Patent ID: 8336083

Claim:
A trusted network access control system based on tri-element peer authentication system, characterized in that the system comprises an access requestor AR, an access controller AC and a policy manager PM, wherein: the PM is configured to verify validity of attestation identity key AIK certificates of the AR and the AC and check platform trustworthiness of the AR and the AC; the AR is connected with the AC through a protocol interface via network, the AC is connected with the PM through a protocol interface via network, and the AR is connected with the PM through the AC via network; the protocol interface connecting the AR with the AC comprises: a trusted network transport interface IF-TNT and an interface IF-TNACCS between a TNAC client and a TNAC sever; the IF-TNT is an information exchanging interface between a network access requestor NAR and a network access controller NAC on a network access control layer, and the IF-TNACCS is an information exchanging interface between the TNAC client and the TNAC server on the trusted platform evaluation layer; the protocol interface between the AC and the PM comprises: an authentication policy service interface IF-APS, an evaluation policy service interface IF-EPS and a trustworthiness measurement interface IF-TM; the IF-APS is an information exchanging interface between a network access controller NAC and an authentication policy server APS on the network control layer, and the IF-EPS is an information exchanging interface between a TNC server and an evaluation policy server EPS on the trusted platform evaluation layer; and the IF-TM is an interface between a trustworthiness measurement collector and a trustworthiness measurement verifier on the trustworthiness measurement layer; and the protocol interface connecting the AR with the PM comprises a trustworthiness measurement interface IF-TM, and the IF-TM is an interface between the trustworthiness measurement collector and the trustworthiness measurement verifier on the trustworthiness measurement layer, wherein the AR includes a client station, wherein the AC includes a base station.