针对视频监控系统接入层中前端设备的身份安全问题,通过对会话初始协议(Session Initiation Protocol,SIP)进行研究和扩展,设计并改进了一种基于超文本传输协议(Hyper Text Transfer Protocol,HTTP)摘要访问认证的SIP安全机制。前端设...针对视频监控系统接入层中前端设备的身份安全问题,通过对会话初始协议(Session Initiation Protocol,SIP)进行研究和扩展,设计并改进了一种基于超文本传输协议(Hyper Text Transfer Protocol,HTTP)摘要访问认证的SIP安全机制。前端设备在接入视频监控系统前,需要通过该安全机制与系统安全管理平台上的SIP服务器进行身份认证。认证双方基于公钥基础设施数字证书认证体系(Public Key Infrastructure/Certificate Authority,PKI/CA)获取对方的数字证书后解析公钥,在摘要认证的基础上使用公钥加密和私钥签名来保护认证序列的安全性,解密认证序列后通过异或校验和摘要校验实现双向身份认证。测试与分析结果表明,改进的安全机制能够抵御常见的SIP安全风险,实现设备与安管平台间的双向身份认证,在适当损失效率的情况下确保接入系统的设备身份合法可信。展开更多
Two common kinds of security mechanisms used in session initial protocol （S1P） are analyzed. An improved HTTP digest authentication scheme is put forward based on the existing SIP authentication theories. This mecha...Two common kinds of security mechanisms used in session initial protocol （S1P） are analyzed. An improved HTTP digest authentication scheme is put forward based on the existing SIP authentication theories. This mechanism is combined with the merits of the HTTP digest authentication and the public key encryption, so the communicating parties complete two-way authentication and public key exchange in pre-calling, and the session key can be randomly generated in post-calling. The mixture of security encryption mechanism with public key encryption and symmetric-key encryption algorithm can ensure the security for network communication data. The emulation of the scheme is verified, and the security analysis is conducted in the end. The researches show that the simulations efficiency of this method is about 78% of HTTP＇s, and it can prevent four kinds of attacks including impersonating a server, offline password guessing attacks, relay-attack, and session monitoring.展开更多
文摘针对视频监控系统接入层中前端设备的身份安全问题,通过对会话初始协议(Session Initiation Protocol,SIP)进行研究和扩展,设计并改进了一种基于超文本传输协议(Hyper Text Transfer Protocol,HTTP)摘要访问认证的SIP安全机制。前端设备在接入视频监控系统前,需要通过该安全机制与系统安全管理平台上的SIP服务器进行身份认证。认证双方基于公钥基础设施数字证书认证体系(Public Key Infrastructure/Certificate Authority,PKI/CA)获取对方的数字证书后解析公钥,在摘要认证的基础上使用公钥加密和私钥签名来保护认证序列的安全性,解密认证序列后通过异或校验和摘要校验实现双向身份认证。测试与分析结果表明,改进的安全机制能够抵御常见的SIP安全风险,实现设备与安管平台间的双向身份认证,在适当损失效率的情况下确保接入系统的设备身份合法可信。
基金Supported by the Central University Basic Research Special Fund Operating Expenses(2011ZM0033)
文摘Two common kinds of security mechanisms used in session initial protocol （S1P） are analyzed. An improved HTTP digest authentication scheme is put forward based on the existing SIP authentication theories. This mechanism is combined with the merits of the HTTP digest authentication and the public key encryption, so the communicating parties complete two-way authentication and public key exchange in pre-calling, and the session key can be randomly generated in post-calling. The mixture of security encryption mechanism with public key encryption and symmetric-key encryption algorithm can ensure the security for network communication data. The emulation of the scheme is verified, and the security analysis is conducted in the end. The researches show that the simulations efficiency of this method is about 78% of HTTP＇s, and it can prevent four kinds of attacks including impersonating a server, offline password guessing attacks, relay-attack, and session monitoring.
