VPN (virtual private network) authority control method and device

Abstract

The invention provides a VPN (virtual private network) authority control method which is applied to a subscriber's main station and includes A, establishing tunnel connection with a service terminal; B, acquiring an intranet IP(internet protocol) address from the VPN service terminal through a tunnel; C, acquiring an authority control list from the VPN service terminal through the tunnel; D, judging whether to allow a user message to pass or not according to the authority control list, if so, then allowing the user message to pass, and if not, then discarding the user message; and E, packaging the user message as a tunnel message, sending the tunnel message to the VPN service terminal through the tunnel, or receiving the tunnel message from the VPN service terminal and then restoring the same into the user message. By the VPN authority control method, processing resources of the subscriber's main station are utilized effectively, and excessive consumption of the resources for tunnel processing and authority control is avoided for the service terminal.

Description

technical field [0001] The invention relates to the authority control technology in network communication, especially the authority control method and device in VPN tunnel. Background technique [0002] The biggest advantage of SSL VPN technology based on B / S mode (also called web proxy technology) is that it can avoid client installation, and users can directly access the web resources of the VPN intranet with a browser. As information security shifts from simply focusing on network security to focusing on business-centric application security, the importance of remote secure access becomes increasingly apparent. SSL VPN protects specific applications without installing client software, and fine-grained access control, Features such as detailed auditing are superior in terms of ease of use, security, and management. Compared with other VPNs, SSL VPN has another outstanding function of authority control. SSL VPN can support user-based authority control. By assigning differ...

AI Technical Summary

Problems solved by technology

For the SSL VPN gateway, every packet has to go through such a process, which seriously consumes the performance of the server

The server can use certain algorithms such as the HASH table method to speed up the determination of the validity of the message, but this does not significantly improve the performance consumption, because these algorithms themselves also consume resources, etc.

Moreover, when many users want to access the intranet server without authorization, a large number of illegal packets arrive at the server, and the server needs to spend a lot of performance to decrypt the packets, judge the permissions, and finally discard the packets, which is a serious waste of performance.

Images