CN102739660B - Key exchange method for single sign on system - Google Patents

Abstract

The invention discloses a key exchange method of a single sign-on system, which is applied to the key exchange between the sending party and the receiving party interacting in the identity authentication request or service request. The shared key performs the HMAC operation on the additional information exchanged to obtain the second data, and transmits the third data after the second data and the key to be exchanged to the receiver, and the receiver receives the first data according to the The HMAC operation is performed with the local shared key to obtain the second data; the receiver performs a bit-exclusive OR operation on the calculated second data and the received third data to obtain the key sent by the sender. The method not only reduces the complexity of the key exchange algorithm, but also supports the exchange of long keys while ensuring the timeliness of key exchange, ensures the security of key exchange, and is suitable for key exchange between thin terminals.

Description

A key exchange method for a single sign-on system

technical field

The invention relates to a single sign-on system, in particular to a key exchange method of the single sign-on system.

Background technique

Single Sign On (SSO): SSO for short, is one of the more popular enterprise business integration solutions. The definition of SSO is that in multiple application systems, users only need to log in once to access all mutually trusted application systems, avoiding the performance loss caused by verifying their identity every time a user requests a service. In order to achieve single sign-on, all application systems share an identity authentication system. If a permanent password is used to encrypt messages for a long time or too much during the entire authentication or service interaction process of the single sign-on system, it is easy to cause the key to be obtained by the attacker and cause the key to be leaked.

Existing key exchange methods are generally based on the Diffie–Hellman key exchange (Diffie–Hellman key exchange, referred to as "D-H") protocol. The D-H protocol is a security protocol that allows both parties to A key is established over an insecure channel without any information. This key can be used as a symmetric key to encrypt the communication content in subsequent communication. In the Chinese invention patent document whose application number is CN03116619.9 and whose patent title is "A Key Exchange Method Based on Public Key Certificate", a key exchange method based on public key certificate is disclosed. Based on the discrete logarithm problem and the D-H protocol, supplemented by anti-collision hash function, public key certificate and digital signature session key exchange method. The D-H protocol is based on the application of discrete logarithms, but if there is an efficient algorithm for solving the discrete logarithm problem, it can be used to simplify the calculation of a or b, and it can solve the Diffie-Hellman problem, making the Many public-key cryptography systems, including the Diffie-Hellman key exchange system, become insecure.

In the Chinese invention patent document with the application number CN200610103449.6 and the patent name "Application of an Elliptic Curve Key Exchange Method in MANET Networks", a new encryption and decryption system and key for MANET network security protection process are disclosed Management method, this method adopts the elliptic curve encryption system, but the key exchange method of elliptic curve encryption requires a large amount of calculation and is not suitable for thin terminals.

Contents of the invention

The technical problem to be solved by the present invention is to provide a key exchange method for a single sign-on system, which has low requirements for calculation and high security.

In order to solve the problems of the technologies described above, the technical solution adopted in the present invention is:

A key exchange method for a single sign-on system, which is applied to the key exchange between a sender and a receiver, where there is a shared key shared by both parties between the sender and the receiver, and the key exchange includes the following step:

The sender uses the shared key to perform an HMAC operation on the first data to be sent to obtain the second data;

The sender performs a bit-exclusive OR operation on the second data and the key to be sent to obtain third data;

The sender sends the first data and the third data to the receiver;

The receiver performs an HMAC operation according to the received first data and the local shared key to obtain the second data;

The receiver performs a bit-exclusive OR operation on the calculated second data and the received third data to obtain the key sent by the sender.

As a further preferred implementation manner, the first data is additional information involved in the interaction during the key exchange process.

As a further preferred implementation manner, the sender or receiver is a client or server interacting in an identity authentication request or a service request.

The beneficial effects of the present invention are: the key exchange method of the single sign-on system of the present invention is applied to the key exchange between the sending party and the receiving party interacting in the identity authentication request or service request, and the method of the present invention passes the sending party and the receiving party The shared key shared by both parties performs the HMAC operation on the additional information exchanged to obtain the second data, and the result of the bit-exclusive OR operation between the second data and the key to be exchanged is transmitted to the receiver, which not only reduces the key exchange algorithm It supports the exchange of long keys while ensuring the timeliness of key interaction, ensuring the security of key exchange, and is suitable for key exchange between thin terminals.

Description of drawings

The specific embodiment of the present invention will be further described below in conjunction with accompanying drawing:

Fig. 1 is a flow chart of the steps of the key exchange method of the single sign-on system of the present invention.

Detailed ways

Referring to FIG. 1 , a key exchange method of a single sign-on system is applied to the key exchange between a sender and a receiver, and the sender or receiver is a client or a client interacting in an identity authentication request or a service request. server. For example, when the sender is a client, the receiver is a server; when the sender is a server, the receiver is a client. The shared key shared between the sender and the receiver is sharekey. The key exchange includes the following steps:

The sender uses the shared key sharekey to perform HMAC operation on the first data content to be sent to obtain the second data H(sharekey, content). The H(sharekey, content) means that the sharekey is used as the key to perform HMAC on the message content operate;

The sender performs an XOR operation on the second data H(sharekey, content) and the key exchangekey to be sent ⊕ to obtain the third data H(sharekey, content) ⊕exchangdkey;

The sender sends the first data content and the third data H(sharekey, content) ⊕exchangdkey to the receiver;

The receiver performs the HMAC operation according to the received first data content and the local shared key sharekey to obtain the second data H(sharekey, content);

The receiver performs a bit-exclusive OR operation on the calculated second data H(sharekey, content) and the received third data H(sharekey, content) ⊕exchangdkey to obtain the key exchangekey sent by the sender. The described process is as follows:

H(sharekey, content) ⊕(H(sharekey, content) ⊕exchangdkey) → exchangekey.

The exchangekey refers to the key that is created or known by one party and exchanged or passed to the other party; the content refers to the additional information that participates in the interaction during the entire key exchange process. If some information in the content is known (marked as share_content), then the data sent by the above sender can also be expressed as "partial_content, share_content_tips, H(sharekey, partial_content+share_content) ⊕exchangdkey", where share_content_tips is the relevant prompt information indicating the shared message to be used , "+" means and operation, and how to organize the information on the left and right of the operation can be determined according to the specific situation.

The above is a specific description of the preferred implementation of the present invention, but the invention is not limited to the described embodiments, and those skilled in the art can also make various equivalent deformations or replacements without violating the spirit of the present invention. These equivalent modifications or replacements are all within the scope defined by the claims of the present application.

Claims (3)

1. a key exchange method for single-node login system, is applied to the cipher key change between transmit leg and recipient, there is the shared key that both sides share, it is characterized in that between described transmit leg and recipient, and described cipher key change comprises the following steps:

Transmit leg carries out HMAC operation with shared key to first data that will send and obtains the second data;

Transmit leg carries out an xor operation to described second data with the key that will send and obtains the 3rd data;

First data and the 3rd data are sent to recipient by transmit leg;

Recipient carries out HMAC operation according to the first data received and local shared key and obtains the second data;

Three data of recipient to the second data calculated and reception carry out the key that an xor operation obtains transmit leg transmission.

2. the key exchange method of a kind of single-node login system according to claim 1, is characterized in that: described first data are participate in mutual extraneous information in key exchange process.

3. the key exchange method of a kind of single-node login system according to claim 1, is characterized in that: described transmit leg or recipient are mutual client or server in ID authentication request or service request.