Method for establishing trusted network connect framework of tri-element peer authentication

• US 8,789,134 B2
• Filed: 12/09/2009
• Issued: 07/22/2014
• Est. Priority Date: 04/16/2009
• Status: Active Grant

• Current Assignee: China Iwncomm Co., Ltd
• Original Assignee: China Iwncomm Co., Ltd
• Inventors: Xiao, Yuelei, Cao, Jun, Ge, Li, Huang, Zhenhai
• Primary Examiner(s): Le, Vu
• Assistant Examiner(s): Mangialaschi, Tracy
• Application Number:
  US13/264,683
• Publication Number:
  US 20120036553A1
• Time in Patent Office: 1,686 Days
• Field of Search: 726/1
• US Class Current: 726/1
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks

Abstract

The present invention provides a method for establishing the trusted network connect framework of tri-element peer authentication. The method includes: the implement of trusted network transport interface (IF-TNT); the implement of authentication policy service interface (IF-APS); the implement of trusted network connect (TNC) client-TNC access point interface (IF-TNCCAP); the implement of evaluation policy service interface (IF-EPS); the implement of integrity measurement collector interface (IF-IMC); the implement of integrity measurement verifier interface (IF-IMV); and the implement of integrity measurement (IF-IM). The embodiments of the present invention can establish the trust of the terminals, implement the trusted network connect of the terminals, implement the trusted authentication among the terminals, implement the trusted management of the terminals, and establish the TNC framework based on tri-element peer authentication (TePA) by defining the interfaces.

Claims

1. A method for a tri-element peer authentication (TePA)-based trusted network connect (TNC) architecture, comprising:

configuring an access control mechanism, a network transmission mechanism, and a user authentication protocol using a Trusted Network Transport Interface (IF-TNT) and an Authentication Policy Service Interface (IF-APS);

wherein the access control mechanism utilizes a tri-element peer authentication (TePA) protocol between an access requestor (AR), an access controller (AC), and a policy manager (PM);

wherein the network transmission mechanism utilizes a Trusted Network Connect (TNC) process that comprises encapsulation of TePA protocols between the AR and the AC and between the AC and the PM; and

wherein the user authentication protocol is a TePA protocol executed by the AR, the AC, and the PM so as to achieve user authentication between the AR and the AC, where the PM functions as a trusted third party in the TePA-based authentication protocol;

configuring a network connection management mechanism, a platform authentication protocol management mechanism, and a platform authentication protocol using a TNC Client-TNC Access Point Interface (IF-TNCCAP) and an Evaluation Policy Service Interface (IF-EPS);

wherein the network connection management mechanism includes participation of a TNC client and a TNC access point in network connection management and does not include participation of an evaluation policy server (EPS) in network connection management;

wherein the platform authentication protocol management mechanism includes participation of a TNC client and a TNC access point in platform authentication management;

wherein platform authentication between the access requestor and the access controller is achieved by a platform authentication protocol; and

wherein the platform authentication protocol is a TePA protocol executed by a TNC client, a TNC access point, and the evaluation policy server so as to achieve platform authentication between the AR and the AC, where the PM functions as a trusted third party;

performing an integrity check handshake at an Integrity Measurement Collector Interface (IF-IMC) in the access requestor and an integrity check handshake at the IF-IMC in the access controller according to a first function using the IF-IMC;

performing an integrity handshake at an Integrity Measurement Verifier Interface (IF-IMV) in the policy manager according to a second function using the IF-IMV; and

using an Integrity Measurement Interface (IF-IMC) for intercommunication between an Integrity Measurement Collector (IMC) and an Integrity Measurement Verifier (IMV) to transport a message, wherein an encapsulation method is used for the message transported between the AR, the AC and the PM.

2. The method of claim 1, wherein the user authentication protocol is configured using the IF-TNT and the IF-APS so that, if user authentication between the access requestor and the access controller has been performed and a security association between the access requestor and the access controller is still valid, then user authentication between the access requestor and the access controller is performed by using the security association between the access requestor and the access controller;

otherwise, user authentication between the access requestor and the access controller is performed by the access requestor, the access controller and an authentication policy server executing the tri-element peer authentication protocol, with the authentication policy server being a trusted third party.

3. The method of claim 1, further comprising configuring a network transport protocol using the IF-TNT and the IF-APS, wherein the network transport protocol is configured to encapsulate and transport user authentication protocol data and platform authentication protocol data in the same way as an Extensible Authentication Protocol (EAP)-tunneled encapsulation and transport mechanism, wherein the user authentication protocol data is encapsulated into an encapsulation transport packet, and the platform authentication protocol data is firstly encapsulated into a first encapsulation transport packet and protected by a security tunnel, and then the first encapsulation transport packet that is protected by the security tunnel is further encapsulated into a second encapsulation transport packet.

4. The method of claim 1, further comprising configuring a network transport protocol using the IF-INT and the IF-APS, wherein the network transport protocol is configured to encapsulate and transport user authentication protocol data and platform authentication protocol data by encapsulation transport mechanisms that are independent of each other, wherein the user authentication protocol data is independently encapsulated into a first encapsulation transport packet, and the platform authentication protocol data is independently encapsulated into a second encapsulation transport packet and protected by a security tunnel.

5. The method of claim 1, further comprising configuring an access control protocol using the IF-TNT, wherein the access control protocol is an access control method based on tri-element peer authentication.

6. The method of claim 1, wherein the IF-TNCCAP network connection management mechanism between the TNC client and the TNC access point comprises the TNC client creating a local network connect identifier for each TNC client-TNC access point pair, to identify each TNC process;

the TNC access point creating a local network connect identifier for each TNC client-TNC access point pair, to identify each TNC process;

in a process of TNC, firstly a TNC client, a TNC access point and an evaluation policy server perform a first process of platform authentication, and if platform remediation is needed after performing the process of platform authentication, or if an evaluation policy is changed, then the TNC client, the TNC access point and the evaluation policy server perform a second process of platform authentication, with the TNC client and the TNC access point maintaining the network connect identifiers created, until the process of TNC ends.

7. The method of claim 1, wherein the IF-TNCCAP/IF-EPS platform authentication protocol is a tri-element peer authentication protocol executed by a TNC client, a TNC access point and an evaluation policy server, wherein the TNC client and the TNC access point request an integrity measurement value of each other'"'"'s platform, the TNC client and the TNC access point verify only a platform signature of the integrity measurement value of each other'"'"'s platform, and the evaluation policy server verifies validity of platform identity certificates and evaluates the integrity measurement values.

8. The method of claim 1, wherein the IF-TNCCAP platform authentication protocol management mechanism uses a process of platform authentication, wherein the platform authentication protocol is executed for a plurality of rounds by a TNC client, a TNC access point and an evaluation policy server, wherein, in each of the rounds of the platform authentication protocol, the TNC client and the TNC access point send an integrity measurement parameter of each other'"'"'s platform that is requested to be measured, and send an integrity measurement parameter that is obtained from measurement to the evaluation policy server;

and when a first round of platform authentication protocol is completed, if the integrity measurement parameter requested to be measured is different from the integrity measurement parameter obtained from measurement, then a second round of platform authentication protocol is performed by the TNC client, the TNC access point and the evaluation policy server, otherwise, the process of platform authentication is successfully completed.

9. The method of claim 1, further comprising routing an integrity measurement layer message using an encapsulation mechanism for the integrity measurement layer message, wherein the encapsulation mechanism of the integrity measurement layer message is configured using the IF-TNCCAP and the IF-EPS, and wherein the encapsulation mechanism comprises encapsulating in an encapsulation format comprising a message type, an integrity measurement collector identifier and the integrity measurement layer message.

10. The method of claim 1, wherein the first function comprises:

a TNC client finding and loading an IMC in the access requestor;

the TNC client initializing the IMC in the access requestor;

the IMC in the access requestor reporting its supported message type to the TNC client;

the TNC client notifying the IMC in the access requestor of a network connect status;

the TNC client notifying the IMC in the access requestor of an integrity measurement parameter that is requested to be measured;

the IMC in the access requestor sending an integrity measurement layer message to the TNC client;

the IMC in the access requestor providing Platform Configuration Register (PCR) reference data in an integrity measurement value to the TNC client, comprising referenced PCR values and a platform signature on the referenced PCR values;

the TNC client notifying the IMC in the access requestor that the message of a current round of platform authentication protocol is to be sent and asking the IMC in the access requestor to stop collecting the integrity measurement value;

the TNC client sending a received integrity measurement layer message to the IMC in the access requestor;

the TNC client terminating the IMC in the access requestor; and

the IMC in the access requestor requesting the TNC client to perform the integrity check handshake again.

11. The method of claim 1, wherein the first function comprises:

a TNC access point finding and loading an IMC in the access controller;

the TNC access point initializing the IMC in the access controller;

the IMC in the access controller reporting its supported message type to the TNC access point;

the TNC access point notifying the IMC in the access controller of a network connect status;

the TNC access point notifying an integrity measurement parameter that is required to be measured to the IMC in the access controller;

the IMC in the access controller sending an integrity measurement layer message to the TNC access point;

the IMC in the access controller providing PCR reference data in an integrity measurement value to the TNC access point, comprising referenced PCR values and a platform signature on the referenced PCR values;

the TNC access point notifying the IMC in the access controller that the message of a current round of platform authentication protocol is to be sent and asking the IMC in the access controller to stop collecting the integrity measurement value;

the TNC access point sending a received integrity measurement layer message to the IMC in the access controller;

the TNC access point terminating the IMC in the access controller; and

the IMC in the access controller requesting the TNC access point to perform the integrity check handshake again.

12. The method of claim 1, wherein the second function comprises:

an evaluation policy server finding and loading an IMV in a policy manager;

the evaluation policy server initializing the IMV in the policy manager;

the IMV in the policy manager reporting its supported message type to the evaluation policy server;

the evaluation policy server notifying the IMV in the policy manager of an evaluation policy that needs to be set in the round of platform authentication protocol;

the evaluation policy server sending a received integrity measurement layer message to the IMV in the policy manager;

the IMV in the policy manager sending an integrity measurement layer message to the evaluation policy server;

the IMV in the policy manager providing PCR reference data in an integrity measurement value to the evaluation policy server, comprising referenced PCR values and a platform signature on the referenced PCR values;

the IMV in the policy manager providing a component-level evaluation result to the evaluation policy server; and

the evaluation policy server terminating the IMV in the policy manager.

13. The method of claim 1, wherein the encapsulation method for the IF-IM is the same as an encapsulation method for an IF-M in a TCG-TNC architecture.

14. The method of claim 1, further comprising dynamically distributing an evaluation policy for an access requestor using an evaluation policy dynamic distribution mechanism.

15. The method of claim 14, wherein the evaluation policy dynamic distribution mechanism comprises:

a TNC access point requesting an evaluation policy for an access requestor from an evaluation policy server, and the evaluation policy server returning the evaluation policy for the access requestor to the TNC access point.