Method, device, server and medium for processing network access request

Abstract

One or more embodiments of the present application provide a method, device, server and medium for processing a network access request. The present application provides a network access certificate including an identity source identifier of a target account, so that after receiving a network access request from a target account and when the validity verification of the network access certificate carried by the network access request is passed, the identity source identifier of the target account can be obtained from the network access certificate, and the identity source identifier of the target account is unique in the target application, so that the account status of the target account can be obtained based on the identity source identifier, and then the network access request can be processed based on the obtained account status, so that network access control based on the account status can be implemented.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of communication technology, and in particular, to a method, device, server, and medium for processing a network access request. Background Art

[0002] Most enterprise networks need to handle a large number of network access requests every day and manage the access of various office terminals including personal computers, notebooks, mobile phones, etc. In this case, network security construction becomes very important. If the network security construction is not perfect, it is easy to cause security risks. Network access control is the first step in enterprise network security management and is an important part of building a more secure and stable enterprise network environment.

[0003] In the related art, when performing network access control, the 802.1x protocol is mainly used to restrict unauthorized users from accessing the enterprise network. The 802.1x protocol can authenticate users connected to the enterprise network and send a network access certificate to the authenticated user so that subsequent users can access the enterprise network through the network access certificate.

[0004] The validity period of the network access certificate sent in the above process is generally several years. Even if the user's employment status changes (for example, resignation, freezing, transfer, etc.), as long as the network access certificate held by the user is still valid, the user can still use the network access certificate to access the enterprise network, which will bring great security risks to the enterprise network management. Therefore, a method for processing network access requests is urgently needed to implement network access control of enterprise networks. Summary of the invention

[0005] In view of this, one or more embodiments of this specification provide a method, device, server and medium for processing a network access request.

[0006] To achieve the above objectives, one or more embodiments of this specification provide the following technical solutions:

[0007] According to a first aspect of one or more embodiments of this specification, a method for processing a network access request is proposed, which is applied to a server. The method includes:

[0008] In response to receiving a network access request from a target account, verifying the validity of a network access certificate carried in the network access request;

[0009] When the validity check of the network access certificate is passed, the unique identity source identifier of the target account in the target application is obtained from the network access certificate;

[0010] Based on the identity source identifier, obtain the account status of the target account;

[0011] Based on the account status, the network access request is processed.

[0012] In some embodiments, the identity source identifier is obtained by encrypting and calculating the account identifier of the target account and the organization identifier of the organization to which the target account belongs by setting a key;

[0013] Based on the identity source identifier, obtain the account status of the target account, including:

[0014] The identity source identifier is decrypted by setting a private key to obtain the account identifier of the target account and the organization identifier of the organization to which the target account belongs;

[0015] Based on the account identifier, the account status of the target account is obtained from the data storage location corresponding to the organization identifier in the server; wherein different organization identifiers have different corresponding data storage locations in the server.

[0016] In some embodiments, the network access request is processed based on the account status, including any of the following:

[0017] When the account status indicates that the target account is in a set state, responding to the network access request;

[0018] When the account status indicates that the target account is in a non-set state, the network access request is rejected.

[0019] In some embodiments, in response to receiving a network access request from a target account, before verifying the validity of a network access certificate carried in the network access request, the method further includes:

[0020] receiving a login request from a target account, the login request carrying information of the first account;

[0021] Verify the legitimacy of the target account based on the first account information carried in the login request;

[0022] If the target account passes the legitimacy check, the target account is allowed to log in.

[0023] In some embodiments, if the target account passes the legitimacy check, after allowing the target account to log in, the method further includes:

[0024] In the case where the target account logs in for the first time, in response to receiving a certificate acquisition request from the target account, obtaining an identity source identifier based on the second account information carried in the certificate acquisition request, and adding the identity source identifier to the network access certificate generated for the target account;

[0025] Send the network access certificate to the terminal device corresponding to the target account.

[0026] In some embodiments, the second account information includes at least an account identifier of the target account and an organization identifier of an organization to which the target account belongs;

[0027] Based on the second account information carried in the certificate acquisition request, the identity source identifier is obtained, including:

[0028] Based on the set key, the account identifier and the organization identifier included in the second account information are encrypted and calculated to obtain the identity source identifier.

[0029] In some embodiments, based on the second account information carried in the certificate acquisition request, obtaining the identity source identifier, before adding the identity source identifier to the network access certificate generated for the target account, the method further includes:

[0030] The second account information is verified. If the second account information is verified, the steps of obtaining the identity source identifier based on the second account information carried in the certificate acquisition request and adding the identity source identifier to the network access certificate generated for the target account are executed.

[0031] In some embodiments, the server includes a first server and at least one second server, the first server is used to provide network access request processing services for at least one second server, the second server is a background server corresponding to the target application used by the organization to which the target account belongs, and the second server is at least used to store the identity source identifier and account status of the registered account in the target application.

[0032] According to a second aspect of one or more embodiments of this specification, a device for processing a network access request is provided, which is applied to a server, and includes:

[0033] A verification module, configured to verify the validity of a network access certificate carried in the network access request in response to receiving a network access request from a target account;

[0034] The identification acquisition module is used to obtain the unique identity source identification of the target account in the target application from the network access certificate when the validity verification of the network access certificate passes;

[0035] A status acquisition module is used to obtain the account status of the target account based on the identity source identifier;

[0036] The processing module is used to process the network access request based on the account status.

[0037] In some embodiments, the identity source identifier is obtained by encrypting and calculating the account identifier of the target account and the organization identifier of the organization to which the target account belongs by setting a key;

[0038] The status acquisition module, when used to obtain the account status of the target account based on the identity source identifier, is used to:

[0039] The identity source identifier is decrypted by setting a private key to obtain the account identifier of the target account and the organization identifier of the organization to which the target account belongs;

[0040] Based on the account identifier, the account status of the target account is obtained from the data storage location corresponding to the organization identifier in the server; wherein different organization identifiers have different corresponding data storage locations in the server.

[0041] In some embodiments, the processing module, when used to process the network access request based on the account status, is used for any of the following:

[0042] When the account status indicates that the target account is in a set state, responding to the network access request;

[0043] When the account status indicates that the target account is in a non-set state, the network access request is rejected.

[0044] In some embodiments, the apparatus further comprises:

[0045] A receiving module, used to receive a login request from a target account, where the login request carries the first account information;

[0046] The verification module is further used to verify the legitimacy of the target account based on the first account information carried in the login request;

[0047] If the target account passes the legitimacy check, the target account is allowed to log in.

[0048] In some embodiments, the identification acquisition module is further used to, in response to receiving a certificate acquisition request from the target account, acquire the identity source identification based on the second account information carried in the certificate acquisition request when the target account logs in for the first time;

[0049] The device also includes:

[0050] Add a module to add the identity source identifier to the network access certificate generated for the target account;

[0051] The sending module is used to send the network access certificate to the terminal device corresponding to the target account.

[0052] In some embodiments, the second account information includes at least an account identifier of the target account and an organization identifier of an organization to which the target account belongs;

[0053] The identification acquisition module, when used to obtain the identity source identification based on the second account information carried in the certificate acquisition request, is used to:

[0054] Based on the set key, the account identifier and the organization identifier included in the second account information are encrypted and calculated to obtain the identity source identifier.

[0055] In some embodiments, the verification module is also used to verify the second account information. If the second account information is verified, the steps of obtaining the identity source identifier based on the second account information carried in the certificate acquisition request and adding the identity source identifier to the network access certificate generated for the target account are executed.

[0056] In some embodiments, the server includes a first server and at least one second server, the first server is used to provide network access request processing services for at least one second server, the second server is a background server corresponding to the target application used by the organization to which the target account belongs, and the second server is at least used to store the identity source identifier and account status of the registered account in the target application.

[0057] According to a third aspect of one or more embodiments of this specification, a server is provided, the server comprising:

[0058] processor;

[0059] a memory for storing processor-executable instructions;

[0060] The processor implements the operations performed by the method for processing a network access request provided in the first aspect and any embodiment of the first aspect by running executable instructions.

[0061] According to a fourth aspect of one or more embodiments of this specification, a computer-readable storage medium is proposed, on which computer instructions are stored. When the instructions are executed by a processor, the operations performed by the method for processing a network access request provided in the first aspect and any embodiment of the first aspect are implemented.

[0062] According to a fifth aspect of one or more embodiments of this specification, a computer program product is proposed, including a computer program, which, when executed by a processor, implements the operations performed by the method for processing a network access request provided in the first aspect and any embodiment of the first aspect.

[0063] The present application provides a network access certificate including an identity source identifier of a target account, so that after receiving a network access request from the target account and when the validity verification of the network access certificate carried by the network access request is passed, the identity source identifier of the target account can be obtained from the network access certificate, and the identity source identifier of the target account is unique in the target application, so that the account status of the target account can be obtained based on the identity source identifier, and then the network access request can be processed based on the obtained account status, so that network access control based on the account status can be implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 It is a schematic diagram of an implementation environment of a method for processing a network access request provided by an exemplary embodiment.

[0065] Figure 2 It is a schematic diagram of an implementation environment of another method for processing a network access request provided by an exemplary embodiment.

[0066] Figure 3 The present invention is a flowchart of a method for processing a network access request, shown in an exemplary embodiment.

[0067] Figure 4 The figure is a flowchart of a login process shown in an exemplary embodiment.

[0068] Figure 5 It is a flowchart of a login process provided by an exemplary embodiment.

[0069] Figure 6 The present invention is a flowchart of issuing a network access certificate shown in an exemplary embodiment.

[0070] Figure 7 The figure is a flow chart of a network access certificate issuance process shown in an exemplary embodiment.

[0071] Figure 8 The present invention is a flowchart of a certificate issuance process provided by an exemplary embodiment.

[0072] Fig. 9 The figure is a flow chart of a network admission control process shown in an exemplary embodiment.

[0073] Fig.10 The figure is a flow chart of a network admission control process shown in an exemplary embodiment.

[0074] Fig.11 The invention is a flowchart of a network admission control process provided by an exemplary embodiment.

[0075] Fig.12 The present invention is a flowchart of a method for processing a network access request, shown in an exemplary embodiment.

[0076] Fig.13 It is a block diagram of a device for processing a network access request provided by an exemplary embodiment.

[0077] Fig.14 It is a schematic structural diagram of a server provided by an exemplary embodiment. DETAILED DESCRIPTION

[0078] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with one or more embodiments of this specification. Instead, they are merely examples of devices and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0079] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0080] First, some technical terms involved in this application are introduced:

[0081] Secure Access Service Edge (SASE): is a framework of software and hardware tools that ensures secure access to cloud and network resources by applications, services, users, and machines, typically delivered as cloud services.

[0082] Public Key Infrastructure (PKI): A collection of hardware, software, personnel, policies and procedures used to implement functions such as the generation, management, storage, distribution and revocation of keys and certificates based on public key cryptography.

[0083] Online Certificate Status Protocol (OCSP): used to verify the validity of Secure Socket Layer (SSL) certificates to ensure that the SSL certificate has not been revoked.

[0084] Digital certificate: An electronic file that uniquely identifies people and resources on the Internet. SSL certificate is a type of digital certificate.

[0085] Extensible Authentication Protocol-Transport Layer Security (EAP-TLS): TLS is an authentication method in the EAP framework, which mainly uses X509 digital certificates for network authentication.

[0086] Identity source: The upstream core data that stores account information. For example, the target applications used in the office process, that is, office software, such as various types of instant messaging applications, Lightweight Directory Access Protocol (LDAP), Active Directory (AD), etc.

[0087] Identity source identifier: An encrypted string consisting of the enterprise identifier and account identifier stored in the network access certificate in the SASE system.

[0088] The present application provides a method for processing a network access request, which is used to verify the status of an account accessing a network (such as an enterprise network), thereby improving network security. Figure 1 , Figure 1 FIG. 1 is a schematic diagram of an implementation environment of a method for processing a network access request provided by an exemplary embodiment. Figure 1 As shown, the implementation environment may include a terminal device 101 , a network device 102 and a server 103 .

[0089] The terminal device 101 may be a variety of terminal devices, for example, the terminal device 101 may be a desktop computer, a laptop computer, a tablet computer, a smart phone, etc., and the present application does not limit the device type and the number of the terminal device 101. A SASE client may be installed in the terminal device 101, so that the user can log in to different types of office software through the SASE client, thereby accessing the network through the logged-in account.

[0090] The network device 102 may be an access controller (AC). Optionally, the network device 102 may also be other types of network devices. It is only necessary to ensure that the network device 102 can achieve network access for the terminal device.

[0091] The server 103 can be one server, multiple servers, a server cluster, a cloud computing platform, etc., and the present application does not limit the device type and number of the server 103. The server 103 may include multiple containers (or processing areas) for providing different types of services to users. For example, the server 103 may include two containers, one of which may be used to provide network access request processing services, and the other container may store the identity source identifiers and account status of registered accounts in different target applications through different data storage locations. Optionally, the server may also provide users with more types of services, which are not limited in the present application.

[0092] Among them, for the container used to provide network access request processing services, the container may include multiple functional modules, and different functional modules can provide different types of services to users, such as certificate issuance services, authentication services, and network access services, so that the container can provide users with more comprehensive network access request processing services through the services provided by these multiple functional modules.

[0093] It should be noted that the terminal device 101 can communicate with the network device 102 via a wired or wireless connection, and the network device 102 can communicate with the server 103 via a wireless connection, so that the network access request processing method provided in this application can be used to control the network access process based on the interaction between the terminal device 101, the network device 102 and the server 103.

[0094] Figure 1 This is only an exemplary implementation environment of the present application. In more possible implementations, the method for processing network access requests provided by the present application can also be applied to other types of implementation environments, for example, Figure 1 The server shown in may include a first server and at least one second server, see Figure 2 , Figure 2 FIG. 1 is a schematic diagram of an implementation environment of another method for processing a network access request provided by an exemplary embodiment. Figure 2 As shown, the implementation environment may include a terminal device 201 , a network device 202 , a first server 203 and a second server 204 .

[0095] For an introduction to the terminal device 201 and the network device 202, see the above Figure 1 The relevant contents in will not be repeated here.

[0096] The first server 203 can be one server, multiple servers, a server cluster, a cloud computing platform, etc., and the present application does not limit the device type and device quantity of the first server 203. The first server can be used to provide network access request processing services for at least one second server. The first server can include multiple functional modules for providing different types of services to users, such as certificate issuance services, authentication services, and network access services, so as to provide network access request processing services through the services provided by these multiple functional modules. Optionally, the first server can also provide users with more types of services, which is not limited by the present application.

[0097] The second server 204 may be one server, multiple servers, a server cluster, a cloud computing platform, etc., and the present application does not limit the device type and device quantity of the second server 204. The second server 204 may be a backend server corresponding to the target application used by the organization to which the target account belongs. Different second servers may correspond to different target applications (that is, office software to which the target account belongs). One target application may correspond to one second server, and different target applications may correspond to different second servers.

[0098] It should be noted that the terminal device 201 can communicate with the network device 202 via a wired or wireless connection, the network device 202 can communicate with the first server 203 via a wireless connection, and the first server 203 can communicate with the second server 204 via a wired or wireless connection, so that the interaction between the terminal device 201, the network device 202, the first server 203 and the second server 204 can achieve control of the network access process through the network access request processing method provided in this application.

[0099] After introducing the implementation environment of the present application, the method for processing the network access request provided by the present application is described in detail below.

[0100] See also Figure 3 , Figure 3 is a flowchart of a method for processing a network access request according to an exemplary embodiment. The method can be applied to a server, such as Figure 3 As shown, the method may include the following steps:

[0101] Step 301: In response to receiving a network access request from a target account, verify the validity of a network access certificate carried in the network access request.

[0102] Step 302: When the validity check of the network access certificate is passed, a unique identity source identifier of the target account in the target application is obtained from the network access certificate.

[0103] Step 303: Based on the identity source identifier, obtain the account status of the target account.

[0104] Step 304: Process the network access request based on the account status.

[0105] The present application provides a network access certificate including an identity source identifier of a target account, so that after receiving a network access request from the target account and when the validity verification of the network access certificate carried by the network access request is passed, the identity source identifier of the target account can be obtained from the network access certificate, and the identity source identifier of the target account is unique in the target application, so that the account status of the target account can be obtained based on the identity source identifier, and then the network access request can be processed based on the obtained account status, so that network access control based on the account status can be implemented.

[0106] After introducing the basic implementation process of the present application, various optional implementation methods of the present application are further described below.

[0107] In some embodiments, the target account can log in to the target application (i.e., office software) through the SASE client in the terminal device, thereby initiating a network access request through the SASE client, so that the terminal device can send a network access request carrying a network access certificate to the server to access the network. The server can verify the validity of the network access certificate carried in the network access request in response to receiving the network access request from the target account through step 301.

[0108] In a possible implementation, before step 301, the server can implement the target account login through the following process:

[0109] Step 1: Receive a login request from a target account, where the login request carries information of a first account.

[0110] Optionally, the terminal device can display the login interface of the SASE client in a visual interface. The user can enter the first account information in the login interface. The terminal device obtains the first account information input by the user in response to the user's input operation, thereby generating a login request based on the obtained first account information, and then sending the generated login request to the server, so that the server can receive the login request carrying the first account information.

[0111] The first account information may include the target account and password entered by the user. Optionally, the first account information may also include other types of information. This application does not limit the specific content included in the first account information.

[0112] Optionally, when sending a login request to the server, the terminal device may send the login request to a network device (such as an access controller, etc.), and the network device sends the login request to the server so that the server can receive the login request from the terminal device.

[0113] Step 2: Based on the first account information carried in the login request, verify the legitimacy of the target account.

[0114] It should be noted that the server may pre-store first account information of multiple accounts. Based on this, after receiving a login request, the server may query the stored first account information to determine whether there is first account information in the stored first account information that is consistent with the first account information carried by the login request, thereby verifying the legitimacy of the target account.

[0115] Taking the first account information including the target account and password as an example, multiple accounts can be pre-registered in the server and passwords of multiple accounts can be stored. After receiving the login request, the server can first query whether the target account exists among the multiple registered accounts. If the target account exists among the multiple registered accounts, the password carried in the login request is verified based on the stored password of the target account to verify the legitimacy of the target account.

[0116] Step 3: If the target account passes the legitimacy verification, allow the target account to log in.

[0117] In a possible implementation, when the first account information carried in the login request is consistent with any stored first account information, it can be determined that the legitimacy check of the target account has passed, and thus the target account can be allowed to log in.

[0118] Still taking the example of the first account information including the target account and password, if the target account exists among the multiple registered accounts and the stored password of the target account is consistent with the password carried in the login request, it can be determined that the legitimacy check of the target account has passed, and the target account can be allowed to log in.

[0119] In more possible implementations, if the target account fails the legitimacy check, login to the target account is denied.

[0120] It should be noted that the target account has not passed the legitimacy check, that is, the first account information carried by the login request is inconsistent with the multiple first account information stored. Taking the first account information including the target account and password as an example, the target account has not passed the legitimacy check, that is, the target account in the first account information carried by the login request is inconsistent with the multiple stored accounts, and / or the password in the first account information carried by the login request is inconsistent with the stored password of the target account.

[0121] By verifying the legitimacy of the target account, and allowing the target account to log in if the legitimacy verification passes, network security can be guaranteed and illegal accounts can be prevented from logging in to the network.

[0122] For ease of understanding, the following describes the login process through interaction between the terminal device and the server. Figure 4 , Figure 4 FIG. 1 is a flowchart of a login process shown in an exemplary embodiment. The process may include the following steps:

[0123] Step 401: The terminal device generates a login request in response to a login operation of a target account, where the login request carries first account information of the target account.

[0124] Step 402: The terminal device sends a login request to the server.

[0125] Step 403: The server receives a login request from the target account.

[0126] Step 404: The server verifies the legitimacy of the target account based on the first account information carried in the login request.

[0127] Step 405: When the target account passes the legitimacy verification, the server allows the target account to log in and returns the identity source identifier of the target account to the terminal device.

[0128] It should be noted that the server can include multiple functional modules to provide different types of services. For example, the server can provide authentication services and information storage services for users, so that the authentication services can be used to verify the legitimacy of the account during the login process, and the information storage services can be used to store the identity source identifiers and account status of the registered accounts in different target applications. Figure 5 , Figure 5 is a flowchart of a login process provided by an exemplary embodiment. Figure 5 As shown, after the terminal device sends a login request to the server, the server can verify the legitimacy of the account through the authentication service, and then return the identity source identifier of the target account to the terminal device.

[0129] Above Figure 4 and Figure 5 The process shown is only a procedural description of the login process. The specific implementation method of each step can be found in the above embodiments and will not be repeated here.

[0130] It should be noted that, when a target account is logged in on a terminal device, the terminal device can access the network through the logged in target account.

[0131] In some embodiments, if the target account is logging in for the first time on the terminal device, the target account can apply to the server for issuance of a network access certificate through the terminal device, and then apply for network access based on the issued network access certificate. If the target account is not logging in for the first time on the terminal device, the target account can directly apply for network access based on the issued network access certificate.

[0132] The following describes the processing procedures for the two cases of whether the target account is logging in for the first time.

[0133] 1. The target account is logging in for the first time on the terminal device

[0134] If the target account logs in to the terminal device for the first time, the terminal device can generate a certificate acquisition request based on the second account information of the target account, and send the certificate acquisition request to the server. The server can respond to receiving the certificate acquisition request from the target account, obtain the identity source identifier based on the second account information carried in the certificate acquisition request, add the identity source identifier to the network access certificate generated for the target account, and then send the network access certificate to the terminal device corresponding to the target account.

[0135] Optionally, the second account information may include the account identifier of the target account and the organization identifier of the organization to which the target account belongs (such as the corporate identifier of the enterprise to which the target account belongs), or the second account information may also include other types of information. This application does not limit the specific content included in the second account information.

[0136] Among them, the process of obtaining the account identification of the target account can be: the user can enter his own account on the visual interface of the terminal device, and the terminal device can respond to the user's input operation to obtain the account input by the user as the account identification of the target account; or, the user can enter his own account name on the visual interface of the terminal device, and the terminal device can respond to the user's input operation to obtain the account name input by the user, and then send the obtained account name to the server, so that the server can obtain the account identification of the target account based on the received account name.

[0137] The process of obtaining the organization identification of the organization to which the target account belongs can be as follows: the user can input the organization identification of the organization to which he / she belongs (such as an enterprise, organization, etc.) on the visual interface of the terminal device, and the terminal device can respond to the user's input operation and obtain the organization identification input by the user as the organization identification of the organization to which the target account belongs; or, the user can input the organization name of the organization to which he / she belongs on the visual interface of the terminal device, and the terminal device can respond to the user's input operation and obtain the organization name input by the user, thereby sending the obtained organization name to the server, so that the server can obtain the organization identification of the organization to which the target account belongs based on the received organization name.

[0138] Taking the example of the second account information including the account identifier of the target account and the organization identifier of the organization to which the target account belongs, when the server generates a network access certificate for the target account based on the second account information carried in the certificate acquisition request, it can encrypt the account identifier and organization identifier included in the second account information based on the set key to obtain the identity source identifier.

[0139] In a possible implementation, the account identifier and the organization identifier included in the second account information can be encrypted and calculated based on a set key by a hash encryption algorithm to obtain the identity source identifier. Optionally, other encryption algorithms can be used to implement the above encryption calculation process, and this application does not limit which encryption algorithm is used.

[0140] Among them, the setting key can be a key obtained by encryption calculation based on organization information (such as organization identification). Optionally, the setting key can also be obtained by other methods. This application does not limit the specific method of obtaining the setting key.

[0141] The above process of generating a network access certificate for the target account can be found in Figure 6 , Figure 6 This is a flowchart of issuing a network access certificate shown in an exemplary embodiment. After obtaining the account identifier and the organization identifier, the server first calculates a set key based on the organization identifier, and then encrypts the organization identifier and the account identifier based on the set key, thereby using the result of the encryption calculation as the identity source identifier of the target account, and then adding the obtained identity source identifier to the network access certificate to obtain a network access certificate generated specifically for the target account.

[0142] By adding the identity source identifier of the target account to the network access certificate, the network access certificate not only includes the basic information of the target account, but also includes the identity source identifier of the target account, and the identity source identifier can be used for the subsequent account status verification process.

[0143] After the network access certificate is generated through the above process, the generated network access certificate can be returned to the terminal device corresponding to the target account. The terminal device can store the received network access certificate so that the target account can subsequently access the network based on the network access certificate.

[0144] For ease of understanding, the following describes the process of issuing a network access certificate through interaction between a terminal device and a server. Figure 7 , Figure 7 The following is a flowchart of a network access certificate issuance process shown in an exemplary embodiment. The process may include the following steps:

[0145] Step 701: The terminal device generates a certificate acquisition request based on the second account information of the target account, and the certificate acquisition request carries the second account information.

[0146] Step 702: The terminal device sends a certificate acquisition request to the server.

[0147] Step 703: The server obtains the identity source identifier based on the second account information carried in the certificate acquisition request, and adds the identity source identifier to the network access certificate generated for the target account.

[0148] Step 704: The server returns the network access certificate to the terminal device.

[0149] It should be noted that the server may include multiple functional modules to provide different types of services. For example, the server may provide users with certificate issuance services so that the issuance process of network access certificates can be implemented through the certificate issuance service. Figure 8 , Figure 8 is a flow chart of a certificate issuance process provided by an exemplary embodiment. Figure 8 As shown, after the terminal device sends a certificate acquisition request carrying the second account information to the server, the server can verify the second account information through the certificate issuance service, and then generate a network access certificate based on the second account information if the second account information verification passes, and then return the network access certificate to the terminal device.

[0150] Above Figure 7 and Figure 8 The figure only illustrates the process of issuing the network access certificate. The specific implementation of each step can be found in the above embodiments and will not be described again here.

[0151] The above process is explained by taking the example of generating a network access certificate based on the second account information carried in the certificate acquisition request after receiving the certificate acquisition request. In more possible implementation methods, before generating a network access certificate for the target account based on the second account information carried in the certificate acquisition request, the second account information can be verified. If the second account information verification passes, a network access certificate can be generated for the target account based on the second account information carried in the certificate acquisition request.

[0152] For example, it is possible to verify whether the second account information satisfies the set format. If the second account information satisfies the set format, it can be determined that the second account information verification has passed. Taking the second account information including the account ID and the organization ID as an example, it is possible to verify whether the account ID and the organization ID meet the set format, thereby realizing the verification of the second account information.

[0153] By first verifying the second account information, and then generating a network access certificate based on the second account information if the second account information passes the verification, network security can be improved.

[0154] 2. The target account is not logging in for the first time on the terminal device

[0155] It should be noted that since a network access certificate has been generated for the target account when the target account logged in for the first time, when the target account logs in again, it can directly access the network based on the stored network access certificate without having to apply for the issuance of the network access certificate again.

[0156] Optionally, the network access certificate involved in the above process may be a digital certificate, for example, the network access certificate may be an X509 digital certificate, or the network access certificate may be of other types. This application does not limit the specific type of the network access certificate.

[0157] The following is an introduction to the process of achieving network access based on network access certificates.

[0158] It should be noted that the target account can trigger a network access request through a terminal device, thereby sending a network access request to the server. Optionally, the terminal device can send the network access request to a network device (such as an access controller, etc.), and the network device can send the network access request to the server so that the server can receive the network access request from the terminal device, and then process it based on the network access certificate carried by the network access request.

[0159] In some embodiments, for step 301, in response to receiving a network access request from a target account, when verifying the validity of the network access certificate carried in the network access request, it is possible to verify whether the network access certificate is within the validity period, or, based on the signature format of the institution that issues the network access certificate, determine whether the signature of the network access certificate satisfies the signature format of the issuing institution, etc., to verify the validity of the network access certificate. Optionally, other methods can also be used to verify the validity of the network access certificate.

[0160] Taking the example of verifying whether the network access certificate is within the validity period to verify the validity of the network access certificate, if the network access certificate is within the validity period, it can be determined that the validity verification of the network access certificate has passed. For another example, based on the signature format of the institution that issues the network access certificate, it is determined whether the signature of the network access certificate meets the signature format of the issuing institution to verify the validity of the network access certificate. If the signature of the network access certificate meets the signature format of the issuing institution, it can be determined that the validity verification of the network access certificate has passed, so that the identity source identifier of the target account can be obtained from the network access certificate through step 302.

[0161] When the server implements the above process, it can be implemented through the container (or processing area) in the server for providing the network access request processing service. After obtaining the identity source identifier of the target account, the server can obtain the account status based on the obtained identity source identifier through the container (or processing area) for providing storage services for the identity source identifier and account status of the registered accounts in different target applications. Since the identity source identifier is obtained through encryption calculation, for step 303, when obtaining the account status of the target account based on the identity source identifier, the following steps can be included:

[0162] Step 3031: Decrypt the identity source identifier by setting a private key to obtain the account identifier of the target account and the organization identifier of the organization to which the target account belongs.

[0163] Step 3032: Based on the account identifier, obtain the account status of the target account from the data storage location corresponding to the organization identifier in the server.

[0164] Among them, the data storage locations corresponding to different organization identifiers in the server may be different. Therefore, based on the organization identifier, the data storage location used to store the account identifier and account status of the target account can be determined first, and then based on the account identifier, the account status of the target account can be obtained from the determined data storage location.

[0165] After the account status of the target account is obtained, network access control can be implemented based on the obtained account status. In some embodiments, for step 304, when processing the network access request based on the account status, any of the following situations can be included:

[0166] In one possible implementation, when the account status indicates that the target account is in a set state, the network access request is responded to, that is, the network access request of the target account is accepted and the target account is allowed to access the network so that the target account can obtain data from the network.

[0167] In another possible implementation, when the account status indicates that the target account is in a non-set state, the network access request is rejected.

[0168] The set status may be the employed status, and the non-set status may include the resigned status, the transferred status, etc.

[0169] The above process of implementing network access control based on network access certificates can be found in Fig. 9 , Fig. 9This is a flowchart of a network access control process shown in an exemplary embodiment. After receiving a network access request, the server can first verify the validity of the network access certificate. If it is determined that the network access certificate is invalid, the network access request can be directly rejected. Only when the network access certificate is valid can the server continue to process the network access request, that is, the server can extract the identity source identifier of the target account from the network access certificate, and use the organization identifier to calculate the setting key, so that the identity source identifier can be decrypted based on the setting key to obtain the organization identifier and the account identifier, thereby determining the corresponding data storage location in the server according to the organization identifier, so that the account status can be queried according to the account identifier in the corresponding data storage location, and then judging the processing method of the network access request according to the account status, that is, when the account status is the set state, the network access request is accepted, and when the account status is not the set state, the network access request is rejected.

[0170] For ease of understanding, the following describes the process of issuing a network access certificate through interaction between a terminal device and a server. Fig.10 , Fig.10 FIG. 1 is a flowchart of a network admission control process shown in an exemplary embodiment. The process may include the following steps:

[0171] Step 1001: The terminal device sends a network access request to the server, and the network access request carries a network access certificate.

[0172] Step 1002: In response to receiving a network access request from a target account, the server verifies the validity of a network access certificate carried in the network access request.

[0173] Step 1003: When the validity check of the network access certificate is passed, the server obtains a unique identity source identifier of the target account in the target application from the network access certificate.

[0174] Step 1004: The server obtains the account status of the target account based on the identity source identifier.

[0175] Step 1005: The server processes the network access request based on the account status.

[0176] It should be noted that the server may include multiple functional modules to provide different types of services. For example, the server may provide network access services to users so that network access can be controlled through network access services. Fig.11 , Fig.11 is a flowchart of a network admission control process provided by an exemplary embodiment. Fig.11As shown, the terminal device can send a network access request to the server. After receiving the network access request, the server verifies the validity of the certificate through the network access service. If the verification passes, the account status of the target account is queried based on the identity source identifier of the target account, and the network access authentication result is determined based on the queried account status, so as to approve or deny the target account access to the network based on the network access authentication result.

[0177] Above Fig.10 and Fig.11 What is shown is only a procedural description of the network admission control process. The specific implementation of each step can be found in the above embodiments and will not be repeated here.

[0178] It should be noted that the network access service may include a dynamic verification module, so that the dynamic verification module can be used to implement the following Fig.11 The network access service dynamic verification process is shown.

[0179] Through the above embodiments, even if the network access certificate is valid, the effect of being unable to access the network when the account status is not the set status can be achieved. At the same time, if the target account is restored to the set status, the account status of the target account's identity source identifier in the target application can be restored to the set status accordingly, and the network can be accessed subsequently without reissuing the network access certificate.

[0180] In addition, the solution provided by this application does not need to use a multi-factor authentication method, and can implement real-time verification of the target account's account status according to the identity source identifier when the target account enters the network for authentication, without affecting the user's use process, and thus will not reduce the user experience. Moreover, the solution provided by this application does not need to build a complex PKI infrastructure, and the network access service does not need to connect to the OCSP service (because the solution provided by this application does not need to verify whether the certificate has been revoked), thereby reducing the complexity of the system.

[0181] The above process is illustrated by dividing different containers (or processing areas) in the server to implement the method for processing network access requests proposed in this application. In more possible implementation methods, the server may include a first server and at least one second server. The first server can be used to provide network access request processing services for at least one second server. The second server can be a background server corresponding to the target application used by the institution to which the target account belongs. The second server is at least used to store the identity source identifier and account status of the registered account in the target application.

[0182] In this case, the processing method of the network access request provided in this application can be found in Fig.12 , Fig.12is a flowchart of a method for processing a network access request according to an exemplary embodiment. The method can be applied to a first server, such as Fig.12 As shown, the method may include the following steps:

[0183] Step 1201: In response to receiving a network access request from a target account, verify the validity of a network access certificate carried in the network access request.

[0184] Step 1202: When the validity check of the network access certificate passes, obtain a unique identity source identifier of the target account in the corresponding second server from the network access certificate.

[0185] Step 1203: Based on the identity source identifier, obtain the account status of the target account from the second server.

[0186] Step 1204: Process the network access request based on the account status.

[0187] By using the first server and the second server to implement different functions, data between the first server and the second server will not be confused, thereby improving data security.

[0188] Based on Fig.12 In the embodiment shown, the above process of realizing the login of the target account and verifying the validity of the network access certificate and related contents can be executed by the first server. For the introduction of the above contents, please refer to the above embodiment, which will not be repeated here.

[0189] If the validity check of the network access certificate passes, the first server can determine the target application used by the organization to which the target account belongs based on the organization identifier of the target account, and then obtain the account status of the target account from the background server of the target application (that is, the second server), thereby executing subsequent processes based on the obtained account status. For the introduction to obtaining the account status and subsequent processes, please refer to the above embodiment, which will not be repeated here.

[0190] Corresponding to the embodiments of the aforementioned method, this specification also provides embodiments of the device and the server used therein.

[0191] See also Fig.13 , Fig.13 1 is a block diagram of a device for processing a network access request provided by an exemplary embodiment, the device comprising:

[0192] The verification module 1301 is used to verify the validity of the network access certificate carried in the network access request in response to receiving the network access request of the target account;

[0193] The identification acquisition module 1302 is used to obtain the unique identity source identification of the target account in the target application from the network access certificate when the validity check of the network access certificate passes;

[0194] The status acquisition module 1303 is used to acquire the account status of the target account based on the identity source identifier;

[0195] The processing module 1304 is used to process the network access request based on the account status.

[0196] In some embodiments, the identity source identifier is obtained by encrypting and calculating the account identifier of the target account and the organization identifier of the organization to which the target account belongs by setting a key;

[0197] The status acquisition module 1303, when used to acquire the account status of the target account based on the identity source identifier, is used to:

[0198] The identity source identifier is decrypted by setting a private key to obtain the account identifier of the target account and the organization identifier of the organization to which the target account belongs;

[0199] Based on the account identifier, the account status of the target account is obtained from the data storage location corresponding to the organization identifier in the server; wherein different organization identifiers have different corresponding data storage locations in the server.

[0200] In some embodiments, the processing module 1304, when used to process the network access request based on the account status, is used for any of the following:

[0201] When the account status indicates that the target account is in a set state, responding to the network access request;

[0202] When the account status indicates that the target account is in a non-set state, the network access request is rejected.

[0203] In some embodiments, the apparatus further comprises:

[0204] A receiving module, used to receive a login request from a target account, where the login request carries the first account information;

[0205] The verification module 1301 is further used to verify the legitimacy of the target account based on the first account information carried in the login request;

[0206] If the target account passes the legitimacy check, the target account is allowed to log in.

[0207] In some embodiments, the identification acquisition module 1302 is further configured to, in response to receiving a certificate acquisition request from the target account, acquire the identity source identification based on the second account information carried in the certificate acquisition request when the target account logs in for the first time;

[0208] The device also includes:

[0209] Add a module to add the identity source identifier to the network access certificate generated for the target account;

[0210] The sending module is used to send the network access certificate to the terminal device corresponding to the target account.

[0211] In some embodiments, the second account information includes at least an account identifier of the target account and an organization identifier of an organization to which the target account belongs;

[0212] The identification acquisition module 1302, when used to obtain the identity source identification based on the second account information carried in the certificate acquisition request, is used to:

[0213] Based on the set key, the account identifier and the organization identifier included in the second account information are encrypted and calculated to obtain the identity source identifier.

[0214] In some embodiments, the verification module 1301 is also used to verify the second account information. If the second account information is verified, the steps of obtaining the identity source identifier based on the second account information carried in the certificate acquisition request and adding the identity source identifier to the network access certificate generated for the target account are executed.

[0215] In some embodiments, the server includes a first server and at least one second server, the first server is used to provide network access request processing services for at least one second server, the second server is a background server corresponding to the target application used by the organization to which the target account belongs, and the second server is at least used to store the identity source identifier and account status of the registered account in the target application.

[0216] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. A person of ordinary skill in the art can understand and implement it without paying creative labor.

[0217] This application also provides a server, see Fig.14 , Fig.14 is a schematic structural diagram of a server provided by an exemplary embodiment. Fig.14At the hardware level, the server includes a processor 1402, an internal bus 1404, a network interface 1406, a memory 1408, and a non-volatile memory 1410, and may also include hardware required to implement other functions. One or more embodiments of this specification may be implemented based on software, such as the processor 1402 reading the corresponding computer program from the non-volatile memory 1410 into the memory 1408 and then running it. Of course, in addition to the software implementation, one or more embodiments of this specification do not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0218] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the method for processing a network access request provided in any embodiment of the present application.

[0219] The devices or modules described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0220] In a typical configuration, a computer includes one or more processors (Central Processing Unit, CPU), input / output interface, network interface and memory.

[0221] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0222] Computer readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer readable instructions, data structures, modules of programs or other data. Examples of computer storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a server. According to the definition in this article, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0223] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0224] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0225] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0226] It should be understood that although the terms first, second, third, etc. may be used to describe various information in one or more embodiments of this specification, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0227] The above description is merely a preferred embodiment of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present specification shall be included in the scope of protection of one or more embodiments of the present specification.

Claims

1. A method for processing a network access request, characterized in that: Applied to a server, the method comprises: In response to receiving a network access request from a target account, verifying the validity of a network access certificate carried in the network access request; When the validity check of the network access certificate is passed, obtaining a unique identity source identifier of the target account in the target application from the network access certificate; Based on the identity source identifier, obtaining the account status of the target account; Based on the account status, processing the network access request; The identity source identifier is obtained by encrypting the account identifier of the target account and the organization identifier of the organization to which the target account belongs by setting a key; The acquiring the account status of the target account based on the identity source identifier includes: Decrypting the identity source identifier by setting a private key to obtain the account identifier of the target account and the organization identifier of the organization to which the target account belongs; Based on the account identifier, the account status of the target account is obtained from the data storage location corresponding to the organization identifier in the server; wherein different organization identifiers have different corresponding data storage locations in the server.

2. The method according to claim 1, characterized in that: The processing of the network access request based on the account status includes any of the following: When the account status indicates that the target account is in a set state, responding to the network access request; When the account status indicates that the target account is in a non-set state, the network access request is rejected.

3. The method according to claim 1, characterized in that Before verifying the validity of the network access certificate carried in the network access request in response to receiving the network access request of the target account, the method further includes: receiving a login request from the target account, wherein the login request carries first account information; Verifying the legitimacy of the target account based on the first account information carried in the login request; If the legitimacy check of the target account passes, the target account is allowed to log in.

4. The method according to claim 3, characterized in that: In the case where the legitimacy check of the target account passes, after the target account is allowed to log in, the method further includes: In the case where the target account logs in for the first time, in response to receiving a certificate acquisition request from the target account, based on the second account information carried in the certificate acquisition request, acquiring the identity source identifier, and adding the identity source identifier to the network access certificate generated for the target account; Send the network access certificate to the terminal device corresponding to the target account.

5. The method according to claim 4, characterized in that The second account information includes at least the account identifier of the target account and the institution identifier of the institution to which the target account belongs; The acquiring the identity source identifier based on the second account information carried in the certificate acquisition request includes: Based on the set key, the account identifier and the organization identifier included in the second account information are encrypted and calculated to obtain the identity source identifier.

6. The method according to claim 4, characterized in that The method further includes: obtaining the identity source identifier based on the second account information carried in the certificate acquisition request, and before adding the identity source identifier to the network access certificate generated for the target account: The second account information is verified. If the second account information passes the verification, the steps of obtaining the identity source identifier based on the second account information carried in the certificate acquisition request, and adding the identity source identifier to the network access certificate generated for the target account are executed.

7. The method according to claim 1, characterized in that The server includes a first server and at least one second server, the first server is used to provide network access request processing services for the at least one second server, the second server is a background server corresponding to the target application used by the organization to which the target account belongs, and the second server is at least used to store the identity source identifier and account status of the registered account in the target application.

8. A device for processing a network access request, characterized in that: Applied to a server, the device comprises: A verification module, configured to verify the validity of a network access certificate carried in the network access request in response to receiving a network access request from a target account; An identification acquisition module, used to obtain a unique identity source identification of the target account in the target application from the network access certificate if the validity check of the network access certificate passes; A status acquisition module, used to acquire the account status of the target account based on the identity source identifier; A processing module, configured to process the network access request based on the account status; The identity source identifier is obtained by encrypting the account identifier of the target account and the organization identifier of the organization to which the target account belongs by setting a key; The status acquisition module, when used to acquire the account status of the target account based on the identity source identifier, is used to: Decrypting the identity source identifier by setting a private key to obtain the account identifier of the target account and the organization identifier of the organization to which the target account belongs; Based on the account identifier, the account status of the target account is obtained from the data storage location corresponding to the organization identifier in the server; wherein different organization identifiers have different corresponding data storage locations in the server.

9. A server, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor implements the method for processing a network access request according to any one of claims 1 to 7 by running the executable instructions.

10. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the instructions are executed by the processor, the method for processing a network access request according to any one of claims 1 to 7 is implemented.

Images