Vpn access method and device, electronic equipment and storage medium

Abstract

The application relates to the computer technical field and provides a VPN access method and device, electronic equipment and a storage medium, which are used for improving the security and flexibility of VPN access. In the method, a virtual private network server used when a client remotely accesses a private cloud is preconfigured with an application policy and an object policy in an MFA service provided by a public cloud server, and the password of a VPN account input by a target is verified through the configured application policy and object policy. Through the preconfigured application policy and object policy, the MFA service provided by the public cloud server is added on the basis of not changing a static password verification service provided by the private cloud server, the implementation mode is simple, the static password verification service provided by the private cloud server and the MFA service provided by the public cloud server can be combined in order, cross-cloud multi-factor combined verification is realized, and the security and flexibility of VPN access are improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to VPN access methods, devices, electronic devices and storage media. Background Technology

[0002] With the widespread application of Internet technology, the requirements for network security are getting higher and higher. External IP addresses generally cannot directly access the internal network and need to use a Virtual Private Network (VPN) for access.

[0003] Existing VPN access technologies typically use Auto-Discovery (AD) protocols / Lightweight Directory Access Protocol (OpenLDAP) provided by enterprise private clouds, or self-developed static password verification services, which have relatively low security.

[0004] To enhance VPN authentication security, some VPN access technologies deploy dynamic password authentication services in private clouds on top of static password authentication, providing both static and dynamic password authentication. However, deploying dynamic password authentication services in private clouds incurs high investment and maintenance costs. Furthermore, adding dynamic password authentication on top of static password authentication requires intrusive changes to the existing authentication service. Additionally, regardless of the method used, VPN access employs a "single-step authentication" approach, resulting in limited flexibility. Summary of the Invention

[0005] This application provides a VPN access method, device, electronic device, and storage medium to improve the security and flexibility of VPN internet access.

[0006] On one hand, embodiments of this application provide a virtual private network access method, including:

[0007] The system receives a verification request message sent by a virtual private network server. The verification request message is generated by the virtual private network server based on a remote access request sent by the client, and includes at least the verification information of the virtual private network account entered by the target object when the client accesses the private cloud server.

[0008] Based on the verification request message, obtain the pre-configured application strategy and object strategy required for multi-factor verification from the public cloud server;

[0009] Based on the target verification method indicated by the application policy and the object type indicated by the object policy, at least one of the verification passwords provided by the private cloud server and the verification passwords provided by the public cloud server is used to perform virtual private network access verification on the verification information.

[0010] Based on the verification results, the virtual private network server is controlled to manage the client's access permissions to the private cloud server.

[0011] On the other hand, embodiments of this application provide a virtual private network access device, including:

[0012] The receiving module is used to receive a verification request message sent by a virtual private network server. The verification request message is generated by the virtual private network server based on a remote access request sent by a client, and includes at least the verification information of the virtual private network account entered by the target object when the client accesses the private cloud server.

[0013] The acquisition module is used to obtain the pre-configured application strategy and object strategy required for multi-factor authentication from the public cloud server based on the verification request message.

[0014] The verification module is used to perform virtual private network access verification on the verification information based on the target verification method indicated by the application policy and the object type indicated by the object policy, using at least one of the verification passwords provided by the private cloud server and the verification passwords provided by the public cloud server.

[0015] The control module is used to control the virtual private network server to manage the client's access permissions to the private cloud server based on the verification results.

[0016] Optionally, the verification information includes at least the client's IP address and the identifier of the virtual private network server, and the acquisition module is specifically used for:

[0017] Based on the identifier of the virtual private network server, obtain the corresponding application strategy required for multi-factor authentication from the public cloud server;

[0018] Obtain the whitelist associated with the virtual private network server from the application policy;

[0019] If the whitelist is empty, or if the client's IP address belongs to the whitelist, then the object policy required for multi-factor authentication is obtained from the public cloud server.

[0020] Optionally, when the target verification method is single-step authentication, the verification module is specifically used for:

[0021] Determine whether the object type indicated by the object policy is an object corresponding to the private cloud server;

[0022] If the object is not the one corresponding to the private cloud server, then the static verification password provided by the public cloud server is used to verify the static login password in the verification information.

[0023] If the object corresponds to the private cloud server, then based on the password type contained in the verification information, at least one of the static verification password provided by the private cloud server and the dynamic verification password provided by the public cloud server is used to perform virtual private network access verification on the verification information.

[0024] Optionally, the verification module is specifically used for:

[0025] If the verification information includes a static login password and a dynamic login password, and the total password length is less than a preset threshold, then the static login password is verified using the static verification password provided by the private cloud server, and the dynamic login password is verified using the dynamic verification password provided by the public cloud server.

[0026] If the verification information only contains a static login password, then the static verification password provided by the private cloud server is used to verify the static login password.

[0027] Optionally, when the target verification method is multi-step authentication, the verification module is specifically used for:

[0028] Obtain the verification status attribute associated with the virtual private network account from the object policy;

[0029] If the verification status attribute is empty, then based on the object type indicated by the object policy, the static login password in the verification information is verified using the static verification password provided by the private cloud or the static verification password provided by the public cloud, and the verification status attribute is updated.

[0030] If the verification status attribute is not empty, the value of the verification status attribute is compared with the virtual private network account, and based on the comparison result, the dynamic login password in the verification information is verified using the dynamic verification password provided by the public cloud.

[0031] Optionally, the verification module is specifically used for:

[0032] Determine whether the object type indicated by the object policy is an object corresponding to the private cloud server;

[0033] If the object is not the one corresponding to the private cloud server, then the static verification password provided by the public cloud server is used to verify the static login password in the verification information.

[0034] If it is an object corresponding to the private cloud server, then the static verification password provided by the private cloud server is used to verify the static login password in the verification information;

[0035] After verification, a random string is generated as the key of the verification status attribute, the virtual private network account is used as the value of the verification status attribute, and the data is entered into the cache in key-value pair form.

[0036] Optionally, the verification module is specifically used for:

[0037] If the value of the verification status attribute matches the virtual private network account, then the dynamic verification password provided by the public cloud server is used to verify the dynamic login password in the verification information.

[0038] Retrieve the role attributes from the application strategy and write the target object into the role attributes.

[0039] Optionally, the verification module is specifically used for:

[0040] Based on the ID of the static password verification service provided by the private cloud server in the object policy, obtain the service address of the static password verification service.

[0041] The static login password corresponding to the virtual private network account is sent to the private cloud server corresponding to the service address, so that the private cloud server compares the static login password with the static verification password.

[0042] The system receives the comparison result sent by the private cloud server to complete the verification of the static login password.

[0043] Optionally, the dynamic verification password provided by the public cloud and the dynamic login password used by the client are updated synchronously according to a preset time period.

[0044] On the other hand, embodiments of this application provide an electronic device, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the steps of the above-described VPN access method.

[0045] On the other hand, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions thereon, which, when executed by an electronic device, implement the steps of the above-described virtual private network access method.

[0046] On the other hand, embodiments of this application provide a computer program product comprising a computer program that, when executed by an electronic device, implements the steps of the above-described virtual private network access method.

[0047] The beneficial effects of the embodiments of this application are as follows:

[0048] The VPN access method, apparatus, electronic device, and storage medium provided in this application embodiment, based on client remote access to the virtual private network server used by the private cloud, pre-configures the application policies and object policies required for the public cloud server's multi-factor authentication service. This adds a multi-factor authentication service provided by the public cloud server without changing the static password authentication service provided by the private cloud server. Thus, when an authentication request message is received from the virtual private network server, the application policies and object policies required for multi-factor authentication are obtained from the public cloud server. Based on these policies, the static password authentication method provided by the private cloud server and the multi-factor authentication method provided by the public cloud server are combined in an orderly manner to form a "cross-cloud" multi-factor combination strategy. This allows for flexible verification of authentication information in the message using different authentication methods, improving the security of VPN access.

[0049] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This is an application scenario diagram applicable to the embodiments of this application;

[0052] Figure 2A A visual configuration interface for an MFA service is provided in this application embodiment;

[0053] Figure 2B An interface for adding applications to the MFA service provided in the embodiments of this application;

[0054] Figure 2C An interface for configuring application policies for the MFA service provided in this application embodiment;

[0055] Figure 3A Another visual configuration interface for MFA services provided in this application embodiment;

[0056] Figure 3B An interface for adding object strategies to the MFA service provided in this application embodiment;

[0057] Figure 3C This application provides a basic information interface for the object strategy in the embodiments of the present application;

[0058] Figure 3D This is the object policy configuration interface in the MFA service provided in the embodiments of this application;

[0059] Figure 3E An interface for configuring dynamic password authentication policy items provided in this application embodiment;

[0060] Figure 4 An interactive flowchart of the VPN access method provided in the embodiments of this application;

[0061] Figure 5 A flowchart illustrating the VPN access method provided in this application embodiment;

[0062] Figure 6 A flowchart illustrating the method for obtaining application strategies and object strategies provided in this application embodiment;

[0063] Figure 7 A code diagram illustrating the application strategy configuration provided in the embodiments of this application;

[0064] Figure 8 A code diagram illustrating the configured object strategy provided in the embodiments of this application;

[0065] Figure 9 A flowchart of a single-step authentication method provided in an embodiment of this application;

[0066] Figure 10 A flowchart of the "cross-cloud" combined authentication method in the single-step authentication process provided in this application embodiment;

[0067] Figure 11 A flowchart of a multi-step authentication method provided in the embodiments of this application;

[0068] Figure 12 A flowchart of the first step of a multi-step authentication method provided in the embodiments of this application;

[0069] Figure 13 A flowchart of the second step of the multi-step authentication method provided in the embodiments of this application;

[0070] Figure 14A complete flowchart illustrating how the verification server verifies the password of a VPN account, as provided in this embodiment of the application.

[0071] Figure 15 This is a structural diagram of the VPN access device provided in the embodiments of this application;

[0072] Figure 16 This is a structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0073] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.

[0074] For ease of understanding, the terms used in the embodiments of this application are explained below.

[0075] AAA: Short for Authentication, Authorization, and Accounting, it is a security management mechanism for access control in network security, providing three security services: authentication, authorization, and accounting.

[0076] RADIUS: Short for Remote Authentication Dial In User Service, it is a client / server (C / S) communication protocol. It is commonly used in network communication AAA scenarios, such as ADSL internet access, IP telephony, and VPN remote access.

[0077] MFA stands for Multi-factor authentication, a method of computer access control that requires clients to pass two or more authentication mechanisms (such as fingerprint authentication, facial recognition, static password authentication, and any combination of dynamic password authentication) before they can be authorized to use computer resources in the cloud.

[0078] VPN: A remote access technology that uses a public network to establish a private network. For example, an employee traveling on business can access resources on a company's intranet server through a client; this type of access is considered remote access.

[0079] The design concept of the embodiments of this application is summarized below.

[0080] Currently, there are two main VPN access methods: the first is to use the static password verification service provided by the private cloud, such as AD / OpenLDAP or a self-developed system; the second is to deploy a dynamic password verification service on top of the static password verification service provided by the private cloud, providing both static and dynamic password verification services. Compared to the first method, the second method is more secure, but it has the following main drawbacks: 1) Deploying a dynamic password verification service on a private cloud server incurs high initial investment and subsequent maintenance costs, which is not conducive to long-term development; 2) Deploying a dynamic password verification service on a private cloud server requires intrusive changes to the existing static password verification service; 3) The static and dynamic password verification services lack configurable, combinable, and switchable mechanisms. Furthermore, both access methods, whether using static password verification or the combined static and dynamic password verification service, are single-step authentication methods, lacking flexibility.

[0081] In view of this, embodiments of this application provide a VPN access method, apparatus, electronic device, and storage medium. Based on the static password verification service provided by a private cloud server, it innovatively incorporates the MFA service provided by a public cloud server. Through the visual interface of the MFA service provided by the public cloud server, and based on a virtual private network server, the application policies and object policies required for MFA are pre-configured. This allows for the orderly combination of the static password verification service provided by the private cloud server and the MFA service provided by the public cloud server, forming a "cross-cloud" multi-factor authentication strategy. The authentication server executes the "combination strategy" to achieve "single-step" or "step-by-step" multi-factor authentication. This method does not require changes to the original static password verification service of the private cloud server, making its implementation relatively simple. It also enriches the VPN access authentication methods and enhances VPN access security, and can be used to address issues raised in security supervision and IT auditing.

[0082] The preferred embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments and features in the embodiments of this application can be combined with each other without conflict.

[0083] refer to Figure 1 This is a schematic diagram of an application scenario according to an embodiment of this application. The application scenario diagram includes a client 110, a virtual private network server 120, a private cloud server 130, a public cloud server 140, and a verification server 150.

[0084] In this embodiment, the client 110 includes, but is not limited to, devices with display capabilities such as mobile phones, tablets, laptops, desktop computers, smart voice interaction devices, and vehicle terminals. A VPN application can be installed on the client 110; this VPN application can be client software or browser software. The target user accesses the private cloud server 130 by entering their username and password in the VPN application installed on the client 110. The virtual private network server 120 is a server specifically designed for VPN access. The private cloud server 130 and the public cloud server 140 can be built from multiple servers, and the authentication server 150 is a server specifically designed for remote user dial-up services.

[0085] The aforementioned types of servers can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0086] The VPN access method in this application embodiment can be provided by Figure 1 The process involves the joint execution of client 110, virtual private network server 120, and authentication server 150. Specifically, when a target accesses resources on private cloud server 130 through client 110, the client 110 inputs the VPN account and password for accessing private cloud server 130 and sends a remote access request to virtual private network server 120 via the internet. Virtual private network server 120 encapsulates the VPN account, password, and other information into an authentication request message according to the RADIUS protocol and sends this message to authentication server 150. Upon receiving the authentication request message, authentication server 150 retrieves the application and object policies required for the MFA service pre-configured on virtual private network server 120 from public cloud server 140. Based on the application and object policies, it invokes the static password authentication service provided by the private cloud server and the MFA service provided by the public cloud server, respectively, and encapsulates the authentication result into a RADIUS protocol authentication result message, returning it to virtual private network server 120. Based on the authentication result message, virtual private network server 120 determines whether to allow client 110 to remotely access resources on private cloud server 130.

[0087] It should be noted that, Figure 1 The examples shown are merely illustrative; in reality, the number of clients and servers is unlimited and is not specifically limited in this embodiment.

[0088] In this embodiment of the application, when there are multiple servers, the multiple servers can form a blockchain, and the servers are nodes on the blockchain; as disclosed in the VPN access method of this embodiment, the application policies, object policies, etc. involved can be stored on the blockchain.

[0089] It should be noted that the embodiments described in this application are shown only to facilitate understanding of the spirit and principles of this application and are not intended to limit the application scenarios.

[0090] The VPN access method provided in this application embodiment is based on a virtual private network server that manages client access to a private cloud server. It pre-configures application policies and object policies, thereby combining the static password verification service provided by the private cloud with the MFA service provided by the public cloud in an orderly manner to form a "cross-cloud" multi-factor combination strategy, which improves the security and flexibility of VPN verification.

[0091] The configuration methods for the two strategies are described in detail below.

[0092] I. Application Strategy Configuration

[0093] like Figure 2A The image shows the visualization interface for the MFA service provided by the public cloud server. First, click the "Policy & Application" menu on this page; then, select the "Application" option from the drop-down menu to proceed to... Figure 2B The interface for adding applications to the MFA service; further, click... Figure 2B The "Add Application" option adds the current Virtual Private Network Server as an application in the MFA service and configures the application policy for that application.

[0094] The configuration interface for application strategies is as follows: Figure 2C As shown, information marked with "*" is required. When configuring the application policy required for MFA, select "Strong Auth" for the type; select "VPN MFA (Strong Auth)" for the authentication policy; the name can be defined by yourself, such as "VPN"; set the application address to the public IP address of the VPN server (e.g., 203.205.100.100) as a whitelist; set the shared key to the shared key used by the VPN server; select "General Device" for the brand; if "Multi-step authentication" is not enabled, perform a single-step authentication process; otherwise, perform a multi-step authentication process; set the RADIUS role attribute to "25Class", which can be set according to the RADIUS protocol supported by the VPN server and specific circumstances; uncheck the "Create Agent" selection.

[0095] It should be noted that, Figure 2CThe configuration shown is for illustrative purposes only. In actual applications, the settings and selections can be made according to the specific circumstances.

[0096] II. Object Strategy Configuration

[0097] like Figure 3A As shown, from the visualization interface of the MFA service provided by the public cloud, click the "Policy & Application" menu on this page, and select the "Policy" option from the drop-down menu to enter... Figure 3B The interface for adding object strategies to the MFA service; then, click... Figure 3B The "Add" option in the menu will redirect you to... Figure 3C The "Create New Object Policy" page will appear. On this page, fill in the basic information of the newly created object policy, such as setting the name of the new object policy to "VPN MFA", the type to "Security Authentication", and the user source to "Local User".

[0098] After completing the creation of the object strategy, proceed to... Figure 3D The "Policy Information" configuration interface shown allows you to configure policy items such as "User Filtering," "Terminal Filtering," "Authorized Roles," "Static Password Authentication," and "Dynamic Password Authentication." You can customize object policies by turning the switches on or off for the relevant policy items.

[0099] For example, in Figure 3E In the interface for configuring the "Dynamic Password Authentication" policy, turn on the switches for Dynamic Password Authentication, Push Authentication, and Force Dynamic Password. Select "Mobile Token" as the token type and enter the number of trusted terminals and the duration of trust (in minutes). After configuring the "Dynamic Password Authentication" policy, click "Submit" to save the current policy settings.

[0100] The VPN access method provided in this application embodiment implements a "cross-cloud" multi-factor combination verification method by configuring the parameter content of each policy item in the visual interface of the MFA service provided by the public cloud server. Optionally, in some embodiments, a visual ABAC decision-making process can also be added to further improve the flexibility of the "cross-cloud" multi-factor combination verification method.

[0101] Based on the application and object policies configured above, the interaction flow of the VPN access method provided in this application embodiment is as follows: Figure 4 As shown, it mainly includes the following steps:

[0102] S401: The client responds to the VPN account and password entered by the target object and initiates a remote access request.

[0103] When the target accesses resources on the private cloud server through a client, the VPN application on the client is activated. In the VPN application interface, the target enters the VPN username and password already activated on the private cloud server, triggering a login operation. In response to the login operation triggered by the target, the client sends a remote access request to the virtual private network server. This remote access request carries at least the VPN username and password entered by the target, as well as the client's IP address.

[0104] S402: The Virtual Private Network server generates an authentication request message based on the VPN account and password carried in the remote access request, as well as the client's IP address, and sends it to the authentication server.

[0105] After receiving a remote access request from a client, the virtual private network server encapsulates the virtual private network server identifier, the VPN account and password carried in the remote access request, the client's IP address, and other information into an authentication request message supported by the Radius protocol, and then sends the message to the authentication server.

[0106] S403: The authentication server obtains the application policies and object policies required for the pre-configured MFA from the public cloud server based on the authentication request message.

[0107] After receiving the verification request message, the verification server retrieves the pre-configured application policies and object policies required by the public cloud server to provide MFA services, based on the identifier of the virtual private network server in the message.

[0108] S404: The verification server, based on the obtained application policy and object policy, calls at least one of the static password verification service provided by the private cloud server and the MFA service provided by the public cloud server to perform VPN access verification on the password corresponding to the VPN account.

[0109] Based on the specific content of each policy item in the application policy and object policy, there are three ways to verify the VPN account password entered by the target object. The first method is to verify the VPN account password by the MFA service provided by the public cloud server. The second method is to verify the VPN account password by the static password verification service provided by the private cloud server. The third method is to jointly verify the VPN account password by the MFA service provided by the public cloud server and the static password verification service provided by the private cloud server.

[0110] S405: The verification server sends the verification result of at least one of the private cloud server and the public cloud server to the virtual private network server.

[0111] The verification server encapsulates the verification result of the VPN account password entered by the target object into a verification result message supported by the Radius protocol, which is obtained from at least one of the private cloud server and the public cloud server, and returns it to the virtual private network server so that the virtual private network server can manage the client's access permissions to the private server based on the verification result.

[0112] S406: The Virtual Private Network Server controls whether to allow clients to remotely access resources in the private cloud server based on the authentication result.

[0113] When the VPN account password entered by the target user is successfully authenticated, the VPN server allows the client to access resources on the private cloud server. When the VPN account password entered by the target user fails to be authenticated, the VPN server denies the client access to resources on the private cloud server.

[0114] The VPN access method provided in this application adds a virtual private network server, which manages client access permissions to a private cloud server, to an application within the MFA service provided by a public cloud server. It then configures corresponding application policies and object policies, thereby combining the static password verification service provided by the private cloud and the MFA service of the public cloud server across clouds. Finally, it switches both the static password verification service provided by the private cloud and the MFA service of the public cloud server to a new verification service provided by the verification server based on application policies and object policies. This avoids changes to the original services, improves the flexibility and security of VPN access at a lower cost, and achieves a cross-cloud multi-factor VPN access method.

[0115] In this embodiment of the application, the verification server can be a web server, a cloud server, or a dedicated server for remote dial-up Internet access, such as a Radius server.

[0116] In one optional implementation, the verification server, based on pre-configured application and object policies, combines the static password verification service provided by the private cloud and the multi-factor authentication service of the public cloud server across clouds to verify the VPN. For details on this method, please refer to [link to relevant documentation]. Figure 5 It mainly includes the following steps:

[0117] S501: The authentication server receives an authentication request message sent by the virtual private network server. The authentication request message is generated by the virtual private network server based on the remote access request sent by the client, and includes at least the authentication information of the VPN account entered by the target object when the client accesses the private cloud server.

[0118] A Virtual Private Network (VPN) server is used to manage client access permissions to resources on a private cloud server. When a target object remotely accesses the private cloud server through a client, it enters the VPN account and password that have been opened on the private cloud server in the client to initiate a remote access request to the VPN server. The VPN server encapsulates the VPN account verification information entered by the target object when the client accesses the private cloud server, carried in the remote access request, into an authentication request message supported by the Radius protocol and sends it to the authentication server.

[0119] Optionally, the verification information in the verification request message may include at least the VPN account, password, identifier of the virtual private network server, and IP address of the client.

[0120] S502: The authentication server obtains the application policies and object policies required for the pre-configured MFA from the public cloud server based on the authentication request message.

[0121] This application embodiment aims to achieve a "cross-cloud" combination of static password verification service provided by a private cloud server and multi-factor authentication service provided by a public cloud server. Based on the visual interface of the MFA service provided by the public cloud server, the application policies and object policies required by MFA are pre-configured for the virtual private network server. When the verification server receives the verification request message sent by the virtual private network server, it parses the message to obtain the identifier of the virtual private network server and the IP address of the client. Based on the identifier of the virtual private network server and the IP address of the client obtained by parsing, the corresponding application policies and object policies are obtained.

[0122] The process of obtaining application strategies and object strategies can be found in [link to documentation]. Figure 6 It mainly includes the following steps:

[0123] S5021: Based on the identifier of the virtual private network server, obtain the corresponding application policy required by the MFA from the public cloud server.

[0124] Optionally, the identifier of a virtual private network server can be any one of the virtual private network server's IP address, number, name, and ID.

[0125] In one alternative implementation, when a virtual private network server is added as an application in the MFA service provided by a public cloud server, an application ID is generated, and the corresponding application policy is obtained from the public cloud server based on the mapping between the IP address of the virtual private network server and the application ID.

[0126] S5022: Obtain the whitelist associated with the virtual private network server from the application policy.

[0127] Optionally, the whitelist includes the IP addresses of clients that the virtual private network server allows to remotely access the private cloud server.

[0128] S5023: Determine if the whitelist is empty. If not, proceed to S5024; if yes, proceed to S5025.

[0129] When the whitelist is empty, it means that all clients are allowed to remotely access the private cloud server. When the whitelist is not empty, it means that only clients in the whitelist can remotely access the private cloud server. Therefore, it is necessary to further determine whether the client used by the current target object is a client in the whitelist.

[0130] S5024: Determine if the client's IP address is on the whitelist. If yes, proceed to S5025; otherwise, end VPN authentication.

[0131] The system compares the IP address of the client currently being used by the target object with the IP addresses in the whitelist. If the comparison matches, it indicates that the current client is allowed to remotely access the private cloud server. If the comparison does not match, it indicates that the current client is not allowed to remotely access the private cloud server. No VPN authentication is required, and an access error message can be returned.

[0132] S5025: Obtain the object strategy required for MFA from the public cloud server.

[0133] When the whitelist is empty, or when the client's IP address is on the whitelist, the client can remotely access the private cloud server. In this case, the public cloud server needs to obtain the object policy required by MFA to authenticate the password of the VPN account received by the client.

[0134] S503: The verification server performs VPN access verification on the verification information based on the target verification method indicated by the application policy and the object type indicated by the object policy, using at least one of the verification passwords provided by the private cloud server and the verification passwords provided by the public cloud server.

[0135] When configuring application policies, such as Figure 2C As shown, you can choose to enable or disable multi-step authentication. When multi-step authentication is enabled, the target verification method is multi-step authentication; when multi-step authentication is disabled, the target verification method is single-step authentication. You can also configure policy items such as application address and RADIUS role attributes. The data structure of some policy items in the application policy is shown in Table 1.

[0136] Table 1. Data Structure of Application Strategies

[0137] As an example, the code representation of the content set for each strategy item in Table 1 is as follows: Figure 7As shown. The whitelist nasIpAddress of the virtual private network server is represented in dotted decimal notation as xxxx, where x is a decimal integer between 0 and 255; the RADIUS role attribute roleAttrName is in the RADIUS protocol data packet format and must include "NAS-Identifier"; multi-step authentication enableMultiStepAuth is set to true, indicating that multi-step authentication is enabled.

[0138] When configuring the object policy, policy items such as object type, password type, and ID of the static password verification service provided by the private cloud server were set. The data structure of each policy item is shown in Table 2.

[0139] Table 2. Data Structure of Object Strategy

[0140]

[0141] The code representations of the content set for each strategy item in Table 2 above are as follows: Figure 8 As shown in the diagram. The object type `userType` is set to `inner`, and the password type `enableDynamicPassword` is set to `true`, indicating that the password entered by the target object includes both a static login password and a dynamic login password. The ID of the static password verification service provided by the private cloud server is set to "1", which can be used to call the AD / openLADP service to perform VPN verification on the static login password entered by the target object.

[0142] In the embodiments of this application, the verification server performs "cross-cloud" combined authentication of the static password verification service provided by the private cloud server and the MFA service provided by the public cloud server based on the target verification method indicated by the application policy and the object type indicated by the object policy. This enables "single-step" or "multi-step" multi-factor (i.e., static login password and dynamic login password) VPN authentication, thereby improving the security and flexibility of VPN access.

[0143] In an optional implementation, when the target verification method is single-step authentication, i.e., enableMultiStepAuth is set to false, the verification process of the verification server for the verification information in the verification request message is as follows: Figure 9 As shown, it mainly includes the following steps:

[0144] S5031_1: Determine whether the object type indicated by the object policy is an object corresponding to a private cloud server. If not, execute S5031_2; if yes, execute S5031_3.

[0145] The value of the object type is obtained from the object strategy. When userType is outside, it represents the object corresponding to the MFA service provided by the public cloud server. When userType is inside, it represents the object corresponding to the static password verification service provided by the private cloud server.

[0146] S5031_2: Use the static password verification provided by the public cloud server to verify the static login password in the verification information.

[0147] When the object type is set to a non-private cloud server object in the object policy, i.e., userType is outside, VPN authentication is performed by the MFA service provided by the public cloud server.

[0148] Specifically, the verification server sends the static login password of the VPN account entered by the target object in the verification information to the public cloud server. The public cloud server compares the static verification password provided by the MFA service with the static login password and returns the comparison result to the verification server to complete the verification of the static login password.

[0149] S5031_3: Based on the password type contained in the verification information, use at least one of the static verification password provided by the private cloud server and the dynamic verification password provided by the public cloud server to perform VPN access verification on the verification information.

[0150] When the object type is set to a private cloud server object in the object policy (i.e., userType is inner), the verification server can use different methods to verify VPN access based on whether the verification information contains a dynamic login password. See details for verification methods. Figure 10 It mainly includes the following steps:

[0151] S5031_31: Determine whether the verification information contains a dynamic login password. If yes, execute S5031_32; otherwise, execute S5031_34.

[0152] When a target user logs into a VPN on a client side, they typically enter a static password. If they also enter a dynamic password, multi-factor authentication is satisfied. However, if they only enter a static password, multi-factor authentication is not satisfied, and only the static password needs to be verified. Therefore, for objects corresponding to private cloud servers, the verification server needs to determine whether the verification information entered by the target user includes a dynamic password in addition to the static password, and then use different methods for VPN access verification accordingly.

[0153] S5031_32: Determine whether the total length of the password in the verification information is less than the preset threshold. If yes, return a VPN authentication failure message. If no, execute S5031_33.

[0154] When the verification information entered by the target user includes both static and dynamic login passwords, the total length of the password is generally quite long. If it is less than the preset threshold, it indicates that there may be an input error, and an authentication failure message is returned to prompt the user to re-enter the password. If it is greater than or equal to the preset threshold, the static and dynamic login passwords can be distinguished, so that the private cloud server and the public cloud server can perform authentication separately, thereby realizing "cross-cloud" combined authentication.

[0155] Optional, the preset threshold is 7 characters.

[0156] S5031_33: Verify the static login password using the static verification password provided by the private cloud server, and verify the dynamic login password using the dynamic verification password provided by the public cloud server.

[0157] Optionally, when the password entered by the target object includes a dynamic login password and the total password length is greater than or equal to a preset threshold, the last N digits of the password (e.g., N=6) are used as the dynamic login password, and the other parts are used as the static login password.

[0158] For dynamic login passwords, a dynamic verification password provided by a public cloud server is used for authentication. This dynamic verification password provided by the public cloud server is updated synchronously with the dynamic login password used by the client according to a preset time period.

[0159] In one optional implementation, the public cloud server and the client are pre-configured with the same initial password. As the timestamp changes, the initial passwords on both ends are updated synchronously according to a preset time period. Thus, for the dynamic login password in the verification information entered by the target, the public cloud server calculates a dynamic verification password with the same timestamp. Theoretically, the dynamic login password and the dynamic verification password are both based on the same initial password and undergo the same changes; they should be identical. Therefore, the verification server sends the dynamic login password of the VPN account entered by the target to the public cloud server. The public cloud server compares the dynamic verification password provided by the MFA service with the dynamic login password in the verification information. If they match, the dynamic login password authentication is successful.

[0160] For static login passwords, use the static verification password provided by the private cloud server for authentication.

[0161] In one alternative implementation, the verification server is based on the ID of the static password verification service provided by the private cloud server in the object policy (e.g., ...). Figure 8If ldapConfigId is "1", the service address of the static password verification service is obtained, and the static login password of the VPN account entered by the target object is sent to the private cloud server corresponding to the service address. The private cloud server compares the static verification password provided by the static password verification service with the static login password in the verification information, and sends the comparison result to the verification server to complete the verification of the static login password.

[0162] Optionally, the ID of the static password verification service provided by the private cloud server is the ID of the AD / openLADP service provided by the private cloud server.

[0163] It should be noted that this application embodiment does not impose any restrictions on the static password verification service provided by the private cloud server. In addition to using AD / openLADP services, the enterprise can also add its own self-developed verification service as a way of "cross-cloud" combined verification.

[0164] S5031_34: Verify the static login password using the static verification password provided by the private cloud server.

[0165] When the password entered by the target does not include a dynamic login password, the static verification password provided by the private cloud server is used to verify the static login password corresponding to the VPN account entered by the target. For details of the verification process, please refer to the description in S5031_33, which will not be repeated here.

[0166] When performing single-step authentication on the VPN account and password entered by the target, the MFA service provided by the public cloud server can verify both the static login password and the dynamic login password of the VPN account entered by the target. Specifically, for objects corresponding to non-private cloud servers, the MFA service provided by the public cloud server is used to verify the static login password. For objects corresponding to private cloud servers, when a dynamic login password is included and its length meets the requirements, the MFA service provided by the public cloud server is used to verify the dynamic login password, and the static password verification service provided by the private cloud server is used to verify the static login password; when no dynamic login password is included, the static password verification service provided by the private cloud server is used to verify the static login password. This embodiment, by obtaining the object type and password type from the object policy, performs "cross-cloud" combined authentication of the MFA service provided by the public cloud server and the static password verification service provided by the private cloud server. This improves the security and flexibility of VPN access without changing the original static password verification service provided by the private cloud server.

[0167] In an optional implementation, when the target verification method is multi-step authentication, i.e., enableMultiStepAuth is set to true, the verification process of the verification server on the verification information in the verification request message is as follows: Figure 11 As shown, it mainly includes the following steps:

[0168] S5032_1: Retrieve the authentication status attribute associated with the VPN account from the object policy.

[0169] The verification status attribute is used to record the number of times the VPN account entered by the target object is verified. When the VPN account is not verified, the verification status attribute is empty; when the VPN account is verified, the verification status attribute is not empty.

[0170] S5032_2: Determine if the verification status attribute is empty. If yes, execute S5032_3; otherwise, execute S5032_4.

[0171] When the verification status attribute is empty, the current VPN account is authenticated for the first time (i.e., the first step). When the verification status attribute is not empty, the current VPN account is authenticated for the second time.

[0172] S5032_3: Based on the object type indicated by the object policy, use the static verification password provided by the private cloud or the static verification password provided by the public cloud to verify the static login password in the verification information and update the verification status attribute.

[0173] During the initial authentication of the current VPN account, different authentication methods are used for the current VPN account based on different object types in the object policy. See the initial authentication process for details. Figure 12 It mainly includes the following steps:

[0174] S5032_31: Determine whether the object type indicated by the object policy is an object corresponding to a private cloud server. If yes, execute S5032_32; otherwise, execute S5032_33.

[0175] The value of the object type is obtained from the object strategy. When userType is outside, it represents the object corresponding to the MFA service provided by the public cloud server. When userType is inside, it represents the object corresponding to the static password verification service provided by the private cloud server.

[0176] S5032_32: Use the static password verification provided by the public cloud server to verify the static login password in the verification information.

[0177] When the object type is set to a non-private cloud server object in the object policy, i.e., userType is outside, VPN access verification is performed by the MFA service provided by the public cloud server.

[0178] Specifically, the verification server sends the static login password of the VPN account entered by the target object in the verification information to the public cloud server. The public cloud server compares the static verification password provided by the MFA service with the static login password and returns the comparison result to the verification server to complete the verification of the static login password.

[0179] S5032_33: Use the static verification password provided by the private cloud server to verify the static login password in the verification information.

[0180] When the object type is set to the private cloud server's object in the object policy, i.e., userType is inner, VPN access verification is performed by the MFA service provided by the private cloud server.

[0181] Specifically, the verification server sends the static login password of the VPN account entered by the target in the verification information to the private cloud server. The private cloud server compares the static verification password provided by the static password verification service with the static login password and returns the comparison result to the verification server to complete the verification of the static login password.

[0182] S5032_34: After verification, a random string is generated as the key of the verification status attribute, the VPN account is used as the value of the verification status attribute, and the data is entered into the cache in key-value pair form.

[0183] After the first step of authentication is completed, the verification status attribute will no longer be empty. The key of the verification status attribute is a randomly generated string, and the value is the VPN account being verified, which is then stored in the cache.

[0184] S5032_4: Compare the value of the verification status attribute with the VPN account, and based on the comparison result, use the dynamic verification password provided by the public cloud to verify the dynamic login password in the verification information.

[0185] After the first step of authentication, the verification status attribute is updated and is no longer empty, allowing you to proceed directly to the second step of authentication. See the second step authentication process for details. Figure 13 It mainly includes the following steps:

[0186] S5032_41: Determine whether the value of the verification status attribute matches the VPN account. If yes, execute S5032_42; otherwise, return a verification failure message.

[0187] Based on the key of the verification status attribute, the corresponding value is obtained. This value is the VPN account authenticated in the first step. The VPN account authenticated in the first step is compared with the VPN account entered by the target to determine whether they are consistent. If they are consistent, the password corresponding to the VPN account is further verified. If they are inconsistent, an authentication failure message is returned.

[0188] S5032_42: Use the dynamic password verification provided by the public cloud server to verify the dynamic login password in the verification information.

[0189] When the VPN account authenticated in the first step is the same as the VPN account entered by the target, the verification server sends the dynamic login password corresponding to the VPN account entered by the target to the public cloud server. The public cloud server compares the dynamic login password with the dynamic verification password provided by the MFA service to complete the verification of the dynamic login password in the verification information.

[0190] S5032_43: Retrieve role attributes from the application strategy and write the target object into the role attributes.

[0191] After the second step of authentication is completed, the role attributes will be obtained from the application strategy, the target object will be written into the role attributes, and the role attributes will be carried in the verification result returned by the multi-step authentication.

[0192] When performing multi-step authentication on the VPN account and password entered by the target, in the first step of authentication, based on the object type indicated by the object attribute in the object policy, the static password verification service provided by the private cloud server or the MFA service provided by the public cloud server is used to verify the static login password of the VPN account entered by the target, realizing "cross-cloud" combined authentication, and the verified VPN account is used as the value of the verification status attribute. In the second step of authentication, the VPN account verified in the first step is retrieved from the cache and compared with the VPN account entered by the target to ensure that the two authentications are for the same VPN account, further improving the security of VPN access.

[0193] S504: The authentication server controls the access permissions of the virtual private network server management client to the private cloud server based on the authentication result.

[0194] Depending on the target verification method indicated in the application policy and the object type indicated in the object policy, the verification method for the VPN account and password for remote access to the private cloud server entered by the target object on the client will differ, and the way to obtain the verification result will also differ.

[0195] Specifically, when using a static verification password provided by a private cloud server to verify the static login password of the VPN account entered by the target, the verification server obtains the verification result from the private cloud server and encapsulates the verification result into a verification result message supported by the RADIUS protocol before sending it to the virtual private network server. When using a static verification password provided by a public cloud server to verify the static login password of the VPN account entered by the target, the verification server obtains the verification result from the public cloud server and encapsulates the verification result into a verification result message supported by the RADIUS protocol before sending it to the virtual private network server. When using a static verification password provided by a private cloud server to verify the static login password of the VPN account entered by the target, and when using a dynamic verification password provided by a public cloud server to verify the dynamic login password of the VPN account entered by the target, the verification server obtains a first verification result from the private cloud server and a second verification result from the public cloud server, and encapsulates the first and second verification results into a verification result message supported by the RADIUS protocol before sending it to the virtual private network server.

[0196] Optionally, the verification result message is a challenge type message.

[0197] After receiving the verification result message, the Virtual Private Network (VPN) server parses the message. If the verification is successful, the VPN server allows the client to remotely access the private cloud server; if the verification fails, the VPN server refuses the client's remote access to the private cloud server.

[0198] The VPN access method provided in this application adds MFA service provided by public cloud server to the static password verification service provided by enterprise private cloud, providing a configurable and combinable "cross-cloud" multi-factor authentication method, which improves the flexibility of VPN access, effectively enhances the security of VPN access, and is more in line with regulatory and auditing requirements.

[0199] Meanwhile, by configuring application and object policies, the verification server performs cross-cloud combined multi-factor authentication, switching the traditional VPN access method to the new access method with low change cost and simple operation.

[0200] The complete process of the verification server verifying verification request messages based on application policies and object policies can be found in [link to documentation]. Figure 14 It mainly includes the following steps:

[0201] S1401: Receive authentication request messages sent by the virtual private network server.

[0202] In one example, the virtual private network server receives a remote access request sent by a target object when remotely accessing a private cloud server through a client. The remote access request includes at least the VPN account and password entered by the target object, as well as verification information such as the client's IP address and the virtual private network server's IP address. The virtual private network server uses the Radius protocol to encapsulate the verification information into a verification request message and then sends it to the verification server.

[0203] S1402: Obtain the corresponding application policy based on the IP address of the virtual private network server in the authentication request message.

[0204] After receiving the authentication request message from the VPN server, the authentication server parses the message to obtain authentication information such as the VPN account, password, client IP address, and VPN server IP address. Since a unique application policy with a specific application ID is pre-configured in the MFA server provided by the public cloud server for the VPN server, the authentication server can retrieve the corresponding application policy based on the VPN server's IP address.

[0205] S1403: Obtain the whitelist associated with the virtual private network server from the application policy.

[0206] In the MFA service of the public cloud server, when pre-configuring application policies for the virtual private network server, a whitelist is configured based on the IP addresses of clients that the virtual private network server allows to remotely access the private cloud server. Clients in the whitelist can remotely access resources on the private cloud server after VPN access verification by the verification server.

[0207] S1404: Determine if the whitelist is empty. If not, proceed to S1405; if yes, proceed to S1406.

[0208] When the whitelist is empty, all clients can remotely access resources on the private cloud server. When the whitelist is not empty, only clients on the whitelist can remotely access resources on the private cloud server.

[0209] S1405: Determine whether the client's IP address in the verification request message is in the whitelist. If yes, proceed to S1406; otherwise, end the verification process.

[0210] In one example, the verification server searches a whitelist based on the client's IP address parsed from the verification request message. If the parsed client's IP address exists in the whitelist, it indicates that the client can remotely access resources in the private cloud server; otherwise, the client cannot remotely access resources in the private cloud server, and the VPN access verification process can be terminated.

[0211] S1406: Determine whether multi-step authentication is enabled in the application policy. If not, proceed to S1407; if yes, proceed to S1418.

[0212] When the verification server determines that the current client can remotely access the private cloud server, it checks whether the multi-step authentication switch in the application policy is enabled. If it is not enabled, it performs the single-step authentication process; if it is enabled, it performs the multi-step authentication process.

[0213] S1407: Obtain the corresponding object strategy.

[0214] The object policy configures policy items such as object type, password type, and the ID of the static password verification service provided by the private cloud server. When `userType` is set to `outer`, the target object corresponds to the MFA service provided by the public cloud server; when `userType` is set to `inner`, the target object corresponds to the static password verification service provided by the private cloud. When `enableDynamicPassword` is set to `false`, the password entered for the target object does not include a dynamic login password but includes a static login password; when `enableDynamicPassword` is set to `false`, the password entered for the target object includes both a dynamic and a static login password. The ID of the static password verification service provided by the private cloud server indicates the address of the static password verification service.

[0215] S1408: Determine whether the object type in the object policy is the object corresponding to the private cloud server. If yes, execute S1409; otherwise, execute S1416.

[0216] Different VPN access authentication methods are used for different types of target objects.

[0217] S1409: Obtain the VPN account and password entered by the target from the authentication request message.

[0218] Optionally, the password entered by the target may include a dynamic login password in addition to a static login password.

[0219] S1410: Determine if the password includes a dynamic login password. If yes, proceed to S1411; otherwise, proceed to S1414.

[0220] For objects associated with private cloud servers, the private cloud servers only provide static password verification services and cannot verify dynamic login passwords. Therefore, different verification methods need to be adopted depending on whether the password entered by the target object contains a dynamic login password.

[0221] S1411: Determine whether the total length of the password is less than the preset threshold. If yes, return a verification failure message. If no, execute S1412.

[0222] VPN account passwords typically have a length limit. If the password entered by the target is less than the preset threshold, it indicates that there may be an error, and an authentication failure message is returned so that the user can re-enter the password.

[0223] S1412: Use the last N digits of the password as the dynamic login password, and the rest as the static login password.

[0224] When the total length of the password entered by the target is greater than or equal to the preset threshold, and includes a dynamic login password, it is necessary to separate the static login password and the dynamic login password from the password entered by the target according to the preset rules.

[0225] S1413: Request the MFA service provided by the public cloud server to verify the dynamic login password.

[0226] When dealing with objects corresponding to private cloud servers, and the password entered by the target object includes a dynamic login password, since the virtual private network server that controls the client's access permissions to the private cloud server is pre-configured as an application in the MFA service provided by the public cloud server, the dynamic login password of the VPN account can be verified by leveraging the MFA service provided by the public cloud server.

[0227] S1414: Retrieve the ID of the AD / openLADP service provided by the private cloud server from the object policy.

[0228] For static login passwords entered for objects corresponding to private cloud servers, VPN access verification is performed by the static password verification service provided by the private cloud server.

[0229] Optionally, the static password verification service is AD / openLADP service.

[0230] S1415: Based on the ID of the AD / openLADP service, request the corresponding AD / openLADP service to verify the static login password.

[0231] In one optional implementation, since the object policy includes the ID of the private cloud server providing AD / openLADP services, the verification server can obtain the service address of the static password verification service based on the ID, and send the static login password of the VPN account entered by the target object to the private cloud server corresponding to the service address. The private cloud server then compares the static verification password provided by the corresponding AD / openLADP service with the static login password entered by the target object, and sends the comparison result to the verification server to complete the verification of the static login password.

[0232] S1416: Request the MFA service provided by the public cloud server to verify the static login password.

[0233] During the single-step authentication process, for the object corresponding to the public cloud server, the static login password entered by the target object can be directly sent to the public cloud server. The public cloud server then compares the static verification password provided by the MFA service with the static login password entered by the target object and sends the comparison result to the verification server to complete the verification of the static login password.

[0234] S1417: Receive verification result message.

[0235] During single-step authentication, the verification server receives a verification result message containing the result of whether the current VPN account and password verification was successful or failed.

[0236] S1418: Get the verification status attribute.

[0237] When multi-step authentication is enabled, the verification server obtains the verification status attribute to confirm whether this is the first authentication.

[0238] S1419: Determine if the verification status attribute is empty. If yes, execute S1420; otherwise, execute S1425.

[0239] If the verification status attribute is empty, it indicates that the password for the current VPN account has not been authenticated, meaning this is the first authentication of the VPN account's password; if the verification status attribute is not empty, it indicates that the password for the VPN account has already been authenticated, meaning this is not the first authentication.

[0240] S1420: Determine the object type in the object policy and whether it is an object corresponding to a private cloud server. If yes, execute S1421; otherwise, execute S1423.

[0241] Similar to the single-step authentication process, the initial authentication process in multi-step authentication uses different methods for VPN access authentication depending on the type of target object.

[0242] S1421: Retrieve the ID of the AD / openLADP service provided by the private cloud server from the object policy.

[0243] Unlike single-step authentication, the initial authentication process in multi-step authentication does not require determining whether the password entered by the target object contains a dynamic login password. Instead, it directly requests the AD / openLADP service provided by the private cloud server to verify the static login password.

[0244] S1422: Based on the ID of the AD / openLADP service, request the corresponding AD / openLADP service to verify the static login password.

[0245] In the multi-step authentication process, the AD / openLADP service provided by the private cloud server verifies the static login password in the same way as the AD / openLADP service provided by the private cloud server verifies the static login password in the single-step authentication process. See S1415 for details, which will not be repeated here.

[0246] S1423: Request the MFA service provided by the public cloud server to verify the static login password.

[0247] During the initial authentication process of multi-step authentication, for the target object corresponding to the MFA service provided by the public cloud server, the MFA service provided by the public cloud server is directly requested to verify the static login password entered by the target object.

[0248] S1424: Randomly generate a string as the key of the verification status attribute, use the VPN account as the value of the verification status attribute, and store it in the cache as a key-value pair.

[0249] After the initial authentication is completed, the currently authenticated VPN account is recorded in the form of key-value pairs to indicate that the current VPN account has been authenticated.

[0250] S1425: Determine whether the value of the verification status attribute matches the VPN account entered by the target object. If yes, execute S1426; otherwise, return a verification failure message.

[0251] When the verification status attribute is not empty, the VPN account of the last authentication can be retrieved from the cache. By comparing the VPN account in the cache with the VPN account entered by the target object, it can be ensured that the VPN account used for multiple authentication steps is the same.

[0252] S1426: Request the MFA service provided by the public cloud server to verify the dynamic login password.

[0253] When the VPN account used for this authentication is the same as the one used for the initial authentication, the verification server sends the static login password entered by the target to the public cloud server. The public cloud server then compares the static verification password provided by the MFA service with the static login password entered by the target and sends the comparison result to the verification server to complete the verification of the static login password.

[0254] S1427: Retrieve role attributes from the application strategy and write the target object into the role attributes.

[0255] After multi-step authentication is completed, the attribute name of the role attribute is obtained from the application strategy, and the current target object is assigned as the attribute value to the corresponding attribute name.

[0256] S1428: Receive a verification result message carrying role attributes.

[0257] Unlike single-step authentication, in multi-step authentication, the verification result message received by the verification server carries not only the VPN account and password verification result, but also role attributes.

[0258] S1429: Send the verification result message to the Virtual Private Network Server (VPN) so that the VPN manages the client's access permissions to the private cloud server.

[0259] The authentication server sends the authentication result message of single-step authentication or multi-step authentication to the virtual private network server. The virtual private network server parses the authentication result message. If the parsing indicates that the authentication is successful, the client is allowed to access remotely. If the parsing indicates that the authentication has failed, the client is denied remote access.

[0260] Based on the same technical concept, this application provides a schematic diagram of a virtual private network access device, which can implement the above-mentioned VPN access method and achieve the same technical effect.

[0261] See Figure 15 The virtual private network access device includes a receiving module 1501, an acquisition module 1502, an authentication module 1503, and a control module 1504, wherein:

[0262] The receiving module 1501 is used to receive the verification request message sent by the virtual private network server. The verification request message is generated by the virtual private network server based on the remote access request sent by the client, and includes at least the verification information of the virtual private network account entered by the target object when the client accesses the private cloud server.

[0263] The acquisition module 1502 is used to obtain the pre-configured application strategy and object strategy required for multi-factor authentication from the public cloud server based on the authentication request message;

[0264] The verification module 1503 is used to perform virtual private network access verification on the verification information based on the target verification method indicated by the application policy and the object type indicated by the object policy, using at least one of the verification passwords provided by the private cloud server and the verification passwords provided by the public cloud server.

[0265] Control module 1504 is used to control the access permissions of the virtual private network server management client to the private cloud server based on the verification results.

[0266] Optionally, the verification information includes at least the client's IP address and the identifier of the virtual private network server. Module 1502 is specifically used for:

[0267] Based on the identifier of the virtual private network server, obtain the corresponding application strategy required for multi-factor authentication from the public cloud server;

[0268] Obtain the whitelist associated with the virtual private network server from the application policy;

[0269] If the whitelist is empty, or if the client's IP address is on the whitelist, then the object policy required for multi-factor authentication is obtained from the public cloud server.

[0270] Optionally, when the target verification method is single-step authentication, the verification module 1503 is specifically used for:

[0271] Determine whether the object type indicated by the object policy is an object corresponding to a private cloud server;

[0272] If the object is not a private cloud server, the static verification password provided by the public cloud server will be used to verify the static login password in the verification information.

[0273] If the object corresponds to a private cloud server, then based on the password type contained in the verification information, at least one of the static verification password provided by the private cloud server and the dynamic verification password provided by the public cloud server is used to perform virtual private network access verification on the verification information.

[0274] Optionally, the verification module 1503 is specifically used for:

[0275] If the verification information includes both a static login password and a dynamic login password, and the total password length is less than a preset threshold, then the static login password will be verified using the static verification password provided by the private cloud server, and the dynamic login password will be verified using the dynamic verification password provided by the public cloud server.

[0276] If the verification information only contains the static login password, then the static verification password provided by the private cloud server will be used to verify the static login password.

[0277] Optionally, when the target verification method is multi-step authentication, the verification module 1503 is specifically used for:

[0278] Retrieve the verification status attribute associated with the VPN account from the object policy;

[0279] If the verification status attribute is empty, then based on the object type indicated by the object policy, use the static verification password provided by the private cloud or the static verification password provided by the public cloud to verify the static login password in the verification information and update the verification status attribute.

[0280] If the verification status attribute is not empty, the value of the verification status attribute is compared with the VPN account, and based on the comparison result, the dynamic login password in the verification information is verified using the dynamic verification password provided by the public cloud.

[0281] Optionally, the verification module 1503 is specifically used for:

[0282] Determine whether the object type indicated by the object policy is an object corresponding to a private cloud server;

[0283] If the object is not a private cloud server, the static verification password provided by the public cloud server will be used to verify the static login password in the verification information.

[0284] If it is an object corresponding to a private cloud server, then use the static verification password provided by the private cloud server to verify the static login password in the verification information;

[0285] After verification, a random string is generated as the key of the verification status attribute, and the VPN account is used as the value of the verification status attribute. The data is then stored in the cache as key-value pairs.

[0286] Optionally, the verification module 1503 is specifically used for:

[0287] If the value of the verification status attribute matches the VPN account, then the dynamic verification password provided by the public cloud server is used to verify the dynamic login password in the verification information.

[0288] Retrieve role attributes from the application strategy and write the target object into the role attributes.

[0289] Optionally, the verification module 1503 is specifically used for:

[0290] Based on the ID of the static password verification service provided by the private cloud server in the object policy, obtain the service address of the static password verification service.

[0291] Send the static login password corresponding to the VPN account to the private cloud server corresponding to the service address, so that the private cloud server can compare the static login password with the static verification password;

[0292] The receiving module 1501 receives the comparison result sent by the private cloud server to complete the verification of the static login password.

[0293] Optionally, the dynamic verification password provided by the public cloud and the dynamic login password used by the client are updated synchronously according to a preset time period.

[0294] The VPN access device provided in this application embodiment, based on the client's remote access to the virtual private network server used by the private cloud, pre-configures the application policies and object policies required by the public cloud server's MFA service. This adds the MFA service provided by the public cloud server without changing the VPN authentication service provided by the private cloud server. Thus, when an authentication request message is received from the virtual private network server, the application policies and object policies required by the MFA are obtained from the public cloud server. Based on these policies, the VPN authentication method provided by the private cloud server and the MFA authentication method provided by the public cloud server are combined in an orderly manner to form a "cross-cloud" multi-factor combination strategy. This allows for flexible verification of the authentication information in the message using different authentication methods, improving the security of VPN access.

[0295] Based on the same inventive concept as the above-described method embodiments, this application also provides an electronic device. In one embodiment, the electronic device may be... Figure 1 The verification server in the system. In this embodiment, the structure of the electronic device can be as follows: Figure 16 As shown, it includes a memory 1601, a communication module 1603, and one or more processors 1602.

[0296] The memory 1601 is used to store computer programs executed by the processor 1602. The memory 1601 may mainly include a program storage area and a data storage area. The program storage area may store the operating system and programs required to run instant messaging functions, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0297] Memory 1601 may be volatile memory, such as random-access memory (RAM); memory 1601 may also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 1601 may be any other medium capable of carrying or storing a desired computer program having the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 1601 may be a combination of the above-described memories.

[0298] Processor 1602 may include one or more central processing units (CPUs) or digital processing units, etc. Processor 1602 is used to implement the above-described VPN access method when calling computer programs stored in memory 1601.

[0299] The communication module 1603 is used to communicate with terminal devices and other servers.

[0300] This application embodiment does not limit the specific connection medium between the memory 1601, communication module 1603, and processor 1602. This application embodiment... Figure 16 The memory 1601 and the processor 1602 are connected via a bus 1604, and the bus 1604 is in Figure 16 The diagram uses thick lines to describe the connections between other components; these are for illustrative purposes only and should not be considered limiting. The 1604 bus can be divided into address bus, data bus, control bus, etc. For ease of description, Figure 16 It is described using only a thick line, but does not indicate that there is only one bus or one type of bus.

[0301] The memory 1601 stores a computer storage medium, which stores computer-executable instructions for implementing the VPN access method of this application embodiment. The processor 1602 is used to execute the above-described VPN access method, such as... Figure 5 As shown.

[0302] In some possible implementations, various aspects of the VPN access method provided in this application can also be implemented as a program product, which includes a computer program. When the program product is run on an electronic device, the computer program causes the electronic device to perform the steps in the VPN access method according to the various exemplary embodiments of this application described above. For example, the electronic device can perform actions such as... Figure 5 The steps are shown in the figure.

[0303] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0304] The program product of the embodiments of this application may employ a portable compact disc read-only memory (CD-ROM) and include a computer program, and may run on an electronic device. However, the program product of this application is not limited thereto. In this document, the readable storage medium may be any tangible medium that contains or stores a program that may be used by or in conjunction with a command execution system, apparatus, or device.

[0305] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a readable computer program. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with a command execution system, apparatus, or device.

[0306] Computer programs contained on readable media may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0307] Computer programs for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The computer program can execute entirely on an electronic device, partially on an electronic device, as a standalone software package, partially on an electronic device and partially on a remote electronic device, or entirely on a remote electronic device or server. In cases involving remote electronic devices, the remote electronic device can be connected to the electronic device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external electronic device (e.g., via the Internet using an Internet service provider).

[0308] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0309] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0310] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0311] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0312] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0313] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0314] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for accessing a virtual private network, characterized in that, The method includes: The system receives a verification request message sent by a virtual private network server. The verification request message is generated by the virtual private network server based on a remote access request sent by the client, and includes at least the verification information of the virtual private network account entered by the target object when the client accesses the private cloud server. Based on the verification request message, obtain the pre-configured application strategy and object strategy required for multi-factor verification from the public cloud server; Based on the target verification method indicated by the application policy and the object type indicated by the object policy, at least one of the verification passwords provided by the private cloud server and the verification passwords provided by the public cloud server is used to perform virtual private network access verification on the verification information. Based on the verification results, the virtual private network server is controlled to manage the client's access permissions to the private cloud server.

2. The method as described in claim 1, characterized in that, The verification information includes at least the client's IP address and the identifier of the virtual private network server. Based on the verification request message, the application policy and object policy required for pre-configured multi-factor authentication are obtained from the public cloud server, including: Based on the identifier of the virtual private network server, obtain the corresponding application strategy required for multi-factor authentication from the public cloud server; Obtain the whitelist associated with the virtual private network server from the application policy; If the whitelist is empty, or if the client's IP address belongs to the whitelist, then the object policy required for multi-factor authentication is obtained from the public cloud server.

3. The method as described in claim 1, characterized in that, When the target verification method is single-step authentication, the virtual private network access verification is performed on the verification information based on the target verification method indicated by the application policy and the object type indicated by the object policy, using at least one of the verification password provided by the private cloud server and the verification password provided by the public cloud server, including: Determine whether the object type indicated by the object policy is an object corresponding to the private cloud server; If the object is not the one corresponding to the private cloud server, then the static verification password provided by the public cloud server is used to verify the static login password in the verification information. If the object corresponds to the private cloud server, then based on the password type contained in the verification information, at least one of the static verification password provided by the private cloud server and the dynamic verification password provided by the public cloud server is used to perform virtual private network access verification on the verification information.

4. The method as described in claim 3, characterized in that, The step of performing virtual private network access verification on the verification information based on the password type contained in the verification information, using at least one of the static verification password provided by the private cloud server and the dynamic verification password provided by the public cloud server, includes: If the verification information includes a static login password and a dynamic login password, and the total password length is less than a preset threshold, then the static login password is verified using the static verification password provided by the private cloud server, and the dynamic login password is verified using the dynamic verification password provided by the public cloud server. If the verification information only contains a static login password, then the static verification password provided by the private cloud server is used to verify the static login password.

5. The method as described in claim 1, characterized in that, When the target verification method is multi-step authentication, then based on the target verification method indicated by the application policy and the object type indicated by the object policy, at least one of the verification passwords provided by the private cloud server and the verification passwords provided by the public cloud server is used to perform virtual private network access verification on the verification information, including: Obtain the verification status attribute associated with the virtual private network account from the object policy; If the verification status attribute is empty, then based on the object type indicated by the object policy, the static login password in the verification information is verified using the static verification password provided by the private cloud or the static verification password provided by the public cloud, and the verification status attribute is updated. If the verification status attribute is not empty, the value of the verification status attribute is compared with the virtual private network account, and based on the comparison result, the dynamic login password in the verification information is verified using the dynamic verification password provided by the public cloud.

6. The method as described in claim 5, characterized in that, Based on the object type indicated by the object policy, the method uses the static verification password provided by the private cloud or the public cloud to verify the static login password in the verification information and update the verification status attribute, including: Determine whether the object type indicated by the object policy is an object corresponding to the private cloud server; If the object is not the one corresponding to the private cloud server, then the static verification password provided by the public cloud server is used to verify the static login password in the verification information. If it is an object corresponding to the private cloud server, then the static verification password provided by the private cloud server is used to verify the static login password in the verification information; After verification, a random string is generated as the key of the verification status attribute, the VPN account is used as the value of the verification status attribute, and the data is entered into the cache as a key-value pair.

7. The method as described in claim 5, characterized in that, The step of comparing the value of the verification status attribute with the virtual private network account, and based on the comparison result, using the dynamic verification password provided by the public cloud to verify the dynamic login password in the verification information, includes: If the value of the verification status attribute matches the virtual private network account, then the dynamic verification password provided by the public cloud server is used to verify the dynamic login password in the verification information. Retrieve the role attributes from the application strategy and write the target object into the role attributes.

8. The method according to any one of claims 3 to 7, characterized in that, The step of verifying the static login password using the static verification password provided by the private cloud includes: Based on the ID of the static password verification service provided by the private cloud server in the object policy, obtain the service address of the static password verification service. The static login password corresponding to the virtual private network account is sent to the private cloud server corresponding to the service address, so that the private cloud server compares the static login password with the static verification password. The system receives the comparison result sent by the private cloud server to complete the verification of the static login password.

9. The method according to any one of claims 3 to 7, characterized in that, The dynamic verification password provided by the public cloud and the dynamic login password used by the client are updated synchronously according to a preset time period.

10. A virtual private network access device, characterized in that, include: The receiving module is used to receive a verification request message sent by a virtual private network server. The verification request message is generated by the virtual private network server based on a remote access request sent by a client, and includes at least the verification information of the virtual private network account entered by the target object when the client accesses the private cloud server. The acquisition module is used to obtain the pre-configured application strategy and object strategy required for multi-factor authentication from the public cloud server based on the verification request message. The verification module is used to perform virtual private network access verification on the verification information based on the target verification method indicated by the application policy and the object type indicated by the object policy, using at least one of the verification passwords provided by the private cloud server and the verification passwords provided by the public cloud server. The control module is used to control the virtual private network server to manage the client's access permissions to the private cloud server based on the verification results.

11. An electronic device, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of any of the methods described in claims 1-9.

12. A computer-readable storage medium, characterized in that, It includes a computer program that, when run on an electronic device, causes the electronic device to perform the steps of any of the methods described in claims 1-9.

13. A computer program product, characterized in that, The method includes a computer program stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, causing the electronic device to perform the steps of any one of the methods of claims 1-9.

Images