An access control system and method based on authentication and resource access management

Abstract

The application discloses an access control system and method based on authentication and resource access management and control, and the access control system is distributed in different levels; the access control system carries out identity authentication on an access subject for the access of the level, and establishes a data connection between the identity-trusted access subject of the level and the access resource of the level; the access control system carries out identity authentication on the access control system of another level which initiates cross-level access for the cross-level access, and establishes a data tunnel between the identity-trusted access control system of another level. The scheme provided by the application can realize resource access between cross-levels and cross-departments, and meanwhile, the data flow of all cross-level and cross-department access subjects is transmitted through the single data tunnel between different level or different department access control systems, so that the safety of data transmission is ensured, and the efficiency of data access is greatly improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security authentication, in particular to the field of zero trust and other cross-layer authentication and data access. BACKGROUND

[0002] With the development of technologies such as big data, cloud computing, and mobile Internet, digital transformation has been integrated into various industries. Remote work, branch access, mobile work, and intranet security scenarios have raised new and higher requirements for user secure access, comprehensive identity authentication, and resource authorization access.

[0003] To meet the above requirements, similar authentication and authorization schemes such as zero trust have emerged in access schemes to meet identity authentication and resource access control. A system typically includes identity management, authentication management, permission management (the first three are collectively referred to as an authentication system), audit management, terminal system (access terminal), and access control system (subject access connection and resource access control and authentication), which meets the subject access authentication, resource access authentication, and control, including trust evaluation and dynamic permission adjustment, to solve the problem of data security.

[0004] However, whether it is a zero trust system or other authentication management system, when managing subjects and accessing resources, the subjects and objects covered are limited to one level or one department. Cross-level and cross-department resource access occurs and becomes a common practice in work, but there is no effective solution. The final measure taken is to increase the number of managed objects or subjects, that is, not only to manage the subjects and objects of the current level and department, but also to manage the subjects and objects of other levels and departments. This not only increases the size of the security authentication system, but also increases the management workload. Moreover, due to the differences in attributes of subjects and objects between different levels and departments, it brings great difficulty to management. After all, the subjects and objects of other levels and departments should not be managed by other levels or departments.

[0005] How to effectively solve the problem of cross-level and cross-department identity authentication and resource access control has become a pressing security issue. SUMMARY

[0006] In view of the existing problems of cross-level and cross-department resource access, a new mechanism and scheme are needed to solve the problem of cross-level identity authentication and resource access.

[0007] Therefore, the purpose of the present application is to provide an access control system based on authentication and resource access control and a corresponding control method for realizing safe and efficient access across levels and departments.

[0008] In order to achieve the above object, the application provides an access control system based on authentication and resource access management, which is distributed in different levels.

[0009] The access control system performs identity authentication on the access subject, and establishes a data connection between the identity-trusted access subject and the access resource in the current level.

[0010] The access control system performs identity authentication on the access control system in the other level which initiates cross-level access, and establishes a data tunnel between the identity-trusted access control system in the other level.

[0011] Further, the access control system comprises an authentication system and an access control system, which interact with each other to perform identity management, authentication management and permission management, and can register the access control system information in the access control system in the other level, establish a connection with the access control system in the other level after registration, and issue relevant identity information.

[0012] The access control system controls the data connection between the access subject in the current level and the access resource in the current level according to the identity authentication result of the authentication system on the access subject in the current level.

[0013] The access control system establishes a data tunnel between the access control system in the identity-trusted access control system in the other level according to the identity authentication result of the authentication system on the access control system in the other level which initiates cross-level access.

[0014] Further, the access control system comprises a first authentication module, a tunnel module, a second authentication module, a traffic forwarding module and an authorized resource module.

[0015] The first authentication module and the tunnel module interact with each other to obtain the tunnel establishment request authentication information extracted by the tunnel module and send it to the access control system in the current level for identity authentication.

[0016] The tunnel module is triggered by the traffic forwarding module, and initiates a tunnel establishment request to the access control system in the other level according to the address information of the access control system in the other level provided by the traffic forwarding module. The tunnel module receives and judges the tunnel establishment request sent by the access control system in the other level, extracts the authentication information of the confirmed tunnel establishment request and sends it to the first authentication module.

[0017] The second authentication module is used to authenticate the access subject in the current level. After authentication, a data channel is established between the access subject in the current level and the access control system, and then the resource system in the current level is accessed through the traffic forwarding module.

[0018] The traffic forwarding module interacts with the authorized resource module and the tunnel module, and can query a routing table item according to gateway information of an access control system in a he-level access control system queried from the authorized resource module, encapsulate a message of cross-layer resource access in a tunnel or trigger establishment of the tunnel, and update the routing table item;

[0019] The authorized resource module stores resource information accessible by an access subject after passing the authentication in the current level, and is connected with the traffic forwarding module for data, so as to be queried by the traffic forwarding module.

[0020] Further, the authentication system comprises attribute information of an access control system in a he-level access control system, and the access control system in the he-level access control system is registered in the authentication system in the current level access control system in the form of an access identity, and the attribute information at least covers the following information: address or domain name, identity, Key, verification algorithm and GRE Key of the he-level access control system.

[0021] Further, after the authentication system completes registration of the access control system information in the he-level access control system, the authentication system interacts with the registered access control system to complete distribution of the identity, Key, verification algorithm and GRE Key.

[0022] Further, the traffic forwarding module obtains gateway information of the access control system in the he-level access control system, queries a tunnel interface in a routing table item with the gateway information as a keyword, directly encapsulates a tunnel if a corresponding table item exists, and forwards a message; if the corresponding table item does not exist, a GRE tunnel between the current level access control system and the he-level access control system needs to be established.

[0023] Further, only one GRE tunnel is established between any two control systems in different levels, and the tunnel serves all related access subjects, and access traffic of all current level related access subjects accessing a resource system in the he-level is encapsulated in the same GRE tunnel.

[0024] Further, the tunnel module generates digest information based on the identity of the current level access control system, a random number generated by itself and a pre-set Key, and generates a tunnel establishment request based on the digest information.

[0025] Further, the tunnel module verifies whether a tunnel needs to be established by using a GRE Key for a tunnel establishment request sent by the access control system in the he-level access control system.

[0026] Further, the authentication system, after receiving the tunnel establishment request authentication information forwarded by the first authentication module, queries the corresponding Key and verification algorithm from the registered identity information based on the identity of the access control system in the other hierarchical access control system received, generates new digest information based on the identity, random number and Key according to the queried verification algorithm, and compares the digest in the tunnel establishment request authentication information, if the same, the identity authentication is passed; if different, the identity authentication fails.

[0027] In order to achieve the above purpose, the access control method based on authentication and resource access control provided by the application deploys the above-mentioned access control system at different levels, first, the access at the current level is authenticated by the access control system deployed at the current level, and the data connection between the identity-trusted access subject at the current level and the access resource at the current level is established.

[0028] Then, for cross-level access, the access control system deployed at the current level authenticates the other-level access control system initiating cross-level access, and establishes a data tunnel between the identity-trusted other-level access control system.

[0029] Further, the access control method transmits all data traffic of cross-level access by establishing a single data tunnel between different levels.

[0030] The scheme provided by the application can automatically solve the problem of identity authentication and resource access across levels and departments, and through access authentication, the identity of the access control system at the current level is guaranteed to be trusted, and the tunnel is trusted. Through unified tunnel, cross-level access of multiple terminal systems is transmitted by a tunnel, which significantly improves the transmission efficiency of data. BRIEF DESCRIPTION OF DRAWINGS

[0031] The application will be further described below in combination with the drawings and specific embodiments.

[0032] Figure 1 The figure is a schematic diagram of cross-level and department authentication and resource access control in the application example.

[0033] Figure 2 The figure is an access control system architecture diagram in the application example.

[0034] Figure 3 The figure is a processing flow diagram between modules of the access control system in the application example. DETAILED DESCRIPTION

[0035] In order to make the technical means, creative features, purposes and effects realized by the application easy to understand, the application will be further described below in combination with specific drawings.

[0036] The present application aims at the problem existing in cross-platform and cross-department resource access, and gives an access control scheme based on authentication and resource access control, which is based on the premise of identity authentication of the current level and department, realizes the establishment of data access tunnel between different levels for resource access, thereby realizing safe and efficient access across levels and departments.

[0037] Specifically, the present scheme constructs an access control system based on authentication and resource access control, and distributes the access control system in different levels.

[0038] Accordingly, the access control system performs identity authentication on the access subject in the current level access, and establishes data connection between the identity-trusted access subject in the current level and the access resource in the current level.

[0039] Meanwhile, the access control system performs identity authentication on the access control system in the other level which initiates cross-level access, and establishes data tunnel between the identity-trusted access control system in the other level.

[0040] In specific implementation, the access control system in the present application mainly includes an authentication system and an access control system.

[0041] The authentication system and the access control system perform data interaction, identity management, authentication management, and permission management, can register the access control system information in the access control system in the other level, establish connection with the access control system in the access control system in the other level after registration, and issue relevant identity information.

[0042] In cooperation therewith, the access control system controls data connection between the access subject in the current level and the access resource in the current level according to the identity authentication result of the authentication system on the access subject in the current level; meanwhile, the access control system establishes data tunnel between the access control system in the identity-trusted access control system in the other level according to the identity authentication result of the authentication system on the access control system in the access control system in the other level which initiates cross-level access.

[0043] It should be noted that the "current level" and "other level" involved in the present scheme are relative, not fixed. As an example, A level and B level, if A level is "current level", then B level is "other level" for A level; if B level is "current level", then A level is "other level" for B level.

[0044] According to the application, when the cross-level and cross-department resource access control is performed based on the access control system, first, the access of the current level is performed, the identity of the access subject of the current level is authenticated by the authentication system in the access control system of the current level, and the data connection is established between the access subject of the current level with the trusted identity and the access resource of the current level.

[0045] Under the premise, for the cross-level access, the authentication system in the access control system of the current level cooperates with the access control system to authenticate the access control system of the other level, and the data tunnel is established between the access control system of the other level with the trusted identity.

[0046] It can be seen that the application can realize the cross-level and cross-department resource access, and does not need to maintain all the access subject information. Meanwhile, the data flow of all the cross-level and cross-department access subjects is transmitted through the single data tunnel between the access control systems of different levels or different departments, so that the safety of data transmission is ensured, and the efficiency of data access is greatly improved.

[0047] In order to improve the efficiency of data forwarding, the tunnel between the access control system of the current level and the access control system of the other level can transmit the access of multiple terminal systems to the resource system, and does not need to establish an independent tunnel for each terminal system.

[0048] The application is further described by the corresponding examples.

[0049] In the example, based on the current internet remote access, cloud access, branch access and the like, the cross-level and cross-department authentication and resource access control are realized based on the access authentication and resource access control system.

[0050] Reference Figure 1 In the example, the access systems deployed in different levels are divided into the access control system of the current level (hereinafter referred to as the current layer) and the access control system of the other level (hereinafter referred to as the other layer), and the two access control systems are independent and perfect access control systems.

[0051] The other layer includes the terminal system 100, the resource system 130, the authentication system 120 and the access control system 110.

[0052] The authentication system 120 cooperates with the access control system 110 to form the corresponding access control system of the other layer, the authentication system 120 is used for the identity management, authentication management and permission management of the access subject, and the access control system 110 is responsible for the function of the data access and authentication of the other layer.

[0053] The terminal system 160, the resource system 190, the authentication system 180, and the access control system 170 in the layer are included in the layer.

[0054] The authentication system 180 and the access control system 170 in the layer form a corresponding access control system in the layer, and the authentication system 180 is used for identity management, authentication management, and permission management of an access subject, and the access control system 170 is responsible for data access and authentication in the layer.

[0055] The two access control systems have a management relationship of upper and lower levels or an organizational relative relationship, and the terminals of the two access control systems (the access subject uses a terminal system to access a resource system) have a cross-layer access to the resource system of the other party.

[0056] Here, the “layer” and the “other layer” are relative, and the corresponding access control systems have the same structure, but are deployed in different layers.

[0057] In this example, the access control system in the layer is taken as an example to illustrate the specific structure of the access control system.

[0058] The authentication system 180 in the access control system in the layer is responsible for identity management, authentication management, and permission management, registers information of the access control system 110 in the other layer, establishes a connection with the access control system 110 in the other layer after the registration is completed, and issues relevant identity information.

[0059] As an example, to realize formation of an authorized resource module, the resource attribute information stored in the authentication system 180 in the layer needs to include the following contents, in which the resource name, the access control system in the other layer, and the access control system in the layer are necessary items.

[0060] Resource name Foreign access control system Local access control system Other resource attribute information

[0061] Further, to realize identity authentication of the access control system in the other layer, the authentication system 180 in the layer needs to include information of the access control system in the other layer, and the information of the access control system 110 in the other layer is registered in the authentication system 180 in the layer in the form of an access identity, and the attribute information needs to cover at least the following information:

[0062]

[0063] Accordingly, after the registration of the information of the access control system 110 in the other layer is completed, the authentication system 180 in the layer needs to interact with the access control system 110 in the other layer, complete issuance of AID, Key, verification algorithm, and GRE Key, and such information will be used as basic materials for subsequent identity authentication of the access control system 110 in the other layer.

[0064] Referring toFigure 2 The access control system in the present access control system 170 mainly includes first authentication module 171, tunnel module 172, second authentication module 173, traffic forwarding module 174, authorized resource module 175 these functional modules.

[0065] Among them, the first authentication module 171 cooperates with the tunnel module data 172 to form a corresponding cross-layer access subsystem.

[0066] Specifically, the first authentication module 171 and the tunnel module data 172 and the layer authentication system 180 interact with data, obtain the tunnel establishment request authentication information extracted by the tunnel module 172 and send the layer authentication system 180 in the layer access control system in the access control system identity authentication.

[0067] The tunnel module 172 is triggered by the traffic forwarding module 174, and according to the address or domain name information of the access control system in the other layer access control system provided by the traffic forwarding module 174, initiates a tunnel establishment request to the access control system in the other layer access control system; Furthermore, the tunnel module 172 also receives and judges the tunnel establishment request sent by the access control system in the other layer access control system, and extracts the authentication information of the confirmed tunnel establishment request and sends it to the first authentication module 171.

[0068] The second authentication module 173 cooperates with the traffic forwarding module 174 to form a corresponding local access subsystem.

[0069] Specifically, the second authentication module 173 is used to authenticate the terminal and the access subject in the layer, and after the authentication is passed, the data channel is established between the terminal in the layer and the access control system, and then the traffic forwarding module is used to access the layer resource system 190 in the layer backend.

[0070] The traffic forwarding module 174 interacts with the authorized resource module 175, the tunnel module 172 and the layer resource system 190, and can query the routing table item according to the gateway information of the access control system in the other layer access control system queried from the authorized resource module 175, tunnel encapsulation or trigger tunnel establishment for cross-layer resource access message, and update the routing table item.

[0071] The authorized resource module 175 stores the resource information that the access subject can access after the layer authentication is passed; and is connected with the traffic forwarding module data, which is used for the traffic forwarding module 174 to query.

[0072] In some embodiments, the authorized resource module 175 stores resource information accessible by the terminal system 160 in the current layer after passing the authentication in the current layer, including the information of the access control system 110 in the other layer required to be connected when accessing across layers, embodied in the form of a gateway, and provides a query interface for the traffic forwarding module 174 to query and obtain the address information of the access control system in the other layer.

[0073] In some embodiments, when the message for cross-layer access reaches the access control system in the current layer, the traffic forwarding module 174 queries the authorized resource module 175 to obtain the gateway information (such as address or domain name information) of the access control system in the other layer, and queries the tunnel interface in the routing table item with the gateway information (such as address or domain name information) as the key. If there is a corresponding table item, tunnel encapsulation is directly performed, and the message is forwarded. If there is no corresponding table item, a GRE tunnel needs to be established between the access control system in the current layer and the access control system in the other layer.

[0074] In some embodiments, the tunnel module 172 generates a tunnel establishment request containing the following information in order to ensure the identity reliability of the access control system in the current layer:

[0075]

[0076] On this basis, in order to perform the identity authentication of the access control system in the current layer, the tunnel module 172 generates digest information based on the identity identifier (AID) of the access control system in the current layer, the random number (Counter) generated by itself, and the pre-set key Key through a pre-set verification algorithm, and forms a corresponding tunnel establishment request based on the tunnel establishment request. The information is transmitted to the tunnel module of the access control system in the other layer.

[0077] At the same time, the tunnel module 172 determines the necessity of tunnel establishment according to the GRE Key of the tunnel establishment request sent by the tunnel module of the access control system in the other layer. Specifically, the tunnel module 172 determines the prerequisite for the access control system in the other layer to establish a tunnel connection through the verification mode of the GRE Key. If the GRE Key of the access control system in the other layer is different from that of the access control system in the current layer, the tunnel is refused to be established, and the process is terminated. If the GRE Key of the access control system in the other layer is the same as that of the access control system in the current layer, the subsequent authentication process is continued.

[0078] In some embodiments, after the tunnel module 172 receives the tunnel establishment request sent by the access control system in the other layer, the first authentication module 171 extracts the identity identifier (AID) of the access control system in the other layer, the random number (Counter) generated by itself, and the digest information in the tunnel establishment request, and forms an authentication request based on the information to send to the authentication system 180 in the current layer for identity authentication to confirm the identity legality of the access control system in the other layer.

[0079] In cooperation with the authentication system 180, after receiving the authentication request, based on the received AID of the other layer access control system, the authentication system 180 queries the corresponding Key and verification algorithm from the registered identity information of the other layer access control system, generates new digest information based on the received identity (AID), random number and Key according to the queried verification algorithm, and compares the two digest information. If they are the same, the identity authentication is passed; if they are different, the identity authentication fails.

[0080] Further, the authentication system 180 returns the authentication result to the tunnel module 172, and the tunnel module 172 establishes the tunnel according to the result: if the identity of the other layer access control system is trusted, the tunnel is established; if the identity of the other layer access control system is not trusted, the tunnel establishment process is ended.

[0081] On this basis, the present example further gives the specific process of tunnel establishment.

[0082] The tunnel for cross-layer and cross-department resource access is mainly completed by the traffic forwarding module, the tunnel module, the other layer tunnel module, the other layer authentication module and the other layer authentication system.

[0083] Referring to Figure 3 , which shows the specific process of tunnel establishment when the terminal of the access control system accesses the resources of the other layer resource system in the present example, further in combination with Figure 2 The tunnel establishment process includes the following steps:

[0084] M100, the traffic forwarding module 174 queries the authorized resource module 175 to check whether there is a gateway of the other layer access control system. If not, it means that it is a local resource access, and the tunnel establishment process is ended, and the resource forwarding is performed; if yes, it means that a cross-layer access tunnel needs to be established.

[0085] M200, the traffic forwarding module 174 queries the routing table item to check whether the obtained gateway of the other layer access control system has a corresponding tunnel. If yes, no new tunnel needs to be established, and the packet forwarding is performed; if not, the tunnel module needs to be triggered to establish a tunnel.

[0086] M300, the tunnel module of the access control system initiates a tunnel establishment request to the tunnel module of the other layer access control system, and the request packet carries the AID, random number, digest information and tunnel shared Key of the initiating request.

[0087] M400, the tunnel module of the access control system of the other layer determines whether the tunnel shared key is consistent, if consistent, it indicates that the access control system of the current layer and the access control system of the other layer have a management superior-inferior relationship or an organizational relative association relationship, the GRE Key of the access control systems having the relationship is the same, and a certain degree of trust relationship is possessed, so that the tunnel can be established; otherwise, the tunnel cannot be established, and the process is directly ended.

[0088] M500, the authentication module of the access control system of the other layer initiates an authentication request to the authentication system of the other layer, and carries the AID, random number and digest information in the received message payload.

[0089] M600, the authentication system of the other layer queries the corresponding Key and verification algorithm according to the AID of the access control system of the current layer, generates a Password according to the AID and random number as materials according to the preset verification algorithm, checks whether the Password and the digest information are equal, if the two are different, it indicates that the access control system of the current layer is not trusted, and returns an authentication failure result to the tunnel module 114; if the two are the same, it indicates that the access control system of the current layer is trusted, and returns an authentication success result to the tunnel module 114.

[0090] M700, the authentication system of the other layer returns the result of authentication success to the authentication module 113, the authentication module 113 returns the result to the tunnel module 114, and the tunnel module establishes a tunnel with the access control system of the current layer. The access control system of the current layer establishes a tunnel, and refreshes the routing table item.

[0091] M800, according to the established routing table item, resource access is performed across layers through the established tunnel.

[0092] As an example, after the tunnel is successfully established, the following routing table item can be formed:

[0093] Destination resource Network mask Next hop Foreign access control system APP1 IP 255.255.255.255 GRE tunnel 1 interface Foreign access control system gateway 1 APP2 IP 255.255.255.255 GRE tunnel 1 interface Foreign access control system gateway 1 APP3 IP 255.255.255.255 GRE tunnel 2 interface Foreign access control system gateway 2

[0094] Further, only one GRE tunnel is established between any two control systems of different levels, the tunnel serves all related access subjects, and the access traffic of all related access subjects of the current layer accessing the resource system of the other layer is encapsulated by the same GRE tunnel. The established GRE tunnel does not belong to a certain access resource or a certain access subject.

[0095] It should be noted that the terminal of the access control system of the other layer accesses the resources of the resource system of the current layer, and the tunnel process followed by the establishment of the tunnel process is the same as above.

[0096] It should be noted that the composition and function of the authentication system 120 of the other layer in the present example are the same as those of the authentication system 180 of the current layer, and will not be described here.

[0097] The inter-layer access control system 110 in this example mainly includes the first authentication module 113, the tunnel module 114, the second authentication module 111, the traffic forwarding module 112, and the authorized resource module 115. The inter-layer access control system 110 has the same structure and functions as the intra-layer access control system 170, and thus will not be described here.

[0098] For ease of illustration, in this example, the process of authentication is described by taking the access of the intra-layer access terminal 1 in the intra-layer access control system to the inter-layer resource system 130 in the inter-layer access control system as an example.

[0099] Precondition:

[0100] Precondition 1:

[0101] First, the intra-layer access control system 170 registers in the inter-layer authentication system by registration, and the registration information at least includes the following contents,

[0102]

[0103] Among them:

[0104] AID (identity): the identity of the intra-layer access control system.

[0105] Key: the key given to the intra-layer access control system for identity verification.

[0106] Verification algorithm: the verification algorithm shared by the intra-layer access control system and the inter-layer authentication system.

[0107] GRE Key: the judgment key for establishing a GRE tunnel between the access control systems.

[0108] After completing the registration, the inter-layer authentication system needs to establish a connection with the intra-layer access control system, and issue the information related to identity verification, such as AID, Key, verification algorithm, and GRE Key, to the intra-layer access control system.

[0109] Precondition 2:

[0110] Secondly, in the intra-layer authentication system, the information of the inter-layer resource needs to be registered by identity management, at least including the following contents:

[0111] Foreign resource name Foreign access control system Local access control system Other resource attribute information

[0112] Among them:

[0113] Inter-layer access control system: the inter-layer network device, such as gateway or other device, that needs to be accessed to access the inter-layer resource.

[0114] Intra-layer access control system: the intra-layer network device, such as gateway or other device, that needs to be accessed to access the inter-layer resource.

[0115] Other resource attribute information: other attributes associated with the other layer resource.

[0116] Specific process of cross-layer access:

[0117] Reference Figure 1 The access subject of the layer completes the identity authentication of the access subject through the layer terminal 1 in the layer authentication system, so as to ensure that the identity of the access subject is trusted, which is also a prerequisite for cross-layer resource access.

[0118] After the access subject of the layer is authenticated successfully, the resource information authorized by the access subject of the layer is issued to the layer access control system by the layer authentication system.

[0119] Reference Figure 2 Specifically, it is an authorized resource module 175, which forms an authorized resource list. Its form is as follows:

[0120] Resource name Resource access control system Resource (foreign) Foreign access control system Resource (local) Null

[0121] Among them:

[0122] Resource (other layer): there is a corresponding access control system, and the layer access control system needs to establish a tunnel connection with the other layer access control system.

[0123] Resource (layer): belongs to the layer access control system, and the resource access is performed in the layer, and there is no other layer access control system.

[0124] Other layer access control system: the access control system connected with the other layer resource, which is manifested as a specific gateway.

[0125] When the access subject accesses the other layer resource (APP1), the traffic forwarding module (174) checks the authorized resource module, finds that the resource (APP1) to be accessed exists cross-layer access, and needs to establish a GRE tunnel connection with the other layer access control system. If the tunnel has been established, the packet is directly encapsulated and forwarded through the GRE tunnel; if there is no corresponding GRE tunnel, the tunnel needs to be established through the following steps.

[0126] Step 1, tunnel establishment request preprocessing.

[0127] In order to realize safe access and avoid network attacks caused by unauthenticated tunnel establishment, the layer access control system needs to establish a tunnel with the other layer access control system, and the identity of the layer access control system needs to be authenticated in the other layer access control system to meet the authentication requirements of the other layer access control system. For this purpose, the traffic forwarding module requires the tunnel module to preprocess according to the address information of the other layer access control system obtained by querying the authorized resource module, and the content includes the following information:

[0128] Counter

[0129] Get AID, Key, authentication algorithm, GRE Key, this part of information is issued to the access control system of this layer in the preset condition 2.

[0130] The tunnel module generates digest information according to the preset authentication algorithm, with the identity AID, the key Key and the random number Counter as materials.

[0131] The tunnel module assembles a message, and the message content includes the following contents:

[0132]

[0133] Step 2, he layer tunnel establishment request preliminary determination.

[0134] The tunnel module of the access control system of the other layer receives the tunnel establishment request, and first judges whether the access control system of this layer and the access control system of the other layer have a management superior-inferior relationship or an organizational relative relationship according to the GRE Key. The GRE Key of the access control system having the relationship is the same, and the access control system has a certain degree of trust relationship, and the tunnel can be established. If the GRE Key is different, the tunnel cannot be established, and the process is directly ended; if the GRE Key is the same, step 3 is performed.

[0135] Step 3, identity authentication of the access control system of this layer.

[0136] The tunnel module extracts the AID (identity), Counter (random number) and digest information in the received tunnel establishment request, and forwards the information to the authentication module 113. The authentication module carries the information to the authentication system 120 of the other layer to initiate an authentication request.

[0137] The authentication system 120 of the other layer searches the AID according to the registration information of the preset condition 1, and obtains the Key and the authentication algorithm corresponding to the AID. The authentication system of the other layer generates Password according to the preset authentication algorithm, with the identity AID, the key Key and the random number Counter as materials. Comparing Password and digest information, if the two are different, it means that the access control system of this layer is not trusted, and the authentication module 113 returns the authentication failure result to the tunnel module 114; if the two are the same, it means that the access control system of this layer is trusted, and the authentication module 113 returns the authentication success result to the tunnel module 114.

[0138] Step 4, tunnel establishment.

[0139] The tunnel module 114 processes according to the authentication result returned by the authentication system of the other layer:

[0140] If the authentication fails, the tunnel establishment procedure is ended, and a result of tunnel establishment failure is returned to the tunnel module 172 of the access control system of the layer;

[0141] If the authentication succeeds, the tunnel module 114 establishes a tunnel with the tunnel module 172 of the access control system of the layer, and returns a result of tunnel establishment success.

[0142] Step 5, formation of a routing table entry.

[0143] From this, the tunnel establishment succeeds, and a routing table entry to the resource APP1 of the other layer is formed in the traffic forwarding module 172, and has the following form.

[0144]

[0145]

[0146] Further, referring to Figure 1 The terminal 1 of the layer accesses the resource APP2 of the other layer, queries the authorization resource module (175), and obtains the gateway 1 of the access control system of the other layer which needs to be accessed across layers. The gateway 1 of the access control system of the other layer already has the corresponding GRE tunnel 1, and does not need to re-establish the tunnel, but directly uses the existing tunnel, and forms a new record in the routing table entry.

[0147] Further, the terminal 1 of the layer accesses the resource APP3 of the other layer, queries the authorization resource module (175), and obtains the gateway 2 of the access control system of the other layer which needs to be accessed across layers. The GRE tunnel corresponding to the gateway 2 of the access control system of the other layer does not exist in the routing table entry, and needs to establish the tunnel according to steps 1-5, and form the routing table entry.

[0148] Further, the terminal 2 of the layer accesses the resource APP2 of the other layer, queries the authorization resource module (175), and obtains the gateway 1 of the access control system of the other layer which needs to be accessed across layers. The gateway 1 of the access control system of the other layer already has the corresponding GRE tunnel 1, and does not need to re-establish the tunnel, but directly uses the existing tunnel, and encapsulates the packet for resource access.

[0149] Further, the terminal 3 of the layer accesses the resource APP3 of the other layer, queries the authorization resource module (175), and obtains the gateway 2 of the access control system of the other layer which needs to be accessed across layers. The gateway 2 of the access control system of the other layer already has the corresponding GRE tunnel 2, and does not need to re-establish the tunnel, but directly uses the existing GRE tunnel, and encapsulates the packet for resource access.

[0150] As can be seen from the above, in the access control system, the access subject completes identity authentication through the terminal in the layer authentication system, so as to ensure that the identity of the access subject is reliable. On this premise, when cross-layer resource access is performed, the tunnel establishment request is sent between the access control system in the layer and the access control system in the other layer through signature verification, and the identity information of the access control system in the layer is transmitted; the tunnel module of the access control system in the other layer performs preliminary tunnel establishment pre-determination through the GRE Key, and determines the necessity of tunnel establishment. The identity of the access control system in the layer is further verified by the authentication module of the access control system in the other layer and the authentication system, so as to determine the legality of the identity. After the tunnel is successfully established, the routing table item corresponding to the relationship between the target resource, the tunnel interface and the access control system in the other layer is formed, and the cross-layer resource access is uniformly encapsulated by the tunnel.

[0151] Further, the scheme provided by the present application realizes identity authentication of the access control system on the premise of identity authentication of the access subject, ensures the reliability of the access control system and the security of resource access. The tunnel established between the access control system in the layer and the access control system in the other layer uniformly encapsulates the cross-layer access traffic, and does not need to repeatedly establish a tunnel, thereby improving the efficiency of traffic transmission.

[0152] The method, or the specific system unit, or the partial unit thereof, of the present application is a pure software architecture, and can be arranged in an entity medium such as a hard disk, an optical disc, or any electronic device (such as a smart phone, a computer readable storage medium) through program code. When the program code is loaded and executed by a machine (such as a smart phone), the machine becomes a device for implementing the present application. The method and device of the present application can also be transmitted in the form of program code through some transmission media such as a cable, an optical fiber, or any transmission type. When the program code is received, loaded and executed by a machine (such as a smart phone), the machine becomes a device for implementing the present application.

[0153] The basic principles, main features and advantages of the present application are shown and described above. It should be understood by those skilled in the art that the present application is not limited to the above embodiments, and the above embodiments and descriptions in the specification are only illustrative of the principles of the present application. Without departing from the spirit and scope of the present application, various changes and improvements can be made to the present application, and these changes and improvements all fall within the scope of the present application. The scope of protection of the present application is defined by the appended claims and their equivalents.

Claims

1. An access control system based on authentication and resource access governance, characterized in that, The access control system is distributed in different levels; The access control system authenticates the access subject, establishes a data connection between the access subject and the access resource in the same level, and authenticates the access control system in another level for cross-level access; The access control system includes an authentication system and an access control system, which interact with each other, manage identity, authentication, and permissions, and can register the access control system information in the access control system in another level, establish a connection with the access control system in another level after registration, and issue relevant identity information; The access control system controls the data connection between the access subject and the access resource in the same level according to the authentication result of the authentication system; The access control system establishes a data tunnel between the access control system in another level and the access control system in another level according to the authentication result of the authentication system; The access control system includes a first authentication module, a tunnel module, a second authentication module, a traffic forwarding module, and an authorized resource module; The first authentication module and the tunnel module interact with each other, obtain the tunnel establishment request authentication information extracted by the tunnel module, and send it to the access control system in the same level for identity authentication; The tunnel module is triggered by the traffic forwarding module, establishes a tunnel between the access control system in another level according to the address information of the access control system in another level provided by the traffic forwarding module, and initiates a tunnel establishment request to the access control system in another level; the tunnel module receives and judges the tunnel establishment request sent by the access control system in another level, extracts the authentication information of the confirmed tunnel establishment request, and sends it to the first authentication module; The second authentication module is used to authenticate the access subject in the same level, and after authentication, a data channel is established between the access subject and the access control system, and then the traffic forwarding module is used to access the resource system in the same level; The traffic forwarding module interacts with the authorized resource module and the tunnel module, can query the gateway information of the access control system in another level from the authorized resource module, query the routing table, encapsulate the cross-level resource access message or trigger the establishment of the tunnel, and update the routing table; The authorized resource module stores the resource information that the access subject can access after authentication in the same level, and is connected with the traffic forwarding module for query.

2. The authentication and resource access governance based access control system of claim 1, wherein, The authentication system comprises attribute information of an access control system in a higher-level access control system, the access control system in the higher-level access control system is registered in the authentication system in the current-level access control system in the form of access identity, and the attribute information at least comprises the following information: address or domain name, identity, Key, verification algorithm and GRE Key of the higher-level access control system.

3. The authentication and resource access governance-based access control system of claim 2, wherein, After the registration of the access control system information in the higher-level access control system is completed, the authentication system interacts with the registered access control system to complete the distribution of the identity, Key, verification algorithm and GRE Key.

4. The authentication and resource access governance-based access control system of claim 1, wherein, The traffic forwarding module obtains gateway information of the access control system in the higher-level access control system, queries a tunnel interface in a routing table item using the gateway information as a keyword, directly performs tunnel encapsulation and packet forwarding if a corresponding table item exists, and needs to establish a data tunnel between the current-level access control system and the higher-level access control system if the corresponding table item does not exist.

5. The authentication and resource access governance-based access control system of claim 4, wherein, Only one data tunnel is established between any two control systems in different levels, the data tunnel serves all related access subjects, and all access traffics of the current-level related access subjects to the resource system in the higher-level are encapsulated by the same data tunnel.

6. The authentication and resource access governance-based access control system of claim 1, wherein, The tunnel module generates digest information based on the identity of the current-level access control system, a random number generated by itself and a pre-set Key, and generates a tunnel establishment request based on the digest information.

7. The authentication and resource access governance-based access control system of claim 1, wherein, The tunnel module verifies whether the tunnel needs to be established by using the GRE Key for the tunnel establishment request sent by the access control system in the higher-level access control system.

8. The authentication and resource access governance-based access control system of claim 6, wherein, After the authentication system receives the tunnel establishment request authentication information forwarded by the first authentication module, the identity of the access control system in the higher-level access control system is queried from the registered identity information based on the received identity, the corresponding Key and verification algorithm are queried based on the queried verification algorithm, new digest information is generated based on the identity, random number and Key, and the new digest information is compared with the digest in the tunnel establishment request authentication information, if the two are the same, the identity authentication is passed, and if the two are different, the identity authentication fails.

9. An access control method based on authentication and resource access management, characterized in that, The access control system in any one of claims 1-8 is deployed in different levels, first, the current-level access is authenticated by the access control system deployed in the current level, the data connection is established between the identity-trusted current-level access subject and the access resource in the current level; Then, for cross-level access, the access control system deployed in the current level authenticates the access control system in the higher-level which initiates the cross-level access, and establishes a data tunnel between the identity-trusted access control system in the higher-level.

10. The authentication and resource access governance-based access control method of claim 9, wherein, The access control method transmits all data traffics of cross-level access by establishing a single data tunnel between different levels.

Images