Dynamic TLS authentication method and device in local area network and storage medium

Abstract

The invention provides a dynamic TLS authentication method and device in a local area network, and a storage medium, and the method comprises a deployment step: signing and issuing an IP certificate for a web server based on a unified self-signing and issuing root certificate Root CA; an access step: enabling the web server to load a corresponding IP certificate, and enabling the client to establish a network connection based on a TLS to access the web server; and a re-signing and re-issuing step: when detecting that the IP address of the equipment port connected to the web server changes, theservice program automatically signs and issues a new IP certificate to the web server, and the service program and the web server do not need to be restarted during re-signing and re-issuing, so thatthe web service is not interrupted. According to the invention, self-signing and issuing CA root certificates of a local area network are unified, intermediate certificates are introduced, and the leakage risk of the root certificates is reduced; the port IP address change automatically triggers issuing and loading of the certificate, a system and a web server do not need to be restarted, serviceinterruption cannot be caused, the whole process is not perceived by a client, and the user experience is improved.

Description

technical field [0001] The invention relates to the technical field of data security, in particular to a dynamic TLS authentication method, device and storage medium in a local area network. Background technique [0002] Web services in intranet environments (local area networks) such as enterprises and families often use non-encrypted network connection communications, which have low security. However, according to the specification: 1. Public CAs will not issue security certificates for private IP address segments; 2. Enterprises can issue self-signed certificates for private IP addresses; 3. Because it is not a public CA, clients (such as browsers) The self-signed certificate cannot be trusted directly, and the client user needs to forcefully trust the self-signed certificate to continue using it. [0003] Effective November 1, 2015, the industry-standard CA / browser form used to manage Baseline Requirements (BR) and set up SSL certificate usage no longer allows publicly ...

AI Technical Summary

Problems solved by technology

[0004] Therefore, in the existing technology, enterprises generally issue self-signed certificates for private network IP addresses. The technical defects are: self-signed certificates require considerable professional knowledge, professional and technical personnel are required in the enterprise for configuration management, and issuance process management. And the issuing period is long, and the operation is inconvenient; more importantly, if the IP address of the web server changes, such as server migration, reconfiguration, etc., then a new security certificate needs to be issued to continue using TLS encrypted data connection, otherwise the IP address If it is inconsistent with the content of the certificate, the client will deny access. Issuing a new security certificate will cause service interruption and affect the user experience

Images