Mobile SSLVPN secure tunnel application method and system

Abstract

The present invention discloses a mobile SSL VPN security tunnel application method and system. The method includes an identity authentication step and a tunnel establishment step. The system includes a mobile client and an SSL VPN server. The mobile client is provided with a security tunnel component and a cryptographic algorithm component. The security tunnel component includes an engine call module, a tunnel management module, a secret key certificate module, a policy acquisition module, a connection management module and a security detection module. The cryptographic algorithm component includes a cryptographic operation module, a cryptographic management module and a security audit module. When the mobile client and the SSL VPN server platform communicate, the sender encrypts and signs the transmitted information, and the receiver verifies the signature and decrypts the information. The communication process involves a signature certificate, an encrypted public-private key pair, a certificate and a signature certificate, thereby strengthening the security operation during communication, effectively ensuring the secure transmission of information, and preventing the information from being leaked or tampered with by lawless elements.

Description

Technical Field

[0001] The present invention relates to the technical field of SSLVPN, and in particular to a mobile terminal SSLVPN secure tunnel application method and system. Background Art

[0002] Information security is a multi-layered, multi-factored, and integrated dynamic process. It requires comprehensive consideration and unified planning of information systems and organizational structures. Information security also requires monitoring changes within and outside the system's internal and external environments. A single security flaw in any aspect of information security can easily pose a threat to the entire system and organization. Therefore, information security, as a multi-layered, multi-factored, and integrated dynamic process, is a continuous development that requires a systematic approach.

[0003] OpenSSL is an open-source software library that allows applications to communicate securely, preventing eavesdropping and verifying the identity of the other end of the connection. It includes major cryptographic algorithms, common key and certificate management functions, and the SSL / TLS protocol. This package is widely used by web servers on the Internet.

[0004] When existing mobile clients communicate with SSLVPN server platforms, security issues are often inadequate, and the secure transmission of information cannot be effectively guaranteed. Information can be easily leaked or tampered with by criminals. Summary of the Invention

[0005] The purpose of the present invention is to provide a mobile terminal SSLVPN secure tunnel application method and system to solve the above-mentioned deficiencies in the prior art.

[0006] To achieve the above-mentioned purpose, the present invention provides the following technical solution: a mobile terminal SSLVPN secure tunnel application method, the method comprising an identity authentication step and a tunnel establishment step:

[0007] The authentication process includes: the user downloads the corresponding mobile client through the Internet, the mobile client obtains the signature public key from the SSLVPN server, the user enters the 4A account number on the mobile client, the mobile client encrypts the account number using the SSLVPN server session key, and sends an authentication request to the SSLVPN server, which then receives the authentication query request.

[0008] The SSLVPN server receives the authentication request, reads the identity authentication information submitted during the registration process from the database, and decrypts the account encryption information using the national encryption algorithm;

[0009] If the SSLVPN server verifies that the account information obtained by decryption is consistent with the account information read from the database, the SSLVPN server sends the digital certificate and ciphertext to the mobile client.

[0010] If the account information obtained by the SSLVPN server through verification and decryption is inconsistent with the account information read from the database, the SSLVPN server sends an authentication failure notification to the mobile client. If the mobile client sends an authentication query request more than three times and all three authentications fail, the account is locked.

[0011] The tunnel establishment steps include:

[0012] The mobile client generates a random number A and sends it and an access request to the SSLVPN server. The SSLVPN server obtains the communication protocol version list and SM2 encryption algorithm supported by the mobile client.

[0013] After receiving the request from the client, the SSLVPN server performs corresponding data processing, encrypts the processing result, generates a ciphertext data packet of the processing result, and sends its national secret certificate and the national secret certificate request for verifying the identity of the mobile client through the SSL secure channel; at the same time, the SSLVPN server generates a random number B and sends it to the mobile client;

[0014] The mobile client verifies the SSLVPN server's national encryption certificate. If the verification is correct, the mobile client sends the master key generated using the SM2 algorithm to the SSLVPN server. The master key is generated using random numbers A and B.

[0015] After receiving the master key from the mobile client, the SSLVPN server uses the signature private key to decrypt the master key and verify the data; if the verification is successful, a national secret tunnel is established.

[0016] Preferably, the mobile client uses the public key provided by the SSLVPN server to generate a session key. After the mobile client uses the SSLVPN server public key to encrypt the session data, it uses the signature private key to sign the ciphertext data to generate the first signature information, and sends the ciphertext data, the first signature information and the signature certificate to the SSLVPN server.

[0017] Preferably, the SSLVPN server queries the mobile client's signature public key based on the signature certificate, uses the queried public key to verify the first signature information, and after the verification is passed, uses the signature private key to decrypt the ciphertext data to obtain the plaintext data.

[0018] Preferably, in the identity authentication step, after the SSLVPN server sends the digital certificate to the mobile client, the mobile client checks the digital certificate, including whether the certificate is issued by a trusted organization, whether the domain name in the certificate is consistent with the actual domain name, and whether the certificate is expired.

[0019] The present invention also provides a mobile SSLVPN secure tunnel application system, based on the above method, comprising a mobile client and an SSLVPN server, wherein the mobile client is provided with a secure tunnel component and a cryptographic algorithm component;

[0020] The secure tunnel component includes an engine calling module, a tunnel management module, a key certificate module, a policy acquisition module, a connection management module and a security detection module;

[0021] The tunnel management module is used to dynamically schedule tunnels for client use based on the operation status after weighted calculation, and dynamically schedule and close idle tunnels when the user operation volume decreases;

[0022] The secret key certificate module is used to encrypt the session key with the SSLVPN server public key, generate a random number for identity authentication, sign the random number, and send it to the SSLVPN server together with the session key ciphertext and the enterprise certificate;

[0023] The policy acquisition module is used to obtain the policy selected by the user;

[0024] The connection management module is used to control the dial-up connection of the SSLVPN secure tunnel based on the restriction data provided by the setting module and in combination with the time-related data and the flow-related data;

[0025] The cryptographic algorithm component includes a cryptographic operation module, a cryptographic management module and a security audit module. The cryptographic operation module is used to call the API interface of the cryptographic management module according to the instructions received by the interface module to negotiate session keys, release session keys and encrypt and decrypt voice data. The security audit module records the system activities in a stream, and the record sequentially checks the audit tracking records, reviews and verifies the environment and activities of each event according to the path of the event from beginning to end.

[0026] Preferably, the SSLVPN server is provided with a verification module and an authentication module;

[0027] The verification module is used for the SSLVPN server to send a server response to the client after receiving the client request, sending a digital certificate stored in the encryption chip, confirming the communication protocol version used, confirming the encryption method, and the server generating a random number B and sending it to the client; the random number A and the random number B are used to generate a master key;

[0028] The authentication module is used for the SSLVPN server to decrypt the encrypted data after receiving it from the mobile client using the encryption private key, verify the data, generate a working key, and send a ciphertext to the mobile client.

[0029] Preferably, when the amount of information in the digital certificate sent to the mobile client is insufficient, the verification module sends a key negotiation request to the digital client.

[0030] The beneficial effects of the present invention are as follows: when the present invention communicates between a mobile client and an SSLVPN server platform, the sender encrypts and signs the transmitted information, and the receiver performs signature verification and decryption operations, and the communication process involves a signature certificate, a signature public-private key pair, an encryption certificate, an encryption public-private key pair, a certificate, and a signature certificate, thereby enhancing security operations during communication, effectively ensuring the secure transmission of information, and preventing information from being leaked or tampered with by criminals. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments described in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0032] Figure 1 A flowchart of the identity authentication steps of the mobile SSLVPN secure tunnel application method according to a preferred embodiment of the present invention;

[0033] Figure 2 A flow chart of the tunnel establishment steps of the mobile SSLVPN secure tunnel application method according to a preferred embodiment of the present invention;

[0034] Figure 3 This is a structural block diagram of a mobile SSLVPN secure tunnel application system according to another preferred embodiment of the present invention. DETAILED DESCRIPTION

[0035] To make the purpose, technical solutions, and advantages of the embodiments of the present invention more clear, the following will be a clear and complete description of the technical solutions in the embodiments of the present invention. Obviously, the embodiments described are some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work shall fall within the scope of protection of the present invention.

[0036] The mobile terminal SSLVPN secure tunnel application method of the preferred embodiment of the present invention is as follows Figure 1-2 As shown, the method includes an authentication step and a tunnel establishment step:

[0037] Authentication steps such as Figure 1 As shown, it includes: the user downloads the corresponding mobile client through the Internet, the mobile client obtains the signature public key from the SSLVPN server, the user enters the 4A account on the mobile client, the mobile client encrypts the account using the SSLVPN server session key, sends an authentication request to the SSLVPN server, and the SSLVPN server obtains the authentication query request;

[0038] The SSLVPN server receives the authentication request, reads the identity authentication information submitted during the registration process from the database, and decrypts the account encryption information using the national encryption algorithm;

[0039] If the SSLVPN server verifies that the account information obtained by decryption is consistent with the account information read from the database, the SSLVPN server sends the digital certificate and ciphertext to the mobile client.

[0040] If the account information obtained by the SSLVPN server through verification and decryption is inconsistent with the account information read from the database, the SSLVPN server sends an authentication failure notification to the mobile client. If the mobile client sends an authentication query request more than three times and all three authentications fail, the account is locked.

[0041] The steps to establish a tunnel are as follows: Figure 2 Shown, including:

[0042] The mobile client generates a random number A and sends it and an access request to the SSLVPN server. The SSLVPN server obtains the communication protocol version list and SM2 encryption algorithm supported by the mobile client.

[0043] After receiving the request from the client, the SSLVPN server performs corresponding data processing, encrypts the processing result, generates a ciphertext data packet of the processing result, and sends its national secret certificate and the national secret certificate request for verifying the identity of the mobile client through the SSL secure channel; at the same time, the SSLVPN server generates a random number B and sends it to the mobile client;

[0044] The mobile client verifies the SSLVPN server's national encryption certificate. If the verification is correct, the mobile client sends the master key generated using the SM2 algorithm to the SSLVPN server. The master key is generated using random numbers A and B.

[0045] After receiving the master key from the mobile client, the SSLVPN server uses the signature private key to decrypt the master key and verify the data; if the verification is successful, a national secret tunnel is established.

[0046] When the present invention communicates between a mobile client and an SSLVPN server platform, the sender encrypts and signs the transmitted information, and the receiver performs signature verification and decryption operations. In addition, the communication process involves a signature certificate, a signature public-private key pair, an encryption certificate, an encryption public-private key pair, a certificate, and a signature certificate, thereby enhancing security operations during communication, effectively ensuring the secure transmission of information, and preventing information from being leaked or tampered with by lawless elements.

[0047] The mobile client uses the public key provided by the SSLVPN server to generate a session key. After the mobile client uses the SSLVPN server public key to encrypt the session data, it uses the signature private key to sign the ciphertext data to generate the first signature information, and sends the ciphertext data, the first signature information and the signature certificate to the SSLVPN server.

[0048] The SSLVPN server queries the mobile client's signature public key based on the signature certificate, uses the queried public key to verify the first signature information, and after the verification is passed, uses the signature private key to decrypt the ciphertext data to obtain the plaintext data.

[0049] During the authentication step, after the SSLVPN server sends the digital certificate to the mobile client, the mobile client checks the digital certificate to see whether it is issued by a trusted authority, whether the domain name in the certificate is consistent with the actual domain name, and whether the certificate is expired.

[0050] The present invention also provides another embodiment applied to the previous embodiment, such as Figure 3 As shown, it is specifically a mobile SSLVPN secure tunnel application system, including a mobile client and an SSLVPN server, wherein the mobile client is provided with a secure tunnel component and a cryptographic algorithm component;

[0051] The secure tunnel component includes an engine calling module, a tunnel management module, a key certificate module, a policy acquisition module, a connection management module and a security detection module;

[0052] The tunnel management module is used to dynamically schedule tunnels for client use based on the operation status after weighted calculation, and dynamically schedule and close idle tunnels when the user operation volume decreases;

[0053] The secret key certificate module is used to encrypt the session key with the SSLVPN server public key, generate a random number for identity authentication, sign the random number, and send it to the SSLVPN server together with the session key ciphertext and the enterprise certificate;

[0054] The policy acquisition module is used to obtain the policy selected by the user;

[0055] The connection management module is used to control the dial-up connection of the SSLVPN secure tunnel based on the restriction condition data provided by the setting module in combination with the time-related data and the flow-related data.

[0056] The cryptographic algorithm component includes a cryptographic operation module, a cryptographic management module and a security audit module. The cryptographic operation module is used to call the API interface of the cryptographic management module according to the instructions received by the interface module to negotiate session keys, release session keys and encrypt and decrypt voice data; the security audit module records the system activities in a stream, and the records sequentially check the audit tracking records, review and verify the environment and activities of each event according to the path of the event from beginning to end.

[0057] The SSLVPN server is equipped with a verification module and an authentication module;

[0058] The verification module is used for the SSLVPN server to send a server response to the client after receiving the client request, sending a digital certificate stored in the encryption chip, confirming the communication protocol version used, confirming the encryption method, and the server generating a random number B and sending it to the client; the random number A and the random number B are used to generate a master key;

[0059] The authentication module is used for the SSLVPN server to decrypt the encrypted data after receiving it from the mobile client using the encryption private key, verify the data, generate a working key, and send a ciphertext to the mobile client.

[0060] When the server certificate sent by the verification module to the mobile client contains insufficient information, a key negotiation request is sent to the client.

[0061] The definitions of the signature certificate, encryption private key, encryption certificate, signature public key, and signature private key in the present invention are as follows:

[0062] Signature certificate: used to sign user information to ensure the validity and non-repudiation of the information.

[0063] An encryption private key is a parameter that is input into an algorithm that converts plaintext to ciphertext or vice versa. Keys are categorized as symmetric and asymmetric.

[0064] Encryption certificate: Contains the public key, the subject of the public key, and the certificate authority (CA). It is used to ensure that the public key is the subject of the public key and prevent the problem of public key forgery.

[0065] Signature public key: The public key is used to encrypt information and decrypt digital signatures.

[0066] Signature private key: The private key is used to decrypt information and encrypt message digests.

[0067] The above description is merely illustrative of certain exemplary embodiments of the present invention. It goes without saying that those skilled in the art will be able to modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the above drawings and description are illustrative in nature and should not be construed as limiting the scope of protection of the claims.

Claims

1. A mobile terminal SSLVPN secure tunnel application method, characterized in that: The method includes an authentication step and a tunnel establishment step: The authentication process includes: the user downloads the corresponding mobile client through the Internet, the mobile client obtains the signature public key from the SSLVPN server, the user enters the 4A account number on the mobile client, the mobile client encrypts the account number using the SSLVPN server session key, and sends an authentication request to the SSLVPN server, which then receives the authentication request. The SSLVPN server receives the authentication request, reads the identity authentication information submitted during the registration process from the database, and decrypts the encrypted information of the account using the national encryption algorithm; If the SSLVPN server verifies that the account information obtained by decryption is consistent with the account information read from the database, the SSLVPN server sends the digital certificate and ciphertext to the mobile client. If the account information obtained by the SSLVPN server through verification and decryption is inconsistent with the account information read from the database, the SSLVPN server sends an authentication failure notification to the mobile client. If the mobile client sends authentication requests more than three times and all three authentications fail, the account is locked. The tunnel establishment steps include: The mobile client generates a random number A and sends it and an access request to the SSLVPN server. The SSLVPN server obtains the communication protocol version list and SM2 encryption algorithm supported by the mobile client. After receiving the request from the mobile client, the SSLVPN server performs corresponding data processing, encrypts the processing result, generates a ciphertext data packet of the processing result, and sends its national secret certificate and the national secret certificate request for verifying the identity of the mobile client through the SSLVPN secure tunnel; at the same time, the SSLVPN server generates a random number B and sends it to the mobile client; The mobile client verifies the SSLVPN server's national encryption certificate. If the verification is correct, the mobile client sends the master key generated using the SM2 algorithm to the SSLVPN server. The master key is generated using random numbers A and B. After receiving the master key from the mobile client, the SSLVPN server uses the signature private key to decrypt the master key and verify the data; if the verification is successful, a national secret tunnel is established.

2. The mobile SSLVPN secure tunnel application method according to claim 1, wherein: The mobile client uses the signature public key provided by the SSLVPN server to generate a session key. After the mobile client uses the signature public key of the SSLVPN server to encrypt the session data, it uses the signature private key to sign the ciphertext data to generate the first signature information, and sends the ciphertext data, the first signature information and the signature certificate to the SSLVPN server.

3. The mobile SSLVPN secure tunnel application method according to claim 1, wherein: The SSLVPN server queries the mobile client's signature public key based on the signature certificate, uses the queried signature public key to verify the first signature information, and uses the signature private key to decrypt the ciphertext data to obtain the plaintext data after the signature verification is passed.

4. The mobile SSLVPN secure tunnel application method according to claim 1, wherein: During the authentication step, after the SSLVPN server sends the digital certificate to the mobile client, the mobile client checks the digital certificate to see whether it is issued by a trusted authority, whether the domain name in the certificate is consistent with the actual domain name, and whether the digital certificate is expired.

5. A mobile SSLVPN secure tunnel application system, based on the method according to any one of claims 1 to 4, characterized in that: It includes a mobile client and an SSLVPN server, wherein the mobile client is provided with a secure tunnel component and a cryptographic algorithm component; The secure tunnel component includes an engine calling module, a tunnel management module, a key certificate module, a policy acquisition module, a connection management module and a security detection module; The tunnel management module is used to dynamically schedule tunnels for use by mobile clients based on the operation status after weighted calculation, and dynamically schedule and close idle tunnels when the user operation volume decreases; The secret key certificate module is used to encrypt the session key with the SSLVPN server signature public key, generate a random number for identity authentication, sign the random number, and send it to the SSLVPN server together with the session key ciphertext and the enterprise certificate; The policy acquisition module is used to obtain the policy selected by the user; The connection management module is used to control the dial-up connection of the SSLVPN secure tunnel based on the restriction data provided by the setting module and in combination with the time-related data and the flow-related data; The cryptographic algorithm component includes a cryptographic operation module, a cryptographic management module and a security audit module. The cryptographic operation module is used to call the API interface of the cryptographic management module according to the instructions received by the interface module to negotiate session keys, release session keys and encrypt and decrypt voice data; the security audit module records the system activities in a stream, and the records check the audit tracking records, review and verify the environment and activities of each event in sequence according to the path of the event from beginning to end.

6. The mobile SSLVPN secure tunnel application system according to claim 5, characterized in that: The SSLVPN server is equipped with a verification module and an authentication module; The verification module is used for the SSLVPN server to send a corresponding response to the mobile client after receiving the request from the mobile client, sending a digital certificate stored in the encryption chip, confirming the communication protocol version used, confirming the encryption method, the mobile client generates a random number A and sends it to the SSLVPN server, and the SSLVPN server generates a random number B and sends it to the mobile client; the random number A and random number B are used to generate a master key; The authentication module is used for the SSLVPN server to decrypt the encrypted data after receiving it from the mobile client using the encryption private key, verify the data, generate a working key, and send a ciphertext to the mobile client.

7. The mobile SSLVPN secure tunnel application system according to claim 6, characterized in that: When the amount of information in the digital certificate sent by the verification module to the mobile client is insufficient, a key negotiation request is sent to the mobile client.

Images