Method and device for establishing data security transmission channel based on SSL VPN

Abstract

This invention relates to the field of data processing technology and provides a method and device for establishing a secure data transmission channel based on SSL VPN. The method includes: authenticating received user information; encrypting the user information upon successful authentication and returning the dynamically encrypted data to the application client; receiving administrative division codes and dynamically encrypted data forwarded by the SSL VPN client through an SSL VPN gateway; verifying the administrative division codes and the dynamically encrypted data sequentially; establishing a VPN transmission channel from the SSL VPN client to the business system when both verifications are successful; and displaying a login failure message when verification fails or the password expires. This invention accesses the civil affairs business system within a civil affairs application platform using dynamically encrypted data, thus eliminating the restriction of password data. Furthermore, the dynamically encrypted data used is difficult to crack, thereby enhancing the protection of user information.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of data processing, and particularly relates to a method and device for establishing a data security transmission channel based on SSL VPN. BACKGROUND

[0002] Civil affairs business involves multiple independent business categories including endowment, minimum living security, marriage, grassroots political power, funeral and burial, and child welfare, and different departments are divided in the civil affairs department according to different businesses. Under the guidance of the current "big data, big platform", it is urgent to establish a unified civil affairs application platform. The civil affairs business data corresponding to the civil affairs business is huge, and through the feature analysis of the civil affairs business data, it is found that the civil affairs business data has high requirements for transmission security.

[0003] The secure sockets layer (SSL) virtual private network (VPN) can provide remote secure access without installing or setting up separate client software. Therefore, the business systems of the civil affairs application platform as access resources can be configured in the SSL VPN gateway, and a virtual transmission channel is established by allocating an account to access each business system, so that a secure output transmission function is provided.

[0004] However, due to the large number of users in the civil affairs department, the passwords allocated to each civil affairs department are not easy to change, resulting in restricted access to the civil affairs application platform, and the existing encryption authentication method has a low cracking difficulty. SUMMARY

[0005] Therefore, the embodiments of the present application provide a method and device for establishing a data security transmission channel based on SSL VPN, aiming to solve the problems that the passwords allocated to each civil affairs department are not easy to change, resulting in restricted access to the civil affairs application platform, and the existing encryption authentication method has a low cracking difficulty.

[0006] To achieve the above-mentioned purpose, a first aspect of the embodiments of the present application provides a method for establishing a data security transmission channel based on SSL VPN, applied to a lightweight directory access protocol (LDAP) server, comprising:

[0007] receiving a business system login request sent by an application client, the business system login request carrying user information, and the application client integrating an SSL VPN client;

[0008] Identity authentication is performed on the user information, and when the identity authentication is successful, the user information is encrypted, and the obtained dynamic encryption data is returned to the application client, and the dynamic encryption data and the administrative division code in the user information are saved as a user name;

[0009] The administrative division code and the dynamic encryption data are received through the SSL VPN gateway, and the administrative division code and the dynamic encryption data are verified in sequence, and when the verification is successful, a VPN transmission channel of the SSL VPN client to the business system is established, and access to the business system is realized; when the verification fails or the password validity period is exceeded, a login failure prompt information is displayed.

[0010] As another embodiment of the application, the user information further includes at least: user name, ID number and mobile phone number.

[0011] As another embodiment of the application, the identity authentication of the user information includes:

[0012] The user information is compared with a plurality of groups of user information pre-stored in the LDAP server, and when the LDAP server has user information consistent with the user information, it is determined that the identity authentication is successful, otherwise the identity authentication fails.

[0013] As another embodiment of the application, the LDAP server stores N data encryption algorithms, N is greater than or equal to 2;

[0014] The user information is encrypted, and the obtained dynamic encryption data is returned to the application client, including:

[0015] According to the user name in the user information, a value n is calculated, n represents the serial number in the N data encryption algorithms, 0

[0016] The numerical information in the user information is first encrypted by using the data encryption algorithm N(n), and first dynamic encryption data is obtained; the numerical information includes the ID number, the mobile phone number and the administrative division code;

[0017] A random number P is generated;

[0018] The random number P is used as a key to perform second-level encryption on the first dynamic encryption data by using the data encryption algorithm N(n), and second dynamic encryption data is obtained;

[0019] The random number P is randomly inserted into the second dynamic encryption data to obtain third dynamic encryption data;

[0020] Return the obtained third dynamic encryption data to the application client.

[0021] As another embodiment of the present application, the value n is calculated according to the user name in the user information, including:

[0022] The quotient of the sum of the strokes of the user name in the user information and N is calculated, and the quotient is taken as the value n.

[0023] Alternatively, the sum of the position numbers of the first letters of the user name in the user information in the English alphabet is calculated, and the quotient of the sum and N is taken as the value n.

[0024] As another embodiment of the present application, the dynamic encryption data and the administrative division code in the user information are saved as a user name, including:

[0025] The dynamic encryption data and the administrative division code in the user information are saved in a tree structure, wherein the administrative division code is a parent node, and the dynamic encryption data is a child node.

[0026] A password validity period is set under the child node.

[0027] As another embodiment of the present application, the administrative division code and the dynamic encryption data are verified in sequence, including:

[0028] It is inquired whether there is the same code as the administrative division code in the parent node of the tree structure, when there is the same code as the administrative division code in the parent node of the tree structure, it is inquired whether there is the same dynamic encryption data as the dynamic encryption data in the child node of the parent node, when there is the same dynamic encryption data as the dynamic encryption data in the child node of the parent node, the verification is successful, otherwise the verification fails.

[0029] The second aspect of the embodiment of the present application provides an establishment device of a data security transmission channel based on an SSL VPN, including:

[0030] A receiving module is configured to receive a service system login request sent by an application client, wherein the service system login request carries user information, and the application client integrates an SSL VPN client;

[0031] A first authentication module is configured to perform identity authentication on the user information, and when the identity authentication is successful, to perform encryption processing on the user information, return obtained dynamic encryption data to the application client, and save the dynamic encryption data and an administrative division code in the user information as a user name.

[0032] The second authentication module is used to receive the administrative division code and the dynamically encrypted data forwarded by the SSL VPN client through the SSL VPN gateway, and to verify the administrative division code and the dynamically encrypted data in sequence. When both verifications are successful, a VPN transmission channel is established between the SSL VPN client and the business system to enable access to the business system. When verification fails or the password expires, a login failure message is displayed.

[0033] A third aspect of the present invention provides a terminal device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps described in the method for establishing a data security transmission channel based on an SSL VPN as described in any of the above embodiments.

[0034] A fourth aspect of the present invention provides a computer-readable storage medium, comprising: the computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the steps of the method for establishing a data security transmission channel based on an SSL VPN as described in any of the above embodiments.

[0035] The beneficial effects of this invention compared to existing technologies are as follows: Compared to existing technologies, this invention uses dynamically encrypted data as the encryption password to access the civil affairs business system in the civil affairs application platform, thus removing the restriction of password data. Furthermore, the dynamically encrypted data used in this embodiment makes it difficult to crack, thereby enhancing the protection of user information. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is a schematic diagram illustrating the implementation process of the method for establishing a secure data transmission channel based on SSL VPN provided in an embodiment of the present invention.

[0038] Figure 2 This is a schematic diagram of the data transmission architecture provided in an embodiment of the present invention;

[0039] Figure 3 This is an example diagram of the device for establishing a secure data transmission channel based on SSL VPN provided in an embodiment of the present invention;

[0040] Figure 4This is a schematic diagram of a terminal device provided in an embodiment of the present invention. Detailed Implementation

[0041] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of the invention. However, those skilled in the art will understand that the invention can be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods are omitted so as not to obscure the description of the invention with unnecessary detail.

[0042] To illustrate the technical solution described in this invention, specific embodiments are described below.

[0043] Figure 1 This is a schematic diagram illustrating the implementation process of a method for establishing a secure data transmission channel based on an SSL VPN, as provided in an embodiment of the present invention. This method is applied to an LDAP server, such as... Figure 2 The data transmission architecture shown integrates an SSL VPN client on the application client. This allows communication between the application client and the SSL VPN client via a pre-defined interface. The application client connects to the LDAP server for initial authentication, obtains an encrypted password, and returns the encrypted password to the application client. The application client then transmits the encrypted password to the SSL VPN client through the pre-defined interface. The SSL VPN client sends the encrypted password and username to the SSL VPN gateway, which in turn performs a second authentication with the LDAP server. Once authentication is successful, a VPN transmission channel is established between the SSL VPN client and the business system, enabling access to the business system.

[0044] The method for establishing a secure data transmission channel based on SSL VPN is detailed below.

[0045] Step 101: Receive a business system login request sent by the application client. The business system login request carries user information. The application client integrates an SSL VPN client.

[0046] Optionally, the user information may also include at least: user name, ID number, and mobile phone number.

[0047] Step 102: Authenticate the user information. When the authentication is successful, encrypt the user information and return the obtained dynamic encrypted data to the application client. Save the dynamic encrypted data and the administrative division code in the user information as the username.

[0048] Optionally, prior to this step, multiple sets of user information can be pre-stored in the LDAP server for authentication purposes.

[0049] Optionally, when authenticating user information, the user information can be compared with multiple sets of user information pre-stored in the LDAP server. If user information that matches the user information exists in the LDAP server, the authentication is considered successful; otherwise, the authentication fails.

[0050] It should be noted that subsequent steps can only be executed if identity verification is successful; otherwise, an identity verification failure message will be returned to the application client.

[0051] Optionally, the LDAP server stores N data encryption algorithms, where N is greater than or equal to 2. It should be noted that the N data encryption algorithms can be existing encryption algorithms, and this embodiment does not limit them.

[0052] Encrypting the user information and returning the resulting dynamically encrypted data to the application client may include:

[0053] Based on the user name in the user information, the value n is calculated, where n represents the sequence number of N data encryption algorithms, and 0 < n ≤ N;

[0054] The data encryption algorithm N(n) is used to perform first-level encryption on the numerical information in the user information to obtain first dynamic encrypted data; the numerical information includes the ID card number, the mobile phone number, and the administrative division code;

[0055] Generate a random number P;

[0056] The random number P is used as the key to perform a second level of encryption on the first dynamically encrypted data using the data encryption algorithm N(n), to obtain the second dynamically encrypted data;

[0057] The random number P is randomly interspersed into the second dynamic encrypted data to obtain the third dynamic encrypted data;

[0058] The obtained third dynamically encrypted data is returned to the application client.

[0059] Optionally, calculating the value n based on the user's name in the user information may include:

[0060] Calculate the quotient of the sum of the number of strokes in the user's name in the user information and N, and use the quotient as the value n;

[0061] Alternatively, calculate the sum of the positions of the first letter of the user's name in the English alphabet, and then use the sum of these sums with N as the quotient.

[0062] It should be noted that when the sum is divided by N, if there is a remainder, this embodiment does not process the remainder, but only obtains the quotient, which is used as the value we need.

[0063] In this embodiment, the user's name is used to determine the encryption algorithm to be used. Then, the determined encryption algorithm is used to perform the first level of encryption on the numerical information in the user information. A random number is used as the key to perform the second level of encryption on the first dynamic encrypted data. Finally, the random number is inserted into the second dynamic encrypted data to obtain the final dynamic encrypted data. The encryption algorithm used in this embodiment increases the difficulty of cracking and enhances the security of user information.

[0064] Optionally, the method for inserting the random number into the second dynamically encrypted data can be to insert the random number into a specified position within the second dynamically encrypted data. For example, if the second dynamically encrypted data is 0x31, 0x52, 0x44, 0x83; and the random number is 0x42, 0x32, 0x11, 0x23, then the third dynamically encrypted data can be 0x31, 0x42, 0x52, 0x32, 0x44, 0x11, 0x83, 0x23. Alternatively, the third dynamically encrypted data can be 0x31, 0x52, 0x42, 0x32, 0x11, 0x23, 0x44, 0x83.

[0065] Optionally, the dynamically encrypted data and the administrative division code in the user information are saved as the username, including:

[0066] The dynamic encrypted data and the administrative division code in the user information are stored in a tree structure, wherein the administrative division code is the parent node and the dynamic encrypted data is the child node.

[0067] It should be noted that you can set a password expiration period and set the password expiration period under child nodes. When the password expires, the password stored under the child node will be automatically deleted.

[0068] Step 103: Receive the administrative division code and the dynamically encrypted data forwarded by the SSL VPN client through the SSL VPN gateway, and verify the administrative division code and the dynamically encrypted data in sequence. When both verifications are successful, establish a VPN transmission channel from the SSL VPN client to the business system to enable access to the business system. If the verification fails or the password expires, display a login failure message.

[0069] The SSL VPN gateway is configured with the LDAP server's access address, user, and password. It periodically synchronizes the username from the LDAP server to the gateway. After obtaining the username and dynamic password requested by the SSL VPN client, it verifies them with the LDAP server, thus achieving third-party authentication. Furthermore, because the password is dynamic, it enhances the security of access to business systems.

[0070] The administrative division code and the dynamically encrypted data are verified sequentially, including:

[0071] The system queries whether a parent node of the tree structure contains a code identical to the administrative division code. If a parent node contains a code identical to the administrative division code, the system queries whether a child node contains dynamically encrypted data identical to the dynamically encrypted data. If a child node contains dynamically encrypted data identical to the dynamically encrypted data, the verification is successful; otherwise, the verification fails.

[0072] It should be noted that if the encrypted password expires, directly deleting the encrypted password from the corresponding child node in the tree structure will cause the verification to fail.

[0073] The aforementioned method for establishing a secure data transmission channel based on SSL VPN authenticates the received user information. Upon successful authentication, the user information is encrypted, and the dynamically encrypted data is returned to the application client. The dynamically encrypted data and the administrative division code from the user information are saved as the username. The method receives the administrative division code and dynamically encrypted data forwarded by the SSL VPN client through the SSL VPN gateway, and verifies both sequentially. If both verifications are successful, a VPN transmission channel is established between the SSL VPN client and the business system, enabling access to the business system. If verification fails or the password expires, a login failure message is displayed. Thus, the dynamically encrypted data can be used as the encrypted password to access the civil affairs business system within the civil affairs application platform, no longer restricted by the password data. Furthermore, the encryption algorithm used in this embodiment is complex and difficult to crack, thereby enhancing the protection of user information.

[0074] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0075] Corresponding to the method for establishing a secure data transmission channel based on SSL VPN described in the above embodiments, Figure 3An example diagram of the apparatus for establishing a secure data transmission channel based on an SSL VPN, provided in an embodiment of the present invention, is shown. Figure 3 As shown, the device may include: a receiving module 301, a first authentication module 302, and a second authentication module 303;

[0076] The receiving module 301 is used to receive a business system login request sent by the application client, wherein the business system login request carries user information and the application client integrates an SSL VPN client;

[0077] The first authentication module 302 is used to authenticate the user information, and when the authentication is successful, to encrypt the user information, return the obtained dynamic encrypted data to the application client, and save the dynamic encrypted data and the administrative division code in the user information as the username.

[0078] The second authentication module 303 is used to receive the administrative division code and the dynamic encrypted data forwarded by the SSL VPN client through the SSL VPN gateway, and to verify the administrative division code and the dynamic encrypted data in sequence. When the verification is successful, a VPN transmission channel is established between the SSL VPN client and the business system to enable access to the business system. When the verification fails or the password expires, a login failure message is displayed.

[0079] Optionally, the user information may include at least: user name, ID number, and mobile phone number.

[0080] Optionally, when the first authentication module 302 performs identity authentication on the user information, it can be used for:

[0081] The user information is compared with multiple sets of user information pre-stored in the LDAP server. If the LDAP server contains user information that matches the user information, the authentication is considered successful; otherwise, the authentication fails.

[0082] Optionally, the LDAP server stores N data encryption algorithms, where N is greater than or equal to 2;

[0083] When the first authentication module 302 encrypts the user information and returns the resulting dynamically encrypted data to the application client, it can be used for:

[0084] Based on the user name in the user information, the value n is calculated, where n represents the sequence number of N data encryption algorithms, and 0 < n ≤ N;

[0085] The data encryption algorithm N(n) is used to perform first-level encryption on the numerical information in the user information to obtain first dynamic encrypted data; the numerical information includes the ID card number, the mobile phone number, and the administrative division code;

[0086] Generate a random number P;

[0087] The random number P is used as the key to perform a second level of encryption on the first dynamically encrypted data using the data encryption algorithm N(n), to obtain the second dynamically encrypted data;

[0088] The random number P is randomly interspersed into the second dynamic encrypted data to obtain the third dynamic encrypted data;

[0089] The obtained third dynamically encrypted data is returned to the application client.

[0090] Optionally, when the first authentication module 302 calculates the value n based on the user's name in the user information, it can be used for:

[0091] Calculate the quotient of the sum of the number of strokes in the user's name in the user information and N, and use the quotient as the value n;

[0092] Alternatively, calculate the sum of the positions of the first letter of the user's name in the English alphabet, and then use the sum of these sums with N as the quotient.

[0093] Optionally, when the first authentication module 302 saves the dynamically encrypted data and the administrative division code in the user information as the username, it can be used for:

[0094] The dynamic encrypted data and the administrative division code in the user information are stored in a tree structure, wherein the administrative division code is the parent node and the dynamic encrypted data is the child node;

[0095] Set the password expiration time under the child node.

[0096] Optionally, when the second authentication module 303 verifies the administrative division code and the dynamically encrypted data sequentially, it can be used to:

[0097] The system queries whether a parent node of the tree structure contains a code identical to the administrative division code. If a parent node contains a code identical to the administrative division code, the system queries whether a child node contains dynamically encrypted data identical to the dynamically encrypted data. If a child node contains dynamically encrypted data identical to the dynamically encrypted data, the verification is successful; otherwise, the verification fails.

[0098] The aforementioned SSL VPN-based data security transmission channel establishment device comprises two modules: a first authentication module that authenticates the received user information and, upon successful authentication, encrypts the user information and returns the dynamically encrypted data to the application client, storing the dynamically encrypted data and the administrative division code from the user information as the username; and a second authentication module that receives the administrative division code and dynamically encrypted data forwarded by the SSL VPN client through the SSL VPN gateway, and verifies both sequentially. If both verifications are successful, a VPN transmission channel is established between the SSL VPN client and the business system, enabling access to the business system. If verification fails or the password expires, a login failure message is displayed, allowing access to the civil affairs business system within the civil affairs application platform via the dynamically encrypted data as the encrypted password, freeing users from the restriction of the password data. Furthermore, the encryption algorithm used in this embodiment is complex and difficult to crack, thus enhancing the protection of user information.

[0099] Figure 4 This is a schematic diagram of a terminal device provided in an embodiment of the present invention. Figure 4 As shown, the terminal device 400 of this embodiment includes: a processor 401, a memory 402, and a computer program 403 stored in the memory 402 and executable on the processor 401, such as a program for establishing a secure data transmission channel based on an SSL VPN. When the processor 401 executes the computer program 403, it implements the steps in the above-described embodiment of the method for establishing a secure data transmission channel based on an SSL VPN, for example... Figure 1 In steps 101 to 103 shown, when the processor 401 executes the computer program 403, it implements the functions of each module in the above-described device embodiments, for example... Figure 3 The functions of modules 301 to 303 are shown.

[0100] For example, the computer program 403 can be divided into one or more program modules, which are stored in the memory 402 and executed by the processor 401 to complete the present invention. The one or more program modules can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program 403 in the SSL VPN-based data security transmission channel establishment device or terminal device 400. For example, the computer program 403 can be divided into a receiving module 301, a first authentication module 302, and a second authentication module 303, with each module having specific functions as follows: Figure 3 As shown, I will not go into detail here.

[0101] The terminal device 400 may be a desktop computer, laptop, handheld computer, or cloud server, etc. The terminal device may include, but is not limited to, a processor 401 and a memory 402. Those skilled in the art will understand that... Figure 4 This is merely an example of terminal device 400 and does not constitute a limitation on terminal device 400. It may include more or fewer components than shown, or combine certain components, or different components. For example, the terminal device may also include input / output devices, network access devices, buses, etc.

[0102] The processor 401 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0103] The memory 402 can be an internal storage unit of the terminal device 400, such as a hard disk or memory of the terminal device 400. The memory 402 can also be an external storage device of the terminal device 400, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the terminal device 400. Furthermore, the memory 402 can include both internal and external storage units of the terminal device 400. The memory 402 is used to store the computer program and other programs and data required by the terminal device 400. The memory 402 can also be used to temporarily store data that has been output or will be output.

[0104] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0105] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0106] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0107] In the embodiments provided by this invention, it should be understood that the disclosed apparatus / terminal devices and methods can be implemented in other ways. For example, the apparatus / terminal device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0108] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0109] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0110] If the integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0111] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for establishing a data security transmission channel based on a secure socket layer (SSL) virtual private network (VPN), applied to a light directory access protocol (LDAP) server, characterized in that, The application relates to a method for realizing SSL VPN access to a business system. Receiving a business system login request sent by an application client, wherein the business system login request carries user information, and the application client integrates an SSL VPN client; Carrying out identity authentication on the user information, and carrying out encryption processing on the user information when the identity authentication is successful, returning dynamic encryption data obtained to the application client, and saving the dynamic encryption data and administrative division codes in the user information as a username; The LDAP server stores N data encryption algorithms, and N is greater than or equal to 2; The method comprises the following steps: calculating a value n according to a user name in the user information, wherein n represents a serial number in the N data encryption algorithms, 0 < n <= N; carrying out first-level encryption on value information in the user information by using the data encryption algorithm N (n) to obtain first dynamic encryption data; the value information comprises an ID number, a mobile phone number and the administrative division codes; generating a random number P; carrying out second-level encryption on the first dynamic encryption data by using the data encryption algorithm N (n) with the random number P as a key to obtain second dynamic encryption data; randomly inserting the random number P into the second dynamic encryption data to obtain third dynamic encryption data; and returning the third dynamic encryption data to the application client; Receiving the administrative division codes and the dynamic encryption data forwarded by the SSL VPN client through an SSL VPN gateway, and verifying the administrative division codes and the dynamic encryption data in sequence, when the verification is successful, establishing a VPN transmission channel of the SSL VPN client to the business system to realize access to the business system; when the verification fails or the password validity period is exceeded, displaying a login failure prompt information.

2. The method for establishing SSL VPN-based data security transmission channel according to claim 1, characterized in that, The user information at least further comprises a user name, an ID number and a mobile phone number.

3. The method for establishing SSL VPN-based data security transmission channel according to claim 2, characterized in that, The method comprises the following steps: Comparing the user information with a plurality of groups of user information pre-stored in the LDAP server, when the LDAP server has user information consistent with the user information, determining that the identity authentication is successful, otherwise, the identity authentication fails.

4. The method for establishing SSL VPN-based data security transmission channel according to claim 3, characterized in that, The method comprises the following steps: Calculating a quotient of a sum of stroke numbers of the user name in the user information and N, and taking the quotient as the value n; Or, calculating a sum of position serial numbers of initial letters of the user name in the user information in an English alphabet table, and taking a quotient of the sum and N as the value n.

5. The method for establishing SSL VPN-based data security transmission channel according to any one of claims 1-4, characterized in that, The method comprises the following steps: Saving the dynamic encryption data and the administrative division codes in the user information by using a tree structure, wherein the administrative division codes are parent nodes, and the dynamic encryption data are child nodes; Setting a password validity period under the child nodes.

6. The method for establishing SSL VPN-based data security transmission channel according to claim 5, characterized in that, The method comprises the following steps: Query whether the same code as the administrative division code exists in the parent node of the tree structure, when the same code as the administrative division code exists in the parent node of the tree structure, query whether the same dynamic encryption data as the dynamic encryption data exists in the child node of the parent node, when the same dynamic encryption data as the dynamic encryption data exists in the child node of the parent node, the verification is successful, otherwise the verification fails.

7. An apparatus for establishing a data security transmission channel based on SSL VPN, characterized in that, Comprise: The receiving module is used for receiving the service system login request sent by the application client, the service system login request carries the user information, and the SSL VPN client is integrated in the application client; The first authentication module is used for performing identity authentication on the user information, and when the identity authentication is successful, performing encryption processing on the user information, returning the obtained dynamic encryption data to the application client, and saving the dynamic encryption data and the administrative division code in the user information as the username; The LDAP server stores N data encryption algorithms, and N is greater than or equal to 2; When the first authentication module performs encryption processing on the user information and returns the obtained dynamic encryption data to the application client, it is used for: calculating a value n according to the user name in the user information, n represents the serial number in the N data encryption algorithms, 0 < n ≤ N; performing first-level encryption on the value information in the user information by using the data encryption algorithm N (n) to obtain first dynamic encryption data; the value information includes the ID number, the mobile phone number and the administrative division code; A random number P is generated; The random number P is used as a key to perform second-level encryption on the first dynamic encryption data by using the data encryption algorithm N (n) to obtain second dynamic encryption data; The random number P is randomly inserted into the second dynamic encryption data to obtain third dynamic encryption data; The obtained third dynamic encryption data is returned to the application client; The second authentication module is used for receiving the administrative division code and the dynamic encryption data forwarded by the SSL VPN client through the SSL VPN gateway, and sequentially verifying the administrative division code and the dynamic encryption data, when the verification is successful, establishing the VPN transmission channel of the SSL VPN client to the service system, and realizing the access to the service system; when the verification fails or exceeds the password validity period, a login failure prompt information is displayed.

8. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to realize the steps of the method of any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 8. The computer program is executed by the processor to realize the steps of the method of any one of claims 1 to 6.

Images