CN101827106A - DHCP safety communication method, device and system - Google Patents

Abstract

An embodiment of the present invention provides a DHCP secure communication method, comprising: the server receives the first message sent by the client, the first message includes an access challenge request, and is used to request the server to authenticate the client; the server generates a server end message, and encrypt it to obtain the server-side ciphertext; the server sends the first response to the client, and the first response includes the server-side ciphertext; the server receives the second message returned by the client, and the second message includes the server-side message, The server-side message is obtained after the client decrypts the server-side ciphertext; the server-side verifies whether the server-side message in the second message is consistent with the server-side message stored locally by the server-side, and if they are consistent, the server-side confirms that the client-side is credible. In addition, the embodiment of the present invention also provides a server device and a client device.

Description

A DHCP secure communication method, device and system

technical field

Embodiments of the present invention relate to the field of network technology, in particular to a DHCP (Dynamic Host Configuration Protocol, Dynamic Host Configuration Protocol) secure communication method, device and system.

Background technique

With the development of network technology, network equipment has been widely used. Since the topology of the network is easy to change, many network devices need to obtain IP addresses dynamically to access the network. In the current implementation scheme, many of these network devices support DHCP, and an external DHCP SERVER (server) assigns a dynamic IP address. However, DHCP itself does not consider any security measures, and there will be many security risks in practical applications, making DHCP SERVER vulnerable to illegal attacks.

In an existing solution, when a network device (that is, a client) initiates a request to a DHCP SERVER (that is, a server), it carries its own ID (identity) in the request, and the server identifies the client according to the client's ID. Whether it is credible, and if it is credible, the client is allowed to access. Since the ID of the client is provided by the client itself, an attacker can easily intercept the identity information of the client, thereby forging the identity to launch an illegal attack on the server, resulting in poor security of the network system.

Contents of the invention

Embodiments of the present invention provide a DHCP secure communication method, device and system.

On the one hand, the embodiment of the present invention provides a DHCP secure communication method, the method includes: the server receives the first message sent by the client, the first message includes an access challenge request, and the access challenge request is used to request the server to Authenticate the client; the server generates a server-side message and encrypts it to obtain the server-side ciphertext; the server sends the first response to the client, and the first response includes the server-side ciphertext; the server receives the first response returned by the client Two messages, the second message includes a server-side message, wherein the server-side message in the second message is obtained after the client decrypts the server-side ciphertext; the server-side verifies the server-side message in the second message and the server-side message stored locally on the server side If the message is consistent, the server will confirm that the client is credible.

On the one hand, the embodiment of the present invention provides a DHCP secure communication method, the method includes: the server receives the first message sent by the client, the first message includes an access challenge request, and the access challenge request is used to request the server to The client authenticates the client; the server generates a server-side message and encrypts it to obtain the server-side ciphertext; the server sends the first response to the client, and the first response includes the server-side ciphertext; the server receives the ciphertext returned by the client The second message, the second message includes the second ciphertext of the client; wherein the second ciphertext of the client is obtained by encrypting the combination of the server-side message and the client-side message by the client, and the server-side message is obtained by encrypting the server-side ciphertext by the client Obtained after decryption; the server side decrypts the second ciphertext of the client to obtain the server side message; the server side verifies whether the decrypted server side message is consistent with the server side message stored locally on the server side, and if they are consistent, the server side confirms that the client side is credible .

On the one hand, the embodiment of the present invention provides a DHCP secure communication method, the method includes: the client sends a first message to the server, the first message includes an access challenge request, and the access challenge request is used to request the server to The client is authenticated; the client receives the first response returned by the server, and the first response includes the server-side ciphertext; the client decrypts the server-side ciphertext to obtain a server-side message, the client generates a client-side message, and Encrypt the client message to obtain the first ciphertext of the client or encrypt the combination of the server message and the client message to obtain the second ciphertext of the client; the client sends the second message to the server, and the second message includes the server message and the first ciphertext of the client, or the second message includes the second ciphertext of the client; the client receives the second response returned by the server, and the second response includes a client message, wherein the client message is sent by the server to the client The first ciphertext or the second ciphertext of the client is decrypted; the client verifies whether the received client message is consistent with the client message stored locally by the client; if so, the client confirms that the server is trustworthy.

On the other hand, an embodiment of the present invention provides a server device, including: a first receiving module, configured to receive a first message sent by a client, the first message includes an access challenge request, and the access challenge request is used to Requesting the server to authenticate the client; the generating module is used to generate server-side ciphertext after the first receiving module receives the access challenge request; the first sending module is used to send the first response to the client, the first The response includes the server-side ciphertext generated by the generating module; the second receiving module is used to receive the second message returned by the client, and the second message includes the server-side message obtained after the client decrypts the server-side ciphertext; the verification module, It is used to verify whether the server-side message in the second message is consistent with the server-side message stored locally by the server, and confirm that the client is credible if they are consistent.

On the other hand, the embodiment of the present invention also provides a server device, including: a first receiving module, configured to receive a first message sent by a client, the first message includes an access challenge request, and the access challenge request uses To request the server to authenticate the client; the generation module is used to generate server-side ciphertext after the first receiving module receives the access challenge request; the first sending module is used to send the first response to the client, and the first sending module is used to send the first response to the client. A response includes the server-side ciphertext generated by the generating module; the second receiving module is used to receive the second message returned by the client, and the second message includes the second ciphertext of the client; wherein the second ciphertext of the client is generated by the client The combination of the server-side message and the client-side message is encrypted, and the server-side message is obtained by decrypting the server-side ciphertext by the client; the decryption module is used to decrypt the second ciphertext of the client to obtain the server-side message; the second receiving module server Check whether the server-side message is consistent with the server-side message stored locally on the server-side, and if they are consistent, confirm that the client is credible.

In yet another aspect, the embodiment of the present invention also provides a client device, including: a first sending module, configured to send a first message to the server, the first message includes an access challenge request, and the access challenge request is used for The server is requested to authenticate the client; the first receiving module is used to receive the first response returned by the server, and the first response includes the server-side ciphertext; the first decryption module is used to decrypt the server-side ciphertext to obtain The server-side message; the generation module is used to generate the client-side message; the encryption module is used to encrypt the client-side message to obtain the first ciphertext of the client or to encrypt the combination of the server-side message and the client-side message to obtain the second ciphertext of the client Ciphertext; the second sending module is used to send a second message to the server, the second message includes the server-side message and the first ciphertext of the client, or the second message includes the second ciphertext of the client; the second receiving module, Used to receive a second response returned by the server, the second response includes a client message, wherein the client message in the second response is obtained by the server decrypting the first ciphertext of the client or the second ciphertext of the client; verifying A module for verifying whether the client message received by the second receiving module is consistent with the client message locally stored by the client, and confirming that the server is credible if they are consistent.

In another aspect, an embodiment of the present invention provides a system, including the above client device and server device.

In the embodiment of the present invention, the server sends the encrypted server-side message to the client, and verifies whether the server-side message returned by the client is consistent with the server-side message stored locally by the server. If they are consistent, it is confirmed that the client can decrypt correctly. Thus, the server confirms that the client is authentic. The method can effectively verify the legitimacy of the client, reduce or avoid illegal attacks on the server, and improve the security of network applications.

Description of drawings

FIG. 1 is a schematic flowchart of a DHCP secure communication method provided by an embodiment of the present invention.

FIG. 2 is a schematic flowchart of another DHCP secure communication method provided by an embodiment of the present invention.

FIG. 3 is a schematic flowchart of another DHCP secure communication method provided by an embodiment of the present invention.

FIG. 4 is a schematic flowchart of another DHCP secure communication method provided by an embodiment of the present invention.

FIG. 5 is a schematic structural diagram of a server device provided by an embodiment of the present invention.

FIG. 6 is a schematic structural diagram of another server-side device provided by an embodiment of the present invention.

FIG. 7 is a schematic structural diagram of a client device provided by an embodiment of the present invention.

Detailed ways

The embodiments of the present invention will be specifically described below in conjunction with the accompanying drawings. Apparently, the embodiments described below are only some of the embodiments of the present invention, not all of them.

Please refer to FIG. 1 . FIG. 1 is a DHCP secure communication method provided by an embodiment of the present invention. The method mainly includes the following steps.

Step 102, the server receives a first message sent by the client, where the first message includes an access challenge request, and the access challenge request is used to request the server to authenticate the client.

Step 104, the server side generates a server side message, and encrypts the server side message to obtain a server side ciphertext.

After receiving the access challenge request, the server generates server ciphertext to verify whether the client is reliable or trustworthy. In a specific application, the server-side message may be a random number, and the server-side ciphertext can be obtained by encrypting the random number. The encryption algorithm adopted by the server side may be an asymmetric algorithm or a symmetric algorithm. Taking the asymmetric algorithm as an example, considering that one server often corresponds to multiple clients, in order to reduce the workload of the server, the server-side shared key generated by the server and the client in the last authentication process can be used to pair the random number to encrypt.

Step 106, the server sends a first response to the client, where the first response includes server-side ciphertext.

Step 108, the server receives the second message returned by the client, the second message includes the server message; the server message in the second message is obtained by the client decrypting the server ciphertext.

When the client decrypts the server-side ciphertext, it can use the client private key generated by the server and the client during the last authentication process to decrypt.

Further, the second message may also include the first ciphertext of the client. In this embodiment, the first ciphertext of the client is obtained after the client encrypts the client message. The client message can also be a random number. When encrypting, the random number can be encrypted with the client shared key generated by the server and the client during the last authentication process to obtain the first ciphertext of the client.

Step 110, the server side verifies that the received server side message is consistent with the server side message stored locally by the server side.

In order to verify whether the client is credible, the server can proceed by verifying whether the client can correctly decrypt the server-side ciphertext. Specifically, the server verifies whether the server-side message returned by the client (that is, the server-side message included in the second message) is consistent with the server-side message locally stored on the server side.

Step 112, if the server message received by the server is consistent with the server message locally stored by the server, the server confirms that the client is authentic.

When the server-side message received by the server-side is consistent with the server-side message locally stored by the server-side, the server-side considers that the client-side can correctly decrypt the server-side ciphertext, and thus considers that the client-side is authentic.

Further, if the second message can also include the first ciphertext of the client, the server can also decrypt the first ciphertext of the client to obtain the client message, and send a second response to the client, wherein the second response Include the decrypted client message. By sending a client message to the client, the client can verify whether the server is credible.

In this embodiment, the server sends the encrypted server-side message to the client, that is, the server-side ciphertext, and verifies whether the server-side message returned by the client is consistent with the client-side message stored locally on the server-side. can be decrypted correctly, confirming that the client is authentic. This method can effectively verify the legitimacy of the client, reduce or avoid illegal attacks on the server, and improve the security of network applications

It should be pointed out that, in addition to being applied to the Internet, the embodiment of the present invention can also be applied to a communication network system supporting the DHCP protocol and the IP protocol, such as a wireless communication network, wherein the client end can specifically be a base station, and the server end can specifically be a The base station controller, or other application manners, are not limited in this embodiment of the present invention.

Please refer to FIG. 2 . FIG. 2 is another DHCP secure communication method provided by an embodiment of the present invention. The method mainly includes the following steps.

Steps 202-206 are substantially the same as steps 102-106, details may refer to the previous embodiment, and will not be described in detail here.

Step 208, the server side receives the second message returned by the client, the second message includes the second ciphertext of the client; wherein the second ciphertext of the client is obtained by encrypting the combination of the server-side message and the client-side message by the client, and the server The terminal message is obtained by the client decrypting the server-side ciphertext.

Both the server-side message and the client-side message can be a random number. After combining the server-side message and the client-side message, a random number string is obtained, and the random number string is encrypted to obtain the second ciphertext of the client. If an asymmetric algorithm is used, the random number string may be encrypted using the client shared key generated by the server and the client during the last authentication process.

Step 210, the server side decrypts the second ciphertext of the client side to obtain the server side message.

After the server side decrypts the second ciphertext of the client side, it obtains a combination of the server side message and the client side message, such as a random number string, and then obtains the server side message and the client side message according to the structure of the combination.

Usually in a message, the following parts are included: message type, message length and message content. When the server-side message and the client-side message are combined, a combination structure may be the server-side message type, the server-side message length, the server-side message content, the client-side message type, the client-side message length, and the client-side message content. Or it may be other combination structures, for example, placing the client message before the server message, which is not limited in this embodiment of the present invention.

When decrypting, the asymmetric algorithm is still used as an example for illustration. Since the client encrypts the random number string using the client’s shared key generated by the server and the client in the previous authentication process, correspondingly, the server The random number string can be decrypted by using the server-side private key generated in the last authentication process of the server-side and the client-side.

Step 212, the server side verifies whether the decrypted server side message is consistent with the server side message stored locally on the server side.

In order to verify whether the client is credible, the server can proceed by verifying whether the client can correctly decrypt the server-side ciphertext. Specifically, after the server decrypts the second message returned by the client to obtain the server-side message, it verifies whether the decrypted server-side message is consistent with the server-side message locally stored by the server.

Step 214, if the server-side message obtained after decryption by the server side is consistent with the server-side message stored locally by the server side, then the server side confirms that the client side is authentic.

When the server-side message obtained after the server-side decryption is consistent with the server-side message stored locally on the server-side, the server-side believes that the client-side can correctly decrypt the server-side ciphertext, and thus considers the client-side to be credible.

In this embodiment, the server sends the encrypted server-side message to the client, that is, the server-side ciphertext, and decrypts the second message returned by the client. Consistent, to confirm whether the client can decrypt correctly, so as to confirm whether the client is trustworthy. The method can effectively verify the legitimacy of the client, reduce or avoid illegal attacks on the server, and improve the security of network applications.

Please refer to FIG. 3 . FIG. 3 is another DHCP secure communication method provided by an embodiment of the present invention. The method mainly includes the following steps.

Step 302, the client sends a first message to the server, where the first message includes an access challenge request, and the access challenge request is used to request the server to authenticate the client.

In step 304, the client receives the first response returned by the server, and the first response includes the ciphertext of the server.

The server-side ciphertext is obtained by encrypting the server-side message on the server side. In a specific application, the server-side message may be a random number, and the server-side ciphertext can be obtained by encrypting the random number. The encryption algorithm adopted by the server side may be an asymmetric algorithm or a symmetric algorithm. Taking the asymmetric algorithm as an example, considering that one server often corresponds to multiple clients, in order to reduce the workload of the server, the server-side shared key generated by the server and the client in the last authentication process can be used to pair the random number to encrypt.

Step 306, the client decrypts the server-side ciphertext to obtain the server-side message, and generates the client-side first ciphertext or the client-side second ciphertext.

The client generates a client message, and encrypts the client message to obtain the first ciphertext of the client; or the client encrypts a combination of the server message and the client message to obtain the second ciphertext of the client.

In a specific application, the client message can be a random number. Encrypt the random number to obtain the first ciphertext of the client; or combine the server-side message and the client-side message to obtain a random number string, encrypt the random number string to obtain the second ciphertext of the client, and use asymmetric The algorithm is used as an example to illustrate. When encrypting, the client shared key generated by the server and the client during the previous authentication process can be used for encryption.

Step 308, the client sends a second message to the server, the second message includes the server message and the client's first ciphertext, or the second message includes the client's second ciphertext.

Taking the asymmetric algorithm as an example, in actual application, before step 308, the client can also regenerate a client private key and a client public key in this authentication process (that is, generate a new client private key and A new client public key), the specific algorithm can refer to the existing technology, and will not be described in detail here.

The client can further save the regenerated client private key.

The client may also carry the new client public key in the second message, so as to ensure that the server can generate a new server-side shared key according to the new client-side public key in this authentication process.

Step 310, the client receives the second response returned by the server, where the second response includes the client message.

After the server receives the second message, if it verifies that the server message contained in the second message is consistent with the server message stored locally by the server, it will confirm that the client is authentic. Further, the server will decrypt the first ciphertext of the client to obtain the server-side message; the server will send the server-side message obtained after decrypting the first ciphertext of the client to the client, so that the client can verify the server-side Is it credible.

Or, after receiving the second message, the server decrypts the second ciphertext of the client to obtain the server message and the client message, and verifies that the decrypted server message is consistent with the server message stored locally on the server, will confirm that the client is trusted. Further, the server sends the server message obtained after decrypting the second ciphertext of the client to the client, so that the client can verify whether the server is credible.

In step 312, the client verifies whether the received client message is consistent with the client message locally stored by the client.

Step 314, if the client message received by the client is consistent with the client message locally stored by the client, the client confirms that the server is authentic.

When the client message received by the client is consistent with the client message stored locally by the client, the client believes that the server can correctly decrypt the client ciphertext, and thus considers the server to be credible.

In actual application, in order to further strengthen the secure communication between the server and the client, the client message in step 310 can also be the client message re-encrypted by the server, and the server can use the last authentication process when encrypting The server-side shared key generated in ; correspondingly, for the client, the private key generated by the client in the last authentication process is used for decryption. Or, the server can also use the server-side shared key generated in this authentication process when encrypting. At this time, the server needs to further send the new server-side public key generated in this authentication process to the client. The terminal generates a new client shared key based on the new server-side public key, that is, the client shared key generated in this authentication process.

In addition, in step 310, the second response may also include the IP address assigned by the server to the client; then in step 314, after the client confirms that the server is credible, it may also include: the client obtains the IP address, and communicates with the server establish connection.

In this embodiment, after the server has passed the authentication of the client, the client further authenticates the server, which can further strengthen the secure communication between the server and the client.

Please refer to FIG. 4 . FIG. 4 is another DHCP secure communication method provided by an embodiment of the present invention. The encryption algorithm used in this embodiment is an asymmetric algorithm. The method mainly includes the following steps.

Step 402, the client sends a first message to the server, where the first message includes an access challenge request, and the access challenge request is used to request the server to authenticate the client.

Considering the compatibility with the DHCP protocol, the first message in this embodiment may be a DHCPDISCOVER/OPTION message. Further, the DHCP DISCOVER/OPTION message may also carry a client ID and a timestamp.

Step 404, the server side generates and encrypts the server side message, and generates the first server side message summary.

In this embodiment, the server-side message may be a random number s, and the server-side ciphertext can be obtained by encrypting the random number s. The first information digest at the server side can be used to prevent the ciphertext at the server side from being tampered with.

Considering that one server often corresponds to multiple clients, in order to reduce the workload of the server, the random number s can be encrypted using the server-side shared key generated during the last authentication process between the server and the client.

Step 406, the server sends a first response to the client, where the first response includes the server-side ciphertext and the server-side first information digest.

Here, the first response may be a DHCP OFFER/OPTION message.

Step 408, the client decrypts the server-side ciphertext to obtain the server-side message. The client generates a client message, and encrypts the combination of the server message and the client message to obtain the second ciphertext of the client. The client also generates a summary of client information. In addition, the client also generates a client public key and a client private key.

Apparently, the client public key and client private key generated in step 408 are new client public keys and client private keys generated during this authentication process.

The client information digest can be used to prevent the second ciphertext of the client from being tampered with.

In this embodiment, the client message can be a random number c, and a combination of the server-side message and the client message is c-s, that is, the random number c and the random number s are combined to obtain a random number string c-s, and the random number c-s is encrypted to obtain For the second ciphertext of the client, for example, the random number string c-s may be encrypted using the client shared key generated by the server and the client during the last authentication process.

Step 410, the client sends a second message to the server, and the second message includes the client's second ciphertext, the client's public key and the client's information digest.

During specific implementation, the second message may be a DHCP REQUEST/OPTION message, and the DHCP REQUEST/OPTION message carries the client public key, the client information digest and the encrypted random number string c-s.

Step 412, the server side decrypts the second ciphertext of the client side to obtain the server side message and the client side message, and when the decrypted server side message is consistent with the server side message stored locally by the server side, it is confirmed that the client side is authentic.

Specifically, when decrypting, the random number string c-s is encrypted with the server-side private key generated in the last server-side and client-side authentication process to obtain random number c and random number s. If the random number s does not occur Change, confirm that the client is trusted.

The server also generates a server-side public key and a server-side private key, and generates a server-side second information summary.

In addition, the server generates a server-side shared key according to the client public key; further, the server uses the server-side shared key to encrypt client messages such as the random number c.

In step 414, the server returns a second response to the client, and the second response includes the server public key, the encrypted client message, and the second information summary of the server.

The second information digest at the server end is used to prevent the encrypted client message from being tampered with.

Specifically, the second response may be a DHCP ACK message, and the DHCP ACK message carries the server-side public key, the encrypted random number c, and the server-side second information digest.

Step 416, the client decrypts to obtain the client message, and when the decrypted client message is consistent with the client message locally stored by the client, it is confirmed that the server is authentic.

Specifically, when decrypting, the client uses the client private key generated in this authentication process (that is, the client private key generated in step 408) to decrypt to obtain the random number c. If the random number c has not changed, Then confirm that the server is trusted.

In this embodiment, for the server side, the legitimacy of the client side can be effectively verified, and for the client side, the legitimacy of the server side can be effectively verified, thereby ensuring secure communication between the client side and the server side, reducing or avoiding the server side Illegal attacks suffered, improve the security of network applications.

FIG. 5 is a schematic structural diagram of a server device provided by an embodiment of the present invention. The device mainly includes: a first receiving module 502 , a generating module 504 , a first sending module 506 , a second receiving module 508 and a verification module 510 .

The first receiving module 502 is configured to receive the first message sent by the client, the first message includes an access challenge request, and the access challenge request is used to request the server to authenticate the client; the generating module 504 uses Generate a server-side ciphertext after the first receiving module 502 receives the access challenge request; the first sending module 506 is configured to send a first response to the client, and the first response includes the server-side ciphertext generated by the generating module 504; The second receiving module 508 is used to receive the second message returned by the client. The second message includes the server-side message obtained after the client decrypts the server-side ciphertext; the verification module 510 is used to verify the server in the second message. Check whether the server-side message is consistent with the server-side message stored locally on the server-side, and confirm that the client is credible if they are consistent.

When generating the server-side ciphertext, the generation module 504 generates a server-side message and encrypts the server-side ciphertext. For example, for an asymmetric algorithm, the server-side and the server-side generated during the last authentication process of the client can be used. The shared key encrypts the random number.

If the second message also includes the first ciphertext of the client, the server may also include a decryption module and a second sending module, where the decryption module is used to send the first ciphertext to the client after the verification module 510 confirms that the client is authentic. The text is decrypted to obtain a client message, and the second sending module is configured to send a second response to the client, wherein the second response includes the client message.

In this embodiment, the server sends the encrypted server-side message to the client, that is, the server-side ciphertext, and verifies whether the server-side message returned by the client is consistent with the client-side message stored locally on the server-side. can be decrypted correctly, confirming that the client is authentic. This method can effectively verify the legitimacy of the client, reduce or avoid illegal attacks on the server, and improve the security of network applications

FIG. 6 is a schematic structural diagram of another server-side device provided by an embodiment of the present invention. The device mainly includes: a first receiving module 602 , a generating module 604 , a first sending module 606 , a second receiving module 608 , a decryption module 610 and a verification module 612 .

The first receiving module 602 is configured to receive the first message sent by the client, the first message includes an access challenge request, and the access challenge request is used to request the server to authenticate the client; the generating module 604 uses After the first receiving module receives the access challenge request, the server-side ciphertext is generated; the first sending module 606 is configured to send a first response to the client, and the first response includes the server-side ciphertext generated by the generating module 604; Two receiving module 608, configured to receive the second message returned by the client, the second message includes the second ciphertext of the client; wherein the second ciphertext of the client is obtained by encrypting the combination of the server-side message and the client-side message by the client , the server-side message is obtained after the client decrypts the server-side ciphertext; the decryption module 610 is used to decrypt the second ciphertext of the client to obtain the server-side message; the verification module 612 is used to verify the decrypted server-side message and the server-side message Check whether the server-side messages stored locally on the client side are consistent, and if they are consistent, confirm that the client side is credible.

When generating the server-side ciphertext, the generation module 602 generates a server-side message and encrypts the server-side ciphertext. For example, for an asymmetric algorithm, the server-side and the server-side generated during the last authentication process of the client can be used. The shared key encrypts the random number.

Since the decryption module 610 decrypts the second ciphertext of the client to obtain the client message in addition to the server message, the server may further include a second sending module for sending a second response to the client, wherein the second The response includes the client message.

In this embodiment, the server sends the encrypted server-side message to the client, that is, the server-side ciphertext, and decrypts the second message returned by the client. Consistent, to confirm whether the client can decrypt correctly, so as to confirm whether the client is trustworthy. The method can effectively verify the legitimacy of the client, reduce or avoid illegal attacks on the server, and improve the security of network applications.

FIG. 7 is a schematic structural diagram of a client device provided by an embodiment of the present invention. The device mainly includes: a first sending module 702 , a first receiving module 704 , a first decryption module 706 , a generating module 708 , an encryption module 710 , a second sending module 712 , a second receiving module 714 , and a verification module 716 .

Wherein, the first sending module 702 is configured to send a first message to the server, the first message includes an access challenge request, and the access challenge request is used to request the server to authenticate the client; the first receiving module 704, For receiving the first response returned by the server, the first response includes the server-side ciphertext; the first decryption module 706 is used to decrypt the server-side ciphertext to obtain the server-side message; the generation module 708 is used to generate the client-side message The encryption module 710 is used to encrypt the client message to obtain the first ciphertext of the client or to encrypt the combination of the server-side message and the client message to obtain the second ciphertext of the client; the second sending module 712 is used to send The server sends a second message, the second message includes the server message and the first ciphertext of the client, or the second message includes the second ciphertext of the client; the second receiving module 714 is configured to receive the second response returned by the server , the second response includes a client message, wherein the client message is obtained by decrypting the first ciphertext of the client or the second ciphertext of the client by the server; the verification module 716 is used to verify that the received client message is consistent with the client Check whether the locally saved client messages are consistent, and if they are consistent, confirm that the server is credible.

Further, if the client message in the second response is a client message re-encrypted by the server; then the client device further includes a second decryption module, configured to decrypt the re-encrypted client message . The verification module 716 is used to confirm whether the client message obtained after decryption is consistent with the client message stored locally by the client, and confirm that the server is credible if they are consistent.

In addition, if the second response also includes the IP address allocated by the server to the client, the client device may further include a connection establishment module, configured to obtain the IP address allocated by the server to the client, and establish a connection with the server.

In this embodiment, after the server has passed the authentication to the client, it returns a client message to the client, and the client verifies whether the returned client message remains unchanged, thereby realizing authentication to the server and further strengthening the server. secure communication with clients.

In addition, the embodiment of the present invention also provides a system, the system includes a server-end device and a client device. Wherein, the specific implementation manner of installing a child on the client device or the server side can refer to the above-mentioned embodiments, and will not be described in detail here.

Those skilled in the art can understand that all or part of the steps in the methods of all the above embodiments can be implemented by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (15)

1. a DHCP safety communicating method is characterized in that, comprising:

Server end receives first message that client sends, and first message comprises that inserting challenge asks, and described access challenge request is used for the request server end this client is authenticated;

Server end generates server end message, and encrypts and obtain the server end ciphertext;

Server end sends first response to client, and first response comprises the server end ciphertext;

Server end receives second message that client is returned, and second message comprises server end message, and the server end message in second message is obtained after to the server end decrypt ciphertext by client;

Server end verifies whether the server end message in second message is consistent with the local server end message of preserving of server end, if then server end affirmation client is credible for unanimity.

2. method according to claim 1 is characterized in that, described second message also comprises client first ciphertext, and described method also comprises:

Server end deciphering client first ciphertext obtains client message;

Server end sends second response to client, and second response comprises client message.

3. a DHCP safety communicating method is characterized in that, comprising:

Server end receives first message that client sends, and first message comprises that inserting challenge asks, and described access challenge request is used for the request server end this client is authenticated;

Server end generates server end message, and encrypts and obtain the server end ciphertext;

Server end sends first response to client, and first response comprises the server end ciphertext;

Server end receives second message that client is returned, and second message comprises client second ciphertext; Wherein client second ciphertext is encrypted the combination of server end message and client message by client and is obtained, and server end message is obtained after to the server end decrypt ciphertext by client;

Server end deciphering client second ciphertext obtains server end message;

Server end verifies whether the server end message that obtains after the deciphering is consistent with the local server end message of preserving of server end, if then server end affirmation client is credible for unanimity.

4. method according to claim 3 is characterized in that, also obtains client message after server end deciphering client second ciphertext, and described method also comprises:

Server end sends second response to client, and second response comprises client message.

5. a DHCP safety communicating method is characterized in that, comprising:

The user end to server end sends first message, and first message comprises that inserting challenge asks, and described access challenge request is used for the request server end this client is authenticated;

First response that client reception server end returns, first response comprises the server end ciphertext;

Client is deciphered described server end ciphertext and is obtained server end message, client generates client message, and client message encrypted obtains client first ciphertext or the combination of server end message and client message encrypted obtaining client second ciphertext;

The user end to server end sends second message, and second message comprises server end message and client first ciphertext, and perhaps second message comprises client second ciphertext;

Second response that client reception server end returns, second response comprises client message, the client message in second response is obtained after to client first ciphertext or client second decrypt ciphertext by server end;

Whether the client message that client validation receives is consistent with the client message that client terminal local is preserved; If then client confirms that server end is credible.

6. method according to claim 5 is characterized in that, the client message in second response is the client message after server end is encrypted again;

Described method also comprises before described checking:

Client is decrypted the client message after encrypting again.

7. method according to claim 5 is characterized in that, comprises that also server end distributes to the IP address of client in second response;

Client confirms that the credible described method afterwards of server end also comprises:

Client is obtained this IP address, connects with server end.

8. a server-side device is characterized in that, comprising:

First receiver module is used to receive first message that client sends, and first message comprises that inserting challenge asks, and described access challenge request is used for the request server end this client is authenticated;

Generation module is used for receiving access challenge request back at first receiver module and generates the server end ciphertext;

First sending module is used for sending first response to client, and first response comprises the server end ciphertext that generation module generates;

Second receiver module is used to receive second message that client is returned, and second message comprises the server end message that obtains after client is decrypted the server end ciphertext;

Authentication module is used for verifying whether the server end message of second message is consistent with the local server end message of preserving of server end, confirms that when unanimity client is credible.

9. server-side device according to claim 8 is characterized in that, if also comprise client first ciphertext in second message, then server-side device also comprises:

Deciphering module is used for after authentication module confirms that client is credible, client first ciphertext is decrypted obtains client message;

Second sending module is used to send second response to client, and wherein second response comprises client message.

10. a server-side device is characterized in that, comprising:

First receiver module is used to receive first message that client sends, and first message comprises that inserting challenge asks, and described access challenge request is used for the request server end this client is authenticated;

Generation module is used for receiving access challenge request back at first receiver module and generates the server end ciphertext;

First sending module is used for sending first response to client, and first response comprises the server end ciphertext that generation module generates;

Second receiver module is used to receive second message that client is returned, and second message comprises client second ciphertext; Wherein client second ciphertext is encrypted the combination of server end message and client message by client and is obtained, and server end message is obtained after to the server end decrypt ciphertext by client;

Deciphering module is used to decipher client second ciphertext and obtains server end message;

Authentication module is used to verify whether the server end message that the deciphering module deciphering obtains is consistent with the local server end message of preserving of server end, if the affirmation client is credible when consistent.

11. server-side device according to claim 10 is characterized in that, if also comprise client first ciphertext in second message, then server end also comprises:

Second sending module is used to send second response to client, and wherein second response comprises client message, and wherein client message is obtained by deciphering module deciphering client second ciphertext.

12. a client terminal device is characterized in that, comprising:

First sending module is used for sending first message to server end, and first message comprises that inserting challenge asks, and described access challenge request is used for the request server end this client is authenticated;

First receiver module is used for first response that the reception server end returns, and first response comprises the server end ciphertext;

First deciphering module is used for the server end ciphertext is decrypted and obtains server end message;

Generation module is used to generate client message;

Encrypting module is used for client message encrypted and obtains client first ciphertext or the combination of server end message and client message encrypted obtaining client second ciphertext;

Second sending module is used for sending second message to server end, and second message comprises server end message and client first ciphertext, and perhaps second message comprises client second ciphertext;

Second receiver module is used for second response that the reception server end returns, and second response comprises client message, and the client message in second response is obtained after to client first ciphertext or client second decrypt ciphertext by server end;

Authentication module is used to verify whether the client message that client message that second receiver module receives and client terminal local preserve is consistent, and the affirmation server end is credible when unanimity.

13. client terminal device according to claim 12 is characterized in that, comprises that also server end distributes to the IP address of client in described second response; Described client terminal device also comprises:

Connect and set up module, be used to obtain the IP address that server end is distributed to client, and connect with server end.

14. client terminal device according to claim 12 is characterized in that, the client message in second response is the client message after server end is encrypted again;

Described client terminal device also comprises:

Second deciphering module, the client message after the encryption again that is used for described second receiver module is received is decrypted;

Described authentication module is used to verify whether the client message that obtains after the deciphering of second deciphering module is consistent with the client message of client terminal local preservation, confirms that when unanimity server end is credible.

15. a system comprises server-side device, and as any described client terminal device among the claim 12-14.

Images