基于信任链技术的SSH 传输层协议改进

Host keys are identification of SSH servers. Users are required to check host key fingerprints to authenticate SSH servers. However, users often ignore the process of checking fingerprints when using SSH, making man-in-the-middle attacks based on host key replacement possible. In this regard,an improvement scheme of the SSH transport layer protocol is proposed based on the chain of trust. In the scheme,a chain of trust is established by signing the new host key with the old host key. The improved SSH protocol can solve the trust problem of new host keys without the need for users to check fingerprints, so as to achieve identity authentication of servers, which greatly reduces the risk of man-in-the-middle attacks. Finally, using Pro Verify to analyze the improved protocol, verification results show that the improved protocol satisfies confidentiality and authentication,and can resist man-in-the-middle attacks.