CN116132026A - Method for realizing remote Web access enhanced security authentication in BMC system - Google Patents

Abstract

The invention discloses a method for realizing remote Web access enhanced security authentication in a BMC system, which uses an asymmetric cryptosystem algorithm to generate a unique public-private key pair for each user, wherein the private key is stored in an encryption and decryption chip of a server side of the BMC system, the system does not store the private key, and the public key is stored by the user; the user browser encrypts specific data by using the public key to generate ciphertext serving as an authentication token; the server sends the ciphertext to the encryption and decryption chip, and the ciphertext is returned after being decrypted by the encryption and decryption chip. The user of the invention changes the holding of the private key into the holding of the public key, and cannot obtain the private key by the inverse operation of the public key; the server changes the public key into the private key from the public key, stores the private key in the encryption and decryption chip, and when the calculation is needed, sends data to the encryption and decryption chip, returns a result after the chip calculation is completed, and the server cannot contact the private key. Further improving the security level of the BMC system as a whole.

Description

A Method for Realizing Remote Web Access Enhanced Security Authentication in BMC System

technical field

The invention belongs to the field of modern Internet information technology, and in particular relates to a method for realizing remote Web access enhanced security authentication in a BMC system.

Background technique

With the development of big data and cloud computing, more and more data storage and computing tasks are transferred to the cloud, that is, processed by the data center. Because data centers need to consume a lot of power and generate huge amounts of heat, most data centers are located in areas with low energy prices and good heat dissipation conditions. Taking China as an example, a large number of data centers are built in caves in Guizhou Inside. These data centers are remote and noisy, so data center managers usually monitor and maintain them remotely. This remote management is usually accomplished through the BMC system (a remote operating system consisting of a management chip welded on the computer motherboard and supporting firmware running on it).

BMC (Baseboard Management Controller) system is a management system that monitors servers or switches and provides remote control interfaces. This type of system communicates with other hardware and software inside the host through LPC or USB interfaces, and provides query and control functions to remote operators through remote transmission interfaces such as the network, allowing administrators to remotely access the host to send instructions or perform various tasks. Task.

With the expansion of BMC system functions, more and more operations can be done remotely, including but not limited to power on and off, monitor system status, install operating system, upgrade motherboard BIOS firmware, etc. These operations are related to system security and stability. If attacked or operated by unauthorized users, it is likely to cause system crash or data leakage.

In a traditional BMC system, account authority control is usually used to control the access authority of different managers to different levels of resources. Each administrator has an account and a corresponding password, and the administrator logs in to the system through the account and password to perform operations. This method has many potential security risks. For example, the system has a factory password, and users often forget to change the factory password when deploying the system; for the convenience of management, users often set weak passwords, which makes them easily cracked by attackers; when the system exists When there are multiple administrators, they often share a set of accounts and passwords, so that the system cannot confirm which administrator issued the specific operation command; the password has no expiration date, and the administrator can still log in to the account to operate after resigning or transferring .

The invention patent application CN202111296468.6 reduces the security risks caused by password leakage, increases the difficulty for malicious attackers to launch attacks, and improves the security level of the BMC system as a whole. However, there are still some weak links. For example, the client has a private key and can calculate the public key stored on the server from the private key; the server stores the public key in the system database. If the server is attacked, the key may be leaked.

Contents of the invention

In view of the shortcomings of the invention patent application CN202111296468.6, the present invention achieves security enhancement by implanting a solidified encryption and decryption chip on the server side. The main improvements include:

1. Use an asymmetric cryptosystem algorithm to generate a unique public-private key pair for each user. The private key is stored in the encryption and decryption chip of the BMC system server, and the BMC system itself does not save the private key. The public key is kept by the user.

2. The user browser uses the public key to encrypt specific data and generates ciphertext as an authentication token.

3. The server sends the ciphertext to the encryption and decryption chip, and the encryption and decryption chip returns the plaintext after decryption.

The present invention realizes the method for remote Web access enhanced security authentication in BMC system, and the technical scheme that specifically adopts comprises the following steps:

The first step, the generation and distribution of asymmetric keys, includes the following specific steps:

① Use the asymmetric cryptosystem algorithm to generate a unique public-private key pair for each user. The user's private key KeyPri is stored in the encryption and decryption chip of the BMC system server, and the user's public key KeyPub is saved by the user;

②The server combines the user id, user public key KeyPub, key validity period, and random salt data Salt into combined data TextA;

③Save the user id, key validity period, and salt data Salt in the server of the BMC system, call the encryption function of the encryption and decryption chip, use the user's private key KeyPri stored in the encryption and decryption chip to sign the above information to generate SignA, and convert TextA and SignA is saved by the user;

After the key distribution is completed, each user has the user id, user public key KeyPub, and signature SignA; the BMC server stores the user id, key validity period, and salt data Salt, and the encryption and decryption chip of the BMC server stores the user's private key KeyPri;

In the second step, the user initiates authentication, including the following specific steps:

①The user sends a request to the BMC server to obtain the session id (Session id) of the current session;

②The user browser uses the public key KeyPub and signature SignA to verify the validity of TextA, user id, key validity period and salt data Salt;

③The user browser composes the combined data TextB of user id, key validity period, session id (Session id), and access resource path;

④The user browser uses the digest algorithm to extract the above data TextB to obtain the digest HashB;

⑤The user's browser uses the user's public key KeyPub to encrypt HashB to obtain CipherB;

⑥The user browser generates a Timestamp according to the local time;

⑦The user browser uses the combination of salt data Salt and timestamp Timestamp to generate the transmission key KeyTransfer;

⑧The user browser uses the transfer key KeyTransfer to encrypt the data group composed of TextB and CipherB to obtain InfoB;

⑨When the user browser accesses server resources, it sends the timestamp Timestamp and ciphertext InfoB to the server in the form of parameters or header (Header) key-value pairs as authentication tokens;

The third step is to authenticate the user on the server side, including the following specific steps:

①The user browser initiates a resource access request to the server, and sends the requested resource path, timestamp Timestamp, InfoB;

②After receiving the user's access request, the server first inquires whether the key validity period corresponding to the user and the salt data Salt exist;

③ If the above information does not exist or the validity period of the key has expired, the authentication process will be stopped and an error message of denial of service will be returned to the user;

④ If the key validity period has not expired, the server uses the user salt data Salt and the timestamp Timestamp sent by the browser to splicing to obtain the transmission key KeyTransfer', and uses KeyTransfer' to decrypt the InfoB sent by the user;

⑤If it is decrypted correctly, the data group TextB' and encrypted information CipherB' composed of user id, key validity period, session id (Session id) and access resource path can be obtained; if the decryption fails, an error message will be returned to the browser, and stop the service;

⑥The server uses the digest algorithm to sign TextB' to obtain the digest HashB', and calls the decryption function of the encryption and decryption chip, and uses the private key KeyPri stored in the encryption and decryption chip to decrypt CipherB' to obtain HashB"; if HashB' and HashB" If they are not equal, the verification fails, an error message is returned and the service is stopped;

⑦If the signature verification is passed, the server will judge each of the following conditions. If any of the conditions is triggered, the server will return an error message to the user and stop the service:

a) The user id obtained by decryption is inconsistent with the user id who initiated the request;

b) The validity period of the key obtained by decryption is inconsistent with the validity period of the key stored on the server;

c) The session id (Session id) obtained by decryption does not exist or has expired on the server side;

d) The access resource path obtained by decryption is not equal to the resource path of the user's current Web request;

⑧If each of the above conditions is not triggered, the authentication is passed, and the server returns the requested resource to the user.

Concrete technical solution principle of the present invention is further elaborated as follows:

First, the generation and distribution of asymmetric keys are divided into the following sub-steps:

1. Use an asymmetric cryptosystem algorithm to generate a unique public-private key pair for each user. The private key is stored in the encryption chip of the BMC system server, and the private key cannot be read from the outside. The public key is kept by the user. Hereinafter, the user public key is called KeyPub, and the user private key is called KeyPri.

2. The server composes the following data into combined data TextA, including:

①User ID;

②User public key;

③ Key validity period;

④ Random salt data, hereinafter referred to as Salt.

3. Save the user id, key validity period, and salt data Salt on the server side of the BMC system. Call the encryption function of the encryption chip, use the private key KeyPri stored in the chip to sign the above information to generate SignA, and hand over TextA and SignA to the user for storage.

After the key distribution is completed, each user owns: user id, user public key KeyPub, and signature SignA.

The BMC server stores: user id, key validity period, salt data Salt, and user private key KeyPri (stored in the encryption and decryption chip, which cannot be obtained by the BMC server).

Second, the user initiates authentication, which is divided into the following sub-steps:

1. The user sends a request to the BMC server to obtain the session id (Session id) of the current session. In the interaction between the browser and the server, the Session can represent the only communication channel established between the current server and the browser.

2. The user browser uses the public key KeyPub and signature SignA to verify the validity of TextA, user id, key validity period and salt data Salt.

3. The user browser composes the following data into combined data TextB, including:

①User ID;

② Key validity period;

③ session id (Session id);

④ Path to access resources.

4. The user browser uses a digest algorithm to extract the above data TextB to obtain the digest HashB.

5. The user's browser encrypts HashB with the public key KeyPub to obtain CipherB.

6. The user browser generates a Timestamp according to the local time.

7. The user browser uses the combination of the salt data Salt and the timestamp Timestamp to generate the transfer key KeyTransfer.

8. The user browser uses the transfer key KeyTransfer to encrypt the data group consisting of TextB and CipherB to obtain InfoB.

9. When the user browser accesses server resources, it sends the timestamp Timestamp and ciphertext InfoB to the server in the form of parameters or header (Header) key-value pairs as authentication tokens.

Third, the steps to authenticate users on the server side:

1. The user browser initiates a resource access request to the server, and sends: request resource address, timestamp Timestamp, InfoB.

2. After receiving the user's access request, the server first inquires whether the key validity period corresponding to the user and the salt data Salt exist.

3. If the above information does not exist or the key has expired, stop the authentication process and return a service denial error message to the user.

4. If the key has not expired, the server uses the user's salt data Salt and the timestamp sent by the browser to concatenate to obtain the transmission key KeyTransfer', and uses KeyTransfer' to decrypt the InfoB sent by the user.

5. If decrypted correctly, the data group TextB' and encrypted information CipherB' composed of user id, key validity period, session id (Session id) and access resource path can be obtained; if the decryption fails, an error message will be returned to the browser, and Out of service.

6. The server uses the digest algorithm to sign TextB' to obtain the digest HashB', and calls the encryption and decryption chip, and uses the private key KeyPri stored in the chip to decrypt CipherB' to obtain HashB". If HashB' and HashB" are not equal, then If the verification fails, return an error message and stop the service.

7. If the verification is passed, the server will judge the following conditions. If any of the following conditions are met, the server will return an error message to the user and stop the service:

①The user id obtained by decryption is inconsistent with the user id who initiated the request;

②The validity period of the public key obtained by decryption is inconsistent with the validity period of the public key stored on the server;

③The session id (Session id) obtained by decryption does not exist or has expired on the server side

④The access resource path obtained by decryption is not equal to the resource path of the user's current Web request.

8. If none of the above conditions are triggered, the authentication is passed, and the server returns the requested resource to the user.

The beneficial effects that the present invention reaches are as follows:

1. The user changes from holding a private key to holding a public key, and the user cannot obtain the private key from the reverse operation of the public key, which increases security.

2. The server changes from holding a public key to holding a private key. The private key is stored in the encryption and decryption chip. When calculation is required, the data is sent to the encryption and decryption chip. The chip returns the result after the calculation is completed, and the server cannot access the private key. key value.

Therefore, using the present invention can reduce the security risk caused by password leakage, increase the difficulty for malicious attackers to launch attacks, and further enhance the security level of the BMC system as a whole.

Description of drawings

Fig. 1 is a block diagram of the generation and distribution flow of the asymmetric key in the present invention.

Fig. 2 is a block diagram 1 of user-initiated authentication and server-side authenticated user flow in the present invention.

Fig. 3 is a block diagram 2 of user-initiated authentication and server-side authenticated user flow in the present invention.

Description: The steps in Figure 2 synthesize the data group TextB, use the digest algorithm to generate the digest HashB of TextB, use the public key KeyPub to encrypt HashB to generate CipherB, and the steps in Figure 3 use the digest algorithm to extract the digest of TextB' to obtain HashB', add The decryption chip sends the received CipherB', and these steps are improvements to the invention patent application CN202111296468.6.

Detailed ways

The present invention is an improvement to the invention patent application CN202111296468.6, and its main process is divided into three stages: generation and distribution of keys; authentication initiated by the user; authentication of the user by the server. The three stages are described in detail below:

First, the generation and distribution of keys. Key generation and distribution is the process of generating and distributing keys to users and servers. In the present invention, the key is generated by the encryption and decryption chip using an asymmetric encryption system algorithm. After the key pair is generated, the private key is stored inside the chip and cannot be obtained from the outside, and the public key is distributed to the user. The specific steps are as follows:

1. The root administrator initiates a key generation request in the key generation and distribution system (hereinafter referred to as the key system);

2. The key system uses encryption and decryption chips to generate public key KeyPub and private key KeyPri. The private key KeyPri is stored inside the chip, and the chip only returns the public key KeyPub.

3. The key system uses a random number algorithm to generate a piece of salt data Salt, and the length of the data can be 64, 128 or 256 bits;

4. The key system sets the expiration time of the set of key pairs according to the set rules, ExpireTime. In order to prevent the impact caused by the time zone inconsistency between the user and the server, the time is uniformly converted to UTC time for storage.

5. The key system splices the above data and the public key KeyPub itself into a complete string TextA: {user id, ExpireTime, Salt, KeyPub}, and uses the digest algorithm to generate a digest HashA for TextA.

6. The system sends HashA to the encryption and decryption chip, and the chip signs HashA with the user's private key KeyPri and returns SignA. When signing, the system only sends HashA to the chip, and the system cannot touch the private key used for signing during the signing process.

7. The system sends TextA and signature SignA to the user, and saves the user id, expiration time ExpireTime, and salt data Salt in the server database.

8. After the user receives TextA, use the user's public key contained in TextA to verify SignA, if passed, save the public key TextA and signature SignA locally, and send a success message to the server; if not, send it to the server failure message;

9. After the server receives the success message, the key distribution is completed; after the server receives the failure message, it notifies the encryption and decryption chip to delete the private key information, and the key distribution fails.

Second, the user initiates authentication. When a user needs to initiate a server-side resource request, it needs to attach information that can be authenticated by the server-side to confirm that the identity of the sender is legal. Take the request for resource Url as an example, the process is as follows:

1. The user first sends a request to the server to obtain the session id (Session id) of the current session.

2. The user's browser composes the following data into combined data TextB: {user id, ExpireTime, Sessionid, Url}.

3. The user's browser extracts TextB using a digest algorithm to obtain HashB.

4. The user's browser encrypts HashB with the held public key KeyPub to obtain CipherB.

5. The user browser uses the Salt and the timestamp of the current time to concatenate to generate the transfer key KeyTransfer.

6. The user browser uses KeyTransfer to encrypt the data group consisting of TetxB and CipherB, and obtains InfoB. The encryption algorithm used for encryption is a symmetric algorithm, such as AES or SM4.

7. When the user browser initiates a request for the resource Url, the timestamp Timestamp and InfoB are used as tokens and sent to the server in the form of parameters or access header (Header) key-value pairs.

Third, the server authenticates the user. When the server receives the user's access to the resource Url, it needs to use the InfoB attached to the request to authenticate the sender. The process is as follows:

1. The server obtains the user's browser to initiate a resource access request to the server, and receives: the requested resource address Url, timestamp Timestamp, and ciphertext InfoB.

2. The server queries the local database according to the user id, and obtains the validity period of the user key and the salt data Salt

3. If the above information does not exist or the key has expired, stop the authentication process and return a service denial error message to the user.

4. If the key has not expired, the server uses the salt data Salt and the timestamp to concatenate it into the transfer key KeyTransfer.

5. The server uses the transmission key KeyTransfer to decrypt the InfoB sent by the user. The decryption algorithm is consistent with the encryption algorithm of the client, and obtains TextB': {user id', ExpireTime', Session id', Url'} and ciphertext CipherB '. If the decryption fails, a denial of service error message is returned.

6. The server uses the digest algorithm consistent with the client to extract the digest from TextB' to obtain HashB', and sends CipherB' to the encryption and decryption chip, and decrypts it with the user's private key. The server cannot access the user's private key during the decryption process. key. The decryption result is HashB", if HashB' is not equal to HashB", an error message will be returned and the service will be stopped.

7. If the signature verification is passed, the server will judge the following conditions. If any of the following conditions are met, the server will return an error message to the user and stop the service

①The user id' obtained by decryption is inconsistent with the user id who initiated the request;

②The validity period of the key obtained by decryption, ExpireTime’, is inconsistent with the validity period of the key stored on the server;

③The session id' obtained by decryption does not exist or has expired on the server side;

④ The access resource path Url' obtained by decryption is not equal to the resource path Url of the user's current Web request.

8. If none of the above conditions are triggered, the authentication is passed, and the server returns the requested resource to the user.

9. Record the detailed information of this request on the server side as an audit file.

Claims (1)

1. A method for realizing remote web access enhanced security authentication in BMC system, is characterized in that, comprises the following steps: The first step, the generation and distribution of asymmetric keys, includes the following specific steps: ① Use the asymmetric cryptosystem algorithm to generate a unique public-private key pair for each user. The user's private key KeyPri is stored in the encryption and decryption chip of the BMC system server, and the user's public key KeyPub is saved by the user; ②The server combines the user id, user public key KeyPub, key validity period, and random salt data Salt into combined data TextA; ③Save the user id, key validity period, and salt data Salt in the server of the BMC system, call the encryption function of the encryption and decryption chip, use the user's private key KeyPri stored in the encryption and decryption chip to sign the above information to generate SignA, and convert TextA and SignA is saved by the user; After the key distribution is completed, each user has the user id, user public key KeyPub, and signature SignA; the BMC server stores the user id, key validity period, and salt data Salt, and the encryption and decryption chip of the BMC server stores the user's private key KeyPri; In the second step, the user initiates authentication, including the following specific steps: ①The user sends a request to the BMC server to obtain the session id of the current session; ②The user browser uses the user public key KeyPub and signature SignA to verify the validity of TextA, user id, key validity period and salt data Salt; ③The user browser composes the combined data TextB of user id, key validity period, session id, and resource access path; ④The user browser uses the digest algorithm to extract the above data TextB to obtain the digest HashB; ⑤The user's browser uses the user's public key KeyPub to encrypt HashB to obtain CipherB; ⑥The user browser generates a Timestamp according to the local time; ⑦The user browser uses the combination of salt data Salt and timestamp Timestamp to generate the transmission key KeyTransfer; ⑧The user browser uses the transfer key KeyTransfer to encrypt the data group composed of TextB and CipherB to obtain InfoB; ⑨When the user browser accesses server resources, the timestamp Timestamp and ciphertext InfoB are sent to the server in the form of parameters or header (Header) key-value pairs as authentication tokens; The third step is to authenticate the user on the server side, including the following specific steps: ①The user browser initiates a resource access request to the server, and sends the requested resource path, timestamp Timestamp, InfoB; ②After receiving the user's access request, the server first inquires whether the key validity period corresponding to the user and the salt data Salt exist; ③ If the above information does not exist or the validity period of the key has expired, the authentication process will be stopped and an error message of denial of service will be returned to the user; ④ If the key validity period has not expired, the server uses the user salt data Salt and the timestamp Timestamp sent by the browser to splicing to obtain the transmission key KeyTransfer', and uses KeyTransfer' to decrypt the InfoB sent by the user; ⑤If the decryption is correct, the data group TextB' and encrypted information CipherB' composed of user id, key validity period, session id and access resource path can be obtained; if the decryption fails, an error message will be returned to the browser and the service will be stopped; ⑥The server uses the digest algorithm to sign TextB' to obtain the digest HashB', and calls the decryption function of the encryption and decryption chip, and uses the user's private key KeyPri stored in the encryption and decryption chip to decrypt CipherB' to obtain HashB"; if HashB' and HashB " is not equal, the verification fails, an error message is returned and the service is stopped; ⑦If the signature verification is passed, the server will judge each of the following conditions. If any of the following conditions is triggered, the server will return an error message to the user and stop the service: a) The user id obtained by decryption is inconsistent with the user id who initiated the request; b) The validity period of the key obtained by decryption is inconsistent with the validity period of the key stored on the server; c) The session id obtained by decryption does not exist or has expired on the server side; d) The access resource path obtained by decryption is not equal to the resource path of the user's current Web request; ⑧If each of the above conditions is not triggered, the authentication is passed, and the server returns the requested resources to the user.

Images