Single package authentication method, device and computer readable storage medium

Abstract

The application provides a single package authentication method, device and computer readable storage medium, belonging to the network security technical field, the client encrypts the authentication information, obtains the authentication ciphertext information; the identity mark is added in the head of the authentication ciphertext information; the authentication ciphertext information with the added identity mark is encrypted, the single package authentication encryption message is obtained, the single package authentication encryption message is sent to the computing device, the computing device decrypts the single package authentication encryption message, obtains the authentication ciphertext information and the identity mark in the single package authentication message; it is judged whether the identity corresponding to the identity mark is legal, if legal, the authentication ciphertext information is decrypted, the authentication information in the authentication ciphertext information is obtained, it is judged whether the single package authentication is a legal request, if legal, it is judged whether the terminal environment information matches the preset environment authentication strategy, if matching, the computing device opens the service port and the protocol of the client according to the request resource information, improves the security of the single package authentication.

Description

TECHNICAL FIELD

[0001] The present application relates to the network security technical field, in particular, relates to a single package authentication method, device and computer readable storage medium. BACKGROUND

[0002] The single package authentication technology refers to that the client only needs to send a data packet to the server, and the server can identify the legitimacy of the terminal identity, for the legitimate terminal, the server will open the real service port to respond to the terminal service request, and the illegal terminal will ignore the data packet, and there is no any reply message to make the terminal unable to perceive the existence of the server.

[0003] And the current single package authentication technology is based on the public IP of the client to verify the legitimacy of the client, and there are often multiple clients in a public IP, the public IP of these clients is the same, so when verifying the legitimacy of the terminal, there may be uncertainty, and other terminals in the intranet can use the uncertainty to attack, thereby there is a problem of low security. SUMMARY

[0004] The purpose of the embodiment of the present application is to provide a single package authentication method, device and computer readable storage medium, to solve the problem of low security in the current single package authentication technology based on the public IP of the client to verify the legitimacy.

[0005] In a first aspect, the present application provides a single package authentication method, which is applied to a computing device, comprising: obtaining a single package authentication encrypted message sent by a client; decrypting the single package authentication encrypted message to obtain authentication ciphertext information and an identity identifier in the single package authentication message; judging whether the identity corresponding to the identity identifier is legal according to the identity identifier; if it is judged that the identity corresponding to the identity identifier is legal, decrypting the authentication ciphertext information to obtain terminal information, terminal environment information, user information and request resource information in the authentication ciphertext information; judging whether the single package authentication is a legal request according to the terminal information, the user information and the identity identifier; if it is judged that the single package authentication is a legal request, judging whether the terminal environment information matches a preset environment authentication strategy; if it is judged that the terminal environment information matches the preset environment authentication strategy, opening a service port and a protocol corresponding to the request resource information according to the request resource information for the client.

[0006] The single packet authentication method has the advantages that the computing device decrypts the single packet authentication encrypted message to obtain the authentication ciphertext information and the identity identifier, and then determines whether the corresponding identity is legal based on the identity identifier. If the identity is legal, the authentication ciphertext information is decrypted, and then the terminal information, the user information and the identity identifier in the authentication ciphertext information are used to determine whether the single packet authentication is a legal request. If the single packet authentication is a legal request, it is determined whether the terminal environment information matches the preset environment authentication strategy. If the terminal environment information matches the preset environment authentication strategy, the computing device opens the service port and the protocol corresponding to the requested resource information for the client based on the requested resource information. Therefore, the single packet authentication process of the single packet authentication method needs to verify the legality of the terminal itself, the user identity and the terminal use environment of the client, and the single packet authentication message is encrypted by double encryption, so that the security of the single packet authentication and the access device is improved.

[0007] In an optional implementation of the first aspect, the single packet authentication encrypted message is decrypted to obtain the authentication ciphertext information and the identity identifier in the single packet authentication message, including: the single packet authentication encrypted message is decrypted by using the first shared secret key to obtain the authentication ciphertext information and the identity identifier in the single packet authentication message; wherein the computing device shares the first shared secret key with the client; and the authentication ciphertext information and the identity identifier in the single packet authentication message are encrypted by the client based on the first shared secret key.

[0008] In an optional implementation of the first aspect, whether the identity corresponding to the identity identifier is legal is determined according to the identity identifier, including: whether the identity identifier in the single packet authentication encrypted message exists in the registered identity identifier library is determined; and if the identity identifier in the single packet authentication encrypted message exists in the registered identity identifier library, it is determined that the identity corresponding to the identity identifier is legal.

[0009] In an optional implementation of the first aspect, the authentication ciphertext information is decrypted, including: a target legality credential corresponding to the identity identifier is obtained according to the identity identifier; wherein a plurality of legality credentials are pre-stored, each legality credential corresponds to an identity identifier, and different legality credentials correspond to different identity identifiers; a first dynamic secret key is generated by using the target legality credential through a TOTP algorithm; and the authentication ciphertext information is decrypted by using the first dynamic secret key; wherein the authentication ciphertext information is obtained by encrypting the terminal information, the terminal environment information, the user information and the requested resource information by using a second dynamic secret key generated by the client through the corresponding legality credential and the TOTP algorithm.

[0010] In the embodiment of the above design, the first dynamic key is generated by the TOTP algorithm and the target legitimacy credential, so that the authentication ciphertext information encrypted by the second dynamic key generated by the TOTP algorithm and the legitimacy credential is decrypted by the first dynamic key, so that the time factor is added to the key, the single packet authentication encrypted message is prevented from being used for a replay attack after being illegally captured, and the security of the single packet authentication is improved.

[0011] In an optional implementation of the first aspect, the first dynamic key is the same as the second dynamic key.

[0012] In an optional implementation of the first aspect, the identity identifier includes a client identifier and a user identifier; and the judging whether the single packet authentication is a legitimate request according to the terminal information, the user information and the identity identifier includes: judging whether the client identifier is consistent with a terminal identifier in the terminal information, and judging whether the user identifier is consistent with a user identifier in the user information; and if the client identifier is consistent with the terminal identifier in the terminal information, and the user identifier is consistent with the user identifier in the user information, the single packet authentication is determined to be a legitimate request.

[0013] In a second aspect, the application provides a single packet authentication device, which is arranged in a computing device and includes an acquisition module, a first decryption module, a judging module and an opening module; the acquisition module is used to acquire a single packet authentication encrypted message sent by a client; the first decryption module is used to decrypt the single packet authentication encrypted message to obtain authentication ciphertext information and an identity identifier in the single packet authentication message; the judging module is used to judge whether an identity corresponding to the identity identifier is legitimate according to the identity identifier; the first decryption module is further used to decrypt the authentication ciphertext information to obtain terminal information, terminal environment information, user information and request resource information in the authentication ciphertext information after the judging module judges that the identity corresponding to the identity identifier is legitimate; the judging module is further used to judge whether the single packet authentication is a legitimate request according to the terminal information, the user information and the identity identifier, and judge whether the terminal environment information matches a preset environment authentication strategy after the single packet authentication is determined to be a legitimate request; and the opening module is used to open a service port and a protocol corresponding to the request resource information to the client according to the request resource information after the judging module judges that the terminal environment information matches the preset environment authentication strategy.

[0014] The single packet authentication device has the advantages that the computing device decrypts the single packet authentication encrypted message to obtain authentication ciphertext information and an identity, judges whether the corresponding identity is legal based on the identity, decrypts the authentication ciphertext information on the basis that the identity is legal, judges whether the single packet authentication is a legal request through terminal information, user information and the identity in the authentication ciphertext information, judges whether the terminal environment information matches the preset environment authentication strategy on the basis that the single packet authentication is the legal request, and the computing device opens the service port and the protocol corresponding to the requested resource information to the client based on the requested resource information on the basis that the terminal environment information matches the preset environment authentication strategy. Therefore, the single packet authentication process of the single packet authentication device needs to verify the legality of the terminal itself, the user identity and the terminal use environment of the client, and the single packet authentication message is encrypted through double encryption, so that the security of the single packet authentication and the access device is improved.

[0015] In an optional implementation of the second aspect, the first decryption module is specifically configured to decrypt the single packet authentication encrypted message by using the first shared secret key to obtain authentication ciphertext information and an identity in the single packet authentication encrypted message; the computing device shares the first shared secret key with the client; and the single packet authentication encrypted message is generated by the client by encrypting the authentication ciphertext information and the identity based on the first shared secret key.

[0016] In an optional implementation of the second aspect, the judgment module is specifically configured to judge whether the identity in the single packet authentication encrypted message exists in the registered identity library; and if the identity in the single packet authentication encrypted message exists in the registered identity library, it is determined that the identity corresponding to the identity is legal.

[0017] In an optional implementation of the second aspect, the first decryption module is further specifically configured to obtain a target legality credential corresponding to the identity according to the identity; a plurality of legality credentials are pre-stored, each legality credential corresponds to an identity, and different legality credentials correspond to different identities; a first dynamic secret key is generated by using the target legality credential through a TOTP algorithm; and the authentication ciphertext information is decrypted by using the first dynamic secret key; the authentication ciphertext information is obtained by encrypting terminal information, terminal environment information, user information and requested resource information by using a second dynamic secret key corresponding to the legality credential of the client and the TOTP algorithm.

[0018] In an optional implementation of the second aspect, the identity includes a client identity and a user identity; the judgment module is further specifically configured to judge whether the client identity is consistent with a terminal identity in the terminal information, and whether the user identity is consistent with a user identity in the user information; if the client identity is consistent with the terminal identity in the terminal information, and the user identity is consistent with the user identity in the user information, it is determined that the single packet authentication is a legal request.

[0019] In a third aspect, the present application provides a single package authentication method, which is applied to a client and includes: generating a second dynamic secret key by a TOTP algorithm and a legality credential corresponding to the client; encrypting authentication information by using the second dynamic secret key to obtain authentication ciphertext information; wherein the authentication information includes terminal information, terminal environment information, user information and requested resource information; adding an identity identifier to a header of the authentication ciphertext information; encrypting the authentication ciphertext information with the added identity identifier by using a first shared secret key to obtain a single package authentication encrypted message; and sending the single package authentication encrypted message to a computing device to enable the computing device to analyze and verify based on the single package authentication encrypted message to determine whether to open a corresponding service port and protocol to the client.

[0020] The single package authentication method designed above, the present application first generates a second dynamic secret key by a TOTP algorithm and a legality credential corresponding to the client based on the client, encrypts authentication information by using the second dynamic secret key to obtain authentication ciphertext information, then adds an identity identifier to a header of the authentication ciphertext information; encrypts the authentication ciphertext information with the added identity identifier by using a first shared secret key to obtain a single package authentication encrypted message; and sends the single package authentication encrypted message to a computing device to enable the computing device to analyze and verify based on the single package authentication encrypted message to determine whether to open a corresponding service port and protocol to the client. Based on this, the single package authentication process of the present application needs to perform legality verification on the terminal itself of the client, user identity and terminal use environment, and encrypts the single package authentication message by double encryption, thereby improving the security of the single package authentication and access device.

[0021] In a fourth aspect, the present application provides a single package authentication device, which is arranged in a client and includes: a generation module, a second encryption module, an addition module and a sending module; the generation module is used to generate a second dynamic secret key by a TOTP algorithm and a legality credential corresponding to the client; the second encryption module is used to encrypt authentication information by using the second dynamic secret key to obtain authentication ciphertext information, wherein the authentication information includes terminal information, terminal environment information, user information and requested resource information; the addition module is used to add an identity identifier to a header of the authentication ciphertext information; the second encryption module is also used to encrypt the authentication ciphertext information with the added identity identifier by using a first shared secret key to obtain a single package authentication encrypted message; and the sending module is used to send the single package authentication encrypted message to a computing device to enable the computing device to analyze and verify based on the single package authentication encrypted message to determine whether to open a corresponding service port and protocol to the client.

[0022] The single package authentication device has the advantages that the single package authentication process needs to perform legality verification on the terminal itself of the client, the user identity and the terminal use environment, and the single package authentication message is encrypted through double encryption, thereby improving the security of the single package authentication and the access device.

[0023] In a fifth aspect, the present application provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to execute the method in the first aspect, any possible implementation of the first aspect, or the third aspect, any possible implementation of the third aspect.

[0024] In a sixth aspect, the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to execute the method in the first aspect, any possible implementation of the first aspect, or the third aspect, any possible implementation of the third aspect.

[0025] In a seventh aspect, the present application provides a computer program product, which, when running on a computer, causes the computer to execute the method in the first aspect, any possible implementation of the first aspect, or the third aspect, any possible implementation of the third aspect.

[0026] The above description is only a summary of the technical solutions of the present application, in order to more clearly understand the technical means of the present application, the content of the specification can be implemented, and in order to make the above and other purposes, characteristics and advantages of the present application more obvious and easy to understand, the following will specifically describe the technical solutions of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0028] Figure 1A flow interaction schematic diagram of a single package authentication method provided by an embodiment of the present application is shown in FIG. 1.

[0029] Figure 2 A structure schematic diagram of a single package authentication device provided by an embodiment of the present application is shown in FIG. 2.

[0030] Figure 3 A structure schematic diagram of another single package authentication device provided by an embodiment of the present application is shown in FIG. 3.

[0031] Figure 4 A structure schematic diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 4.

[0032] Icon: 200 - acquisition module; 210 - first decryption module; 220 - judgment module; 230 - opening module; 300 - generation module; 310 - second encryption module; 320 - appending module; 330 - sending module; 4 - electronic device; 401 - processor; 402 - memory; 403 - communication bus. DETAILED DESCRIPTION

[0033] The embodiments of the technical solutions of the present application will be described in detail below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present application, and therefore only serve as examples, and cannot limit the protection scope of the present application.

[0034] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "include" and "have" and any variations thereof in the specification and claims of the present application and the above description of drawings are intended to cover non-exclusive inclusion.

[0035] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "a plurality of" is two or more, unless otherwise explicitly and specifically limited.

[0036] Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the present application. The appearance of the phrase in various places in the specification does not necessarily all refer to the same embodiment, nor is it necessarily independent or alternative embodiments to other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0037] In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the three cases of A existing alone, A and B existing together, and B existing alone. In addition, the character " / " in this paper generally represents that the front and rear associated objects are in an "or" relationship.

[0038] In the description of the embodiments of the present application, the term "a plurality of" refers to two or more (including two), and similarly, "a plurality of groups" refers to two or more groups (including two groups), and "a plurality of pieces" refers to two or more pieces (including two pieces).

[0039] In the description of the embodiments of the present application, the technical terms "center", "longitudinal", "transverse", "length", "width", "thickness", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", "clockwise", "counterclockwise", "axial", "radial", "circumferential" and the like indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the embodiments of the present application and simplifying the description, and do not indicate or imply that the devices or elements referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation on the embodiments of the present application.

[0040] In the description of the embodiments of the present application, unless otherwise explicitly specified and limited, the technical terms "mounting", "connection", "connection", "fixing" and the like should be understood in a broad sense, for example, it can be fixedly connected, or it can be detachably connected, or it can be integrated; it can be mechanically connected, or it can be electrically connected; it can be directly connected, or it can be indirectly connected through an intermediate medium; it can be the communication or interaction relationship between two elements. For those skilled in the art, the specific meaning of the above terms in the embodiments of the present application can be understood according to the specific circumstances.

[0041] In the current network environment, there are more and more application scenarios of remote access and remote access. Any terminal can access remote services, and while enjoying the convenience provided by the network, remote servers also bear the risk of being illegally accessed and attacked. Since the remote server is exposed on the network, how to allow legitimate users and terminals to normally access service resources, and to exclude unauthorized users and terminals, is a problem that needs to be solved at present.

[0042] Single packet authentication technology is a means to solve the above problems. Single packet authentication technology means that the client only needs to send one data packet to the server, and the server can identify the legitimacy of the terminal identity. For a legitimate terminal, the server will open the real business service port to respond to the terminal's business request, and the illegal terminal will ignore the data packet and there will be no reply message to make the terminal unable to perceive the existence of the server.

[0043] The present application inventors find that current single package authentication technologies are all based on the public network IP of the client to verify the legitimacy of the client, and there are often multiple clients in a public network IP, and the public network IPs of these clients are the same, so there may be uncertainty when verifying the legitimacy of the terminal, and then other terminals in the internal network can use this uncertainty to attack the server, thereby causing the problem of low network security.

[0044] Based on the above problems, the present application inventors propose a single package authentication method, device, method, device and computer readable storage medium, which can verify the legitimacy of the terminal itself, user identity and terminal use environment of the network access terminal (client), so that the server only opens the corresponding port and protocol to the client on the basis of successful verification, and waits for the business access of the client, thereby improving the security of single package authentication and access equipment.

[0045] Based on the above idea, the present application provides a single package authentication method, which can be applied to the interaction of a client and a computing device, the client including but not limited to a computer, a mobile phone, an iPad or other terminal equipment, and the computing device including but not limited to a server, a security gateway, a controller and other computing devices, such as Figure 1 As shown, the single package authentication method can be implemented in the following way:

[0046] Step S100: The client generates a second dynamic secret key through a TOTP algorithm and a legitimacy credential corresponding to the client.

[0047] Step S110: The client encrypts the authentication information using the second dynamic secret key to obtain authentication ciphertext information.

[0048] Step S120: The client appends an identity identifier to the head of the authentication ciphertext information.

[0049] Step S130: The client encrypts the authentication ciphertext information with the added identity identifier using the first shared secret key to obtain a single package authentication encrypted message.

[0050] Step S140: The client sends the single package authentication encrypted message to the computing device.

[0051] Step S150: The computing device decrypts the single package authentication encrypted message to obtain the authentication ciphertext information and the identity identifier in the single package authentication message.

[0052] Step S160: The computing device determines whether the identity corresponding to the identity identifier is legitimate according to the identity identifier, and if so, goes to step S170.

[0053] Step S170: The computing device decrypts the authentication ciphertext information to obtain terminal information, terminal environment information, user information, and request resource information in the authentication ciphertext information.

[0054] Step S180: The computing device determines whether the single-package authentication is a legal request according to the terminal information, the user information, and the identity, and if so, proceeds to step S190.

[0055] Step S190: The computing device determines whether the terminal environment information matches a preset environment authentication strategy, and if so, proceeds to step S191.

[0056] Step S191: The computing device opens a service port and a protocol corresponding to the request resource information according to the request resource information.

[0057] In the above embodiment, the client first generates a second dynamic secret key according to a TOTP algorithm and a legality credential corresponding to the client, where the legality credential corresponding to the client can be a user-prestored shared secret key, a digital signature certificate, etc., which can be pre-burned or stored in the client.

[0058] Specifically, the client can generate the second dynamic secret key according to the TOTP algorithm, the legality credential corresponding to the client, and the current time, which aims to add a time factor to the second dynamic secret key, so as to prevent the encrypted information from being used for a replay attack after being illegally captured, thereby improving the security.

[0059] The client can obtain authentication information, which can include terminal information, terminal environment information, user information, and request resource information, where the terminal information can specifically be information of the client itself, such as an IP address of the client itself, a client identifier, etc.; the terminal environment information can specifically be information of an environment in which the client is located, such as a geographic location, a public network IP in which the client is located, whether the client has been scanned for viruses, etc.; the user information can specifically be information of a user using the client, such as a user identifier, a user name, etc.; and the request resource information can specifically be information of a protocol and a service port required for accessing the computing device.

[0060] The client can obtain the authentication information before generating the second dynamic secret key, at the same time period of generating the second dynamic secret key, or after generating the second dynamic secret key, and the time period for obtaining the authentication information can be adaptively adjusted according to specific scenarios, which is not limited in the present application.

[0061] After generating the second dynamic key and obtaining the authentication information, the client can encrypt the authentication information by the second dynamic key to generate authentication ciphertext information, and then append an identity to the head of the authentication ciphertext information. The identity can represent the identity of the client and the user using the client, for example, the identity can include a client identifier and a user identifier.

[0062] After appending the identity to the head of the authentication ciphertext information, the client encrypts the entire data block by the first shared key to obtain a single packet authentication encryption message, and then sends the single packet authentication encryption message to the computing device.

[0063] The computing device defaults to rejecting any external access, and only filters the message conforming to the single packet authentication format in the traffic mirrored by the network card to parse and verify it. Specifically, the computing device can receive the single packet authentication encryption message sent by the client, and then decrypt the single packet authentication encryption message to obtain the authentication ciphertext information and the identity in the single packet authentication encryption message.

[0064] As a possible implementation, the client described in the foregoing encrypts the authentication ciphertext information and the identity by the first shared key, and therefore, the computing device can also decrypt the single packet authentication encryption message by the first shared key. The computing device and the client share the first shared key in advance, and the first shared key can be burned into the computing device and the client in advance.

[0065] In addition, it should be noted that since the computing device can perform single packet authentication with multiple clients, multiple shared keys can be burned into the computing device. On this basis, the computing device can establish a mapping relationship between each shared key and the IP address of the corresponding client, and when receiving the single packet authentication encryption message, the computing device can find the mapped first shared key through the IP address of the client sending the single packet authentication encryption message.

[0066] After the computing device decrypts the single packet authentication encryption message by the above method to obtain the authentication ciphertext information and the identity, the computing device can first determine whether the identity corresponding to the identity is legal according to the identity.

[0067] As a possible implementation, the computing device can determine whether the identity in the single packet authentication encryption message exists in the registered identity library. If the identity in the single packet authentication encryption message exists in the registered identity library, it is determined that the identity corresponding to the identity in the single packet authentication encryption message is legal. If the identity in the single packet authentication encryption message does not exist in the registered identity library, it is determined that the identity is illegal, and the single packet authentication encryption message is ignored.

[0068] After the computing device determines that the identity corresponding to the identity identifier is legal in the above manner, the computing device can decrypt the authentication ciphertext information to obtain the terminal information, the terminal environment information, the user information, and the requested resource information in the authentication ciphertext information.

[0069] As a possible implementation, the foregoing describes that the client encrypts the authentication information by using the TOTP algorithm and the legality credential corresponding to the client to obtain the authentication ciphertext information. Therefore, the computing device can also generate the first dynamic secret key by using the same TOTP algorithm and the legality credential corresponding to the client, and decrypt the authentication ciphertext information by using the first dynamic secret key.

[0070] It should be noted that, since the granularity of the time factor of the TOTP algorithm can be flexibly set, and the dynamic secret keys calculated based on the same TOTP algorithm and the legality credential are the same within the time difference corresponding to the flexibly set time factor, for example, if the set time difference is 5 s, then the dynamic secret keys generated by using the same TOTP algorithm and the legality credential of the box are the same within 5 s. Therefore, the present scheme can adaptively adjust the time difference of the TOTP algorithm according to the time at which the client generates the second dynamic secret key and the time at which the computing device receives the single-packet authentication encryption message, so that the computing device generates the first dynamic secret key by using the same TOTP algorithm and the legality credential corresponding to the client within the time difference, so that the first dynamic secret key is the same as the second dynamic secret key generated by the client, and then the authentication ciphertext information encrypted by using the second dynamic secret key can be decrypted based on the first dynamic secret key.

[0071] In addition, the legality credential corresponding to each client can be stored in the computing device, and on this basis, the legality credential corresponding to each client can be mapped to the corresponding client identifier in advance. The computing device can find the target legality credential based on the client identifier based on the obtained client identifier, and then generate the first dynamic secret key based on the target legality credential and the TOTP algorithm.

[0072] After the computing device decrypts the authentication ciphertext information through the first dynamic key, the authentication information is obtained, and on this basis, the computing device can determine whether the single packet authentication is a legal request according to the terminal information and the user information in the authentication information and the identity in the decrypted single packet authentication encrypted message. Specifically, the identity described in the foregoing can include a client identifier and a user identifier, and on this basis, the computing device can specifically determine whether the client identifier is consistent with the terminal identifier in the terminal information, and whether the user identifier is consistent with the user identifier in the user information. If the client identifier is consistent with the terminal identifier in the terminal information, and the user identifier is consistent with the user identifier in the user information, it is determined that the single packet authentication is a legal request. If the client identifier is inconsistent with the terminal identifier in the terminal information, or the user identifier is inconsistent with the user identifier in the user information, it is determined that the single packet authentication is an illegal request, and then the single packet authentication encrypted message is ignored.

[0073] On the basis of determining that the single packet authentication is a legal request, the computing device further determines whether the terminal environment information matches the preset environment authentication policy. If it is determined that the terminal environment information matches the preset environment authentication policy, the client is allowed to access the service port and the protocol corresponding to the requested resource information according to the requested resource information.

[0074] Specifically, the terminal environment information described in the foregoing can include the geographic location information of the client, the public IP address of the client, the virus scanning result, and the like. On this basis, the computing device determines whether the terminal environment information matches the preset environment authentication policy, which can specifically determine whether the geographic location information of the client in the terminal environment information is in the preset geographic area range. If the geographic location information of the client is in the preset geographic area range, it is determined that the terminal environment information matches the preset environment authentication policy.

[0075] Or it is determined whether the public IP address of the client in the terminal environment information is the same as the preset IP address. If the public IP address of the client is the same as the preset IP address, it is determined that the terminal environment information matches the preset environment authentication policy.

[0076] Or it is determined whether the virus scanning result in the terminal environment information has completed the preset virus scanning. If the virus scanning result has completed the preset virus scanning, it is determined that the terminal environment information matches the preset environment authentication policy, and the like.

[0077] The single package authentication method has the advantages that the single package authentication process needs to verify the legality of the terminal itself, the user identity and the terminal use environment of the client, and the single package authentication message is encrypted through double encryption, so that the security of the single package authentication and the access device is improved.

[0078] Figure 2 The single package authentication method has the advantages that the single package authentication process needs to verify the legality of the terminal itself, the user identity and the terminal use environment of the client, and the single package authentication message is encrypted through double encryption, so that the security of the single package authentication and the access device is improved. Figure 1The method embodiment executed by the computing device corresponds to the steps involved in the aforementioned method, and the specific functions of the device can be referred to the description above. To avoid repetition, the detailed description is appropriately omitted here. The device includes at least one software function module stored in the memory in the form of software or firmware or solidified in the operating system (OS) of the device. Specifically, the device includes an acquisition module 200, a first decryption module 210, a judgment module 220, and an opening module 230; the acquisition module 200 is configured to acquire a single packet authentication encrypted message sent by a client; the first decryption module 210 is configured to decrypt the single packet authentication encrypted message to obtain authentication ciphertext information and an identity identifier in the single packet authentication message; the judgment module 220 is configured to determine whether the identity corresponding to the identity identifier is legal according to the identity identifier; the first decryption module 210 is further configured to decrypt the authentication ciphertext information to obtain terminal information, terminal environment information, user information, and request resource information in the authentication ciphertext information after the judgment module determines that the identity corresponding to the identity identifier is legal; the judgment module 220 is further configured to determine whether the single packet authentication is a legal request according to the terminal information, the user information, and the identity identifier, and determine whether the terminal environment information matches a preset environment authentication strategy after determining that it is a legal request; and the opening module 230 is configured to open a service port and a protocol corresponding to the request resource information to the client according to the request resource information after the judgment module 220 determines that the terminal environment information matches the preset environment authentication strategy.

[0079] The single packet authentication device designed above, the computing device decrypts the single packet authentication encrypted message to obtain authentication ciphertext information and an identity identifier, then determines whether the identity corresponding to the identity identifier is legal based on the identity identifier, decrypts the authentication ciphertext information based on the legal identity, then determines whether the single packet authentication is a legal request through the terminal information, the user information, and the identity identifier in the authentication ciphertext information, determines whether the terminal environment information matches a preset environment authentication strategy based on the legal request, and opens a service port and a protocol corresponding to the request resource information to the client according to the request resource information based on the determination that the terminal environment information matches the preset environment authentication strategy. Based on this, the single packet authentication process of the present scheme needs to verify the legality of the terminal itself, the user identity, and the terminal use environment of the client, and encrypts the single packet authentication message through double encryption, thereby improving the security of the single packet authentication and the access device.

[0080] In an optional embodiment of this example, the first decryption module 210 is specifically used to decrypt the single-packet authentication encrypted message using the first shared key to obtain the authentication ciphertext information and identity identifier in the single-packet authentication message; wherein, the computing device and the client share the first shared key; the single-packet authentication message is generated by the client encrypting the authentication ciphertext information and identity identifier based on the first shared key.

[0081] In an optional embodiment of this example, the judgment module 220 is specifically used to determine whether there is an identity identifier in a single-packet authentication encrypted message in the registered identity identifier database; if there is an identity identifier in a single-packet authentication encrypted message in the registered identity identifier database, then the identity corresponding to the identity identifier is determined to be legitimate.

[0082] In an optional embodiment of this example, the first decryption module 210 is further configured to obtain the target legitimacy credential corresponding to the identity identifier based on the identity identifier; wherein, multiple legitimacy credentials are pre-stored, each legitimacy credential corresponding to an identity identifier, and different legitimacy credentials correspond to different identity identifiers.

[0083] The difference lies in the following: A first dynamic key is generated using the target legitimacy credential via the TOTP algorithm; the first dynamic key is used to decrypt the authentication ciphertext; the authentication ciphertext is obtained by the client encrypting terminal information, terminal environment information, user information, and requested resource information using its corresponding legitimacy credential and a second dynamic key generated by the TOTP algorithm.

[0084] In an optional implementation of this embodiment, the identity identifier includes a client identifier and a user identifier;

[0085] The judgment module 220 is also specifically used to determine whether the client identifier is consistent with the terminal identifier in the terminal information, and to determine whether the user identifier is consistent with the user identifier in the user information; if the client identifier is consistent with the terminal identifier in the terminal information, and the user identifier is consistent with the user identifier in the user information, then the single packet authentication is determined to be a legitimate request.

[0086] Figure 3 A schematic structural block diagram of a single-package authentication device provided in this application is presented. It should be understood that...

[0087] The device and Figure 1The method embodiment executed by the client corresponds to the method described above, and can execute the steps related to the method described above. The specific functions of the device can be referred to the description above, and the detailed description is appropriately omitted here. The device includes at least one software function module stored in the memory in the form of software or firmware or solidified in the operating system (OS) of the device. Specifically, the device includes a generation module 300, a second encryption module 310, an additional module 320, and a sending module 330. The generation module 300 is configured to generate a second dynamic key by a TOTP algorithm and a legality credential corresponding to the client. The second encryption module 310 is configured to encrypt authentication information by using the second dynamic key to obtain authentication ciphertext information, wherein the authentication information includes terminal information, terminal environment information, user information, and request resource information. The additional module 320 is configured to add an identity in the header of the authentication ciphertext information. The second encryption module 310 is further configured to encrypt the authentication ciphertext information with the added identity by using a first shared key to obtain a single package authentication encryption message. The sending module 330 is configured to send the single package authentication encryption message to a computing device, so that the computing device analyzes and verifies based on the single package authentication encryption message to determine whether to open a corresponding service port and protocol to the client.

[0088] The single package authentication device designed above, the present scheme first generates a second dynamic key by a TOTP algorithm and a legality credential corresponding to the client based on the client, encrypts authentication information by using the second dynamic key to obtain authentication ciphertext information, and then adds an identity in the header of the authentication ciphertext information. The authentication ciphertext information with the added identity is encrypted by using a first shared key to obtain a single package authentication encryption message. The single package authentication encryption message is sent to a computing device, so that the computing device analyzes and verifies based on the single package authentication encryption message to determine whether to open a corresponding service port and protocol to the client. Based on this, the single package authentication process of the present scheme needs to perform legality verification on the terminal itself of the client, user identity, and terminal use environment, and encrypts the single package authentication message by double encryption, thereby improving the security of the single package authentication and access device.

[0089] The single package authentication device designed above, the present scheme first generates a second dynamic key by a TOTP algorithm and a legality credential corresponding to the client based on the client, encrypts authentication information by using the second dynamic key to obtain authentication ciphertext information, and then adds an identity in the header of the authentication ciphertext information. The authentication ciphertext information with the added identity is encrypted by using a first shared key to obtain a single package authentication encryption message. The single package authentication encryption message is sent to a computing device, so that the computing device analyzes and verifies based on the single package authentication encryption message to determine whether to open a corresponding service port and protocol to the client. Based on this, the single package authentication process of the present scheme needs to perform legality verification on the terminal itself of the client, user identity, and terminal use environment, and encrypts the single package authentication message by double encryption, thereby improving the security of the single package authentication and access device.

[0090] According to some embodiments of the present application, as Figure 4As shown, the present application provides an electronic device 4, comprising: a processor 401 and a memory 402, the processor 401 and the memory 402 are interconnected and communicate with each other through a communication bus 403 and / or other forms of connection mechanism (not shown), the memory 402 stores a computer program executable by the processor 401, when the computing device is running, the processor 401 executes the computer program to execute the method executed in the foregoing implementation manner, for example, steps S100 to S140: the client generates a second dynamic secret key through the TOTP algorithm and the legitimacy credential corresponding to the client; the client encrypts the authentication information by using the second dynamic secret key to obtain authentication ciphertext information; the client appends an identity identifier to the head of the authentication ciphertext information; the client encrypts the authentication ciphertext information with the added identity identifier by using the first shared secret key to obtain a single packet authentication encryption message; and the client sends the single packet authentication encryption message to the computing device. Or steps S150 to S191: the computing device decrypts the single packet authentication encryption message to obtain the authentication ciphertext information and the identity identifier in the single packet authentication message; the computing device judges whether the identity corresponding to the identity identifier is legitimate according to the identity identifier, if so, the computing device decrypts the authentication ciphertext information to obtain the terminal information, the terminal environment information, the user information and the request resource information in the authentication ciphertext information, the computing device judges whether the single packet authentication is a legitimate request according to the terminal information, the user information and the identity identifier, if so, the computing device judges whether the terminal environment information matches the preset environment authentication strategy, if so, the computing device opens the service port and the protocol corresponding to the request resource information according to the request resource information.

[0091] The present application provides a computer readable storage medium, the computer readable storage medium stores a computer program, the computer program is executed by the processor to execute the foregoing method.

[0092] The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0093] The application provides a computer program product, which, when running on a computer, causes the computer to execute the aforementioned method.

[0094] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application, and they should be covered in the scope of the claims and the specification of the present application. Especially, as long as there is no structural conflict, the technical features mentioned in each embodiment can be combined in any way. The present application is not limited to the specific embodiments disclosed in the text, but includes all technical solutions falling within the scope of the claims.

Claims

1. A single-package authentication method, characterized in that, The method is applied to a computing device and includes: Obtain the single-packet authentication encrypted message sent by the client; The single-packet authentication encrypted message is decrypted to obtain the authentication ciphertext information and identity identifier in the single-packet authentication message; Based on the identity identifier, determine whether the identity corresponding to the identity identifier is legitimate; If the identity corresponding to the identity identifier is determined to be legitimate, the authentication ciphertext information is decrypted to obtain the terminal information, terminal environment information, user information, and requested resource information contained in the authentication ciphertext information. Based on the terminal information, user information, and identity identifier, determine whether the single-packet authentication is a legitimate request; If the single-packet authentication is determined to be a legitimate request, then it is determined whether the terminal environment information matches the preset environment authentication policy. If it is determined that the terminal environment information matches the preset environment authentication policy, then the service port and protocol corresponding to the requested resource information are opened to the client according to the requested resource information; The process of decrypting the authentication ciphertext includes: Obtain the target legitimacy credential corresponding to the identity identifier; wherein, multiple legitimacy credentials are pre-stored, each legitimacy credential corresponds to an identity identifier, and different legitimacy credentials correspond to different identity identifiers; The first dynamic key is generated using the target legitimacy credential through the TOTP algorithm; The authentication ciphertext information is decrypted using the first dynamic key; The authentication encrypted information is obtained by the client encrypting terminal information, terminal environment information, user information, and requested resource information using its corresponding legitimacy credential and a second dynamic key generated by the TOTP algorithm.

2. The method according to claim 1, characterized in that, The step of decrypting the single-packet authentication encrypted message to obtain the authentication ciphertext information and identity identifier in the single-packet authentication message includes: The single-packet authentication encrypted message is decrypted using the first shared key to obtain the authentication ciphertext information and identity identifier in the single-packet authentication message; The computing device and the client share the first shared key; the single-packet authentication message is generated by the client encrypting the authentication ciphertext information and identity identifier based on the first shared key.

3. The method according to claim 1, characterized in that, The step of determining whether the identity corresponding to the identity identifier is valid based on the identity identifier includes: Determine whether the identity identifier in the single-packet authentication encrypted message exists in the registered identity identifier database; If the identity identifier in the single-packet authentication encrypted message exists in the registered identity identifier database, then the identity corresponding to the identity identifier is deemed legitimate.

4. The method according to claim 1, characterized in that, in, The first dynamic key is the same as the second dynamic key.

5. The method according to claim 1, characterized in that, in, The identity identifier includes a client identifier and a user identifier; The step of determining whether the single-packet authentication is a legitimate request based on the terminal information, user information, and identity identifier includes: Determine whether the client identifier matches the terminal identifier in the terminal information, and determine whether the user identifier matches the user identifier in the user information; If the client identifier matches the terminal identifier in the terminal information, and the user identifier matches the user identifier in the user information, then the single packet authentication is determined to be a legitimate request.

6. A single-package authentication device, characterized in that, The single-packet authentication device is installed in a computing device and includes: an acquisition module, a first decryption module, a judgment module, and an opening module; The acquisition module is used to acquire single-packet authentication encrypted messages sent by the client; The first decryption module is used to decrypt the single-packet authentication encrypted message to obtain the authentication ciphertext information and identity identifier in the single-packet authentication message; The judgment module is used to determine whether the identity corresponding to the identity identifier is legitimate based on the identity identifier; The first decryption module is further configured to decrypt the authentication ciphertext information after the judgment module determines that the identity corresponding to the identity identifier is legitimate, so as to obtain the terminal information, terminal environment information, user information and requested resource information in the authentication ciphertext information; The judgment module is also used to determine whether the single packet authentication is a legitimate request based on the terminal information, user information, and identity identifier; and after determining that it is a legitimate request, to determine whether the terminal environment information matches the preset environment authentication policy. The opening module is used to open the service port and protocol corresponding to the requested resource information to the client according to the requested resource information after the judgment module determines that the terminal environment information matches the preset environment authentication policy; The first decryption module is specifically used to obtain the target legitimacy credential corresponding to the identity identifier based on the identity identifier; wherein, multiple legitimacy credentials are pre-stored, each legitimacy credential corresponds to an identity identifier, and different legitimacy credentials correspond to different identity identifiers; a first dynamic key is generated using the target legitimacy credential through the TOTP algorithm; the first dynamic key is used to decrypt the authentication ciphertext information; wherein, the authentication ciphertext information is obtained by the client encrypting terminal information, terminal environment information, user information, and requested resource information using its corresponding legitimacy credential and a second dynamic key generated by the TOTP algorithm.

7. A single-package authentication method, characterized in that, The method is applied to the client and includes: A second dynamic key is generated using the TOTP algorithm and the client's corresponding valid credentials; The authentication information is encrypted using the second dynamic key to obtain the authentication ciphertext information; wherein, the authentication information includes terminal information, terminal environment information, user information, and requested resource information; Add an identity identifier to the header of the encrypted authentication information; The authentication ciphertext information with added identity identifier is encrypted using the first shared key to obtain a single-packet authentication encrypted message; The single-packet authentication encrypted message is sent to the computing device so that the computing device can parse and verify it based on the single-packet authentication method of any one of claims 1-5 to determine whether to open the corresponding service port and protocol to the client.

8. A single-package authentication device, characterized in that, The device is installed in the client and includes: a generation module, a second encryption module, an append module, and a sending module; The generation module is used to generate a second dynamic key using the TOTP algorithm and the corresponding legal credentials of the client; The second encryption module is used to encrypt the authentication information using the second dynamic key to obtain the authentication ciphertext information, wherein the authentication information includes terminal information, terminal environment information, user information, and requested resource information; The appending module is used to append an identity identifier to the header of the authenticated encrypted information; The second encryption module is also used to encrypt the authentication ciphertext information with added identity identifier using the first shared key to obtain a single-packet authentication encrypted message; The sending module is used to send the single-packet authentication encrypted message to the computing device, so that the computing device can parse and verify it based on the single-packet authentication method of any one of claims 1-5, in order to determine whether to open the corresponding service port and protocol to the client.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 5 or claim 7.

Images