CN106992978B - Network security management method and server - Google Patents
Network security management method and serverDownload PDFInfo
- Publication number
- CN106992978B CN106992978BCN201710192013.7ACN201710192013ACN106992978BCN 106992978 BCN106992978 BCN 106992978BCN 201710192013 ACN201710192013 ACN 201710192013ACN 106992978 BCN106992978 BCN 106992978B
- Authority
- CN
- China
- Prior art keywords
- authority
- certificate file
- request
- authority certificate
- hardware module
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000007726management methodMethods0.000titleclaimsabstractdescription52
- 238000000034methodMethods0.000claimsabstractdescription27
- 230000004044responseEffects0.000claimsabstractdescription19
- 238000012545processingMethods0.000claimsdescription8
- 238000004891communicationMethods0.000description6
- 238000013475authorizationMethods0.000description5
- 238000012795verificationMethods0.000description5
- 230000008878couplingEffects0.000description3
- 238000010168coupling processMethods0.000description3
- 238000005859coupling reactionMethods0.000description3
- 230000009286beneficial effectEffects0.000description2
- 238000010586diagramMethods0.000description2
- 230000003993interactionEffects0.000description2
- 238000012986modificationMethods0.000description2
- 230000004048modificationEffects0.000description2
- 230000003287optical effectEffects0.000description2
- 230000008569processEffects0.000description2
- 238000006467substitution reactionMethods0.000description2
- 238000005516engineering processMethods0.000description1
- 230000006870functionEffects0.000description1
- 238000010200validation analysisMethods0.000description1
Images
Classifications
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Storage Device Security (AREA)
Abstract
Description
Technical Field
The present invention relates to the field of network security technologies, and in particular, to a network security management method and a server.
Background
For large data systems, the rights management module is an important module. Because the authority management module not only controls the access authority of the user to the big data system, but also directly controls the access of the user to the data of the big data system. Especially inside a big data system, communication across hosts is usually involved, and at this time, the rights management module can control the authorization data of each host in the cluster and complete updating of the authorization data.
When the rights management module manages the authorization data, identity verification is usually required, specifically, identity verification is performed through a certificate issued by a big data system. If the certificate is read by a third party, the security of the authority management module is threatened, so that the communication security between the hosts is threatened.
Disclosure of Invention
In view of this, an object of the embodiments of the present invention is to provide a network security management method and a server capable of performing identity verification on an authority management module.
In order to achieve the above object, an embodiment of the present invention provides a network security management method, including:
when detecting that the authority certificate file is used for executing an identity authentication operation request, acquiring the authority certificate file;
sending the authority certificate file to a trusted encryption hardware module; so that the trusted encryption hardware module carries out decryption operation on the authority certificate file;
and performing identity authentication operation by using the decrypted authority certificate file.
Preferably, before invoking the trusted encryption hardware module to perform decryption operation on the authority certificate file, the method further includes:
verifying the processing authority of the request to obtain a first judgment result;
and when the first judgment result shows that the request has the authority for executing the identity authentication operation, the trusted encryption hardware module performs decryption operation on the authority certificate file.
Preferably, the method further comprises:
judging the access authority of the user sending the request to obtain a second judgment result;
and when the second judgment result shows that the user has the access right to the authority certificate file, the trusted encryption hardware module carries out decryption operation on the authority certificate file.
Preferably, the method further comprises: receiving an access request of a user sending the request according to the result of identity authentication operation of the decrypted authority certificate file;
sending the access request to the trusted cryptographic hardware module; so that the trusted encryption hardware module performs decryption operation on the access request;
and responding to the decrypted access request.
Preferably, the method further comprises:
calling the trusted encryption hardware module to encrypt the response;
and sending the encrypted response to the user sending the request.
The embodiment of the invention also provides a network security management method, which comprises the following steps:
generating an authority certificate file;
calling a trusted encryption hardware module to encrypt the authority certificate file;
and sending an identity authentication operation request by using the authority certificate file.
Preferably, the method comprises: and receiving a response result to the operation request.
An embodiment of the present invention further provides a server, including:
the processor is configured to acquire the authority certificate file and send the authority certificate file to the trusted encryption hardware module when detecting that the authority certificate file is used for executing an identity authentication operation request;
the trusted encryption hardware module is configured to decrypt the authority certificate file;
and the processor is also configured to perform identity authentication operation by using the decrypted authority certificate file.
Preferably, the server includes:
the processor is further configured to verify the processing permission of the request to obtain a first judgment result before calling the trusted encryption hardware module to perform decryption operation on the permission certificate file, and when the first judgment result shows that the request has permission to perform identity authentication operation, the trusted encryption hardware module performs decryption operation on the permission certificate file.
An embodiment of the present invention further provides a server, including:
and the processor is configured to generate an authority certificate file, call a trusted encryption hardware module to encrypt the authority certificate file, and send an identity authentication operation request by using the authority certificate file.
Compared with the prior art, the embodiment of the invention has the following beneficial effects: according to the technical scheme of the embodiment, the authority certificate file of the main body in the cluster is encrypted by adopting the trusted encryption hardware module, and the response is sent to the main body according to the content of the decrypted request, so that the network security is ensured.
Drawings
FIG. 1 is a flowchart of a first embodiment of a network security management method according to the present invention;
fig. 2 is a schematic view of a scenario of a network security management method according to a first embodiment of the present invention;
FIG. 3 is a flowchart of a third embodiment of a network security management method according to the present invention;
FIG. 4 is a diagram of a first embodiment of a server according to the present invention;
fig. 5 is a schematic diagram of a second embodiment of the server according to the present invention.
Detailed Description
Various aspects and features of the disclosure are described herein with reference to the drawings.
It will be understood that various modifications may be made to the embodiments disclosed herein. Accordingly, the foregoing description should not be construed as limiting, but merely as exemplifications of embodiments. Other modifications will occur to those skilled in the art within the scope and spirit of the disclosure.
The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the disclosure and, together with a general description of the disclosure given above, and the detailed description of the embodiments given below, serve to explain the principles of the disclosure.
These and other characteristics of the invention will become apparent from the following description of a preferred form of embodiment, given as a non-limiting example, with reference to the accompanying drawings.
It should also be understood that, although the invention has been described with reference to some specific examples, a person of skill in the art shall certainly be able to achieve many other equivalent forms of the invention, having the characteristics as set forth in the claims and hence all coming within the field of protection defined thereby.
The above and other aspects, features and advantages of the present disclosure will become more apparent in view of the following detailed description when taken in conjunction with the accompanying drawings.
Specific embodiments of the present disclosure are described hereinafter with reference to the accompanying drawings; however, it is to be understood that the disclosed embodiments are merely examples of the disclosure that may be embodied in various forms. Well-known and/or repeated functions and structures have not been described in detail so as not to obscure the present disclosure with unnecessary or unnecessary detail. Therefore, specific structural and functional details disclosed herein are not to be interpreted as limiting, but merely as a basis for the claims and as a representative basis for teaching one skilled in the art to variously employ the present disclosure in virtually any appropriately detailed structure.
The specification may use the phrases "in one embodiment," "in another embodiment," "in yet another embodiment," or "in other embodiments," which may each refer to one or more of the same or different embodiments in accordance with the disclosure.
The existing big data cluster manages data generated in the cluster through the management of the authority management module, and the authority management module adopts a forced authentication mode, namely the authority management module can manage the database only after the authority management module authenticates the identity of the authority management module. Because the rights management module can involve communication between main bodies (principle) in the cluster when managing data, if the rights management module has a security problem, the data in the whole cluster can be threatened. Therefore, to solve the above problems, embodiments of the present invention provide a method and an apparatus for network security management; further, in order to make the invention more comprehensible, its features and technical contents are described in detail below with reference to the accompanying drawings, which are provided for illustration and are not intended to limit the invention.
Example one
The embodiment provides a network security management method, and particularly, the method is applied to a large data cluster. There are multiple principals in the cluster, where principals may be servers and the principals may communicate with each other. The authority management module performs information interaction with the main body when managing the authority of each main body and generated data, when the authority management module communicates with the main body, the authority certificate file encrypted by hardware is used, so that the main body verifies the identity of the main body, when the main body first detects that the authority certificate file is used for executing an identity authentication operation request, the authority certificate file is obtained, then the authority certificate file is sent to the trusted encryption hardware module so that the trusted encryption hardware module performs decryption operation on the authority certificate file, and then the decrypted authority certificate file is used for performing identity authentication operation. The authority management module can be arranged on one main body in the cluster and can also be arranged on different hosts. Because the trusted encryption hardware module is arranged locally, even if an illegal user obtains the authority certification file, the authority certification file cannot be decrypted, and other operations cannot be performed by using the authority certification file. Therefore, when the authority management module manages the authority, the encrypted authority certification file is used for carrying out identity verification on the authority management module, so that the safety of the authority management module is ensured, and the safety of a network is improved.
Fig. 1 is a flowchart of a first embodiment of a network security management method of the present invention, as shown in fig. 1, the network security management method of this embodiment may specifically include the following steps:
s101, when detecting that the authority certificate file is used for executing the identity authentication operation request, acquiring the authority certificate file.
The execution subject of this embodiment is any server in the cluster. When the server detects that the main body uses the authority certificate file to send the management request for the authority, the authority certificate file needs to be verified. The main body sending the request may be any main body in the cluster, and specifically, the authority management module of the cluster management platform is set on the main body.
S102, sending the authority certificate file to a trusted encryption hardware module; so that the trusted encryption hardware module performs decryption operation on the authority certificate file.
The servers in the cluster of this embodiment all comply with this validation rule by convention. And after the server obtains the authority certificate file, sending the authority certificate file to the trusted encryption hardware module for decryption, and if the decryption is successful, indicating that the identity of the authority management module is legal.
The Trusted encryption hardware Module can be a Trusted Cryptography Module (TCM), which is a microcontroller storing keys, passwords and data certificates, and can ensure the security of data stored in the computer without the risk of external software attack or entity stealing.
And S103, performing identity authentication operation by using the decrypted authority certificate file.
Specifically, if the main body can decrypt the authority certificate file, the decrypted authority certificate file obtains the authentication information of the main body, and a response of corresponding authority can be made to the main body according to the authentication information.
In an application scenario, as shown in fig. 2, a principal a and a server B in a cluster, where the principal a sends a request for performing identity authentication using a permission certificate file C to the server B, the server B first obtains the permission certificate file C and verifies the permission certificate file C, specifically, sends the permission certificate file to a trusted encryption hardware module for decryption, and the decrypted permission certificate file can obtain authentication information of the principal a. Therefore, the server B decrypts the authorization data according to the authorization data of the main body A, and if the decryption is successful, the authentication information in the authority certificate file C can be obtained. Thereby responding to the request of a according to the authentication information of the subject a.
The trusted encryption hardware module of this embodiment is a hardware module disposed locally, so when decrypting the authority certificate file, the trusted encryption hardware module must be called locally to decrypt the authority certificate file; that is, even if an unauthorized user obtains the authority certificate file, the authorized user cannot call the trusted encryption module of the server to decrypt the authority certificate file, and therefore cannot obtain the authentication information described in the authority certificate file. Thereby protecting the security of the network.
According to the technical scheme of the embodiment, the authority certificate file of the main body in the cluster is encrypted by adopting the trusted encryption hardware module, and the response is sent to the main body according to the content of the decrypted request, so that the network security is ensured.
Example two
Based on the method described in the first embodiment, several specific ways of verifying the subject are given in this embodiment.
In a first embodiment, in order to further ensure the security of the network, before invoking the trusted encryption hardware module to perform a decryption operation on the permission certificate file, the server further needs to verify the processing permission of the request, including the following steps: a, verifying the processing authority of the request to obtain a first judgment result; and B, when the first judgment result shows that the request has the authority to execute the identity authentication operation, the trusted encryption hardware module performs decryption operation on the authority certificate file. For example, in one of the application scenarios, the request has timed out, and the server may not respond to the timed-out request.
In another specific embodiment, the method further verifies the authority of the subject sending the request, and includes the following steps: c, judging the access authority of the user sending the request to obtain a second judgment result; and D, when the second judgment result shows that the user has the access right to the authority certificate file, the trusted encryption hardware module carries out decryption operation on the authority certificate file. For example, in another application scenario, if the server determines that the IP address of the request is not legal, the server may not respond to the request, and if the request has legal authentication information and the IP address is legal, the server may respond to the content of the request accordingly. The user sending the request refers to the main body sending the request, and the two are the same semantic. The same is as follows.
In another specific embodiment, the authentication result of the server for the principal indicates that the principal has a legal identity. The server may receive an operation of the rights management by the principal. The method specifically comprises the following steps: e, receiving an access request of a user sending the request according to the result of identity authentication operation of the decrypted authority certificate file; f, sending the access request to the trusted encryption hardware module; g, enabling the trusted encryption hardware module to perform decryption operation on the access request; and responding to the decrypted access request.
In another specific embodiment, to further improve network security, the server may also encrypt the response to the subject. The method specifically comprises the following steps: calling the trusted encryption hardware module to encrypt the response; and I, sending the encrypted response to the user sending the request.
According to the technical scheme, the authority certificate file of the main body in the cluster is encrypted by the trusted encryption hardware module, the authority information of the main body is verified, the response sent to the main body is also encrypted, and the network security is improved from different dimensions.
EXAMPLE III
The embodiment provides a network security management method, and particularly, the method is applied to a large data cluster. There are multiple principals in the cluster, where principals may be servers and the principals may communicate with each other. The authority management module performs information interaction with the main body when managing the authority of each main body and generated data, when the authority management module communicates with the main body, the authority certificate file encrypted by hardware is used, so that the main body verifies the identity of the main body, when the main body first detects that the authority certificate file is used for executing an identity authentication operation request, the authority certificate file is obtained, then the authority certificate file is sent to the trusted encryption hardware module so that the trusted encryption hardware module performs decryption operation on the authority certificate file, and then the decrypted authority certificate file is used for performing identity authentication operation. The authority management module can be arranged on one main body in the cluster and can also be arranged on different hosts. Because the trusted encryption hardware module is arranged locally, even if an illegal user obtains the authority certification file, the authority certification file cannot be decrypted, and other operations cannot be performed by using the authority certification file. Therefore, when the authority management module manages the authority, the encrypted authority certification file is used for carrying out identity verification on the authority management module, so that the safety of the authority management module is ensured, and the safety of a network is improved. Fig. 3 is a flowchart of a third embodiment of the network security management method of the present invention, and as shown in fig. 3, the network security management method of this embodiment may specifically include the following steps:
s301, generating a permission certificate file.
Specifically, when the principal sends an identity authentication request to the server using the authority certificate file, the principal first needs to generate the authority certificate file. The authority certificate file can be generated by the main body itself or generated by a communication protocol server used between the main bodies.
S302, calling a trusted encryption hardware module to encrypt the authority certificate file.
The Trusted encryption hardware Module can be a Trusted Cryptography Module (TCM), which is a microcontroller storing keys, passwords and data certificates, and can ensure the security of data stored in the computer without the risk of external software attack or entity stealing. The trusted encryption hardware module of this embodiment is a hardware module disposed locally, so when encrypting and decrypting an authority certificate file, the trusted encryption hardware module must be called locally to perform decryption and decryption; that is, even if an unauthorized user obtains the authority certificate file, the authorized user cannot call the trusted encryption module of the server to encrypt and decrypt the authority certificate file, and thus cannot obtain the authentication information described in the authority certificate file. Thereby protecting the security of the network.
S303, sending an identity authentication operation request by using the authority certificate file.
Specifically, before requesting from the server, the principal sends the encrypted authority certificate file to the server to request for identity authentication. So that the authority can be subsequently operated after passing the identity authentication.
In a specific embodiment, a response result to the operation request is received. Specifically, a response result of the server to the operation request is received. In practical applications, in order to improve network security, the response result may also be encrypted by using a trusted hardware encryption module, so that the main body needs to decrypt the response result.
According to the technical scheme of the embodiment, the authority certificate file of the main body in the cluster is encrypted by adopting the trusted encryption hardware module, and the response is sent to the main body according to the content of the decrypted request, so that the network security is ensured.
Example four
The embodiment provides a server, which is a server in a cluster. In order to improve the security of a network when each main body in a cluster communicates, the authority of the main body is authenticated during authority management, and when the main body sends an operation request for data, the authority certificate file of the main body needs to be further verified. Because the trusted encryption hardware module is arranged locally, the encryption and decryption processes are both carried out locally, and even if an illegal user obtains the authority certificate file, the authority certificate file cannot be decrypted, so that the network security is improved. Further, as shown in fig. 4, the server includes:
aprocessor 41 configured to obtain the authority certificate file and send the authority certificate file to a trusted encryption hardware module when detecting that an identity authentication operation request is executed by using the authority certificate file;
the trustedencryption hardware module 42 is configured to perform decryption operation on the authority certificate file;
wherein, theprocessor 41 is further configured to perform an identity authentication operation by using the decrypted authority certificate file.
In a specific embodiment, theprocessor 41 is further configured to verify the processing permission of the request before invoking the trusted encryption hardware module to perform a decryption operation on the permission certificate file, obtain a first determination result, and perform a decryption operation on the permission certificate file by the trusted encryption hardware module when the first determination result indicates that the request has the permission to perform the identity authentication operation.
In the fifth embodiment, the first step is,
the embodiment provides a server, which is a server in a cluster. In order to improve the security of a network when each main body in a cluster communicates, the authority of the main body is authenticated during authority management, and when the main body sends an operation request for data, the authority certificate file of the main body needs to be further verified. Because the trusted encryption hardware module is arranged locally, the encryption and decryption processes are both carried out locally, and even if an illegal user obtains the authority certificate file, the authority certificate file cannot be decrypted, so that the network security is improved. Further, as shown in fig. 5, the server includes:
theprocessor 51 is configured to generate a permission certificate file, call a trusted encryption hardware module to encrypt the permission certificate file, and send an identity authentication operation request by using the permission certificate file.
Here, it should be noted that: the description of the embodiment of the electronic device is similar to the description of the method, and has the same beneficial effects as the embodiment of the method, and therefore, the description is omitted. For technical details that are not disclosed in the embodiment of the electronic device of the present invention, those skilled in the art should refer to the description of the embodiment of the method of the present invention to understand that, for the sake of brevity, detailed description is not repeated here.
In the several embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. The above-described device embodiments are merely illustrative, for example, the division of the unit is only a logical functional division, and there may be other division ways in actual implementation, such as: multiple units or components may be combined, or may be integrated into another system, or some features may be omitted, or not implemented. In addition, the coupling, direct coupling or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection between the devices or units may be electrical, mechanical or other forms.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed on a plurality of network units; some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, all the functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately regarded as one unit, or two or more units may be integrated into one unit; the integrated unit can be realized in a form of hardware, or in a form of hardware plus a software functional unit.
Those of ordinary skill in the art will understand that: all or part of the steps for implementing the method embodiments may be implemented by hardware related to program instructions, and the program may be stored in a computer readable storage medium, and when executed, the program performs the steps including the method embodiments; and the aforementioned storage medium includes: a mobile storage device, a Read Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.
Alternatively, the integrated unit of the present invention may be stored in a computer-readable storage medium if it is implemented in the form of a software functional module and sold or used as a separate product. Based on such understanding, the technical solutions of the embodiments of the present invention may be essentially implemented or a part contributing to the prior art may be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the methods described in the embodiments of the present invention. And the aforementioned storage medium includes: a mobile storage device, a Read Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.
The above description is only for the specific embodiments of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present invention, and all the changes or substitutions should be covered within the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the appended claims.
Claims (7)
1. A network security management method, comprising:
when detecting that the authority certificate file is used for executing an identity authentication operation request, acquiring the authority certificate file;
sending the authority certificate file to a trusted encryption hardware module; so that the trusted encryption hardware module carries out decryption operation on the authority certificate file;
carrying out identity authentication operation by using the decrypted authority certificate file;
before the trusted encryption hardware module is called to decrypt the authority certificate file, the method further comprises the following steps: verifying the processing authority of the request to obtain a first judgment result;
judging the access authority of the user sending the request to obtain a second judgment result;
and when the second judgment result shows that the user has the access authority to the authority certificate file and the first judgment result shows that the request has the authority to execute the identity authentication operation, the trusted encryption hardware module performs decryption operation on the authority certificate file.
2. The method of claim 1, further comprising: receiving an access request of a user sending the request according to the result of identity authentication operation of the decrypted authority certificate file;
sending the access request to the trusted cryptographic hardware module; so that the trusted encryption hardware module performs decryption operation on the access request;
and responding to the decrypted access request.
3. The method of claim 2, further comprising:
calling the trusted encryption hardware module to encrypt the response;
and sending the encrypted response to the user sending the request.
4. A network security management method, comprising:
generating an authority certificate file;
calling a trusted encryption hardware module to encrypt the authority certificate file;
and sending an identity authentication operation request by using the authority certificate file so as to verify the identity authentication operation request and the access authority of the user, and decrypting the authority certificate after verifying that the identity authentication operation request has the identity authentication operation and the user has the access authority of the authority certificate file.
5. The method of claim 4, the method comprising: and receiving a response result to the operation request.
6. A server, comprising:
the processor is configured to acquire the authority certificate file and send the authority certificate file to the trusted encryption hardware module when detecting that the authority certificate file is used for executing an identity authentication operation request;
the trusted encryption hardware module is configured to decrypt the authority certificate file;
the processor is further configured to perform identity authentication operation by using the decrypted authority certificate file; the processor is further configured to verify the processing authority of the request before calling the trusted encryption hardware module to perform decryption operation on the authority certificate file, and obtain a first judgment result; judging the access authority of the user sending the request to obtain a second judgment result;
and when the second judgment result shows that the user has the access authority to the authority certificate file and the first judgment result shows that the request has the authority to execute the identity authentication operation, the trusted encryption hardware module performs decryption operation on the authority certificate file.
7. A server, comprising:
the processor is configured to generate an authority certificate file, call a trusted encryption hardware module to encrypt the authority certificate file, and send an identity authentication operation request by using the authority certificate file; so that the identity authentication operation request is verified and the access authority of the user is verified, and the authority certificate is decrypted after the identity authentication operation request is verified to have the authority to execute the identity authentication operation and the user has the access authority to the authority certificate file.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710192013.7ACN106992978B (en) | 2017-03-28 | 2017-03-28 | Network security management method and server |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710192013.7ACN106992978B (en) | 2017-03-28 | 2017-03-28 | Network security management method and server |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106992978A CN106992978A (en) | 2017-07-28 |
| CN106992978Btrue CN106992978B (en) | 2020-08-25 |
Family
ID=59413301
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710192013.7AActiveCN106992978B (en) | 2017-03-28 | 2017-03-28 | Network security management method and server |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106992978B (en) |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107919955B (en)* | 2017-12-28 | 2021-02-26 | 北京奇虎科技有限公司 | A vehicle network security authentication method, system, vehicle, device and medium |
| CN109684864A (en)* | 2018-11-05 | 2019-04-26 | 众安信息技术服务有限公司 | A kind of certificate processing method and system based on block chain |
| CN111756532B (en)* | 2020-06-08 | 2024-06-07 | 西安万像电子科技有限公司 | Data transmission method and device |
| CN115118474A (en)* | 2022-06-20 | 2022-09-27 | 广东省工业边缘智能创新中心有限公司 | Identification query, storage management method, identification agent module and authority management system |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102025503A (en)* | 2010-11-04 | 2011-04-20 | 北京曙光天演信息技术有限公司 | Data security implementation method in cluster environment and high-security cluster |
| CN102207999A (en)* | 2010-03-29 | 2011-10-05 | 国民技术股份有限公司 | Data protection method based on trusted computing cryptography support platform |
| CN104023012A (en)* | 2014-05-30 | 2014-09-03 | 北京金山网络科技有限公司 | Method, device and system for scheduling service in cluster |
| CN104580250A (en)* | 2015-01-29 | 2015-04-29 | 成都卫士通信息产业股份有限公司 | System and method for authenticating credible identities on basis of safety chips |
- 2017
- 2017-03-28CNCN201710192013.7Apatent/CN106992978B/enactiveActive
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102207999A (en)* | 2010-03-29 | 2011-10-05 | 国民技术股份有限公司 | Data protection method based on trusted computing cryptography support platform |
| CN102025503A (en)* | 2010-11-04 | 2011-04-20 | 北京曙光天演信息技术有限公司 | Data security implementation method in cluster environment and high-security cluster |
| CN104023012A (en)* | 2014-05-30 | 2014-09-03 | 北京金山网络科技有限公司 | Method, device and system for scheduling service in cluster |
| CN104580250A (en)* | 2015-01-29 | 2015-04-29 | 成都卫士通信息产业股份有限公司 | System and method for authenticating credible identities on basis of safety chips |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106992978A (en) | 2017-07-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9875368B1 (en) | Remote authorization of usage of protected data in trusted execution environments | |
| KR101530809B1 (en) | Dynamic platform reconfiguration by multi-tenant service providers | |
| US9673979B1 (en) | Hierarchical, deterministic, one-time login tokens | |
| CN109587101B (en) | Digital certificate management method, device and storage medium | |
| CN116458117A (en) | Secure digital signatures | |
| US20140095867A1 (en) | Device, method, and system for secure trust anchor provisioning and protection using tamper-resistant hardware | |
| US20140096213A1 (en) | Method and system for distributed credential usage for android based and other restricted environment devices | |
| WO2020173332A1 (en) | Trusted execution environment-based application activation method and apparatus | |
| US10237057B2 (en) | Method and system for controlling the exchange of privacy-sensitive information | |
| CN102271037A (en) | Key protectors based on online keys | |
| GB2554082B (en) | User sign-in and authentication without passwords | |
| JP2004513420A (en) | Method and apparatus for leveled security access control | |
| CN101605137A (en) | Safe distribution file system | |
| CN110505055B (en) | External network access identity authentication method and system based on asymmetric key pool pair and key fob | |
| JP5452192B2 (en) | Access control system, access control method and program | |
| EP3455763B1 (en) | Digital rights management for anonymous digital content sharing | |
| CN106992978B (en) | Network security management method and server | |
| CN111431840A (en) | Security processing method and device | |
| CN115801232A (en) | Private key protection method, device, equipment and storage medium | |
| CN117157623A (en) | System and method for protecting secrets when used in conjunction with containerized applications | |
| CN114338091A (en) | Data transmission method and device, electronic equipment and storage medium | |
| CN110519222B (en) | External network access identity authentication method and system based on disposable asymmetric key pair and key fob | |
| CN116244750A (en) | Secret-related information maintenance method, device, equipment and storage medium | |
| CN108900595B (en) | Method, apparatus, device and computing medium for accessing cloud storage server data | |
| CN103532961A (en) | Method and system for authenticating identity of power grid website based on trusted crypto modules |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |