A terminal VPN network access authentication method and system in a 5G scenario

Abstract

This invention proposes a terminal VPN network access authentication method and system for 5G scenarios. The method involves setting up VPN proxy gateways on both the requesting and destination sides. These VPN proxy gateways parse the access requests sent by the requesting party and impersonate the destination party to process the parsed data. Upon obtaining permission from the destination party, the terminal gains VPN network access. The VPN security gateway of this invention utilizes IP / SSL tunneling technology to implement a multi-tunnel virtual data transmission method, transforming network packets into more random and confidential network transmission data. This effectively prevents data theft and decryption, as well as virus infection. It also allows for better management and secure storage of keys and tunneling methods.

Description

Technical Field

[0001] This invention relates to the field of access networks, specifically to a terminal VPN network access authentication method and system in a 5G scenario. Background Technology

[0002] The application of 5G technology in smart policing systems has freed policing from the geographical limitations of police stations, allowing police officers to work from anywhere. However, the security of information within the policing system is paramount, necessitating the establishment of a comprehensive cybersecurity protection mechanism to meet the demands of smart policing in the new era. The lack of a robust authentication mechanism allows unauthorized users and devices to access the system, compromising terminal security.

[0003] The security and quality of data transmission on mobile networks can be affected by viruses and malicious code, which disrupt normal data transmission by causing network congestion. Existing network access environments use components such as VPN proxy gateways to address security issues during network access. However, these existing proxy gateways only perform simple encryption and decryption of data, and during data transmission, they merely forward data, failing to effectively provide security for the network access process. Summary of the Invention

[0004] To address the aforementioned technical issues, a terminal VPN network access authentication method and system for 5G scenarios are proposed to resolve security problems that arise during network access.

[0005] According to the purpose of this invention, a terminal VPN network access authentication method in a 5G scenario is proposed. This method is applied to a VPN proxy gateway based on the IPSec protocol, and includes the following steps performed through the VPN proxy gateway:

[0006] Before initiating VPN network access, a mobile network based on 5G scenarios is built to provide a communication channel for the requester and the destination.

[0007] The requesting party encrypts the data to be transmitted using a commercial cryptographic algorithm based on IPSec tunnel mode, forming the first encrypted data.

[0008] The VPN proxy gateway listens to the IPSec negotiation traffic in the communication channel, performs an adaptive IKE attack on the diverted IPSec negotiation traffic, impersonates the target, and processes the received first encrypted datagram to remove the plaintext IP packet header. After decrypting the content, it obtains the initial payload IP packet, executes a scanning thread on the payload IP packet to determine whether there is a network attack. If not, it executes the encryption and decryption process established with the target using a commercial cryptographic algorithm to generate second encrypted data, and sends the second encrypted data to the target through the tunnel server to realize the terminal VPN network access authentication process.

[0009] Preferably, the step of the requesting party encrypting the data to be transmitted using a commercial cryptographic algorithm based on IPSec tunnel mode to form the first encrypted data further includes: the IPSec tunnel mode using a commercial cryptographic algorithm to encapsulate and encrypt the entire IP packet to form an encapsulated and encrypted payload, and encapsulating the payload in a plaintext IP packet header to form the first encrypted data.

[0010] Preferably, the plaintext IP packet header carries the destination network IP address.

[0011] Preferably, the VPN proxy gateway listens to the IPSec negotiation traffic in the communication channel and performs an adaptive IKE attack on the diverted IPSec negotiation traffic to impersonate the destination. Specifically, the VPN proxy gateway pre-stores the destination address based on the destination network and the requester address based on the requesting network. When the VPN proxy gateway listens to the IPSec negotiation traffic in the communication channel, it identifies and intercepts it, extracts the destination network IP address, and performs polling to determine if a matching IP address exists. If not, the data content is discarded directly; otherwise, a virtual destination address space is constructed, and a confirmation response message indicating that the data has been received is sent to the requester.

[0012] Preferably, the step of generating the second encrypted data by executing the encryption and decryption process established with the destination using a commercial cryptographic algorithm includes generating the second encrypted data based on the initial payload IP packet and the virtual destination address space index after constructing the virtual destination address space.

[0013] Preferably, the method further includes pre-establishing encryption and decryption processes for commercial cryptographic algorithms between the VPN proxy gateway and the destination network, and establishing different encryption and decryption algorithms based on different destination networks in the VPN network.

[0014] Preferably, after the VPN proxy gateway sends the second encrypted data to the target party through the tunnel server, the target party performs a network access permission determination. If access is allowed, the target party sends a network access response message to the requesting party through the VPN proxy gateway.

[0015] According to the purpose of this invention, this invention also proposes a terminal VPN network access authentication system in a 5G scenario. The system includes a requester, a destination, and a VPN proxy gateway, wherein...

[0016] Before initiating VPN network access, the VPN proxy gateway constructs a mobile network based on the 5G scenario to provide communication channels for the requester and the destination.

[0017] The requesting party encrypts the data to be transmitted using a commercial cryptographic algorithm based on IPSec tunnel mode, forming the first encrypted data.

[0018] The VPN proxy gateway listens to the IPSec negotiation traffic in the communication channel, performs an adaptive IKE attack on the diverted IPSec negotiation traffic, impersonates the target, and processes the received first encrypted datagram to remove the plaintext IP packet header. After decrypting the content, it obtains the initial payload IP packet, executes a scanning thread on the payload IP packet to determine whether there is a network attack. If not, it executes the encryption and decryption process established with the target using a commercial cryptographic algorithm to generate second encrypted data, and sends the second encrypted data to the target through the tunnel server to realize the terminal VPN network access authentication process.

[0019] Preferably, the VPN proxy gateway includes:

[0020] IKE processing module: Identifies and captures IPSec negotiation traffic, performs adaptive IKE attacks on the diverted IPSec negotiation traffic, and disguises it to deceive both parties using IPSec communication. It stores the SA information generated by the negotiation into the system's storage data structure and adaptively establishes IPSec channels with both communicating parties.

[0021] Policy and SA Management Module: This module is responsible for storing and retrieving SA policies. It is mainly responsible for storing or updating the SA policies negotiated by the IKE module into the system's data structure. When the network data processing module needs SA policy-related parameters, it is responsible for retrieving the SA policies accordingly.

[0022] The network data processing module decrypts the ciphertext traffic by querying and using the SA information generated by the IKE negotiation module. Then, it identifies the information and keywords to be monitored in the configuration file and performs related actions on the plaintext data. For traffic that is allowed to pass, it encrypts the traffic using the relevant parameters of the IPSec channel established between the system and the communication destination, thus completing the communication between the two parties.

[0023] Preferably, the strategy and SA management module is also used to receive SA data generated by the IKE negotiation module and transmitted in the form of Netlink messages using the Netlink interface, and add it to the SADB structure maintained by the system.

[0024] This invention proposes a terminal VPN network access authentication method and system for 5G scenarios. The method involves setting up a VPN proxy gateway at both the requesting and destination sides. The VPN proxy gateway parses the access request sent by the requesting party and impersonates the destination party to process the parsed data. Upon obtaining permission from the destination party's access request, the terminal gains VPN network access. The VPN security gateway of this invention relies on IP / SSL tunneling technology to implement a multi-tunnel virtual data transmission method, which can transform network packets into more random and confidential network transmission data, effectively preventing data theft and decryption, as well as virus infection. This allows for better management and secure storage of keys and tunneling methods. Attached Figure Description

[0025] Figure 1 This is a flowchart of the terminal VPN network access authentication method in the 5G scenario proposed in this invention. Detailed Implementation

[0026] For ease of understanding, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] like Figure 1 As shown, a terminal VPN network access authentication method in a 5G scenario is described. This method is applied to a VPN proxy gateway based on the IPSec protocol, and includes the following steps performed through the VPN proxy gateway:

[0028] P001. Before initiating VPN network access, a mobile network based on the 5G scenario is built to provide a communication channel for the requester and the destination;

[0029] P002. The requesting party uses a commercial cryptographic algorithm based on IPSec tunnel mode to encrypt the data to be transmitted, forming the first encrypted data.

[0030] P003. The VPN proxy gateway listens to the IPSec negotiation traffic in the communication channel and performs an adaptive IKE attack on the diverted IPSec negotiation traffic, masquerading as the destination.

[0031] P004. The received first encrypted datagram is processed to remove the plaintext IP packet header, and the content is decrypted to obtain the initial payload IP packet.

[0032] P005. Perform a scanning thread on the payload IP packet to determine if there is any network attack. If not, execute the encryption / decryption process established with the target party using a commercial cryptographic algorithm to generate second encrypted data.

[0033] P006. The second encrypted data is sent to the target party through the tunnel server to realize the terminal VPN network access authentication process.

[0034] In this embodiment, the step of the requesting party encrypting the data to be transmitted using a commercial cryptographic algorithm based on IPSec tunnel mode to form the first encrypted data further includes: the IPSec tunnel mode using a commercial cryptographic algorithm to encapsulate and encrypt the entire IP packet to form an encapsulated and encrypted payload, and encapsulating the payload in a plaintext IP packet header to form the first encrypted data.

[0035] In this embodiment, the plaintext IP packet header carries the destination network IP address.

[0036] In this embodiment, the VPN proxy gateway listens to the IPSec negotiation traffic in the communication channel and performs an adaptive IKE attack on the diverted IPSec negotiation traffic. The specific steps of impersonating the destination are as follows: the VPN proxy gateway pre-stores the destination address based on the destination network and the requester address based on the requesting network; when the VPN proxy gateway listens to the IPSec negotiation traffic in the communication channel, it identifies and intercepts it, extracts the destination network IP address, and performs polling and matching to determine whether a matching IP address exists. If no matching IP address exists, the data content is discarded directly; otherwise, a virtual destination address space is constructed, and a confirmation response message indicating that the data has been received is sent to the requester.

[0037] In this embodiment, the step of generating second encrypted data by executing the encryption and decryption process established with the destination using a commercial cryptographic algorithm includes generating second encrypted data based on the initial payload IP packet and the virtual destination address space index after constructing the virtual destination address space.

[0038] In this embodiment, the method further includes pre-establishing encryption and decryption processes for commercial cryptographic algorithms between the VPN proxy gateway and the destination network, and establishing different encryption and decryption algorithms based on different destination networks in the VPN network.

[0039] In this embodiment, after the VPN proxy gateway sends the second encrypted data to the target party through the tunnel server, the target party performs a network access permission determination. If access is allowed, the target party sends a network access response message to the requesting party through the VPN proxy gateway.

[0040] According to the purpose of this invention, this invention also proposes a terminal VPN network access authentication system in a 5G scenario. The system includes a requester, a destination, and a VPN proxy gateway, wherein...

[0041] Before initiating VPN network access, the VPN proxy gateway constructs a mobile network based on the 5G scenario to provide communication channels for the requester and the destination.

[0042] The requesting party encrypts the data to be transmitted using a commercial cryptographic algorithm based on IPSec tunnel mode, forming the first encrypted data.

[0043] The VPN proxy gateway listens to the IPSec negotiation traffic in the communication channel, performs an adaptive IKE attack on the diverted IPSec negotiation traffic, impersonates the target, and processes the received first encrypted datagram to remove the plaintext IP packet header. After decrypting the content, it obtains the initial payload IP packet, executes a scanning thread on the payload IP packet to determine whether there is a network attack. If not, it executes the encryption and decryption process established with the target using a commercial cryptographic algorithm to generate second encrypted data, and sends the second encrypted data to the target through the tunnel server to realize the terminal VPN network access authentication process.

[0044] In this embodiment, the VPN proxy gateway includes:

[0045] IKE processing module: Identifies and captures IPSec negotiation traffic, performs adaptive IKE attacks on the diverted IPSec negotiation traffic, and disguises it to deceive both parties using IPSec communication. It stores the SA information generated by the negotiation into the system's storage data structure and adaptively establishes IPSec channels with both communicating parties.

[0046] Policy and SA Management Module: This module is responsible for storing and retrieving SA policies. It is mainly responsible for storing or updating the SA policies negotiated by the IKE module into the system's data structure. When the network data processing module needs SA policy-related parameters, it is responsible for retrieving the SA policies accordingly.

[0047] The network data processing module decrypts the ciphertext traffic by querying and using the SA information generated by the IKE negotiation module. Then, it identifies the information and keywords to be monitored in the configuration file and performs related actions on the plaintext data. For traffic that is allowed to pass, it encrypts the traffic using the relevant parameters of the IPSec channel established between the system and the communication destination, thus completing the communication between the two parties.

[0048] In this embodiment, the policy and SA management module is also used to receive SA data generated by the IKE negotiation module and transmitted in the form of Netlink messages using the Netlink interface, and add it to the SADB structure maintained by the system.

[0049] It will be apparent to those skilled in the art that the embodiments of the present invention are not limited to the details of the exemplary embodiments described above, and that the embodiments of the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the embodiments of the present invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the embodiments of the present invention is defined by the appended claims rather than the foregoing description. Therefore, all variations falling within the meaning and scope of equivalents of the claims are intended to be encompassed within the embodiments of the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims. Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units, modules, or devices recited in the system, apparatus, or terminal claims may also be implemented by the same unit, module, or device through software or hardware. The terms "first," "second," etc., are used to indicate names and do not indicate any particular order.

[0050] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention and are not intended to limit them. Although the embodiments of the present invention have been described in detail with reference to the above preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions to the technical solutions of the embodiments of the present invention should not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A terminal VPN network access authentication method in a 5G scenario, characterized in that, The method, applied to a VPN proxy gateway based on the IPSec protocol, includes performing the following steps through the VPN proxy gateway: before initiating VPN network access, constructing a mobile network based on a 5G scenario to provide a communication channel for the requester and the destination; The requesting party encrypts the data to be transmitted using a commercial cryptographic algorithm based on IPSec tunnel mode, forming the first encrypted data. The VPN proxy gateway listens to the IPSec negotiation traffic in the communication channel, performs an adaptive IKE attack on the diverted IPSec negotiation traffic, impersonates the target party, and processes the received first encrypted datagram to remove the plaintext IP packet header, decrypts the content to obtain the initial payload IP packet, executes a scanning thread on the payload IP packet to determine whether there is a network attack behavior, if not, executes the encryption and decryption process established with the target party through commercial cryptographic algorithms to generate second encrypted data, and sends the second encrypted data to the target party through the tunnel server to realize the terminal VPN network access authentication process; The steps for forming the first encrypted data further include: the IPSec tunnel mode uses commercial cryptographic algorithms to encapsulate and encrypt the entire IP packet to form the encapsulated and encrypted payload, and encapsulates the payload in a plaintext IP packet header to form the first encrypted data; the plaintext IP packet header carries the destination network IP address; The VPN proxy gateway listens to the IPSec negotiation traffic in the communication channel and performs an adaptive IKE attack on the diverted IPSec negotiation traffic, impersonating the destination party. Specifically, the VPN proxy gateway pre-stores the destination party address based on the destination network and the requester address based on the requesting network. When the VPN proxy gateway detects IPSec negotiation traffic in the communication channel, it identifies and intercepts it, extracts the destination network IP address, and performs polling to determine if a matching IP address exists. If no matching IP address exists, the detected IPSec negotiation traffic is discarded. Otherwise, a virtual destination address space is constructed, and a confirmation response message indicating that the traffic has been received is sent to the requesting party.

2. The terminal VPN network access authentication method in a 5G scenario according to claim 1, characterized in that, The step of generating second encrypted data by executing the encryption and decryption process established with the destination using a commercial cryptographic algorithm includes generating second encrypted data based on the initial payload IP packet and the virtual destination address space index after constructing the virtual destination address space.

3. The terminal VPN network access authentication method in a 5G scenario according to claim 2, characterized in that, The method also includes pre-establishing encryption and decryption processes for commercial cryptographic algorithms between the VPN proxy gateway and the destination network, and establishing different encryption and decryption algorithms based on different destination networks within the VPN network.

4. The terminal VPN network access authentication method in a 5G scenario according to claim 3, characterized in that, After the VPN proxy gateway sends the second encrypted data to the target party through the tunnel server, the target party performs a network access permission determination. If access is allowed, the target party sends a network access response message to the requesting party through the VPN proxy gateway.

5. A terminal VPN network access authentication system for 5G scenarios, characterized in that, The system includes a requester, a destination, and a VPN proxy gateway. Before initiating VPN network access, the VPN proxy gateway constructs a mobile network based on a 5G scenario to provide communication channels for the requester and the destination. The requesting party encrypts the data to be transmitted using a commercial cryptographic algorithm based on IPSec tunnel mode, forming the first encrypted data. The VPN proxy gateway listens to the IPSec negotiation traffic in the communication channel, performs an adaptive IKE attack on the diverted IPSec negotiation traffic, impersonates the target party, and processes the received first encrypted datagram to remove the plaintext IP packet header, decrypts the content to obtain the initial payload IP packet, executes a scanning thread on the payload IP packet to determine whether there is a network attack behavior, if not, executes the encryption and decryption process established with the target party through commercial cryptographic algorithms to generate second encrypted data, and sends the second encrypted data to the target party through the tunnel server to realize the terminal VPN network access authentication process; The VPN proxy gateway includes: an IKE processing module: which identifies and captures IPSec negotiation traffic, performs adaptive IKE attacks on the diverted IPSec negotiation traffic, and disguises the traffic to deceive both parties using IPSec communication. It also stores the SA information generated by the negotiation into the system's storage data structure and adaptively establishes IPSec channels with both communicating parties. Policy and SA Management Module: This module is responsible for storing and retrieving SA policies. It is mainly responsible for storing or updating the SA policies negotiated by the IKE module into the system's data structure. When the network data processing module needs SA policy-related parameters, it is responsible for retrieving the SA policies accordingly. The network data processing module decrypts the ciphertext traffic by querying and using the SA information generated by the IKE negotiation module. Then, it identifies the information and keywords to be monitored in the configuration file and performs related actions on the plaintext data. For traffic that is allowed to pass, it encrypts the traffic using the relevant parameters of the IPSec channel established between the system and the communication destination, thus completing the communication between the two parties.

6. The terminal VPN network access authentication system in a 5G scenario according to claim 5, characterized in that, The strategy and SA management module is also used to receive SA data generated by the IKE negotiation module and transmitted in the form of Netlink messages using the Netlink interface, and add it to the SADB structure maintained by the system.

Images