How to learn dynamic token and key agreement techniques?

The technology that combines "dynamic token" and "key agreement" is virtual private network (VPN) technology. So what is a dynamic token? What is key agreement technology? The so-called dynamic token, the English token, can be understood as a "one-time password", expressed in English as "One Time Password", abbreviated as OTP. Because the number displayed on the token in real time changes every minute, it is dynamic, which is also the origin of the one-time password. First let's see what a dynamic token looks like:



These colorful tokens on the picture, although not only work in the same way, but the working principle is very similar. The principles are not expanded in the popular science article, and only how are they used to authenticate users?

User Identity / Server Identity
When users work remotely, they usually dial a VPN client.


Here comes the question, how do you make sure that the server your users access is a real server? The server has the same problem. How to ensure that the user who is using the VPN client (Wang Xiaoming) is the real Wang Xiaoming?
Assume that Wang Xiaoming now starts dialing and uses the control protocol IKE (Internet Key Exchange) to start negotiating with the server for authentication algorithms, control channel encryption algorithms, control channel verification algorithms, data traffic encryption algorithms, data traffic verification algorithms, and so on.

The two-way DH public key exchange has been completed, and the two parties have been able to derive the key of the control channel encryption algorithm. It is still not possible to verify the identity of the other party.
So the server began to say to Xiaoming on the encrypted control channel: Please show me your token number!

Xiaoming enters: "159759", the client uses "159759" + "Please show me your token number!" To do a secure Keyed hash operation to generate a random string "49efjoiweu9u2343jdwjd @ 94% s" and transmits it to the server.


The server backend also has exactly the same one-time password "159759" as Xiaoming, and performs a secure Keyed hash operation with "Please show me your token number!" To generate a random string "49efjoiweu9u2343jdwjd @ 94% s", exactly the same as Xiaoming , Xiaoming authentication is successful.
Xiaoming also needs to verify the identity of the server. The principle is similar to the above, so it will not be expanded.

When both parties authenticate each other's identities, they can then independently derive the encryption / decryption key for encrypting data traffic, the verification key for data traffic, and then assign private IP and other parameters to the client.

The VPN client can transmit all the traffic that accesses the company's internal network to the server through the VPN encrypted tunnel. The server completes decryption and verification, and then strips the outer tunnel header to reveal the user's private IP traffic and reach the real The server completes two-way communication.

How to ensure that the number (OTP) displayed by the token in the user's hand is the same as the OTP calculated by the server background? DH itself cannot defend against man-in-the-middle attacks. How does VPN technology effectively defend against man-in-the-middle attacks?

The above is the news sharing from the PASSHOT. I hope it can be inspired you. If you think today' s content is not too bad, you are welcome to share it with other friends. There are more latest Linux dumps, CCNA 200-301 dumps and CCNP Written dumps waiting for you.

Comments

Post a Comment

Popular posts from this blog

How to choose Cisco dumps?

Image
In this era of lack of trust between people, if you want to buy one thing, in addition to buying on a platform such as a regular platform, such as Amazon. Do you still believe in other self-built platforms? I believe many people have the experience of being cheated. lowest The means of defrauding money is: Your good friend comes to borrow money from you, and you have a relationship card with you so that you can lend him money. At this time, according to the normal person’s thinking, this friend has known me for many years that he might not take the money away. Note that it is often the same idea that gives others the opportunity to owe money. If the amount borrowed is not high, then it is okay. Once the amount you borrowed is too large, you should be careful and your money may not be returned! Back to the topic, in this era of lack of trust, how to choose the Cisco dumps have become an important topic. First, when you buy it depends on whether the website's URL link is https
Read more

What is proxy communication?

Image
Is it correct to understand the working level of forward proxy reverse proxy transparent proxy? Forward proxy and reverse proxy (application load balancing, some NG reverse proxy) can be understood as a man-in-the-middle mode. At the same time, both ends establish a TCP connection, and then the man-in-the-middle performs TCP connection between the two ends. Can a transparent proxy be understood as a simple and crude "hijacking" of a passing data packet, without splitting the complete TCP connection into two independent segments. So, in this sense, this kind of transparent proxy is similar to the working hierarchy of NAT devices? Preface I once saw a person write tens of thousands of words to answer a question, and read it after three days. Shocked, what is all this for? These words can produce a book, and it is also a reward for your hard work. However, I think the man has always been happy, but there is no doubt that his reputation (Reputation) is in full swin
Read more

What are CCNP Data Center jobs in Dubai?

Image
  What are CCNP Data Center jobs in Dubai? Over the last few years, Cisco accreditations have gotten popular astonishingly. Undoubtedly, Cisco certifications would be deemed the outright most necessary certificates in the field of computer system networking. About Cisco certifications, there would be an extensive range of choices. To help your career and assist you in opening brand-new doors in your career, you need the ideal accreditations. Cisco introduced its primary certification program in 1998. The essential idea behind the accreditations was to supplement the CCIE or Cisco Certified Internetwork Expert program. Cisco would have extended its qualifications and supplies lots of certifications for experts of all experience levels from that point forward. CCNP Overview: CCNP or Cisco Certified Network Professional is considered the certification available for IT specialists with one year of expert experience in computer system networking. A diploma or equivalent in a significant fie
Read more