Unlock instant, AI-driven research and patent intelligence for your innovation.

Method and system for controlling access permission

A technology of access rights and controllers, applied in the field of network security, can solve problems such as business services being attacked, and achieve the effect of avoiding attacks and illegal access

Active Publication Date: 2020-05-08
BEIJING QIANXIN TECH +1
View PDF5 Cites 7 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

[0002] In the existing SDP (Software Defined Perimeter, software-defined boundary) framework, it includes a connection initiating host, a controller, and a connection accepting host; the controller is used to authenticate the connection initiating host and the connection accepting host, and determine the connection initiating host An accessible connection accepting host; before the connection initiating host establishes a service link with the connection accepting host, the connection initiating host will send a SPA (Single Packet Authorization, single packet authorization) package to the connection accepting host; wherein, the SPA package includes According to the dynamic password generated by the key algorithm pair, the access authority can be controlled through the dynamic password; however, in the standard SDP framework, the key algorithm pair is unchanged, and once the key algorithm pair is leaked, it may cause concealment The business service on the connection accepting host is attacked; in addition, in the standard SDP framework, if the connection initiating host is hijacked after the business link is established, the business service hidden on the connection accepting host will also be attacked risk; therefore, how to ensure the security of accessing hidden services in the SDP framework has become a technical problem that those skilled in the art need to solve urgently

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Method and system for controlling access permission
  • Method and system for controlling access permission
  • Method and system for controlling access permission

Examples

Experimental program
Comparison scheme
Effect test

Embodiment 1

[0059] An embodiment of the present invention provides a method for controlling access rights, and the method is specifically applied to such as figure 1 The controller in the shown SDP framework, wherein, the SDP framework includes: a connection initiating host, a controller and a connection accepting host, wherein the controller is used to perform security authentication on the connection initiating host and the connection accepting host, and the connection The initiating host accesses the connection accepting host after being authenticated by the controller; figure 2 An optional schematic flowchart of the method for controlling access rights provided by Embodiment 1 of the present invention, as shown in figure 2 As shown, the method specifically includes the following steps:

[0060] Step S201: Receive an identity verification request sent by a connection initiating host in an SDP frame; wherein, the identity verification request includes: identity information of the con...

Embodiment 2

[0095] An embodiment of the present invention provides a method for controlling access rights, and the method is specifically applied to such as figure 1 The connection initiating host in the SDP frame shown, wherein, the SDP frame includes: a connection initiating host, a controller, and a connection accepting host; image 3 An optional schematic flowchart of the method for controlling access rights provided in Embodiment 2 of the present invention, as shown in image 3 As shown, the method specifically includes the following steps:

[0096] Step 301: Send an identity verification request containing the identity information of the connection initiating host to the controller in the SDP framework, so that the controller can obtain risk information corresponding to the identity information through a third-party environmental risk awareness platform , and perform identity verification on the connection initiating host according to the risk information.

[0097] Preferably, the...

Embodiment 3

[0110] An embodiment of the present invention provides a method for controlling access rights, and the method is specifically applied to such as figure 1 The connection accepting host in the shown SDP frame, wherein, the SDP frame includes: a connection initiating host, a controller, and a connection accepting host; Figure 4 An optional schematic flowchart of the method for controlling access rights provided in Embodiment 2 of the present invention, as shown in Figure 4 As shown, the method specifically includes the following steps:

[0111] Step S401: Receive the SPA authorization package containing the dynamic password sent by the connection initiating host in the SDP frame according to the connection accepting host list; wherein, the dynamic password is generated according to the key algorithm pair within the validity period.

[0112] Wherein, before receiving the SPA authorization packet containing the dynamic password sent by the connection initiating host in the SDP f...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The invention discloses a method and a system for controlling access permission. The method comprises the steps of receiving an identity verification request sent by a connection initiating host in anSDP framework, wherein the identity verification request comprises identity recognition information of the connection initiating host; acquiring risk information corresponding to the identity recognition information from a third-party environment risk perception platform; performing identity verification on the connection initiating host according to the risk information, and determining a connection receiving host list accessible to the connection initiating host in the SDP framework under the condition that the identity verification is passed; configuring a key algorithm pair for the identity recognition information, and configuring the validity period of the key algorithm pair according to the risk information; and sending the connection receiving host list, the key algorithm pair andthe validity period to the connection initiating host. According to the invention, the leakage risk of the key algorithm pair can be avoided, and the security of accessing a hidden service is ensured.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and system for controlling access rights. Background technique [0002] In the existing SDP (Software Defined Perimeter, software-defined boundary) framework, it includes a connection initiating host, a controller, and a connection accepting host; the controller is used to authenticate the connection initiating host and the connection accepting host, and determine the connection initiating host An accessible connection accepting host; before the connection initiating host establishes a service link with the connection accepting host, the connection initiating host will send a SPA (Single Packet Authorization, single packet authorization) package to the connection accepting host; wherein, the SPA package includes According to the dynamic password generated by the key algorithm pair, the access authority can be controlled through the dynamic password; however, in ...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & Authority Applications(China)
IPC IPC(8): H04L29/06
CPCH04L63/0838H04L63/0846H04L63/0876H04L63/101H04L63/102H04L63/108
Inventor 刘成伟张泽洲魏勇简明
Owner BEIJING QIANXIN TECH