Method, device and system for realizing secure access

Abstract

The invention provides a method, a device and a system for realizing secure access, and relates to the field of information security. Wherein when the control device successfully authenticates the authentication information sent by the user terminal, the control device instructs the access device to establish a VPN tunnel with the user terminal; Sending authorization information corresponding to the user authority to an access device, so that the access device distributes a virtual network tag and an NAT address for the user terminal; And an access control strategy is arranged by using the user permission and the access control strategy is sent to the access device, so that the access device performs corresponding access control strategy configuration, and the service data flow of the userterminal is audited so as to perform corresponding security access control on the service data flow. According to the invention, fine-grained access authority distribution and flexible change of theuser are realized through combination of authentication and the access control strategy, so that a security control mechanism is independent from an underlying equipment processing level, and the problem that multiple VPN services isolated from each other are supported on the same network infrastructure is solved.

Description

technical field [0001] The present disclosure relates to the field of information security, in particular to a method, device and system for implementing secure access. Background technique [0002] During the process of migrating the enterprise network to the cloud, there is a need for users to remotely access the cloud resource pool. Currently, VPN (Virtual Private Network, virtual private network) is the main method of remote access. [0003] There are two problems in remote access to the cloud resource pool through VPN: First, the granularity of access control is not fine enough, all resource access within the access range can only be fully allowed or completely denied, and different access rights cannot be set according to user identification. It is also impossible to trace user behavior; in addition, each virtual private cloud carried requires an independent VPN device, which requires high construction costs and requires a fixed network topology, making it difficult t...

AI Technical Summary

Problems solved by technology

[0004] A technical problem solved by the embodiments of the present disclosure is that fine-grained user access rights allocation and flexible change cannot be realized, and the problem of supporting multiple VPN services isolated from each other on the same network infrastructure cannot be solved.

Images