IPSec VPN security gateway system

Abstract

The invention discloses an IPSec VPN security gateway system, and relates to the technical field of security gateways, and the technical scheme is characterized in that an extraction module is used for extracting access subject information and a target data identifier of a data access request; a security access reference set is set, the security access reference set comprises a protocol standard, a key hierarchy rule and a hardware acceleration configuration parameter, the protocol standard corresponds to a compliance interval, the key hierarchy rule corresponds to a key life cycle threshold, and the hardware acceleration configuration parameter corresponds to a computing power adaptation range; performing comparative analysis on access characteristic parameters corresponding to the access subject information and the target data identifier with a compliance interval of a protocol standard in a security access reference set and a key life cycle threshold of a key hierarchy rule to obtain a target authentication mechanism conforming to the protocol standard and a target key system conforming to the key hierarchy rule; the method has the effect of promoting efficient operation of data access under a security specification.

Description

Technical Field

[0001] This invention relates to the field of security gateway technology, and more specifically, to an IPSec VPN security gateway system. Background Technology

[0002] The increasing demand for secure data access in network communication scenarios highlights the significant shortcomings of traditional VPN devices. This underpinned the development of this IPSec VPN security gateway system. Algorithms such as RSA and SHA1, relied upon by some traditional VPNs, are vulnerable to cracking or have compliance issues, making them unsuitable for high-security scenarios. Furthermore, the static nature of keys is a major concern; keys with fixed periods or long-term immutability are susceptible to leakage and cracking, leading to data loss and failing to adapt to dynamically changing network threat environments. Performance bottlenecks also limit data transmission efficiency. Faced with large-scale concurrent data access, traditional VPN devices lack the encryption and decryption capabilities to guarantee access speed and security under high throughput, potentially impacting business continuity. Summary of the Invention

[0003] In view of the shortcomings of the existing technology, the purpose of this invention is to provide an IPSec VPN security gateway system.

[0004] To achieve the above objectives, the present invention provides the following technical solution: An IPSec VPN security gateway system includes: Extraction module: Extracts the access subject information and target data identifier of the data access request; Configuration module: Configure the security access benchmark set, which includes protocol standards, key level rules and hardware acceleration configuration parameters. The protocol standards have corresponding compliance ranges, the key level rules have corresponding key lifecycle thresholds, and the hardware acceleration configuration parameters have corresponding computing power adaptation ranges. The comparison module compares and analyzes the access feature parameters corresponding to the access subject information and the target data identifier with the compliance range of the protocol standard and the key lifecycle threshold of the key level rule in the security access benchmark set, respectively, to obtain the target authentication mechanism that conforms to the protocol standard and the target key system that conforms to the key level rule. Generation module: Generates an access preparation set corresponding to the secure access baseline set based on the target authentication mechanism and target key system; Analysis module: Obtains the associated parameters of the target authentication mechanism in the access preparation set corresponding to the security access benchmark set, and analyzes the target authentication process of the security access benchmark set based on the associated parameters; Processing module: Processes and analyzes the secure access baseline set to obtain the secure access order; Security module: Generates access logs after performing secure data access operations on target data based on the secure access baseline set, target authentication process, and hardware acceleration configuration parameters.

[0005] Preferably, the secure access benchmark set is processed and analyzed to obtain the secure access order, specifically including the following steps: Obtain the key feature parameters of the target key system in the access preparation set corresponding to the secure access benchmark set, and analyze the key security coefficient corresponding to the secure access benchmark set based on the key feature parameters; Set the access weight of the secure access benchmark set; obtain the access priority coefficient of the secure access benchmark set based on the access weight and the key security coefficient corresponding to the secure access benchmark set, and obtain the secure access order of the secure access benchmark set based on the access priority coefficient.

[0006] Preferably, extracting the access subject information and target data identifier of the data access request specifically includes the following steps: Set up an access information extraction model, which includes a subject identity parsing module and a data identification and location module; The access subject information is obtained by parsing the identity field in the data access request using the subject identity parsing module in the access information extraction model. The target data identifier is obtained by identifying the data index field in the data access request based on the data identifier positioning module in the access information extraction model.

[0007] Preferably, the access feature parameters corresponding to the access subject information and the target data identifier are compared and analyzed with the compliance range of the protocol standard in the security access benchmark set and the key lifecycle threshold of the key level rules, respectively, to obtain the target authentication mechanism that conforms to the protocol standard and the target key system that conforms to the key level rules. Specifically, this includes the following steps: If the authentication algorithm parameters corresponding to the access subject information are not within the compliance range of the protocol standard, then the authentication algorithm is determined to be non-compliant with the protocol standard. If the authentication algorithm parameters corresponding to the access subject information are within the compliance range of the protocol standard, then the authentication algorithm is determined to comply with the protocol standard and is recorded as the target authentication mechanism. If the key validity period parameter corresponding to the target data identifier exceeds the key lifecycle threshold of the key hierarchy rule, then the key system is determined to be inconsistent with the key hierarchy rule. If the key validity period parameter corresponding to the target data identifier does not exceed the key lifecycle threshold of the key hierarchy rule, then the key system is determined to conform to the key hierarchy rule and is recorded as the target key system.

[0008] Preferably, the target authentication process for obtaining the secure access baseline set based on correlation parameter analysis specifically includes the following steps: The associated parameters include the identity binding degree between the target authentication mechanism and the access subject information, the data compatibility degree between the target authentication mechanism and the target data identifier, and the computation latency of the target authentication mechanism; Set identity binding weights, data adaptation weights, and latency weights; Based on identity binding weight and identity binding degree, data adaptation weight and data adaptation degree, latency weight and computation latency, the comprehensive adaptation degree of the target authentication mechanism is obtained; Based on the comprehensive adaptability, the target authentication mechanism is optimized to obtain the target authentication process of the secure access benchmark set. Set the authentication node identifier for the target authentication process according to the protocol standard.

[0009] Preferably, obtaining the key characteristic parameters of the target key system in the access preparation set corresponding to the secure access benchmark set specifically includes the following steps: Key characteristic parameters include the number of levels of device keys, working keys, and session keys in the target key system; The key feature parameters include the encryption strength values ​​of the keys at each level in the target key system, and the average encryption strength of the target key system is obtained based on the encryption strength values.

[0010] Preferably, the key security coefficient corresponding to the secure access benchmark set is obtained based on the analysis of key feature parameters, specifically including the following steps: Set the hierarchical quantity weights, and based on the hierarchical quantity weights and the number of device keys, working keys, and session keys in the target key system, obtain the first key security coefficient of the secure access benchmark set; Obtain the risk level coefficient for data access, and based on the risk level coefficient and the average encryption strength of the target key system, obtain the encryption strength adaptation value of the security access benchmark set; Set the encryption strength weight, and obtain the second key security coefficient of the secure access benchmark set based on the encryption strength weight and the encryption strength adaptation value; Set a first security weight and a second security weight; based on the first security weight and the first key security coefficient, and the second security weight and the second key security coefficient, obtain the key security coefficient of the secure access benchmark set.

[0011] Preferably, the secure access order of the secure access benchmark set is obtained based on the access priority coefficient, specifically as follows: Sort the security access benchmark set in descending order of access priority coefficient to construct the security access order of the security access benchmark set; Among them, the higher the access priority coefficient of the security access benchmark set, the higher its priority in the security access order.

[0012] Preferably, after performing data security access operations on the target data based on the security access benchmark set, the target authentication process, and hardware acceleration configuration parameters, an access log is generated, specifically including the following steps: The corresponding target authentication process is invoked sequentially according to the secure access order to authenticate the access subject. After successful identity authentication, the multi-core processor and password card are activated according to the hardware acceleration configuration parameters to perform encrypted transmission and access control of the target data. After the data access operation is completed, record the access subject information, target data identifier, access time, authentication result and encryption / decryption information, generate access logs and store them in the security log library.

[0013] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the IPSec VPN security gateway system.

[0014] Compared with the prior art, the present invention has the following beneficial effects: This invention constructs a comprehensive and efficient security protection process, achieving significant results in data access security. The extraction module accurately obtains access subjects and data identification information, clearly defining the targets for subsequent security processing and ensuring that access participants and target data are clearly identifiable from the source. The setting module establishes a secure access benchmark set, covering protocol standards, key rules, and hardware parameters. Protocol standards specify the security principles followed in communication, key hierarchy rules dynamically manage keys through lifecycle thresholds to avoid long-term use risks, and hardware acceleration parameters adapt to computing power requirements, allowing security and performance to synergize. The comparison module filters out compliant target authentication mechanisms and key systems, strengthening security from both algorithm and key dimensions to ensure legitimate identity verification and compliant key usage. The generation module integrates authentication and key systems to generate an access preparation set, making the access process seamless and reducing configuration vulnerabilities. The analysis module optimizes the authentication process based on parameters, making identity authentication more adaptable to business and data security needs, improving verification accuracy and efficiency. The processing module determines the secure access order, scheduling access in an orderly manner to ensure priority processing of critical data and improve overall access efficiency. The security module connects the entire access process, strictly verifies identity authentication, hardware acceleration facilitates encrypted data transmission, and log records retain a complete track, building a solid security barrier for network data interaction, ensuring the safe and orderly operation of business, and promoting the efficient operation of data access under security standards. Attached Figure Description

[0015] Figure 1 This invention presents a schematic diagram of the modules of an IPSec VPN security gateway system. Figure 2This invention provides a schematic diagram illustrating the steps for obtaining target data identifiers in an IPSec VPN security gateway system. Figure 3 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention.

[0016] 610. Processor; 620. Communication interface; 630. Memory; 640. Communication bus. Detailed Implementation

[0017] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0018] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0019] Secondly, the term "an embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places throughout this specification does not necessarily refer to the same embodiment, nor is it a single embodiment or an embodiment selectively excluded from other embodiments.

[0020] Reference Figures 1-3 As shown.

[0021] The embodiments further illustrate the IPSec VPN security gateway system proposed in this invention.

[0022] An IPSec VPN security gateway system includes: Extraction module: Extracts the access subject information and target data identifier of the data access request; Configuration module: Configure the security access benchmark set, which includes protocol standards, key level rules and hardware acceleration configuration parameters. The protocol standards have corresponding compliance ranges, the key level rules have corresponding key lifecycle thresholds, and the hardware acceleration configuration parameters have corresponding computing power adaptation ranges. The comparison module compares and analyzes the access feature parameters corresponding to the access subject information and the target data identifier with the compliance range of the protocol standard and the key lifecycle threshold of the key level rule in the security access benchmark set, respectively, to obtain the target authentication mechanism that conforms to the protocol standard and the target key system that conforms to the key level rule. Generation module: Generates an access preparation set corresponding to the secure access baseline set based on the target authentication mechanism and target key system; Analysis module: Obtains the associated parameters of the target authentication mechanism in the access preparation set corresponding to the security access benchmark set, and analyzes the target authentication process of the security access benchmark set based on the associated parameters; Processing module: Processes and analyzes the secure access baseline set to obtain the secure access order; Security module: Generates access logs after performing secure data access operations on target data based on the secure access baseline set, target authentication process, and hardware acceleration configuration parameters.

[0023] The extraction module is responsible for separating the access subject information and target data identifier from the data access request. The settings module builds a secure access benchmark set, in which the protocol standard defines the compliance range and standardizes the communication rules that must be followed for access. The key level rules set the key lifecycle threshold and constrain the validity period of the key. The hardware acceleration configuration parameters clarify the computing power adaptation range and provide a basis for accelerating data processing.

[0024] The comparison module compares the access characteristics of the accessing subject and the target data with the protocol standard compliance range and key level rule threshold in the security access benchmark set. If the accessing subject's authentication algorithm parameters meet the protocol standard compliance range, it becomes the target authentication mechanism; if the key validity period of the target data has not exceeded the threshold, the corresponding key system is used as the target key system, and suitable authentication and key mechanisms are selected.

[0025] The generation module generates an access preparation set based on the target authentication mechanism and the target key system. The analysis module obtains the associated parameters of the target authentication mechanism from the access preparation set, such as identity binding degree, data adaptability and computation latency. It calculates the comprehensive adaptability by combining various set weights, thereby optimizing the target authentication process and setting authentication node identifiers to make the authentication steps clear and standardized.

[0026] The processing module first extracts the characteristic parameters of the target key system, including the number of keys at each level and the encryption strength, and calculates the key security coefficient in combination with the data access risk level; then it calculates the access priority coefficient based on the access weight and the key security coefficient, and determines the secure access order by sorting the coefficients from largest to smallest.

[0027] The security module invokes the target authentication process according to the secure access order, first completing the authentication of the access subject's identity; after successful authentication, it uses hardware acceleration configuration parameters to start the multi-core processor and cryptographic card to encrypt the transmission and control access of the target data; after the access is completed, it records the subject information, data identifier, and access time, generates an access log and stores it in the security log database, ensuring data access security and traceability throughout the process.

[0028] The secure access baseline is processed and analyzed to obtain the secure access order, which specifically includes the following steps: Obtain the key feature parameters of the target key system in the access preparation set corresponding to the secure access benchmark set, and analyze the key security coefficient corresponding to the secure access benchmark set based on the key feature parameters; Set the access weight of the secure access benchmark set; obtain the access priority coefficient of the secure access benchmark set based on the access weight and the key security coefficient corresponding to the secure access benchmark set, and obtain the secure access order of the secure access benchmark set based on the access priority coefficient.

[0029] First, obtain the key characteristic parameters of the target key system from the access preparation set corresponding to the security access benchmark set. For example, the number of levels of device keys, working keys, and session keys in the target key system, as well as the encryption strength value of each level of key. Suppose that in the target key system of a certain business system, the number of device key levels is 2, the number of working key levels is 3, and the number of session key levels is 1. The encryption strength values ​​of each level of key are 0.9, 0.85, 0.8, 0.95, and 0.88, respectively. The key security coefficient corresponding to the security access benchmark set is obtained through these parameters.

[0030] Access weights are set for the secure access baseline set. These weights can be determined based on factors such as business needs and data importance. For example, the access weights for the secure access baseline set corresponding to core business data are set to higher values, such as 0.8, while the access weights for ordinary office data are set to 0.5. Based on the set access weights and key security coefficients, the access priority coefficient of the secure access baseline set is obtained. The access weights and key security coefficients work together; baseline sets with higher weights and higher key security coefficients will have a higher access priority coefficient.

[0031] The secure access benchmark sets are arranged according to their access priority coefficients to form a secure access order. Benchmark sets with higher access priority coefficients will be processed first during data access. This ensures that the data access process meets business needs while relying on the high security of the key system to protect the data during the access process. For example, when an enterprise has both core business data access requests and ordinary data access requests at the same time, the secure access benchmark set corresponding to the core business will be accessed first due to its higher access priority coefficient, ensuring that critical data is accessed securely and preferentially.

[0032] Extracting the access subject information and target data identifier of the data access request includes the following steps: Set up an access information extraction model, which includes a subject identity parsing module and a data identification and location module; The access subject information is obtained by parsing the identity field in the data access request using the subject identity parsing module in the access information extraction model. The target data identifier is obtained by identifying the data index field in the data access request based on the data identifier positioning module in the access information extraction model.

[0033] This application establishes an access information extraction model, which consists of a subject identity resolution module and a data identifier location module. The subject identity resolution module is activated when a data access request is initiated. It focuses on identity fields in the request, such as employee ID, department, and account permission identifiers, and parses these fields. The data identifier location module also works simultaneously, identifying data index fields in the data access request. These data index fields include data number, storage path identifier, and business category label. The module finds and parses these fields from the request according to pre-defined identification rules, thereby determining the target data identifier—that is, identifying the specific data to be accessed. Through the collaborative operation of these two modules, the access information extraction model can completely and accurately obtain the access subject information and target data identifier from the data access request, ensuring that data access is clear and controllable from the source.

[0034] The access feature parameters corresponding to the access subject information and target data identifier are compared and analyzed with the compliance range of the protocol standard and the key lifecycle threshold of the key level rule in the security access benchmark set, respectively, to obtain the target authentication mechanism that conforms to the protocol standard and the target key system that conforms to the key level rule. The specific steps include: If the authentication algorithm parameters corresponding to the access subject information are not within the compliance range of the protocol standard, then the authentication algorithm is determined to be non-compliant with the protocol standard. If the authentication algorithm parameters corresponding to the access subject information are within the compliance range of the protocol standard, then the authentication algorithm is determined to comply with the protocol standard and is recorded as the target authentication mechanism. If the key validity period parameter corresponding to the target data identifier exceeds the key lifecycle threshold of the key hierarchy rule, then the key system is determined to be inconsistent with the key hierarchy rule. If the key validity period parameter corresponding to the target data identifier does not exceed the key lifecycle threshold of the key hierarchy rule, then the key system is determined to conform to the key hierarchy rule and is recorded as the target key system.

[0035] In data access scenarios, protocol standards are pre-defined, including compliance ranges for authentication algorithm parameters. When an access request arrives, the authentication algorithm parameters corresponding to the access subject's information are extracted. Taking enterprise VPN access as an example, assuming the protocol standard stipulates that for authentication based on the Chinese national cryptographic algorithm SM2, the compliant range for key length parameters is 256 bits. If the access subject uses the SM2 authentication algorithm, but the actual key length is 192 bits, since 192 bits is not within the compliant range of 256 bits, the authentication algorithm is determined to be non-compliant with the protocol standard. Conversely, if the key length is 256 bits, within the compliant range, the algorithm is determined to be compliant with the standard and is selected as the target authentication mechanism for subsequent authentication processes.

[0036] Similarly, key hierarchy rules are pre-defined, including key lifecycle thresholds. The key validity period parameter corresponding to the target data identifier is extracted. For example, the key hierarchy rules set a key lifecycle threshold of 7 days for a certain type of business data. If the key validity period parameter corresponding to the target data identifier is 10 days, exceeding the 7-day threshold, then the key system is determined to be non-compliant with the key hierarchy rules. If the key validity period parameter is 5 days, not exceeding the threshold, then it is deemed compliant, and the key system is identified as the target key system for subsequent data encryption and other security operations. By separately determining the compliance of the identity authentication algorithm and the key system, suitable target authentication mechanisms and target key systems are selected, laying a solid foundation for secure data access and ensuring that the access process not only complies with protocol specifications but also relies on a compliant key system to guarantee the security of encrypted data transmission.

[0037] The target authentication process for obtaining the security access baseline set based on correlation parameter analysis includes the following steps: The associated parameters include the identity binding degree between the target authentication mechanism and the access subject information, the data compatibility degree between the target authentication mechanism and the target data identifier, and the computation latency of the target authentication mechanism; Set identity binding weights, data adaptation weights, and latency weights; Based on identity binding weight and identity binding degree, data adaptation weight and data adaptation degree, latency weight and computation latency, the comprehensive adaptation degree of the target authentication mechanism is obtained; Based on the comprehensive adaptability, the target authentication mechanism is optimized to obtain the target authentication process of the secure access benchmark set. Set the authentication node identifier for the target authentication process according to the protocol standard.

[0038] In data access scenarios, the target authentication mechanism must be compatible with the access subject and the target data. Therefore, the associated parameters include identity binding degree, data compatibility degree, and computation latency. Identity binding degree refers to the degree of fit between the target authentication mechanism and the access subject information, such as the accuracy of the authentication mechanism in identifying the subject's identity. A higher value indicates a tighter binding. Data compatibility degree refers to the matching between the target authentication mechanism and the target data identifier, such as the compatibility of the authentication algorithm with the data encryption format. A better compatibility results in a higher value. Computation latency refers to the time it takes for the target authentication mechanism to perform the authentication operation. Shorter latency is better.

[0039] Set weights based on the business's emphasis on identity authentication, data adaptation, and computing efficiency. For example, for access to core enterprise data, the security of identity binding is more important, so the identity binding weight is set to 0.5; data adaptation affects the accuracy of data access, so the data adaptation weight is set to 0.3; and computing latency affects access efficiency, so the latency weight is set to 0.2.

[0040] Overall Adaptability = Identity Binding Weight × Identity Binding Degree + Data Adaptability Weight × Data Adaptability + Latency Weight × (1 / Calculation Latency). Assuming the identity binding degree is 0.8, the data adaptability is 0.7, and the calculation latency is 0.002 seconds, then the overall adaptability = 0.5 × 0.8 + 0.3 × 0.7 + 0.2 × (1 / 0.002) = 0.4 + 0.21 + 100 = 100.61.

[0041] After obtaining the overall compatibility score, the target authentication mechanism process is optimized. A high overall compatibility score indicates good mechanism adaptability, allowing for process simplification, such as reducing unnecessary identity verification steps. Conversely, a low compatibility score necessitates adding security verification steps, such as implementing secondary authentication. The optimized process yields a target authentication flow based on a secure access baseline, ensuring both security and efficiency in authentication.

[0042] Obtaining the key characteristic parameters of the target key system in the access preparation set corresponding to the secure access benchmark set includes the following steps: Key characteristic parameters include the number of levels of device keys, working keys, and session keys in the target key system; The key feature parameters include the encryption strength values ​​of the keys at each level in the target key system, and the average encryption strength of the target key system is obtained based on the encryption strength values.

[0043] First, it's important to clarify the composition of key characteristic parameters. In a key system, device keys, working keys, and session keys are key components, and the number of their layers is a crucial parameter. For example, in a certain enterprise data center's key system, the number of device key layers is set to 2, the number of working key layers is 3, and the number of session key layers is 1. These number of layers reflect the structural complexity of the key system; the more layers, the more detailed the key management and application scenario division.

[0044] The encryption strength values ​​of each key level are also key parameters. Encryption strength reflects the key's ability to resist cracking; higher values ​​indicate stronger security. Assuming the device key has two layers of encryption strength values ​​of 0.9 and 0.85, the working key has three layers of 0.8, 0.95, and 0.88, and the session key has one layer of 0.75, the average encryption strength is calculated as follows: First, add the encryption strength values ​​of all key levels: 0.9 + 0.85 + 0.8 + 0.95 + 0.88 + 0.75 = 5.13. Then divide by the total number of key levels (2 + 3 + 1 = 6). The average encryption strength is calculated as: (Sum of encryption strength values ​​of each key level) ÷ (Total number of key levels). The resulting average encryption strength is 5.13 ÷ 6 = 0.855. By extracting the number of levels for the device key, working key, and session key, and calculating the encryption strength values ​​of each level and the average encryption strength, the characteristics of the key system are comprehensively characterized, providing fundamental support for data encryption security.

[0045] The key security coefficient corresponding to the secure access benchmark set is obtained by analyzing the key feature parameters, specifically including the following steps: Set the hierarchical quantity weights, and based on the hierarchical quantity weights and the number of device keys, working keys, and session keys in the target key system, obtain the first key security coefficient of the secure access benchmark set; Obtain the risk level coefficient for data access, and based on the risk level coefficient and the average encryption strength of the target key system, obtain the encryption strength adaptation value of the security access benchmark set; Set the encryption strength weight, and obtain the second key security coefficient of the secure access benchmark set based on the encryption strength weight and the encryption strength adaptation value; Set a first security weight and a second security weight; based on the first security weight and the first key security coefficient, and the second security weight and the second key security coefficient, obtain the key security coefficient of the secure access benchmark set.

[0046] This application, based on the security requirements of different key hierarchy structures for various business applications, sets weights for the number of key levels for these three key types. Device keys, used for device authentication and crucial for basic security, can be assigned a weight of 0.4. Working keys, used for production process data encryption, have a weight of 0.3. Session keys, ensuring real-time communication security, also have a weight of 0.3. Assuming a key system has 3 device key levels, 4 working key levels, and 2 session key levels, the first key security coefficient is calculated using the formula: First Key Security Coefficient = Number of Device Key Levels × Device Key Level Weight + Number of Working Key Levels × Working Key Level Weight + Number of Session Key Levels × Session Key Level Weight. Substituting the values, we get 3 × 0.4 + 4 × 0.3 + 2 × 0.3 = 1.2 + 1.2 + 0.6 = 3.0. This reflects the basic security contribution of the key system due to the number and structure of its levels; the richer the levels and the more closely the weight allocation matches the business requirements, the higher the first key security coefficient.

[0047] First, determine the risk level coefficient for data access. Different risk scenarios correspond to different coefficients. For example, the risk level coefficient for daily office data access is set to 1.0, for financial data access to 1.5, and for core R&D data access to 2.0. Simultaneously, calculate the average encryption strength using the encryption strength of each level of the target key system. Assuming the average encryption strength of the target key system is 0.9 and the risk level coefficient is 2.0 in the core R&D data access scenario, according to the formula Encryption Strength Fit Value = Risk Level Coefficient × Average Encryption Strength, the calculated encryption strength fit value is 2.0 × 0.9 = 1.8. This value reflects the matching degree between the encryption capability of the key system and the access risk. The higher the risk and the greater the encryption strength, the higher the fit value, indicating a stronger risk coverage capability.

[0048] Set an encryption strength weight for the encryption strength matching value. The weight value is determined by the business's emphasis on the risk of encryption strength mismatch. For highly sensitive scenarios such as core R&D data, the encryption strength weight can be set to 0.6. According to the formula Second Key Security Coefficient = Encryption Strength Weight × Encryption Strength Matching Value, substituting the values ​​in the example above, we get 0.6 × 1.8 = 1.08. This coefficient focuses on the actual ability of the key system to resist current access risks. The higher the encryption strength weight and the larger the matching value, the higher the security coefficient of the second key.

[0049] First and second security weights are assigned to the first and second key security coefficients, respectively. The weight allocation depends on the business's priority regarding key structure complexity and encryption risk coverage. If structural complexity is prioritized to ensure basic security, the first security weight is set to 0.4, and the second security weight is set to 0.6. According to the formula: Key Security Coefficient = First Key Security Coefficient × First Security Weight + Second Key Security Coefficient × Second Security Weight, substituting the previously calculated values: 3.0 × 0.4 + 1.08 × 0.6 = 1.2 + 0.648 = 1.848. This coefficient comprehensively considers the structure and risk resistance capability of the key system; a higher value indicates stronger overall security in the current data access scenario.

[0050] The secure access order of the secure access benchmark set is obtained based on the access priority coefficient, specifically as follows: Sort the security access benchmark set in descending order of access priority coefficient to construct the security access order of the security access benchmark set; Among them, the higher the access priority coefficient of the security access benchmark set, the higher its priority in the security access order.

[0051] This application first calculates an access priority coefficient for each secure access benchmark set. This coefficient comprehensively considers factors such as key security coefficient and access weight, assuming that the access priority coefficient = key security coefficient × access weight. For example, in an enterprise data center, there are three secure access benchmark sets, corresponding to R&D data, financial data, and office data access, respectively. The calculated access priority coefficient is 1.8 for R&D data, 1.5 for financial data, and 1.2 for office data.

[0052] These security access benchmark sets are sorted according to their access priority coefficients from highest to lowest. The higher the access priority coefficient, the higher the comprehensive score of the access requests corresponding to that benchmark set in terms of security adaptability, business importance, and other dimensions, and the more priority they need to be processed. This is how the security access order is constructed.

[0053] In actual data access, this order is followed, prioritizing the access processes corresponding to the security access benchmark set with the highest access priority coefficient. This ensures that high-priority, high-security data access can be carried out in a timely manner, and that the entire data access process is carried out in an orderly manner within the security framework, avoiding security risks or resource conflicts caused by disordered access.

[0054] After performing secure data access operations on the target data based on the secure access baseline set, the target authentication process, and hardware acceleration configuration parameters, an access log is generated. This process includes the following steps: The corresponding target authentication process is invoked sequentially according to the secure access order to authenticate the access subject. After successful identity authentication, the multi-core processor and password card are activated according to the hardware acceleration configuration parameters to perform encrypted transmission and access control of the target data. After the data access operation is completed, record the access subject information, target data identifier, access time, authentication result and encryption / decryption information, generate access logs and store them in the security log library.

[0055] The first step is identity authentication. Following a pre-determined secure access order, the corresponding target authentication processes are invoked sequentially to verify the identity of the accessing entity. Research and development data access is processed first according to the secure access order. At this point, the system invokes the target authentication process corresponding to the research and development data. This process combines the accessing entity's identity information with preset authentication rules to verify the legitimacy of the accessing entity's identity. Next, data encryption transmission and access control are performed. Once the accessing entity's identity is authenticated, the multi-core processor and cryptographic card work together based on the hardware acceleration configuration parameters. The multi-core processor can handle multiple data access tasks in parallel, while the cryptographic card focuses on encryption operations. Taking the transmission of research and development data as an example, assuming the data needs to be encrypted using the SM4 algorithm, the hardware acceleration configuration parameters will guide the multi-core processor to allocate computing resources and simultaneously trigger the cryptographic card to perform SM4 encryption and decryption operations, encrypting the target data for transmission so that the data exists in ciphertext form during network transmission, preventing theft or tampering; based on access control policies, the scope of data access is controlled to ensure that data is only accessed within authorized limits.

[0056] After a data access operation is completed, key information is collected, including the access subject information, target data identifier, access time, authentication result, and encryption / decryption information. This information is then integrated to generate an access log, which is stored in a security log repository. By tracing the access source through the log, detailed evidence is provided for post-event tracing and security analysis, forming a complete security loop for data access.

[0057] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement an IPSec VPN security gateway system.

[0058] like Figure 3 As shown, the electronic device may include a processor 610, a communication interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 can call logical instructions in the memory 630 to execute an IPSec VPN security gateway system.

[0059] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory, random access memory, magnetic disks, or optical disks.

[0060] On the other hand, the present invention also provides a computer program product, the computer program product including a computer program that can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer is able to execute an IPSec VPN security gateway system.

[0061] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform an IPSec VPN security gateway system.

[0062] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0063] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0064] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An IPSec VPN security gateway system, characterized in that, include: Extraction module: Extracts the access subject information and target data identifier of the data access request; Configuration module: Configure the security access benchmark set, which includes protocol standards, key level rules and hardware acceleration configuration parameters. The protocol standards have corresponding compliance ranges, the key level rules have corresponding key lifecycle thresholds, and the hardware acceleration configuration parameters have corresponding computing power adaptation ranges. The comparison module compares and analyzes the access feature parameters corresponding to the access subject information and the target data identifier with the compliance range of the protocol standard and the key lifecycle threshold of the key level rule in the security access benchmark set, respectively, to obtain the target authentication mechanism that conforms to the protocol standard and the target key system that conforms to the key level rule. Generation module: Generates an access preparation set corresponding to the secure access baseline set based on the target authentication mechanism and target key system; Analysis module: Obtains the associated parameters of the target authentication mechanism in the access preparation set corresponding to the security access benchmark set, and analyzes the target authentication process of the security access benchmark set based on the associated parameters; Processing module: Processes and analyzes the secure access baseline set to obtain the secure access order; Security module: Generates access logs after performing secure data access operations on target data based on the secure access baseline set, target authentication process, and hardware acceleration configuration parameters.

2. The IPSec VPN security gateway system according to claim 1, characterized in that, The secure access baseline is processed and analyzed to obtain the secure access order, which specifically includes the following steps: Obtain the key feature parameters of the target key system in the access preparation set corresponding to the secure access benchmark set, and analyze the key security coefficient corresponding to the secure access benchmark set based on the key feature parameters; Set the access weight of the secure access benchmark set; obtain the access priority coefficient of the secure access benchmark set based on the access weight and the key security coefficient corresponding to the secure access benchmark set, and obtain the secure access order of the secure access benchmark set based on the access priority coefficient.

3. The IPSec VPN security gateway system according to claim 2, characterized in that, Extracting the access subject information and target data identifier of the data access request includes the following steps: Set up an access information extraction model, which includes a subject identity parsing module and a data identification and location module; The access subject information is obtained by parsing the identity field in the data access request using the subject identity parsing module in the access information extraction model. The target data identifier is obtained by identifying the data index field in the data access request based on the data identifier positioning module in the access information extraction model.

4. The IPSec VPN security gateway system according to claim 3, characterized in that, The access feature parameters corresponding to the access subject information and target data identifier are compared and analyzed with the compliance range of the protocol standard and the key lifecycle threshold of the key level rule in the security access benchmark set, respectively, to obtain the target authentication mechanism that conforms to the protocol standard and the target key system that conforms to the key level rule. The specific steps include: If the authentication algorithm parameters corresponding to the access subject information are not within the compliance range of the protocol standard, then the authentication algorithm is determined to be non-compliant with the protocol standard. If the authentication algorithm parameters corresponding to the access subject information are within the compliance range of the protocol standard, then the authentication algorithm is determined to comply with the protocol standard and is recorded as the target authentication mechanism. If the key validity period parameter corresponding to the target data identifier exceeds the key lifecycle threshold of the key hierarchy rule, then the key system is determined to be inconsistent with the key hierarchy rule. If the key validity period parameter corresponding to the target data identifier does not exceed the key lifecycle threshold of the key hierarchy rule, then the key system is determined to conform to the key hierarchy rule and is recorded as the target key system.

5. The IPSec VPN security gateway system according to claim 4, characterized in that, The target authentication process for obtaining the security access baseline set based on correlation parameter analysis includes the following steps: The associated parameters include the identity binding degree between the target authentication mechanism and the access subject information, the data compatibility degree between the target authentication mechanism and the target data identifier, and the computation latency of the target authentication mechanism; Set identity binding weights, data adaptation weights, and latency weights; Based on identity binding weight and identity binding degree, data adaptation weight and data adaptation degree, latency weight and computation latency, the comprehensive adaptation degree of the target authentication mechanism is obtained; Based on the comprehensive adaptability, the target authentication mechanism is optimized to obtain the target authentication process of the secure access benchmark set. Set the authentication node identifier for the target authentication process according to the protocol standard.

6. The IPSec VPN security gateway system according to claim 5, characterized in that, Obtaining the key characteristic parameters of the target key system in the access preparation set corresponding to the secure access benchmark set includes the following steps: Key characteristic parameters include the number of levels of device keys, working keys, and session keys in the target key system; The key feature parameters include the encryption strength values ​​of the keys at each level in the target key system, and the average encryption strength of the target key system is obtained based on the encryption strength values.

7. The IPSec VPN security gateway system according to claim 6, characterized in that, The key security coefficient corresponding to the secure access benchmark set is obtained by analyzing the key feature parameters, specifically including the following steps: Set the hierarchical quantity weights, and based on the hierarchical quantity weights and the number of device keys, working keys, and session keys in the target key system, obtain the first key security coefficient of the secure access benchmark set; Obtain the risk level coefficient for data access, and based on the risk level coefficient and the average encryption strength of the target key system, obtain the encryption strength adaptation value of the security access benchmark set; Set the encryption strength weight, and obtain the second key security coefficient of the secure access benchmark set based on the encryption strength weight and the encryption strength adaptation value; Set a first security weight and a second security weight; based on the first security weight and the first key security coefficient, and the second security weight and the second key security coefficient, obtain the key security coefficient of the secure access benchmark set.

8. The IPSec VPN security gateway system according to claim 7, characterized in that, The secure access order of the secure access benchmark set is obtained based on the access priority coefficient, specifically as follows: Sort the security access benchmark set in descending order of access priority coefficient to construct the security access order of the security access benchmark set; Among them, the higher the access priority coefficient of the security access benchmark set, the higher its priority in the security access order.

9. The IPSec VPN security gateway system according to claim 8, characterized in that, After performing secure data access operations on the target data based on the secure access baseline set, the target authentication process, and hardware acceleration configuration parameters, an access log is generated. This process includes the following steps: The corresponding target authentication process is invoked sequentially according to the secure access order to authenticate the access subject. After successful identity authentication, the multi-core processor and password card are activated according to the hardware acceleration configuration parameters to perform encrypted transmission and access control of the target data. After the data access operation is completed, record the access subject information, target data identifier, access time, authentication result and encryption / decryption information, generate access logs and store them in the security log library.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements an IPSec VPN security gateway system as described in any one of claims 1 to 9.

Images