A method and device for securely accessing an information network via a mobile terminal

Abstract

The present invention discloses a method and device for a mobile phone terminal to securely access an information network, wherein the method comprises the following steps: importing user information and mobile phone terminal information allowed to access into an information verification system to generate an information verification whitelist; constructing a one-to-one corresponding legality mapping table for users, mobile phone terminals, and user digital certificates, and pre-importing it into a network controller; the network controller obtains user information and mobile phone terminal information for access application, and compares the user information and mobile phone terminal information for access application with the information in the generated information verification whitelist; when the user information and mobile phone terminal information for access application exist in the information verification whitelist, the user, mobile phone terminal, and digital certificate for access application are compared with the pre-imported legality mapping table; if they are consistent, the mobile phone terminal is allowed to access the information network; otherwise, access is denied. The method can realize the safe, efficient, and flexible access of mobile phone terminals to the information network.

Description

Technical Field

[0001] The invention relates to a method for a mobile phone terminal to securely access an information network, and also to a device for implementing the method, belonging to the technical field of network security. Background Art

[0002] Information networks usually need to authenticate the identity of users before providing services, and may encrypt and protect subsequent communication data to control that only legitimate users can use related resources, services or functions. Using digital certificates is a common security mechanism to solve this problem. By using digital certificates bound to users, using PKI systems, VPN technologies, etc., the complexity of user use can be simplified and the security of identity authentication can be improved.

[0003] Mobile terminals obtain various data resources and services through information networks. The number of accesses is large, and the data exchange traffic is large. Information networks have an urgent need for secure, reliable, and convenient access for mobile terminals.

[0004] At present, the main means of identity recognition used by terminal security is to judge and verify by collecting terminal feature information, including USBKEY serial number, digital certificate serial number, mobile terminal serial number and user fingerprint feature information, and upload this terminal feature information to the secure access gateway through an encrypted channel. The secure access gateway verifies the integrity and validity of the terminal feature information and decides whether the terminal can access the protected server based on the verification results.

[0005] like Figure 1 As shown, the existing mobile terminal access information network mainly includes the following steps: establishing an encrypted channel, the client calls USBKEY and the digital certificate stored in USBKEY, and completes the two-way identity authentication based on the digital certificate and the encryption channel negotiation based on the national secret SM1 algorithm according to the SSLVPN protocol; then, the client collects the user's fingerprint feature information; the client collects the terminal feature information, including the USBKEY serial number, the digital certificate serial number and the mobile terminal serial number; finally, the client uploads the user's fingerprint feature information together with the terminal feature information to the secure access gateway, and the secure access gateway searches the database according to a data in the terminal feature information and determines its legitimacy; if the information is illegal, the terminal will be stopped from accessing the network server; if the information is legal, the terminal can access the network server.

[0006] However, the existing technology of terminal access to the server of the information network has the following disadvantages:

[0007] 1) The password module USBKEY is only applicable to terminals such as dedicated mobile terminals or laptop computers with USB interfaces, and is not suitable for mobile terminals. Mobile terminals cannot use password modules such as USBKEY;

[0008] 2) When collecting and sending terminal feature information, only the digital certificate serial number is sent without signing the digital certificate itself, which poses a security risk;

[0009] 3) There is no real-time query on the validity of digital certificates, which allows terminals to access the information network even when their digital certificates are expired or revoked;

[0010] 4) Using fingerprints as user identity authentication is easy to be misused and tampered with. For example, a hand mask can be used to obtain the user's fingerprint information and then forged, thus posing a security risk. Summary of the invention

[0011] In view of the deficiencies in the prior art, the primary technical problem to be solved by the present invention is to provide a method for a mobile phone terminal to securely access an information network.

[0012] Another technical problem to be solved by the present invention is to provide a device for implementing the method for securely accessing the mobile phone terminal to the information network.

[0013] In order to achieve the above-mentioned object of the invention, the present invention adopts the following technical solutions:

[0014] According to a first aspect of an embodiment of the present invention, a method for securely accessing an information network by a mobile terminal is provided, comprising the following steps:

[0015] Import the user information and mobile terminal information allowed to access into the information verification system to generate an information verification whitelist;

[0016] Construct a one-to-one correspondence legitimacy mapping table for users, mobile terminals, and user digital certificates, and pre-import it into the network controller;

[0017] The network controller obtains the user information and mobile terminal information of the user applying for access, and compares the user information and mobile terminal information of the user applying for access with the information in the generated information verification whitelist;

[0018] When the information verification whitelist contains the user information and mobile terminal information applying for access, the user, mobile terminal, and user digital certificate applying for access are compared with the pre-imported legitimacy mapping table; if they are consistent, the mobile terminal is allowed to access the information network; otherwise, access is denied.

[0019] Preferably, the user information and mobile terminal information allowed to access are imported into the information verification system to generate an information verification whitelist, including the following steps:

[0020] Import the portrait information of legitimate users who are allowed to access the portrait data system deployed on the information network to establish a portrait information whitelist;

[0021] The IMEI number information of legal mobile phone terminals that are allowed to access is pre-imported into the terminal management and control system deployed on the information network to establish an IMEI number whitelist.

[0022] Preferably, the mobile terminal client obtains the user information and mobile terminal information applying for access, and compares the user information and mobile terminal information applying for access with the information in the generated information verification whitelist, including sending the obtained portrait information of the user using the mobile terminal and the IMEI number information of the mobile terminal to the network controller, and the network controller compares the obtained portrait information of the user using the mobile terminal and the IMEI number information of the mobile terminal with the information in the portrait information whitelist and the IMEI number whitelist respectively.

[0023] Preferably, the obtained portrait information of the user of the mobile terminal is sent to the network controller, and the network controller compares the obtained portrait information of the user of the mobile terminal with the information in the portrait information whitelist, including the following steps:

[0024] Obtaining the portrait information of the user of the mobile terminal and signing the portrait information;

[0025] Send the signed portrait information to the network controller;

[0026] The network controller verifies the portrait information and verifies whether the person applying for access is a real mobile terminal user by querying the portrait information whitelist; when the portrait information exists in the portrait information whitelist, the person applying for access is a real mobile terminal user; otherwise, the network access of the mobile terminal is stopped.

[0027] Preferably, the obtained IMEI number information of the mobile phone terminal is sent to the network controller, and the network controller compares the obtained IMEI number information of the mobile phone terminal with the information in the IMEI number whitelist, including the following steps:

[0028] The mobile terminal client reads the IMEI number information of the terminal and signs the information;

[0029] The mobile terminal client sends the signed IMEI number information to the network controller via a wireless transmission link;

[0030] The network controller verifies the IMEI number information and verifies whether the mobile terminal access is legal by querying the IMEI number whitelist of the terminal management system. If it is legal, it will proceed to the next step; if it is not legal, it will stop the mobile terminal's network access.

[0031] Preferably, when the information verification whitelist contains the user information and mobile terminal information of the user applying for access, the mobile terminal, and the user digital certificate of the user applying for access and the pre-imported legitimacy mapping table, the following steps are also included before comparing:

[0032] The acquired user digital certificate is sent to the network controller, and the validity of the user digital certificate is queried through the certificate directory service.

[0033] Preferably, the obtained user digital certificate is sent to the network controller, and the validity of the user digital certificate is queried through the certificate directory service; the steps include:

[0034] Read the user digital certificate and send the signed user digital certificate to the network controller;

[0035] The network controller verifies the signed user digital certificate;

[0036] The network controller queries the validity of the user's digital certificate in real time through the certificate directory service.

[0037] Preferably, the method for securely accessing an information network via a mobile terminal further comprises the following steps:

[0038] When a mobile phone terminal accesses the information network, the IMEI number of the mobile phone terminal requesting access and the user digital certificate are verified cyclically. When the user digital certificate expires or the IMEI number is deleted, the network connection is terminated in time.

[0039] According to a second aspect of an embodiment of the present invention, there is provided a device for a mobile terminal to securely access an information network, comprising a mobile terminal password module, a mobile terminal client, a mobile terminal, a network controller and an information verification system;

[0040] The mobile terminal password module is used to generate the digital signature and the information required for signature verification according to the terminal password module type selected by the user, and provide the user digital certificate;

[0041] The mobile terminal client is used to obtain mobile terminal verification information from the mobile terminal and the mobile terminal password module respectively, and send the signed mobile terminal verification information to the network controller;

[0042] The network controller is used to verify the signature of the mobile terminal verification information sent by the mobile terminal client, and verify the verified mobile terminal verification information according to the information stored in the information verification system.

[0043] Preferably, the information verification system includes a portrait data system, a terminal management system and a certificate directory service;

[0044] The portrait data system is used to import portrait information of legitimate users to provide a portrait information whitelist;

[0045] The terminal management and control system establishes secure communication with the network controller to import legitimate mobile terminal IMEI numbers to provide an IMEI number whitelist;

[0046] The certificate directory service is used to synchronize PKI system digital certificate data and provide a real-time query interface for digital certificate validity.

[0047] The method for securely accessing an information network by a mobile phone terminal provided by the present invention can confirm the real identity of the user through portrait recognition and face comparison verification; can prevent the mobile phone terminal from being tampered with or forged by confirming the IMEI number information; and according to different models and different users, the mobile phone will use different password modules, including TF cards, inSE, TEE and film cards, and through automatic retrieval of these password modules, reading user digital certificates of multiple password modules and real-time query of validity, the mobile phone terminal authentication is made safer, more reliable and has real-time performance; finally, by establishing a one-to-one binding relationship between people / machines / certificates, it is prevented that users, terminals, security modules or application services are forged or tampered with, and that certificates are not issued to illegal users or certificates cannot be effectively associated with users, etc., thereby effectively ensuring the security of real users using legal mobile phones to enter the information network, reducing the possibility of security risks such as mobile phone terminals being impersonated, and realizing safe, efficient and flexible access of mobile phone terminals to the information network. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A flow chart of a terminal securely accessing an information network server in the prior art;

[0049] Figure 2 A schematic diagram of the structure of the device for securely accessing an information network by a mobile terminal provided by the present invention;

[0050] Figure 3 A flow chart of a method for a mobile phone terminal to securely access an information network provided by the present invention;

[0051] Figure 4 This is a flow chart of a method for a mobile terminal to securely access an information network in Embodiment 1 provided by the present invention;

[0052] Figure 5 This is a flow chart of a method for a mobile phone terminal to securely access an information network in Embodiment 2 provided by the present invention. DETAILED DESCRIPTION

[0053] The technical content of the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0054] In order to solve the shortcomings of the existing methods and devices for terminal access to information networks, the present invention proposes a method and device for mobile terminal secure access to information networks, which comprehensively utilizes personnel verification - portrait recognition and face comparison verification, terminal authentication - IMEI number legitimacy, and certificate authentication - obtaining user digital certificates of password modules of different user terminals and querying their validity in real time, and performing corresponding binding of people / machines / certificates. The specific advantages include the following:

[0055] First, portrait recognition and face comparison verification can confirm the real identity of the user; second, the IMEI (International Mobile Equipment Identity) number is the unique identification code of the mobile terminal, which is the "identity card" of the mobile terminal and cannot be tampered with or forged; third, according to different models and different users, the mobile phone will use different password modules, including TF card, inSE (Inside Security Element, built-in security chip), TEE (Executive Environment, trusted execution environment) and film card, which need to be automatically retrieved, and can read the user digital certificates of multiple password modules and query the validity in real time, so that the mobile terminal authentication is safer, more reliable and real-time; fourth, establish a one-to-one binding relationship between people / machines / certificates to prevent users, terminals, security modules or application services from being forged and tampered, and there will be no phenomenon such as certificates being issued to illegal users or certificates failing to be effectively associated with users, so that the security of real users using legal mobile phones to enter the information network is effectively improved, and the possibility of security risks such as mobile phone terminals being impersonated is reduced. Therefore, the present invention proposes a method and device for secure access to information networks by mobile terminals, which can realize secure, efficient and flexible access to information networks by mobile terminals.

[0056] like Figure 2As shown, the device for secure access of a mobile terminal to an information network provided by the present invention includes a mobile terminal password module, a mobile terminal client, a mobile terminal, a network controller and an information verification system. Among them, the mobile terminal password module is used to generate digital signatures and information required for signature verification according to the terminal password module type selected by the user, and provide a user digital certificate. Specifically, the mobile terminal password module provides key generation, certificate request assembly, digital signature, signature verification, encryption and decryption, secure storage of information such as keys and user digital certificates. In the embodiment provided by the present invention, the mobile terminal password module includes: security modules such as external TF cards, inSE, TEE, film cards, etc. and password modules implemented in a combination of the above multiple methods. Among them, inSE is together with the terminal SoC main chip, reducing the physical connection between external chips, physically isolating from the bottom of the chip, and ensuring sufficient performance and storage space. It can be used as a hardware password module in mobile scenes; TEE is a trusted execution environment, which can ensure calculations that are not interfered with by conventional operating systems, and can be used as a software password module in mobile policing.

[0057] The mobile terminal client is used to obtain the mobile terminal verification information from the mobile terminal and the mobile terminal password module respectively, and send the signed mobile terminal verification information to the network controller. Among them, the mobile terminal verification information includes portrait information (user face image information), mobile terminal IMEI number information, and user digital certificate of the mobile terminal password module. Specifically, the mobile terminal client calls the mobile terminal password module, obtains the information required for the signature from the mobile terminal password module according to the terminal password module type, signs the mobile terminal verification information, and establishes a secure communication connection with the network controller, and sends the signed portrait information, IMEI number information, and user digital certificate to the network controller through a wireless transmission link.

[0058] The mobile terminal password module and the mobile terminal client can be set independently or in the mobile terminal. When the mobile terminal password module and the mobile terminal client are set in the mobile terminal, Figure 3 As shown, the mobile terminal is a terminal device having a camera for collecting face information, running a mobile terminal password module and a mobile terminal client. The mobile terminal communicates with the information network via a wireless dedicated transmission link. In the embodiments provided by the present invention, the mobile terminal password module and the mobile terminal client are set in the mobile terminal as an example for explanation.

[0059] The network controller is used to verify the signature of the mobile terminal verification information sent by the mobile terminal client, and verify the mobile terminal verification information after the signature verification according to the information stored in the information verification system. When the verification is passed, the mobile terminal is allowed to access the information network; otherwise, the access is denied. Among them, the information verification system includes a portrait data system, a terminal management and control system, and a certificate directory service. The portrait data system establishes a secure communication with the network controller, which is used to import the portrait information of legal users to provide a legal portrait information white list, and provide a portrait information legitimacy query structure. The terminal management and control system establishes a secure communication with the network controller, which is used to import the legal mobile terminal IMEI number to provide a legal IMEI number white list, and provide an IMEI number legitimacy query structure. The certificate directory service establishes a secure communication with the network controller, which is used to synchronize the PKI system digital certificate data, provide a real-time query interface for the validity of the digital certificate, and verify not only the correctness of the digital certificate, but also the validity of the data certificate. In the embodiment provided by the present invention, the network controller also imports users, mobile terminals, and user digital certificates to construct a one-to-one corresponding legitimacy mapping table, which is used to verify the corresponding relationship between the user requesting access, the mobile terminal, and the user digital certificate.

[0060] Specifically, the network controller communicates securely with the mobile terminal client, verifies the signature of the mobile terminal verification information sent by the mobile terminal client, communicates with the portrait data system to verify the real identity of the user, communicates with the terminal management system to verify the legitimacy of the mobile terminal IMEI, and communicates with the certificate directory service to query the validity of the digital certificate in real time, imports the corresponding binding relationship of human / machine / certificate in advance, and verifies the information. When all verifications are passed, the mobile terminal is allowed to access the information network; otherwise, access is denied.

[0061] Figure 2 The figure is a flow chart of a method for securely accessing an information network via a mobile terminal based on the above system, which specifically includes the following steps:

[0062] S1, import the user information and mobile terminal information allowed to access into the information verification system to generate an information verification whitelist. The information verification system can be any server that has information storage and can provide an information query structure.

[0063] Specifically, the user information and mobile terminal information allowed to access are imported into the information verification system to generate an information verification whitelist, including the following steps:

[0064] S11, pre-importing the portrait information of legitimate users who are allowed to access into the portrait data system deployed on the information network, and establishing a portrait information whitelist;

[0065] S12, pre-importing the IMEI number information of legal mobile phone terminals that are allowed to access into a terminal management and control system deployed on the information network, and establishing an IMEI number whitelist (legitimacy list).

[0066] Among them, in the embodiment provided by the present invention, the pre-imported portrait information and IMEI number information have no order relationship.

[0067] S2, a one-to-one correspondence legitimacy mapping table is constructed for the user, mobile terminal, and user digital certificate, and pre-imported into the network controller. The network controller can be any network control server with signature verification, storage, and comparison functions, which is deployed at the entrance of the information network and can establish an HTTPS connection with the mobile terminal.

[0068] S3, the mobile terminal client obtains the user information and mobile terminal information of the user applying for access, and compares the user information and mobile terminal information of the user applying for access with the information in the generated information verification whitelist. When the user information and mobile terminal information of the user applying for access exist in the information verification whitelist, go to step S4; otherwise, deny access.

[0069] Specifically, the mobile terminal client obtains the user information and mobile terminal information applying for access, and compares the user information and mobile terminal information applying for access with the information in the generated information verification whitelist, including sending the obtained portrait information of the mobile terminal user and the IMEI number information of the mobile terminal to the network controller, and the network controller compares the obtained portrait information of the mobile terminal user and the IMEI number information of the mobile terminal with the information in the information verification whitelist respectively.

[0070] The obtained portrait information of the user of the mobile terminal is sent to the network controller, and the network controller compares the obtained portrait information of the user of the mobile terminal with the information in the information verification whitelist, which specifically includes the following steps:

[0071] The mobile terminal client obtains the portrait information of the user using the mobile terminal, and signs the portrait information to prevent the information from being illegally obtained and tampered with;

[0072] The mobile terminal client establishes a secure communication connection with the network controller. To prevent the information from being illegally obtained and tampered with, the signed portrait information is sent to the network controller via a wireless transmission link;

[0073] The network controller verifies the portrait information and verifies whether the user is a real mobile terminal user by querying the portrait information whitelist of the portrait data system. If yes, proceed to the next step; if not, stop the network access of the mobile terminal.

[0074] The IMEI number information of the obtained mobile terminal is sent to the network controller, and the network controller compares the IMEI number information of the obtained mobile terminal with the information in the information verification whitelist, specifically including the following steps:

[0075] The mobile terminal client reads the IMEI number information of the terminal and signs the information;

[0076] The mobile terminal client sends the signed IMEI number information to the network controller via a wireless transmission link;

[0077] The network controller verifies the IMEI number information and verifies whether the mobile terminal access is legal by querying the IMEI number whitelist of the terminal management system. If it is legal, it will proceed to the next step; if it is not legal, it will stop the mobile terminal's network access.

[0078] In the embodiment provided by the present invention, when the information verification whitelist contains the user information and mobile terminal information of the user applying for access, the mobile terminal, and the user digital certificate of the user applying for access and the pre-imported legitimacy mapping table, the following steps are also included before comparing:

[0079] The obtained user digital certificate is sent to the network controller, and the network controller queries the validity of the user digital certificate through the certificate directory service; specifically, the following steps are included: the mobile terminal client identifies the type of the local password module;

[0080] The mobile terminal client reads the user's digital certificate through the password module;

[0081] The mobile terminal client signs the user digital certificate; the mobile terminal client sends the signed user digital certificate to the network controller via a wireless transmission link;

[0082] The network controller verifies the signed user digital certificate;

[0083] The network controller queries the validity of the user's digital certificate in real time through the certificate directory service. If the user's digital certificate is valid, the next step of verification will be carried out, otherwise the network access will be stopped. Among them, the real-time query of the validity of the user's digital certificate through the certificate directory service is to synchronize the PKI (Public Key Infrastructure) system data certificate data through the certificate directory server deployed on the information network, and obtain the interface for querying the valid user digital certificate.

[0084] S4, compare the user applying for access, the mobile terminal, the user digital certificate with the pre-imported legitimacy mapping table; if they are consistent, the mobile terminal is allowed to access the information network; if they are inconsistent, access is denied.

[0085] Specifically, the network controller compares the user, mobile terminal, and user digital certificate of the current access link with the pre-imported legitimacy mapping table. If they are consistent, the mobile terminal is allowed to access the information network; otherwise, the network access of the mobile terminal is stopped.

[0086] In the embodiment provided by the present invention, the following steps are also included:

[0087] S5, when the mobile terminal accesses the information network, the IMEI number of the mobile terminal requesting access and the user digital certificate are verified cyclically. When the user digital certificate expires or the IMEI number is deleted, the network connection is stopped in time to ensure security.

[0088] The following is a detailed description of the method for a mobile phone terminal to securely access an information network using two specific embodiments.

[0089] Example 1

[0090] In the embodiment 1 provided by the present invention, the mobile terminal encryption module is taken as inSE as an example for description. The equipment and environment configuration of the embodiment 1 are as follows:

[0091] 1) Complete information network environment;

[0092] 2) A mobile terminal with a built-in mobile terminal password module inSE, a user digital certificate has been obtained and written into inSE. The mobile terminal network control APP has been installed. It has mobile wireless network data communication capabilities. It has a front camera.

[0093] 3) A network control server, deployed at the entrance of the information network, can establish an HTTPS connection with the mobile terminal and has the ability to verify signatures.

[0094] 4) A portrait data server is deployed on the information network to import the portrait information of legitimate users in advance and provide an interface for querying the portrait information of legitimate users.

[0095] 5) A terminal management and control server is deployed on the information network, imports the legal IMEI numbers of mobile phone terminals in advance, and provides an interface for querying legal IMEI numbers.

[0096] 6) A certificate directory server, deployed on the information network, synchronizes the digital certificate data of the PKI system and provides an interface for querying valid digital certificates.

[0097] like Figure 4 As shown, in Example 1, the method for securely accessing an information network by a mobile terminal provided by the present invention specifically includes the following steps:

[0098] The administrator pre-imports the portrait information of legitimate users (i.e. users allowed to access the information network) into the portrait data server deployed on the information network to establish a portrait information whitelist;

[0099] The administrator imports the IMEI number information of legal mobile terminals (i.e., the IMEI number information of mobile terminals allowed to access the information network) into the terminal management and control server deployed on the information network, and establishes an IMEI number whitelist (legitimacy list);

[0100] The administrator builds a one-to-one legality mapping table for users, mobile terminals, and user digital certificates, and pre-imports it into the network control server;

[0101] The mobile terminal network control APP prompts the mobile terminal user to perform face recognition operations, obtains the user's portrait information, and uses the national secret SM2 algorithm to sign the information;

[0102] The mobile terminal network control APP establishes an HTTPS secure access connection with the network control server, and sends the signed portrait information to the network control server via a wireless transmission link;

[0103] The network control server verifies the signature of the portrait information and verifies whether the user is a real mobile terminal user by querying the portrait information whitelist of the portrait data server; if yes, proceed to the next step; if not, stop the network access of the mobile terminal;

[0104] The mobile terminal network control APP reads the IMEI number information of the terminal and signs the information using the national secret SM2 algorithm;

[0105] The mobile terminal network control APP sends the signed IMEI number information to the network control server via a wireless transmission link;

[0106] The network control server verifies the IMEI number information and verifies whether the mobile terminal access is legal by querying the terminal control server's legal IMEI number whitelist; if legal, proceed to the next step; if illegal, stop the mobile terminal's network access;

[0107] The mobile terminal network control APP identifies the password module type of this machine as inSE;

[0108] The mobile terminal network control APP reads the user's digital certificate through the password module inSE;

[0109] The mobile terminal network control APP signs the user digital certificate using the national secret SM2 algorithm, and sends the signed user digital certificate to the network control server via a wireless transmission link;

[0110] The network control server verifies the signed user digital certificate;

[0111] The network control server queries the validity of the user's digital certificate in real time through the certificate directory server. If the user's digital certificate is valid, the next step of verification will be carried out, otherwise the network access will be stopped;

[0112] The network control server compares the user, mobile terminal, and user digital certificate of the current access link with the pre-imported legitimacy mapping table. If they are consistent, the mobile terminal is allowed to access the information network; if they are inconsistent, the network access of the mobile terminal is stopped.

[0113] In embodiment 1 provided by the present invention, when a mobile phone terminal accesses an information network, the IMEI number of the mobile phone terminal requesting access and the user digital certificate are verified cyclically. When the user digital certificate expires or the IMEI number is deleted, the network connection is stopped in time to ensure security.

[0114] Example 2

[0115] In the embodiment 2 provided by the present invention, the mobile terminal encryption module is taken as an example for description. The equipment and environment configuration of the embodiment 2 are as follows:

[0116] 1) Complete information network environment;

[0117] 2) A mobile phone terminal with a TF card interface and a password module TF card inserted; a user digital certificate has been obtained and written into the TF card; a mobile phone terminal network control APP has been installed; it has mobile wireless network data communication capabilities; and a front camera;

[0118] 3) A network control server, deployed at the entrance of the information network, can establish an HTTPS connection with the mobile terminal and has the ability to verify signatures;

[0119] 4) In the private cloud of the information network, three virtual cloud hosts are created to realize the cloud deployment of the portrait data server, terminal control server and certificate directory server. They are marked as the portrait data cloud host, terminal control cloud host and certificate directory cloud host, and the portrait data system module, terminal control system module and certificate directory service module are deployed respectively. The portrait data cloud host can import the portrait information of legitimate users in advance and provide an interface for querying the portrait information of legitimate users; the terminal control cloud host can import the IMEI number information of legitimate mobile terminals in advance and provide an interface for querying legitimate IMEI numbers; the certificate directory cloud host synchronizes the PKI system digital certificate data and provides an interface for querying valid digital certificates. All three cloud hosts have a network communication environment.

[0120] like Figure 5As shown, in Example 2, the method for securely accessing an information network by a mobile terminal provided by the present invention specifically includes the following steps:

[0121] The administrator pre-imports the portrait information of legitimate users to the portrait data cloud host deployed on the information network and establishes a portrait information whitelist;

[0122] The administrator imports the IMEI number information of legitimate mobile phone terminals into the terminal control cloud host deployed on the information network and establishes an IMEI number whitelist (legitimacy list);

[0123] The administrator builds a one-to-one legality mapping table for users, mobile terminals, and user digital certificates, and pre-imports it into the network control server;

[0124] The mobile terminal network control APP prompts the mobile terminal user to perform face recognition operations, obtains the user's portrait information, and uses the national secret SM2 algorithm to sign the information;

[0125] The mobile terminal network control APP establishes an HTTPS secure access connection with the network control server, and sends the signed portrait information to the network control server via a wireless transmission link;

[0126] The network control server verifies the signature of the portrait information and verifies whether the user is a real mobile terminal user by querying the portrait information whitelist of the portrait data cloud host; if yes, proceed to the next step; if not, stop the network access of the mobile terminal;

[0127] The mobile terminal network control APP reads the IMEI number information of the terminal and signs the information using the national secret SM2 algorithm;

[0128] The mobile terminal network control APP sends the signed IMEI number information to the network control server via a wireless transmission link;

[0129] The network control server verifies the IMEI number information and verifies whether the mobile terminal access is legal by querying the legal IMEI number whitelist of the terminal control cloud host. If it is legal, it proceeds to the next step; if it is not legal, it stops the network access of the mobile terminal;

[0130] The mobile terminal network control APP recognizes that the password module type of this machine is TF card;

[0131] The mobile terminal network control APP reads the user digital certificate through the password module TF card;

[0132] The mobile terminal network control APP signs the user digital certificate using the national secret SM2 algorithm, and sends the signed user digital certificate to the network control server via a wireless transmission link;

[0133] The network control server verifies the signed user digital certificate;

[0134] The network control server queries the validity of the user's digital certificate in real time through the certificate directory cloud host. If the user's digital certificate is valid, the next step of verification will be carried out, otherwise network access will be stopped.

[0135] The network control server compares the user, mobile terminal, and user digital certificate of the current access link with the pre-imported legitimacy mapping table. If they are consistent, the mobile terminal is allowed to access the information network; if they are inconsistent, the network access of the mobile terminal is stopped.

[0136] In Example 2 provided by the present invention, when a mobile phone terminal accesses an information network, the IMEI number of the mobile phone terminal requesting access and the user digital certificate are verified cyclically. When the user digital certificate expires or the IMEI number is deleted, the network connection is stopped in time to ensure security.

[0137] The above is a detailed description of the method and device for securely accessing an information network by a mobile terminal provided by the present invention. For a person skilled in the art, any obvious changes made to the present invention without departing from the essential spirit of the present invention will constitute an infringement of the patent right of the present invention and will bear corresponding legal responsibilities.

Claims

1. A method for securely accessing an information network via a mobile terminal, characterized in that The steps include: Import the user information and mobile terminal information allowed to access into the information verification system to generate an information verification whitelist; Construct a one-to-one correspondence legitimacy mapping table for users, mobile terminals, and user digital certificates, and pre-import it into the network controller; The network controller obtains the user information and mobile terminal information of the user applying for access, and compares the user information and mobile terminal information of the user applying for access with the information in the generated information verification whitelist; When the information verification whitelist contains the user information and mobile terminal information of the applicant, the user, mobile terminal and user digital certificate of the applicant are compared with the pre-imported legitimacy mapping table; if they are consistent, the mobile terminal is allowed to access the information network; otherwise, access is denied; The step of importing the user information and mobile terminal information allowed to access into the information verification system to generate an information verification whitelist includes the following steps: Import the portrait information of legitimate users who are allowed to access the portrait data system deployed on the information network to establish a portrait information whitelist; Import the IMEI number information of legal mobile terminals that are allowed to access into the terminal management and control system deployed on the information network to establish an IMEI number whitelist; When the information verification whitelist contains the user information and mobile terminal information of the user applying for access, the mobile terminal, and the user digital certificate of the user applying for access are compared with the pre-imported legitimacy mapping table, the following steps are also included: Sending the acquired user digital certificate to the network controller, and querying the validity of the user digital certificate through the certificate directory service; When a mobile phone terminal accesses the information network, the IMEI number of the mobile phone terminal requesting access and the user digital certificate are verified cyclically. When the user digital certificate expires or the IMEI number is deleted, the network connection is terminated in time.

2. The method for securely accessing an information network via a mobile terminal as claimed in claim 1, characterized in that: The mobile terminal client obtains the user information and mobile terminal information applying for access, and compares the user information and mobile terminal information applying for access with the information in the generated information verification whitelist, including sending the obtained portrait information of the mobile terminal user and the IMEI number information of the mobile terminal to the network controller. The network controller compares the obtained portrait information of the mobile terminal user and the IMEI number information of the mobile terminal with the information in the portrait information whitelist and the IMEI number whitelist respectively.

3. The method for securely accessing an information network via a mobile terminal as claimed in claim 2, characterized in that The obtained portrait information of the user of the mobile terminal is sent to the network controller, and the network controller compares the obtained portrait information of the user of the mobile terminal with the information in the portrait information whitelist, including the following steps: Obtaining the portrait information of the user of the mobile terminal and signing the portrait information; Send the signed portrait information to the network controller; The network controller verifies the portrait information and verifies whether the person applying for access is a real mobile terminal user by querying the portrait information whitelist; when the portrait information exists in the portrait information whitelist, the person applying for access is a real mobile terminal user; otherwise, the network access of the mobile terminal is stopped.

4. The method for securely accessing an information network via a mobile terminal as claimed in claim 2, characterized in that The obtained IMEI number information of the mobile terminal is sent to the network controller, and the network controller compares the obtained IMEI number information of the mobile terminal with the information in the IMEI number whitelist, including the following steps: The mobile terminal client reads the IMEI number information of the terminal and signs the information; The mobile terminal client sends the signed IMEI number information to the network controller via a wireless transmission link; The network controller verifies the IMEI number information and verifies whether the mobile terminal's access is legal by querying the IMEI number whitelist of the terminal management and control system; if legal, it proceeds to the next step; if illegal, it stops the mobile terminal's network access.

5. The method for securely accessing an information network via a mobile terminal as claimed in claim 1, characterized in that The obtained user digital certificate is sent to the network controller, and the validity of the user digital certificate is queried through the certificate directory service; the steps include: Read the user digital certificate and send the signed user digital certificate to the network controller; The network controller verifies the signed user digital certificate; The network controller queries the validity of the user's digital certificate in real time through the certificate directory service.

6. A device for securely accessing an information network via a mobile terminal, used to implement the method for securely accessing an information network via a mobile terminal as claimed in any one of claims 1 to 5, characterized in that It includes a mobile terminal password module, a mobile terminal client, a mobile terminal, a network controller and an information verification system; The mobile terminal password module is used to generate the digital signature and the information required for signature verification according to the terminal password module type selected by the user, and provide the user digital certificate; The mobile terminal client is used to obtain mobile terminal verification information from the mobile terminal and the mobile terminal password module respectively, and send the signed mobile terminal verification information to the network controller; The network controller is used to verify the signature of the mobile terminal verification information sent by the mobile terminal client, and verify the verified mobile terminal verification information according to the information stored in the information verification system; The information verification system includes a portrait data system, a terminal management and control system, and a certificate directory service; The portrait data system is used to import portrait information of legitimate users to provide a portrait information whitelist; The terminal management and control system establishes secure communication with the network controller to import legitimate mobile terminal IMEI numbers to provide an IMEI number whitelist; The certificate directory service is used to synchronize PKI system digital certificate data and provide a real-time query interface for digital certificate validity.

Images