A trusted network management method of trusted network connections based on tri-element peer authentication. A trusted management proxy and a trusted management system are respectively installed and configured on a host to be managed and a management host, and are verified as local trusted. When the host to be managed and the management host are not connected to the trusted network, they use the trusted network connection method based on the tri-element peer authentication to connect to the trusted network respectively, and subsequently perform the authentications and the cipher key negotiations of the trusted management proxy and the trusted management system; when the host to be managed and the management host have not completed the user authentication and the cipher key negotiation process, they use the tri-element peer authentication protocol to complete the user authentication and the cipher key negotiation process, then use the tri-element peer authentication protocol to implement the remote trust of the trusted management proxy and the trusted management system, and finally perform network management. The present invention can actively defend attacks, reinforce the safety of the trusted network management architecture, and realize the trusted network management of distributed control and centralized management.

Claims

6 · 1 independent · depth 6

6 granted claims

›1.independentA trusted network management method over a trusted network connection based on tri-element peer authentication, comprising the steps of:n1) installing…+5

A trusted network management method over a trusted network connection based on tri-element peer authentication, comprising the steps of:n1) installing and configuring a trusted management agent residing in a managed host and a trusted management system residing in a managing host;2) verifying the trusted management agent for trustworthiness on the managed host and the trusted management system for local trustworthiness;3) if the managed host and the managing host have not been connected to a trusted network, connecting the managed host and the managing host to the trusted network respectively via a trusted network connection based on tri-element peer authentication, wherein the managed host and the managing host act as an access requestor (AR) in a trusted network connection architecture based on tri-element peer authentication, and then performing the step 4); if the managed host and the managing host have been connected to a trusted network, performing the step 4) directly;4) performing, by the trusted management agent and the trusted management system, authentication and key negotiation;5) if user authentication and key negotiation has not been completed between the managed host and the managing host, firstly performing, by the managing host and the managed host, mutual user authentication in a tri-element peer authentication protocol in which the managed host acts as an AR and the managing host acts as an access controller (AC), and then negotiating by the managed host and the managing host a session key using a primary key generated from the mutual user authentication and subsequently performing the step 6); if user authentication and key negotiation has been completed between the managed host and the managing host, performing the step 6) directly;6) verifying, by the managed host and the managing host, remote trustworthiness of the trusted management agent and the trusted management system in the tri-element peer authentication protocol in which the managed host acts as an AR and the managing host acts as an AC; and7) performing network management.

›2.↳ 1The trusted network management method over a trusted network connection based on tri-element peer authentication according to claim 1, wherein in the …d2+4

›3.↳ 2The trusted network management method over a trusted network connection based on tri-element peer authentication according to claim 2, wherein verifyi…d3+3

›4.↳ 3The trusted network management method over a trusted network connection based on tri-element peer authentication according to claim 3, wherein perform…d4+2

›5.↳ 4The trusted network management method over a trusted network connection based on tri-element peer authentication according to claim 4, wherein verifyi…d5+1

The trusted network management method over a trusted network connection based on tri-element peer authentication according to claim 4, wherein verifying, by the managed host and the managing host, the remote trustworthiness of the trusted management agent and the trusted management system in the tri-element peer authentication protocol in which the managed host acts as an AR and the managing host acts as an AC in the step 6) comprises the following sub-steps of:n6.1) requesting, by the managing host, the managed host for a platform configuration register value corresponding to the trusted management agent on the managed host, and requesting, by the managed host, the managing host for a platform configuration register value corresponding to the trusted management system on the managing host;6.2) retrieving, by the managed host, the platform configuration register value corresponding to the trusted management agent from a local TPM and performing platform attestation identity key (AIK) signing thereon in the TPM, and retrieving, by the managing host, the platform configuration register value corresponding to the trusted management system from the local TPM and performing platform AIK signing thereon in the TPM;6.3) transmitting, by the managing host, the signed platform configuration register values corresponding to the trusted management agent and the trusted management system, measurement logs of the platform configuration register values corresponding to the trusted management agent and the trusted management system, an AIK certificate of the managing host and an AIK certificate of the managed host to a policy manager, and verifying, by the policy manager, the AIK certificates of the managing host and the managed host for validity and checking the platform configuration register values corresponding to the trusted management agent and the trusted management system;6.4) signing, by the policy manager, a result of verifying the AIK certificates of the managing host and the managed host for validity and a result of checking the platform configuration register values corresponding to the trusted management agent and the trusted management system for integrity by using a private key corresponding to an identity certificate of the policy manager, and transmitting the signature, the result of verifying the AIK certificates of the managing host and the managed host for validity and the result of checking the platform configuration register values corresponding to the trusted management agent and the trusted management system for integrity to the managing host, which in turn forwards the same to the managed host; and6.5) judging, by the managing host and the managed host, the remote trustworthiness of the trusted management agent and the trusted management system according to the result of verifying the AIK certificates of the managing host and the managed host for validity and the result of checking the platform configuration register values corresponding to the trusted management agent and the trusted management system for integrity.

Classifications

12 codes

IPC · International Patent Classification

Section G — Physics

G06F17/00
G06F7/04
G06F17/30
G06F15/16

Section H — Electricity

H04L29/06

USPC · US Patent Classification

726/2713/151713/156713/150726/4726/1726/3

Claim changes

Soon

Coming soonHow the claims changed between publication and grant

See which claims were amended, added or cancelled during examination, with every added and removed word marked.

AmendedAddedCancelledUnchanged

The published claims of this patent are not paired with the granted ones in what we hold.

File wrapper

⤢ drag to zoom

USPTOApplicanthover for detail · click to open

Pendency

4.4 y

1,608 days filing → grant

Office actions

non-final + final

Responses

1 RCE

Examiner

Kambiz Zand

art unit 2434 · TC 2400

Law firm

Law firm · Log in to unlock

Citations: 26 back · 0 forward

See the full prosecution history — every USPTO and applicant action on this file, in order.

Term & fees

See the term timeline — pendency span, in-force span, the maintenance fees paid and both computed expiry dates.

Priority chain

1 priority documents

›Priority documents — 1

Type	Document	Date
related publication	US 20110162042 A1	30 Jun 2011

Validity challenges

See the validity challenges on record — reexaminations, IPRs and PGRs, with their institution decisions and outcomes.

Citations

See every patent this one cites and every patent that cites it back — publication, assignee, and how each one was found.