Android IKEv2: isitifiketi somsebenzisi ne-CA benza imisebenzi ehlukene
Inkambu eyodwa ifakaza ukuthi ubani ucingo, enye inquma ukuthi iyiphi i-gateway okufanele ithenjwe. Iphrofayili ye-Android IKEv2 iyahlukanisa ngoba i-handshake yenza kanjalo.
Isikrini se-Android IKEv2 esicela kokubili isitifiketi somsebenzisi nesitifiketi se-CA sibukeka sifuna into efanayo kabili. Akunjalo. I-IKEv2 iqinisekisa izinhlangothi zombili, ezinhlangothini zombili, ngaphakathi kokushintshana okukodwa, futhi ucingo lunendima ehlukile ohlangothini ngalunye: kufanele lubonise ukuthi lungubani, futhi kufanele lunqume ukuthi iyiphi i-gateway eliyikholwayo. Isitifiketi somsebenzisi siphendula umbuzo wokuqala, i-CA ethenjwayo iphendula owesibili, futhi akukho okungamela okunye.
Izinhlangothi ezimbili zokuqinisekisa ekushintshaneni okukodwa
I-IKEv2 isungula isiteshi sokulawula ngezigaba ezimbili. Ukushintshana kokuqala kuxoxa ngama-algorithm nokhiye; okwesibili, i-IKE_AUTH, kuthwala i-AUTH payload eyodwa evela ohlangothini ngalunye kanye nobuwena bohlangothi ngalunye. I-payload iyisiginesha noma i-MAC ebalwe phezu kokushintshana, futhi iqinisekiswa ngokumelene nento umamukeli asevele eyethemba.
I-gateway ibonisa ubuyena bayo ngesitifiketi sayo, futhi ucingo luqinisekisa uchungechunge lwaleso sitifiketi kuze kufike empandeni elikulungele ukulithemba, bese lihlola ukuthi ubuyena obusestifiketini buyafana ne-gateway elalihlose ukufinyelela kuyo. Ucingo lubonisa ubuyena ngesiqinisekiso salo, futhi i-gateway iqinisekisa lokho ngokumelene ne-CA eyakhipha isitifiketi sekhasimende.
Yiwona wonke umshini ongemuva kwalezi zinkambu ezimbili. Isitifiketi somsebenzisi siyisitatimende ucingo olusenza ngokwalo; inkambu ye-CA iyisitatimende mayelana nokuthi ucingo luzokholwa ubani. Iphrofayili enokukodwa kodwa ingekho okunye ayikwazi ukuqeda ukuqinisekiswa komabili, futhi noma ngabe uyaphindaphinda lokho akukushintshi. Lawa maphutha amabili aze abukeke ehlukile: ukhiye womsebenzisi ongekho uvimbela ucingo ukuthi lukhiqize isiginesha nhlobo, kanti i-anchor yethemba engekho iyivimbela ukwamukela isitifiketi se-gateway.
| Material | Role | What it cannot do |
|---|---|---|
| User certificate plus its private key | Proves possession of the enrolled client identity | Establish that the gateway is the right one |
| Trusted CA certificate | Validates the gateway chain under the intended identity checks | Prove the client's identity to the gateway |
| Expected gateway identity | Pins which server the phone accepts | Grant that user access to every private resource |
Yini umakhi wephrofayili we-Android ayicelayo
Umakhi wephrofayili ye-IKEv2 ka-Google uveza indlela ngayinye yokuqinisekisa ngokwehlukana esikhundleni semodi eyodwa yesitifiketi. Indlela yesiginesha yedijithali ithatha isitifiketi somsebenzisi, ukhiye oyimfihlo kanye ne-CA yempande yeseva. Ezinye izindlela zithatha igama lomsebenzisi nephasiwedi, noma ukhiye okwabelwana ngawo ngaphambili.
Funda leyo siginesha ngokucophelela, ngoba ihlanganisa umshini ongenhla. Akukho nkambu yokhiye oyimfihlo womsebenzisi endleleni yegama lomsebenzisi nephasiwedi, futhi akukho nkambu ye-anchor yethemba ye-gateway endleleni ye-PSK, ngesizathu esilula sokuthi lezo zindlela zifakaza izinto ezihlukene. Ukuzihlanganisa ngokunamathisela iphasiwedi enkambini yesitifiketi kukhiqiza iphrofayili ehlulekayo ku-IKE_AUTH ngomlayezo ongasho nelilodwa lawo.
Uhlobo lokhiye oyimfihlo olubhalwe phansi lwendlela yesiginesha yedijithali yi-RSA. Imenyu ebhalwe i-IPsec noma isitifiketi ayisho ukuthi kusekelwa i-ECDSA, futhi iphrofayili eyakhiwe ngokucabanga ukuthi kusekelwa izohluleka ku-API yepulatifomu ngaphambi kokuba inethiwekhi ihlanganyele nhlobo.
Kungani isitifiketi somsebenzisi esidlangalaleni sisodwa singanele
I-AUTH payload iyisiginesha phezu kokushintshana, eyenziwe ngokhiye oyimfihlo wekhasimende. Ukuba nesitifiketi esidlangalaleni kuvumela i-gateway ukuthi ihlole isiginesha; akusizi lutho ocingweni, ngoba lidinga ukhiye ukuze likhiqize esinye. Ukungenisa kuphela .crt nokushiya ukhiye ngemuva yiyo yona ndlela evamile yalokhu kuhluleka.
Ingqalasizinda yokhiye ye-Android ikhombisa lokho. Ukukhetha ubuyena bekhasimende kudlula ku-KeyChain, edinga ukufinyelela kukhiye oyimfihlo ohambisanayo, hhayi nje umugqa wesitifiketi. Iphakethe lokubhalisa noma uhlelo lokulawula idivayisi olufaka kokubili ndawonye yiyo indlela evamile yokuthola ubuyena obusebenzisekayo; ukukopisha ifayela lesitifiketi ngesandla ngokuvamile akusiyo.
Ngakho izinto ezimbili kuphrofayili akuzona isiqephu sezitifiketi nokukopishwa kwaso. Enye iyipheya lokhiye okumele ipulatifomu ikwazi ukusayina ngalo, enye iyi-anchor yethemba ipulatifomu eqhathanisa nayo. Zihlole njengamaqiniso amabili ahlukene: ingabe le phrofayili iyakwazi ukusayina, futhi iyazi yini ukuthi ikholwe ubani?
Ama-anchor ethemba angawohlelo lokusebenza, hhayi ocingo
Ukufaka isitifiketi sempande esitolo somsebenzisi akwenzi wonke uhlelo lwe-Android lukholwe yiso: kusukela ku-Android 7 uhlelo kufanele luzibandakanye ngokucushwa kwalo kokuphepha kwenethiwekhi, futhi ngaphambi kwalokho kukhishwa ama-CA afakwe umsebenzisi ayemukelwa kabanzi kakhulu. Ukucushwa kokwethemba kwezinhlelo kungahluka, futhi iklayenti le-VPN elilawula impahla yalo yethemba lingase lingakaze libheke isitolo somsebenzisi nhlobo. Yingakho ifayela le-CA elifanayo lingasebenza kuklayenti elilodwa futhi libonakale linganakwa kwelinye.
Kulandela izindlela ezimbili zobunikazi. Iphrofayili ye-VPN elawulwa uhlelo isebenzisa ukufakwa kwezitifiketi kwedivayisi noma uhlelo lokubhalisa umlawuli, bese iphrofayili ibhekisela ku-CA ehlosiwe. I-VPN elawulwa uhlelo lokusebenza igcina impahla yayo yethemba futhi isebenzisa ukungenisa kwayo okubhalwe phansi, okungase kuhluke ngokuphelele kusikrini sezilungiselelo ze-Android. Yilapho futhi ulungisa khona uchungechunge olugqashukile: esitolo se-CA nasekukhetheni iphrofayili esimweni esilawulwa uhlelo, esikrinini sokungenisa sekhasimende esimweni esilawulwa uhlelo lokusebenza.
Nquma ukuthi usesimweni sini ngaphambi kokungenisa noma yini, bese uqinisekisa ukukhethwa kokwethemba kwephrofayili esebenzayo ngemuva kwalokho. Uma iziyalo zomqhubi nemenyu yeklayenti kungavumelani, ukuziphatha kweklayenti okubhalwe phansi kuyanqoba kulokho kufakwa, kodwa i-CA kusafanele ivele kumqhubi ngendlela ongayiqinisekisa. Igama lefayela alisiyo ubufakazi bokuthi ngubani oyikhiphile.
Khetha imodi, bese kuba amafayela
Imodi yesitifiketi idinga ipheya lokhiye lekhasimende, i-CA ekhiphayo ohlangothini lwe-gateway, i-anchor yethemba yesitifiketi se-gateway, kanye nokulindela ukuthi ubuphi ubuyena okufanele busithwale leso sitifiketi. Imodi yegama lomsebenzisi nephasiwedi ithatha indawo yepheya lokhiye lekhasimende ngesiqinisekiso kodwa igcina isidingo sokwethemba i-gateway. Imodi ye-PSK ithatha indawo yakho kokubili ngemfihlo okwabelwana ngayo futhi ishintsha imodeli yokwethemba esikhundleni sokuyenza lula.
Noma yikuphi okukhethayo, gcina ukuqinisekisa okuvamile kuvuliwe. Inketho yokungaqinisekisi, lapho iklayenti inikezela khona, isusa ukuhlola i-CA eyenzelwe ukukwenza; ayilungisi i-anchor yethemba engekho. Kuyafana nokwamukela noma yisiphi isitifiketi seseva ngoba ukuxhumana kusebenza ngaphandle kwaso.
Bese uqinisekisa endaweni efanele: ngenisa impahla, xhuma kanye, futhi uqinisekise emininingwaneni yokuxhumana yeklayenti ukuthi ubuyena be-gateway yibo obukulindele nokuthi iphrofayili ibika indlela yokuqinisekisa owawuhlosile ukuyisebenzisa. Ukuxhumana okuphumelelayo nemodi engalungile ekhethiwe ukucushwa ongakakuqondi, futhi kuzohluleka ngokulandelayo lapho umqhubi eqinisa inqubomgomo.