Certificate generation and access authentication method based on host fingerprint

Abstract

The invention provides a certificate generation and access authentication method based on host fingerprints, and aims to improve authentication security by combining hardware fingerprints and certificate management. In the traditional EAP-TLS authentication, the user identity completely depends on a client certificate and a private key, is easy to copy or leak and has potential safety hazards, and when the private key is captured, an attacker can disguise as a user to access an intranet. According to the method, hardware fingerprints are dynamically calculated at a client side (an SHA256 Hash value is generated based on information of a network card, a hard disk, an SMBIOS, a mainboard and the like) to verify a certificate, and the certificate is sent to an authentication server. Meanwhile, on the basis of EAP-TLS bidirectional authentication, the matching condition of the certificate fingerprint and the client host is additionally checked, strong binding of the certificate and the host is achieved, and the related certificate can only be used on the corresponding host. In order to further enhance the protection of the certificate, the client stores the certificate and the private key as EFI variables. The method is widely applicable to various wireless network authentication scenes, and has wide applicability and remarkable economic benefits.

Description

TECHNICAL FIELD

[0001] The present application proposes a host fingerprint-based certificate generation and access authentication method, aiming to combine hardware fingerprint and certificate management to improve authentication security. In traditional EAP-TLS authentication, user identity completely depends on client certificate and private key, which is easy to be copied or leaked, and there is a security risk. When the private key is captured, the attacker can pretend to be a user to access the internal network. The present application dynamically calculates the hardware fingerprint (generates SHA256 hash value based on network card, hard disk, SMBIOS, motherboard, etc.) on the client side and sends it to the authentication server, and verifies the certificate according to the fingerprint. At the same time, on the basis of EAP-TLS two-way authentication, the certificate fingerprint is additionally checked for matching with the client host, realizing strong binding of the certificate and the host, so that the related certificate can only be used on the corresponding host. To further strengthen the protection of the certificate, the client will store the certificate and private key as EFI variables. The present application is widely applicable to various wireless network authentication scenarios, has wide applicability and significant economic benefits. BACKGROUND

[0002] Network authentication technology is a key mechanism to ensure wireless network security, and is usually used to verify the identity of users or devices to ensure that only authorized entities can access the network. EAP-TLS (Extensible Authentication Protocol - Transport Layer Security) is an extended authentication protocol based on TLS protocol, which uses digital certificates for two-way authentication to provide a high level of security, and has become an important authentication method for enterprise-level wireless networks (such as WPA2-Enterprise). EAP-TLS exchanges certificates between the client and the server to achieve identity verification and key agreement, supports encrypted communication, and avoids clear text transmission of sensitive information. The protocol is widely used in wireless local area networks (WLAN), VPN access and other fields, and can effectively resist man-in-the-middle attacks and fake identity attacks.

[0003] Traditional EAP-TLS authentication relies on client certificates and private keys, and user identity is completely determined by these credentials. However, this approach has significant security risks: certificates and private keys are easy to copy or leak, and once the private key is captured, the attacker can pretend to be a legitimate user to access the internal network, leading to data leakage or system intrusion. In addition, the traditional method does not consider the binding of device hardware, and the certificate can be used on any host, further amplifying the risk. In resource-constrained environments such as mobile devices or Internet of Things devices, certificate management also faces challenges and is vulnerable to physical attacks or software vulnerabilities.

[0004] In view of the demand for authentication efficiency and security of wireless networks, the present application proposes an optimization mechanism for EAP-TLS. By studying the working principle of EAP-TLS, it is found that the traditional protocol does not integrate device hardware information, resulting in the disconnection of certificates and hosts. If hardware fingerprint verification is introduced in the authentication process, combined with certificate fingerprint binding, the authentication security will be greatly improved. Therefore, the present application proposes a dynamic binding mechanism based on hardware fingerprint, which can realize the strong association of certificates and devices based on EAP-TLS. Through double verification on the client and server side, it is ensured that the valid certificate can only be used on the specified host. This optimization method can significantly improve the anti-attack ability and reduce the risk of leakage when dealing with high security demand scenarios. Even if the attacker captures the certificate and private key by means, it cannot complete the authentication access to the intranet, which significantly improves the overall network security.

[0005] EFI variable is a persistent key-value pair provided by UEFI firmware, saved in the NVRAM of the platform. It is available before the operating system is loaded, used to save the boot order, Secure Boot's PK / KEK / db / dbx, etc. Trust material, through authenticated write, can prevent unauthorized modification by administrators. The present application proposes an EFI variable storage strategy for the actual scenario of wireless networks, which can avoid user or administrator's misoperation.

[0006] In summary, the present application proposes a special device access authentication technology based on hardware fingerprint, which has wide applicability and can be applied to wireless networks of different scales and complexities, significantly improving the security of authentication and achieving better network protection. This technology has important research and application value in academia and industry, and provides an innovative solution for wireless network security. SUMMARY

[0007] The application introduces a device binding mechanism based on the EAP-TLS protocol to improve the security of network authentication. In the authentication process, the user or host identity is not only dependent on the certificate and private key, but also uses the hardware fingerprint as an additional check factor. The authentication result is determined according to the matching of the hardware hash value calculated by the client and the certificate fingerprint. First, when generating the client certificate, a field that is one-way mapped with the client host hardware fingerprint needs to be set, so that the user who obtains the certificate can determine whether the certificate belongs to a certain host (matches the hardware fingerprint of the host), but cannot calculate the hardware fingerprint of the host. For the hardware fingerprint, the client generates a hash value by dynamically collecting the information of the network card, hard disk, SMBIOS, motherboard, etc., and judges whether the identification on the certificate matches, so as to realize the first binding check of the host and the certificate on the client; then the client sends the hardware fingerprint to the server. On the server side, the second binding check of the certificate and the host hardware fingerprint is realized through the check rule other than the standard EAP-TLS two-way certificate authentication, so as to ensure that only the target host can access the network. In order to further enhance the protection and avoid the defense line of the client administrator's misoperation or error management, the certificate and the private key are stored as EFI variables in the application.

[0008] The core of the application is the customized generation of the client certificate, the calculation, check and sending of the client hardware fingerprint information, the joint check of the client certificate fingerprint and the hardware fingerprint on the server side, and the storage and use of the certificate and the private key by the EFI variable.

[0009] The customized generation of the client certificate includes the following steps: (1) Set up a public key infrastructure to allow the certificate to contain an extended field; limit a single unit to apply for a certificate from the public key infrastructure, and then distribute the certificate to the client by the unit.

[0010] (2) The client host generates a public-private key pair and calculates the hash value of the local hardware fingerprint as an extended field together with the public key and other information to apply for a client certificate strictly bound with the host.

[0011] The calculation, check and sending of the client hardware fingerprint include the following steps: (1) The client authentication program dynamically collects hardware information, including the network card manufacturer and MAC address, the SMBIOS serial number, the motherboard manufacturer and serial number, the hard disk manufacturer and serial number, etc. The specific selection of these information is determined by the system and is not transparent to the user.

[0012] (2) The selected information is spliced and the hash value is calculated as the hardware fingerprint.

[0013] (3) The client authentication program compares whether the hash value of the hardware fingerprint matches the extended field of the client certificate. If yes, the following steps are continued, otherwise the authentication is ended.

[0014] (4) In the EAP-TLS authentication process, the hardware fingerprint is sent to the authentication server, the fingerprint is stored only in memory and interaction network, and is not written in the certificate.

[0015] The server-side joint verification rule has the following steps: (1) Add a verification rule for the field containing the hardware fingerprint under the authorize function module of the authentication server.

[0016] (2) Add a verification rule for the certificate fingerprint field under the authorize function module of the authentication server.

[0017] (3) The above rules are combined to ensure that the hardware fingerprint and the certificate fingerprint match each other. Only when the two fields are equal to the specified value at the same time, the authentication can continue.

[0018] The steps of EFI variable certificate and private key storage are as follows: (1) Generate an unused UUID and record it as part of the subsequent EFI variable name.

[0019] (2) Use a tool to write the certificate and private key into the EFI variable.

[0020] (3) Handle the four extra bytes in the file header when using it as an EFI variable.

[0021] The special device access authentication technology based on hardware fingerprint has the following advantages compared with the existing technology: 1. Improve the security of network identity authentication, reduce the risk of certificate duplication and private key leakage by binding hardware fingerprint and certificate fingerprint. Device-level strong authentication makes the issued client certificate only be used on the target host.

[0022] 2. Optimize certificate management, store the certificate and private key as EFI variable, enhance physical protection, and avoid user or administrator's misoperation and mismanagement.

[0023] 3. High compatibility, the entire authentication process is implemented on the basis of EAP-TLS authentication, and the existing system can be adapted to the technology proposed by the application by patching. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 is a network authentication flowchart; Figure 2 is a client network access program pseudo code. DETAILED DESCRIPTION

[0025] In order to make the objects, technical solutions and advantages of the present application clearer and more apparent, the present application will be described in detail below in conjunction with the drawings and specific embodiments. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0026] Embodiments The embodiment realizes a host-fingerprint-based certificate generation and access authentication method. The authentication process is shown in Figure 1 , which is based on the standard EAP-TLS protocol and adds an additional process, which is divided into three parts of preprocessing, client and authentication server.

[0027] The preprocessing stage is mainly responsible for the work of certificate acquisition and storage, which specifically includes: Acquisition of the certificate containing the extension field, configuration of the public key infrastructure allows the certificate to contain the extension field, and the user can apply for the client certificate bound to the host.

[0028] Specifically, a public key infrastructure is built, which allows the certificate to contain the extension field; the client generates a public-private key pair, dynamically calculates the hardware fingerprint of the host, calculates the hash value of the host, and submits the value as an extension field together with the public key and other fields to apply for and obtain the certificate strictly bound to the host.

[0029] The pseudo code of the client network access program is shown in Figure 2 , which specifically includes: The hardware fingerprint calculation module collects part of the hardware information of the host and calculates the hash value as the hardware fingerprint of the host.

[0030] Specifically, the network card manufacturer and MAC address ( / sys / class / net / {ifname} / device / vendor and / sys / class / net / {ifname} / address), SMBIOS serial number ( / sys / class / dmi / id / product_serial), motherboard manufacturer and serial number ( / sys / class / dmi / id / board_vendor and / sys / class / dmi / id / board_serial), hard disk manufacturer and serial number ( / sys / block / {name} / device / vendor and / sys / block / {name} / device / serial) are collected on the Linux host. The hash value calculated by splicing them in turn is the hardware fingerprint of the client.

[0031] Load EFI variables, extract the certificate and private key that have been saved as EFI variables, and preprocess them to convert them into a format that complies with the specification.

[0032] Specifically, the CA certificate, the client certificate, and the private key saved in advance are read from / sys / firmware / efi / efivars / 'name-uuid' in the form of reading a file. Because 4 bytes are added to the head of each file after being saved as an EFI variable, the file format is destroyed. Therefore, the four bytes of the head are processed by the user when reading, and the result is used as the target file.

[0033] Fingerprint verification, first verification of the certificate fingerprint and the host hardware fingerprint, to determine whether the certificate belongs to the host.

[0034] Specifically, the extension field of the client certificate is extracted and compared with the hash value of the hardware fingerprint calculated previously. If they are equal, it means that the certificate belongs to the host, and the following authentication continues; otherwise, it means that the certificate does not belong to the host, and the authentication fails, and the network cannot be accessed.

[0035] Setting and network connection, integrating hardware fingerprint and related certificate information, sending an access authentication request to the gateway, and assigning an IP address after a successful connection.

[0036] Specifically, the hardware fingerprint and related certificate information are temporarily integrated into a configuration file, the wpa_supplicant is used to set the network card and read the aforementioned configuration to apply for connection to the gateway and perform authentication. When the authentication is successful and the connection is completed, the dhcpcd is used to assign an IP address, and the final intranet access is completed.

[0037] On the server side of the authentication, the authorize function module is added to check the serial number of the client certificate and the hardware fingerprint.

[0038] Specifically, the freeradius project is used to build a radius authentication server, and the basic EAP-TLS authentication function setting is completed. Then, the limit rules of the client certificate fingerprint and the hardware fingerprint are added to the authorize module of the / etc / freeradius / 3.0 / sites-enabled / default configuration file, which requires that the two items must be matched, and the server will continue to the subsequent standard authentication steps.

[0039] It should be noted that the hardware fingerprint calculated in the client authentication connection program should be opaque to the user, and the specific calculation algorithm is secret to the user (different systems can customize different algorithms), which requires additional confusion and other anti-reverse engineering techniques to be added to the client program to avoid the leakage and forgery of the hardware fingerprint.

[0040] The implementation cases listed in the present document are intended to illustrate the implementation manner of the technical solution through specific application scenarios, rather than limiting the scope of patent protection. It needs to be particularly pointed out that, based on the innovation core of the technical solution, the related technical personnel can make adaptive adjustment to the implementation scheme within the existing technical cognition range, including but not limited to optimization of technical parameters, reasonable change of implementation steps or equivalent conversion of technical features, etc. Such reasonable evolution and improvement based on the essence of the technical solution are considered to be within the design concept and protection boundary of the patent. The final legal protection range is defined by the approved claims of the State Intellectual Property Office.

Claims

1. A certificate generation and access authentication method based on host fingerprinting, characterized in that: include: Customized generation of client certificates, calculation, verification and transmission of client hardware fingerprints, joint verification of certificate fingerprints and hardware fingerprints on the server side, and storage and use of EFI variables for certificates and private keys; To enhance network authentication security, a device binding mechanism is introduced based on the EAP-TLS protocol. During the authentication process, the identity of a user or host depends not only on the client certificate and private key, but also on the hardware fingerprint as an additional verification factor. The authentication result is determined by pairing the hardware hash value dynamically calculated by the client with the certificate fingerprint. The client generates an SHA256 hash value as the hardware fingerprint by collecting information from the network card, hard drive, SMBIOS, motherboard, etc., and sends it to the authentication server through the protocol field. On the authentication server side, by adding joint verification rules for the certificate fingerprint and hardware fingerprint on the basis of EAP-TLS two-way authentication, a strong binding between the certificate and the host is ensured, allowing only valid certificates to be used on the specified host. In addition, the certificate and private key are stored as EFI variables to enhance protection and prevent unauthorized modification.

2. The certificate generation and access authentication method based on host fingerprinting according to claim 1, characterized in that: Customized generation of client certificates includes: (1) Configure the public key infrastructure to allow certificates to include extended fields and restrict a single entity from applying for certificates from the public key infrastructure, and have that entity distribute the certificates to the client; (2) The client host generates a public-private key pair and dynamically calculates the SHA256 hash value of the hardware fingerprint. It submits the hash value as an extended field along with the public key and other information to generate a client certificate that is strictly bound to the host.

3. The certificate generation and access authentication method based on host fingerprinting according to claim 1, characterized in that: Client hardware fingerprint calculation, verification, and transmission include: (1) The client authentication program dynamically collects hardware information, including but not limited to network card manufacturer and MAC address, SMBIOS serial number, motherboard manufacturer and serial number, hard drive manufacturer and serial number. The specific information selection is determined by the system and is not transparent to the user. (2) Calculate the SHA256 hash value after concatenating the collected hardware information, and use it as the hardware fingerprint; (3) The client authentication program compares the hash value of the hardware fingerprint with the certificate extension field. If they match, the subsequent steps are continued; otherwise, the authentication is terminated.

4. The certificate generation and access authentication method based on host fingerprinting according to claim 1, characterized in that: The server-side joint verification of certificate fingerprints and hardware fingerprints includes: (1) Add a validation rule for protocol fields (such as User-Name) in the authorization function module of the authentication server. This field contains the client hardware fingerprint. (2) Add verification rules for certificate fingerprint fields (such as TLS-Client-Cert-Serial) in the authorize function module; (3) The above rules are combined to ensure that the hardware fingerprint and the certificate fingerprint match each other. Authentication will continue only when both meet the pairing constraints.

5. The certificate generation and access authentication method based on host fingerprinting according to claim 1, characterized in that: EFI variables are used for storing and using certificates and private keys, including: (1) Generate a unique UUID as part of the EFI variable name and record it; (2) Use tools to write the CA certificate, client certificate and private key into the EFI variable and store them in the platform's NVRAM; (3) When in use, read the EFI variable and process the extra four bytes in the file header, converting them into a compliant certificate and private key format for authentication interaction.

6. The certificate generation and access authentication method based on host fingerprinting according to claim 1, characterized in that: EFI variables are used for storing and using certificates and private keys, including: (1) The client network access program includes a hardware fingerprint calculation module, which dynamically collects the host's hardware information and calculates the SHA256 hash value as the hardware fingerprint; (2) Load EFI variables, extract the CA certificate, client certificate and private key stored as EFI variables, and preprocess them to convert them into a compliant format; (3) Integrate hardware fingerprint and certificate information, generate configuration file, use wpa_supplicant to set up network card and send access authentication request to gateway. After successful authentication, use dhcpcd to allocate IP address to complete intranet access; (4) On the authentication server side, build a RADIUS authentication server based on FreeRADIUS, configure the authorize module on the basis of EAP-TLS authentication, and add pairing verification rules for client certificate fingerprints and hardware fingerprints.

7. The certificate generation and access authentication method based on host fingerprinting according to any one of claims 1 to 6, characterized in that: Network authentication technologies include: The hardware fingerprint calculation algorithm is kept confidential from the user, and the client authentication program uses anti-reverse engineering techniques (such as code obfuscation) to prevent the hardware fingerprint from being leaked or forged, thus ensuring the security of the authentication process.

Images