified. If the target conditions are met, record data is created, and a registration response message is returned to the target device.

[0113] The registration response message includes registration status data and a timestamp. The record data includes the mapping relationship between the trust identifier and the device identifier in the access token, the hash value of the session key, and the valid time. The record data is used for synchronization between multiple servers.

[0114] Exemplarily, the authentication server can receive a registration request sent by the target device, and the registration request can be a communication message encapsulated by the target communication protocol. The authentication server first decapsulates the registration request to obtain an access token with a timestamp and a device identifier. The authentication server can verify whether the signature of the access token is valid, and whether the timestamp of the current access token is within the effective time. The target condition can be that the authentication server determines that the signature of the access token is valid, and the timestamp is within the effective time range, so that the server can create record data locally, which includes the mapping relationship between the trust identifier and the device identifier, the hash value of the session key, and the effective time. The effective time can be the latest active time of the trust identifier. The authentication server can create record data in the distributed directory service, and the update of the distributed directory service is realized by atomic operation. After the creation is completed, the synchronization of the record data in multiple servers can be realized. In this way, the authentication server can return a registration response message to the target device, and the registration response message includes a registration status code and a timestamp for clock synchronization.

[0115] In an exemplary embodiment, as shown in Figure 4 a secure authentication method is provided. The method is applied to a target device in Figure 1 , and an example is described, which includes:

[0116] Step 402, sending a key generation request to the first device, so that the first device generates a trust identifier and a security certificate of the target device under the condition that the key generation request is determined to be legal, and obtains an identifier verification request through the trust identifier and an access token corresponding to the target device through the authentication server.

[0117] Exemplarily, the target device sends a communication message / control message to the first device through the target communication protocol; the first device can be a device that is secure and trusted for the communication system, which can be referred to as a secure and trusted anchor point. The first device can also be a secure and trusted terminal node or a network node, etc. The device that is secure and trusted for the communication system can be a device that has passed the security authentication process of the communication system and is registered in the communication system.

[0118] Exemplarily, the target device can generate a key generation request when it accesses the communication system for the first time, and send the key generation request in the communication message type of the target communication protocol to the first device based on the target communication protocol. In this way, the first device can receive the communication message of the target communication protocol, which can be the key generation request sent by the target device.

[0119] At step 404, the trust identifier and the security certificate returned by the first device are received, and the authentication server is registered based on the trust identifier and the security certificate. The trust identifier is returned by the authentication server to the first device.

[0120] Exemplarily, the first device can receive the message returned by the authentication server, unpack the message, and obtain the data carried by the message. The data can include an access token. In this way, the first device can write the security certificate into the target protection area, and return the trust identifier and the security certificate to the target device. The target device can register with the authentication server based on the received trust identifier.

[0121] In this embodiment, a complete and secure device authentication and registration process is implemented. The security of message transmission between different devices is ensured by the key and the signature. The identity verification of the device and the control of the encrypted communication mechanism are implemented by the authentication and authorization registration mechanism of the device, and the security protection performance in the communication system is further improved. A reliable security guarantee is provided for the communication in the high-performance computing environment.

[0122] In one exemplary embodiment, as shown in Figure 5 The method further includes:

[0123] At step 502, a data access request is sent to a second device.

[0124] At step 504, a data response message returned by the second device is received.

[0125] The data access request includes a trust identifier, and the data response message carries data corresponding to the data access request. The second device is a device that stores the data. The second device is configured to verify the target device based on the record data, and return a data access response message to the target device after the verification is passed.

[0126] Exemplarily, when the target device needs to access a protected area, the protected area can be set on the second device. The target device can generate a data access request and send the data access request to the second device. The second device can determine the trust identifier corresponding to the device identifier carried in the data access request, and determine the validity of the trust identifier for verification. For example, the validity time corresponding to the trust identifier in the record data is determined based on the current timestamp, and the data access request is determined to be passed when the current timestamp is within the validity time. The data response message carrying the data corresponding to the data access request is returned to the target device.

[0127] In this embodiment, the corresponding data is returned after the data access request is verified, and the security level of the data is further improved.

[0128] The following describes the specific implementation steps of the above security authentication method in combination with a specific embodiment:

[0129] As shown in Figure 6 , which can be a communication architecture diagram of the security authentication method provided by the embodiment, the authentication / authorization service can be implemented, including a RoCEv2 network, a plurality of trust anchor points, and a plurality of devices to be verified. The devices to be verified can achieve security authentication of the devices through interaction with the trust anchor points. If the security authentication is passed, the device to be verified can be updated to a trust anchor point.

[0130] As shown in Figure 7 , which can be a schematic diagram of the RoCEv2 protocol extension format in the embodiment, the upper layer protocol encapsulation layer can include an ETH L2 Header (Ethernet Layer 2 header), an IP Header (network layer), a UDP Header (transport layer), an IBBTH+ L4 Header (InfiniBand four-layer header, BTH is Base Transport Header, which is the core control header of the InfiniBand protocol), a Payload (payload), and an ICRC (internal cyclic redundancy check). The InfiniBand four-layer header can include three layers of 32-bit data; the first layer can be 31-24 bits corresponding to the data, which can be an operation code Opcode, used to define the packet type; 23-16 bits corresponding to the data can be S / M / Pa / Version, i.e., control flag bits, S can be a "start packet" identifier, M can be a "middle packet", Pa is a partition-related, and Version is a protocol version; 15-8 bits and 7-0 bits corresponding to the data can be a partition key.

[0131] The 31-24 bits corresponding to the data of the second layer can be ECN (Explicit Congestion Notification, Explicit Congestion Notification) and a reserved field; the 23-16 bits, 15-8 bits, and 7-0 bits corresponding to the data can be Destination QP (Destination Queue Pair, Destination Queue Pair).

[0132] The 31-24 bits corresponding to the data of the third layer can be an a field and a reserved field; the 23-16 bits, 15-8 bits, and 7-0 bits corresponding to the data can be a packet sequence number. The reserved field can include an operation code opcode, a security parameter index, a sequence number, a trust identifier, and a check / key.

[0133] As Figure 8 shown, it can be a signaling diagram of the security authentication method provided by the embodiment, which includes network / terminal node, secure trusted anchor point and authentication authorization server, and specifically:

[0134] The network / terminal node needs to complete the security authentication process when accessing for the first time. The terminal node sends a key generation request to the secure trusted anchor point through the control message of the ROCE protocol. The request message contains terminal hardware identification, public key part of the asymmetric key pair generated based on the hardware security module, random signature and other information.

[0135] After receiving the request, the secure trusted anchor point first verifies the validity, randomly obtains the terminal public key through decryption and verifies the legality of the signature and other information, confirms the validity of the request, and then the secure trusted anchor point generates a trust ID and a security certificate. The identifier is calculated from the anchor point master key, terminal hardware ID and random number, and is encapsulated into a ROCE protocol message to send an identification verification request (trust ID+key) to the authentication authorization server for verification.

[0136] After receiving the verification request, the authentication authorization server first decapsulates the message, checks whether it comes from a trusted root certificate, then queries whether the ID has been applied in the database, and after verification, the server generates a session key and an access token (TOKEN). The token contains information such as encryptable trust ID, drawing key and permission policy. The server returns its own certificate of the token to the secure trusted anchor point through the ROCE message.

[0137] After obtaining the token, the secure trusted anchor point decrypts and extracts the session key, and constructs complete security context information. The anchor point directly writes the security credentials into the pre-registered memory area of the terminal node through RDMA write operation, realizing zero-copy efficient transmission. The trust ID and security credentials are sent to the network / terminal node through the ROCE protocol message.

[0138] If the network / terminal node has applied for a trust ID, when accessing protected resources, it will encapsulate the trust ID and token into a ROCE request message and send it to the authentication server for registration. The registration request contains a timestamped token signature and hardware information. After receiving the request, the authentication server verifies the validity of the token signature and checks the timeliness, then creates a record in the distributed directory service, stores the mapping relationship between the trust ID and the terminal information, the session key hash value and the last active time. Directory update uses atomic operation to ensure consistency and is synchronized between multiple server nodes. Finally, the server returns the registration status code and the timestamp for clock synchronization, completing the entire authentication process.

[0139] The security authentication method provided by the embodiment is a security encryption method based on ROCE protocol extension, and an end-to-end encryption authentication mechanism is constructed by using a reserved field in a RoCEv2 protocol packet. In the protocol extension framework design, security extension is performed on the transport layer of the standard ROCE protocol stack, and the ROCEv2 adopts the transport layer of IB. The RoCEv2 protocol stack borrows the encapsulation format of UDP, and the connection, retransmission, congestion control and other functions of the transport layer are completed by the IB transport layer. The transport layer of IB adopts a modular flexible design, including a basic BTH (Base Transport Header) and a plurality of extended transport headers. The BTH is part of the header of the IB transport layer, is the basic header of the L4 transport layer, is used for describing the control information of the data packet transmission, and includes the sequence of the verification packet and the identification of the operation type. The BTH has a reserved field, and the security authentication encryption information is marked by using the reserved field. Since the reserved field has only 7 bits, this part is only used for identifying the operation type and the security parameter index identification. The opcode represents the operation code, represents the operation type, requests, registers, activates and the like. The SecurityParameters Index represents the extended security information identification, the number of transport layer extension headers and the like. Then, the security authentication information is identified through the extended transport header. The Sequence Number is used for counting the sent packet, and the sequence number is increased; the trust ID represents the registered / applied trust ID; and the key is used for security encryption integrity check.

[0140] The security authentication method provided by the embodiment constructs a complete security encryption authentication system. By introducing a secure trusted anchor point and an authentication server as two core security roles in the traditional RDMA architecture, the mechanism deeply integrates the hardware-level security module and modern cryptography technology, realizes the all-round security protection from the link layer to the application layer on the basis of maintaining the original high performance characteristics of RoCEv2, and adopts a layered encryption architecture. The terminal node must pass through a strict multi-factor authentication process before communication. The whole process includes key application, identity verification, certificate issuance, token issuance, security registration and the like. The security interaction between the links is performed through the optimized ROCE control packet, the zero-copy transmission, instant data encapsulation and the like are adopted to minimize the delay overhead introduced by the security mechanism. The security mechanism deeply integrated in the RoCEv2 protocol stack effectively solves the defect that the traditional RDMA network lacks native security protection, and provides enterprise-level security protection for RDMA applications in sensitive scenarios.

[0141] By introducing a security trusted anchor and an authentication server dual role system, a complete authentication process including key application, identity verification, certificate issuance, token issuance and security registration is constructed, and the security of each RDMA operation is ensured through dynamic session key rotation and encrypted signed token mechanism. In terms of implementation, a modular extension design of IB transport layer is adopted, and at the same time, zero-copy transmission, instant data encapsulation and other optimization technologies are used to minimize the performance overhead of the security mechanism, so that the system can maintain the high performance characteristics of RDMA while providing end-to-end encryption authentication. This scheme first implements the native security support of the RDMA network at the protocol layer, and effectively solves the long-standing security protection defects of the RDMA network through the collaborative design of protocol field innovation and dual role authentication architecture, providing reliable security protection for high-performance computing applications in sensitive scenarios.

[0142] It should be understood that, although each step in the flowchart involved in each embodiment as described above is shown in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be alternately or alternately executed with at least part of other steps or steps or stages in other steps. It can be understood that the steps in different embodiments can be freely combined as needed, and various non-contradictory schemes formed by the combination are within the scope of protection of the present application.

[0143] Based on the same inventive concept, the embodiments of the present application also provide a security authentication device for implementing the security authentication method as described above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more security authentication device embodiments provided below can refer to the limitations of the security authentication method in the above text, which will not be repeated here.

[0144] In one exemplary embodiment, as shown in Figure 9 applied to a first device, a security authentication device 900 is provided, comprising:

[0145] The first receiving module 902 is configured to receive a key generation request sent by a target device.

[0146] The first determining module 904 is configured to, if it is determined that the key generation request is legal, generate a trust identifier and a security certificate of the target device, obtain an identity verification request through the trust identifier, and send the identity verification request to an authentication server to enable the authentication server to verify the trust identifier and obtain an access token corresponding to the target device.

[0147] The second receiving module 906 is configured to receive a message returned by the authentication server, process the access token carried in the message to obtain a trust identifier, write the security certificate into a target protection area, and send the trust identifier and the security certificate to the target device to enable the target device to register with the authentication server.

[0148] In an exemplary embodiment, as shown in Figure 10 applicable to an authentication server, a secure authentication apparatus 1000 is provided, which comprises:

[0149] The third receiving module 1002 is configured to receive an identity verification request sent by a first device, the identity verification request carrying a trust identifier of a target device, the trust identifier being generated by the first device based on a key generation request sent by the target device.

[0150] The first verifying module 1004 is configured to verify the trust identifier to obtain an access token corresponding to the target device, and return a message to the first device, the message at least carrying the access token, the access token being used by the first device to obtain a trust identifier and send the trust identifier and a security certificate to the target device.

[0151] The fourth receiving module 1006 is configured to receive a registration request sent by the target device based on the trust identifier, and return a registration response message.

[0152] In an exemplary embodiment, as shown in Figure 11 applicable to a target device, a secure authentication apparatus 1100 is provided, which comprises:

[0153] The first sending module 1102 is configured to send a key generation request to a first device to enable the first device to, if it is determined that the key generation request is legal, generate a trust identifier and a security certificate of the target device, obtain an identity verification request through the trust identifier, and obtain an access token corresponding to the target device through an authentication server.

[0154] The fifth receiving module 1104 is configured to receive a trust identifier and a security certificate returned by the first device, and register with the authentication server based on the trust identifier and the security certificate, the trust identifier being returned by the authentication server to the first device.

[0155] The modules in the security authentication apparatus can be implemented by software, hardware, or a combination thereof. The modules can be embedded in or independent of a processor in a computer device in hardware form, or stored in a memory in the computer device in software form, so as to be invoked and executed by the processor to perform operations corresponding to the modules.

[0156] In an exemplary embodiment, a computer device, which can be a server, has an internal structure as shown in Figure 12 The computer device includes a processor, a memory, an input / output interface, and a communication interface. The processor, the memory, and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store security authentication data. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to communicate with terminals outside through a network connection. The computer program is executed by the processor to implement a security authentication method.

[0157] Those skilled in the art can understand that Figure 12 The structure shown in the above embodiment is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0158] In an embodiment, a computer device is also provided, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0159] In an embodiment, a computer readable storage medium is provided, which stores a computer program. The computer program is executed by a processor to implement the steps in the above method embodiments.

[0160] In an embodiment, a computer program product is provided, which includes a computer program. The computer program is executed by a processor to implement the steps in the above method embodiments.

[0161] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.

[0162] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments of each method. In the embodiments provided in the present application, any reference to memory, database or other medium can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., without being limited thereto.

[0163] Any technical features in the above embodiments can be combined, and for the sake of brevity, not all possible combinations are described above, however, any combination of these technical features is deemed to be within the scope of the present application.

[0164] The above embodiments only express several implementation manners of the present application, and the description is relatively specific and detailed, but it should not be understood as a limitation on the patent scope of the present application. It should be pointed out that, for ordinary skilled persons in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A security authentication method characterized by, Applied to a first device, the method comprises: receiving a key generation request sent by a target device; if it is determined that the key generation request is legal, generating a trust identifier and a security certificate of the target device, and obtaining an identity verification request through the trust identifier, and sending the identity verification request to an authentication server to make the authentication server verify the trust identifier to obtain an access token corresponding to the target device; receiving a message returned by the authentication server, processing the access token carried in the message to obtain a trust identifier, writing the security certificate into a target protection area, and sending the trust identifier and the security certificate to the target device to make the target device register with the authentication server.

2. The method of claim 1, wherein, The first device is a trusted device; the key generation request comprises an identifier, a public key and a signature corresponding to the target device; If it is determined that the key generation request is legal, the method comprises: decrypting the key generation request to obtain the identifier, the public key and the signature of the target device; if it is determined that the key generation request is legal based on the public key of the target device and the signature, obtaining the trust identifier of the target device based on the master key of the trusted device, the identifier of the target device and random data.

3. The method of claim 1, wherein, The message also carries a session key; the access token carried in the message is processed to obtain a trust identifier; writing the security certificate into a target protection area, and sending the trust identifier and the security certificate to the target device, comprises: decrypting the access token carried in the message to obtain the trust identifier, the session key and the access right corresponding to the target device; obtaining security context information based on the session key; writing the security certificate into the target protection area through the write operation of the target communication protocol, and sending the trust identifier and the security certificate to the target device through the communication message of the target communication protocol.

4. The method of claim 1, wherein, The key generation request, the identity verification request and the message are all communication messages transmitted through a target communication protocol, and the trust identifier is written into a reserved field in the communication message of the target communication protocol.

5. A security authentication method characterized by, Applied to an authentication server, the method comprises: receiving an identity verification request sent by a first device, the identity verification request carrying a trust identifier of a target device, the trust identifier being generated by the first device based on a key generation request sent by the target device; verifying the trust identifier to obtain an access token corresponding to the target device, and returning a message to the first device, the message at least carrying the access token, the access token being used by the first device to obtain a trust identifier and send the trust identifier and a security certificate to the target device; receiving a registration request sent by the target device based on the trust identifier, and returning a registration response message.

6. The method of claim 5, wherein, The verification of the trust identifier to obtain an access token corresponding to the target device comprises: The source device of the trust identifier is verified for trustworthiness, and if it is determined that the source device is trustworthy, it is determined whether the trust identifier is available based on a local database; If the trust identifier is available, a session key corresponding to the target device and an access token are generated, the access token including the encrypted trust identifier, the session key and access permissions, or the access token including the trust identifier in plaintext form, the session key and access permissions.

7. The method of claim 6, wherein, The receiving of the registration request sent by the target device based on the trust identifier, and the returning of a registration response message, include: Receiving a registration request sent by a target device, the registration request including an access token with a timestamp and a device identifier; Verifying the validity and timeliness of the signature of the access token, and if the target conditions are met, creating record data and returning a registration response message to the target device, the registration response message including registration status data and a timestamp; the record data including a mapping relationship between the trust identifier and the device identifier in the access token, a hash value of the session key and a valid time, the record data being used for synchronization between multiple servers.

8. A security authentication method characterized by, Applied to a target device, the method includes: Sending a key generation request to a first device, so that the first device generates a trust identifier and a security certificate of the target device if it is determined that the key generation request is legal, and obtains an identity verification request through the trust identifier and an access token corresponding to the target device through an authentication server; Receiving the trust identifier and the security certificate returned by the first device, and registering at the authentication server based on the trust identifier and the security certificate, the trust identifier being returned by the authentication server to the first device.

9. The method of claim 8, wherein, The method further includes: Sending a data access request to a second device, the data access request including a trust identifier, the second device being a device storing data, the second device being used to verify the target device based on record data and return a data access response message to the target device after verification; Receiving a data response message returned by the second device, the data response message carrying data corresponding to the data access request.

10. A security authentication apparatus characterized by comprising: Applied to a first device, the apparatus includes: A first receiving module configured to receive a key generation request sent by a target device; A first determining module configured to generate a trust identifier and a security certificate of the target device if it is determined that the key generation request is legal, and obtain an identity verification request through the trust identifier and send the identity verification request to an authentication server, so that the authentication server verifies the trust identifier and obtains an access token corresponding to the target device; A second receiving module configured to receive a message returned by the authentication server, process the access token carried by the message to obtain a trust identifier, write the security certificate to a target protection area, and send the trust identifier and the security certificate to the target device, so that the target device registers at the authentication server. 11.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-10. The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 9.

12. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 9.

13. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 9.

Images