A PC-side SSLVPN secure tunnel application method and system

Abstract

The present invention discloses a PC-side SSL VPN secure tunnel application method, which is characterized by comprising the following steps: a tunnel connection management module and a connection status management module control the connection status of a virtual tunnel, and the tunnel connection management module controls the connection to an encryption tunnel module; the tunnel connection management module connects to an authentication module, and the tunnel connection management module calls the authentication module to request tunnel establishment; the authentication module obtains authentication / encryption and decryption keys from a key management module, and the authentication module calls the key management module to decrypt returned data; the key management module and the encryption tunnel module mutually encrypt and decrypt keys, the encryption tunnel module calls the password management module to encrypt and decrypt inbound and outbound data, and the encryption tunnel module connects to an SSL VPN gateway via a TCP / UDP protocol; an SSL VPN client is installed on the PC side, and a virtual tunnel is established with the SSL VPN gateway. The present invention encrypts and decrypts transmitted data using a national secret encryption algorithm library, thereby ensuring the security of SSL VPN data transmission.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a PC-side SSL VPN security tunnel application method and system. Background Art

[0002] To prevent out-of-town employees from accessing the intranet, a VPN (virtual private network) is the solution. After connecting to the internet, out-of-town employees connect to the VPN server, which then allows them to access the company's intranet. To ensure data security, all communications between the VPN server and client are encrypted. Data encryption allows for secure data transmission over a dedicated data link, as if it were a private network. However, VPNs actually utilize public links on the internet, hence the name "virtual private network." VPNs, in essence, use encryption technology to create a data tunnel over the public internet. With VPN technology, users can access the intranet and steal data using VPN, whether they are on a business trip or working from home, as long as they have internet access. This is why VPNs are so widely used in enterprises.

[0003] With the increasing use of the internet, network security issues have become increasingly important. SSLVPN is a virtual private network (VPN) technology based on Secure Sockets Layer (SSL). VPN is a remote access technology that uses public networks to establish a private network. When company employees are traveling or working from home, they need VPNs to access server resources on the corporate intranet. However, existing VPNs lack high data transmission security.

[0004] Therefore, a PC-side SSL VPN secure tunnel application method is provided to ensure the security of SSL VPN data transmission. Summary of the Invention

[0005] The purpose of the present invention is to provide a PC-side SSL VPN security tunnel application method to solve the problem of low security of existing data transmission.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A PC-side SSL VPN secure tunnel application method includes: a tunnel connection management module, a state management module, an authentication module, a key management module, an encryption tunnel module, and an SSL VPN gateway; wherein,

[0008] Tunnel connection management module, state management module, authentication module, key management module, encryption tunnel module, SSLVPN gateway; it includes the following steps:

[0009] Status management module, used to manage the connection status and traffic reporting status of the SSL VPN secure tunnel;

[0010] The tunnel connection management module, whose connection state management module is used to control the connection state of the virtual tunnel, controls the connection encryption tunnel module;

[0011] A tunnel connection management module is connected to the authentication module, and the tunnel connection management module calls the authentication module to request tunnel establishment;

[0012] The authentication module is connected to the key management module, and the authentication module calls the key management module to decrypt the returned data;

[0013] The key management module encrypts and decrypts the key with the encryption tunnel module, and the encryption tunnel module calls the password management module to encrypt and decrypt the inbound and outbound data;

[0014] Encrypted tunnel module, which connects to the SSL VPN gateway via TCP / UDP protocol;

[0015] The SSL VPN client is installed on the PC, which establishes a virtual tunnel with the SSL VPN gateway.

[0016] Furthermore, the PC has an SSL VPN client installed, and establishing a virtual tunnel with the SSL VPN gateway includes the following steps:

[0017] S1: The PC has an SSL VPN client installed and a VPN configuration file.

[0018] S2: Load and configure the virtual network device and start the VPN connection thread;

[0019] S3: Connect to the SSL VPN gateway. If the connection fails, perform server verification. If verification succeeds, verify the encryption algorithm, set the virtual IP address, and set the routing table.

[0020] S4: Establish a virtual tunnel with the VPN server and perform data encryption or data compression;

[0021] S5: If the VPN tunnel is stopped, the server will be notified that the tunnel will be closed, system data will be released, and the virtual network card device will be uninstalled.

[0022] Furthermore, the encryption tunnel module adopts commercial cryptographic algorithms for encryption and decryption, and uses SM2, SM3, and SM4 algorithms of commercial cryptographic algorithms to ensure data transmission security.

[0023] Furthermore, the SSL VPN client process module includes an SSL VPN tunnel function module, an SSL VPN Web proxy function module, an SSL VPN certificate two-way authentication module, and an SSL VPN USB Key function module; the usage order is to first start the SSLVPN client, perform login authentication through the SSL VPN USB Key function module, enter the main interface and use the function of the SSL VPN tunnel function module to request the SSL VPN certificate two-way authentication module to perform preliminary authentication preparations for tunnel establishment; the SSL VPN tunnel function module and the SSL VPN certificate two-way authentication module are a call-and-return process; the SSL VPN Web proxy function module is an independent function, and the prerequisite is that the SSL VPN tunnel function module, the SSL VPN certificate two-way authentication module, and the SSL VPN USB Key function module steps need to be completed; the SSL VPN tunnel function module is used to establish a secure VPN tunnel, and the SSLVPN certificate two-way authentication module will simultaneously verify the identities of the client and the server.

[0024] Furthermore, the SSL VPN tunnel function module is used to establish a secure VPN tunnel, including a tunnel control module, an encryption and decryption module, an intelligent IC card encryption and decryption module, a virtual network device module, and a flow reporting module;

[0025] The tunnel control module is the SSL VPN module, which is used to control the tunnel extranet function, including starting, stopping, pausing, and resuming the connection. It starts the VPN service according to the content of the configuration file and can respond in real time and process quickly.

[0026] An encryption and decryption module, used to encrypt the key;

[0027] Smart IC card encryption and decryption module, providing encryption and decryption service module based on smart IC card, realizing the establishment of secure tunnel based on the encryption and decryption function provided by USBKey in accordance with the State Cryptography Administration specification;

[0028] Virtual network device module: The virtual network device module provides tunnel layer and local network routing. The virtual network device module allows local traffic to be sent directly into the encrypted tunnel, allowing users to securely access encrypted resources on remote servers.

[0029] The traffic reporting module monitors the traffic size / rate generated by the tunnel and displays the traffic / rate passing through the tunnel.

[0030] Furthermore, the SSL VPN Web proxy function module includes a traffic forwarding module and a PAC web automatic proxy setting module;

[0031] The traffic forwarding module determines the port based on the forwarding resource returned by the gateway, listens to the specified port locally, and acts as an HTTP proxy server;

[0032] PAC web automatic proxy setting module, PAC proxy-free setting, for browsers that support PAC. Through this function, the proxy server can be automatically selected without the user having to set it up.

[0033] Furthermore, the SSL VPN certificate two-way authentication module includes a national secret certificate authentication module and a national secret certificate local storage encryption module;

[0034] The national secret certificate authentication module is used to provide authentication based on the national secret certificate, which is a dual certificate of signature and encryption issued by the national secret issuing authority;

[0035] The local storage encryption module of the national secret certificate is used for encrypted storage to ensure the security of local storage of certificates. By using national secret encrypted storage, customer keys are prevented from being stolen.

[0036] Furthermore, the SSL VPN USB Key function module includes a smart IC card authentication module and a smart IC card SKF encryption and decryption module;

[0037] Smart IC card authentication module, used to provide smart IC card authentication based on national encryption, national encryption skf interface, and dual certificate import USBKey;

[0038] The smart IC card SKF encryption and decryption module is used to provide encryption and decryption service modules during tunnel communication and adopts the ECC_SM4_SM3 cipher suite.

[0039] Furthermore, the SSL VPN client also includes a login function module, a resource list function module, a tunnel status control function module, a flow reporting function module, and a setting function module;

[0040] The login function module is a user interface module that implements basic functions; including login / resource list, setting web proxy port, and PAC automatic proxy switch user interface;

[0041] The resource list function module is a resource list, including a list of authorized resources provided by the display gateway. Resources are usually returned directly by the gateway and need to be obtained through an encrypted tunnel.

[0042] The flow reporting function module is used for tunnel status control and connection control;

[0043] The flow reporting function module is used for flow reporting;

[0044] The setting function module is used to set system parameters, which is conducive to the implementation of http proxy port / pac automatic proxy.

[0045] Compared with the existing technology, the beneficial effect of the present invention is to encrypt and decrypt the transmitted data through the national secret encryption algorithm library, thereby ensuring the security of SSL VPN data transmission and preventing data from being stolen during network transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 Schematic diagram of the structure of an embodiment of the present invention;

[0047] Figure 2 is a cross-sectional view of an embodiment of the present invention; DETAILED DESCRIPTION

[0048] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0049] See also Figure 1-2 The present invention provides a PC-side SSL VPN secure tunnel application method, comprising: a tunnel connection management module, a state management module, an authentication module, a key management module, an encryption tunnel module, and an SSL VPN gateway; and the method comprises the following steps:

[0050] Status management module, used to manage the connection status and traffic reporting status of the SSL VPN secure tunnel;

[0051] The tunnel connection management module, whose connection state management module is used to control the connection state of the virtual tunnel, controls the connection encryption tunnel module;

[0052] A tunnel connection management module is connected to the authentication module, and the tunnel connection management module calls the authentication module to request tunnel establishment;

[0053] The authentication module is connected to the key management module, which obtains the authentication / encryption and decryption keys from the key management module. The authentication module calls the key management module to decrypt the returned data;

[0054] The key management module encrypts and decrypts the key with the encryption tunnel module, and the encryption tunnel module calls the password management module to encrypt and decrypt the inbound and outbound data;

[0055] Encrypted tunnel module, which connects to the SSL VPN gateway via TCP / UDP protocol;

[0056] The PC is installed with an SSL VPN client, which establishes a virtual tunnel with the SSL VPN gateway. The invention has the beneficial effect of ensuring stable SSL VPN user data transmission while encrypting and encapsulating the transmitted data using the GM SSL encryption algorithm library, thereby ensuring the security of SSL VPN data transmission and preventing data from being stolen during network transmission.

[0057] A PC-side SSL VPN secure tunnel application method, such as Figure 1 As shown, VPN setup file → configuration file parsing → setting system configuration options → loading and setting virtual network devices → starting the VPN connection thread, SSL VPN client → connecting to the VPN server. If the connection fails, server verification is performed. If verification succeeds, the encryption algorithm is verified: setting the virtual IP address and routing table; then establishing a virtual tunnel and performing data encryption and decryption or data compression; stopping the VPN tunnel → notifying the server that the tunnel will be closed → releasing system data; and uninstalling the virtual network card device. The PC has an SSL VPN client installed, establishing a virtual tunnel with the SSL VPN gateway, and performing data encryption or data compression. Establishing a virtual tunnel with the SSL VPN gateway includes the following steps:

[0058] S1: The PC has a VPN configuration file (you can create your own VPN configuration file or create a work account to obtain a VPN configuration file from the company). The PC parses the VPN configuration file and sets the system configuration options.

[0059] S2: Load and set up the virtual network device and start the VPN connection thread

[0060] S3: Connect to the VPN server. If the connection fails, perform server verification. If verification succeeds, verify the encryption algorithm, set the virtual IP address, and set the routing table.

[0061] S4: Establish a virtual tunnel with the VPN server and perform data encryption or data compression;

[0062] S5: If the VPN tunnel is stopped, the server will be notified that the tunnel will be closed, system data will be released, and the virtual network card device will be uninstalled.

[0063] Furthermore, the encryption tunnel module adopts commercial cryptographic algorithms for encryption and decryption, and uses SM2, SM3, and SM4 algorithms of commercial cryptographic algorithms to ensure data transmission security.

[0064] like Figure 2As shown, it includes a tunnel connection management module, a state management module, an authentication module, a key management module, an encryption tunnel module, and a server / SSL VPN gateway; the tunnel connection management module connects to the state management module to control the connection state of the tunnel, the tunnel connection management module controls the connection to the encryption tunnel module, the tunnel connection management module connects to the authentication module, the tunnel connection management module calls the authentication management module to request tunnel establishment, the authentication module obtains the authentication / encryption and decryption key from the key management module, the authentication module calls the key management module to decrypt the returned data, the key management module and the encryption tunnel module encrypt and decrypt each other or the key, the encryption tunnel module calls the password management module to encrypt and decrypt the inbound and outbound data, the encryption tunnel module is connected to the server / SSL VPN gateway via TCP / UDP, the connection channel between the encryption tunnel module and the server / SSLVPN gateway carries TCP and UDP protocol numbers, TCP and UDP are two transport layer protocols on the network layer; the PC logs in to the SSL VPN gateway through a browser.

[0065] Furthermore, the SSL VPN client process module includes an SSL VPN tunnel function module, an SSL VPN Web proxy function module, an SSL VPN certificate two-way authentication module, and an SSL VPN USB Key function module; the usage order is to first start the SSLVPN client (UI interface), perform login authentication through the SSL VPN USB Key function module (similar to a bank U-shield), enter the main interface, and use the function of the SSL VPN tunnel function module to request the SSL VPN certificate two-way authentication module to perform preliminary authentication preparations for tunnel establishment. The SSL VPN tunnel function module and the SSL VPN certificate two-way authentication module are call-return processes, and the SSL VPN Web proxy function module is an independent function, and the prerequisite is that the SSL VPN tunnel function module, SSL VPN certificate two-way authentication module, and SSL VPN USB Key function module steps must be completed.

[0066] Furthermore, the SSL VPN client includes a UI login function module including a UI resource list function module 2, a UI tunnel state control function module 3, a UI flow report function module 4, and a UI setting function module 5;

[0067] UI login function module: a user interface module for implementing basic functions; login / resource list, setting web proxy port, PAC automatic proxy switch user interface;

[0068] UI resource list function module: resource list, which displays the list of resources that can be authorized to access provided by the gateway; resources are usually returned directly by the gateway and need to be obtained through an encrypted tunnel;

[0069] UI tunnel status control function module: tunnel status control, used to control the connection;

[0070] UI traffic report function module: traffic report, used for traffic reporting;

[0071] UI setting function module: settings, used for system parameter settings; http proxy port / pac automatic proxy implementation;

[0072] Furthermore, the SSL VPN tunnel function module includes a tunnel control module, an encryption and decryption module, an intelligent IC card encryption and decryption module, a virtual network device (tap / tun) module, and a traffic reporting module. The SSL VPN tunnel function module is used to control the tunnel extranet function, including the functions of starting, stopping, pausing, and resuming the connection. It starts the VPN service according to the content of the configuration file and can respond in real time and process quickly.

[0073] An encryption and decryption module, used to encrypt the key;

[0074] Smart IC card encryption and decryption module, providing a smart IC card-based (usbkey) encryption and decryption service module, realizing the establishment of a secure tunnel based on the encryption and decryption function provided by the usbkey in accordance with the National Cryptography Administration (GMT_0016-2012) specification;

[0075] Virtual network device (tap / tun) module. Virtual tap / tun provides tunnel layer and local network routing. Tap / run device allows local traffic to be sent directly into an encrypted tunnel, allowing users to securely access encrypted resources on remote servers.

[0076] TUN / TAP is a virtual network device in the operating system kernel. All virtual network devices are implemented in software. If the server has a TUN / TAP module, the VPN proxy function can be enabled.

[0077] Traffic reporting module monitors the traffic size / rate generated by the tunnel and displays the traffic / rate passing through the tunnel;

[0078] Furthermore, the SSL VPN Web proxy function module includes a traffic forwarding module and a PAC web automatic proxy setting module;

[0079] The traffic forwarding module determines the port based on the forwarding resource returned by the gateway, listens to the specified port locally, and acts as an HTTP proxy server;

[0080] PAC web automatic proxy setting module, PAC proxy-free setting, for browsers that support PAC. Through this function, the proxy server can be automatically selected without the user having to set it up;

[0081] Furthermore, in order to ensure the security of transmitted information, the SSL VPN certificate two-way authentication module includes the national secret certificate authentication module, the national secret certificate local storage encryption module,

[0082] The national secret certificate authentication module provides authentication based on the national secret certificate, which includes signature and encryption dual certificates issued by the national secret issuing authority;

[0083] The local storage encryption module of the national secret certificate is encrypted and stored securely, using national secret encryption to prevent customer keys from being stolen;

[0084] Furthermore, the SSL VPN USB Key function module includes a smart IC card authentication module and a smart IC card SKF encryption and decryption module;

[0085] Smart IC card authentication module, providing smart IC card (USBKEY) authentication based on national encryption; national encryption skf interface, dual certificate import USB key;

[0086] Smart IC card SKF encryption and decryption module provides encryption and decryption service module during tunnel communication; adopts ECC_SM4_SM3 cipher suite;

[0087] First start the SSL VPN client (UI interface), log in and authenticate through the SSL VPN client, enter the main interface and use the SSL VPN tunnel function module to request the SSL VPN certificate two-way authentication module to perform preliminary authentication preparations for tunnel establishment. The SSL VPN tunnel function module and the SSL VPN certificate two-way authentication module are call-and-return processes, and the SSL VPN Web proxy function module is an independent function.

[0088] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A PC-side SSL VPN secure tunnel application method, characterized in that: include: Tunnel connection management module, state management module, authentication module, key management module, encryption tunnel module, SSL VPN gateway; It includes the following steps: Status management module, used to manage the connection status and traffic reporting status of the SSL VPN secure tunnel; The tunnel connection management module, whose connection state management module is used to control the connection state of the virtual tunnel, controls the connection encryption tunnel module; A tunnel connection management module is connected to the authentication module, and the tunnel connection management module calls the authentication module to request tunnel establishment; The authentication module is connected to the key management module, and the authentication module calls the key management module to decrypt the returned data; The key management module performs encryption and decryption or key processing with the encryption tunnel module. The encryption tunnel module calls the password management module to encrypt and decrypt inbound and outbound data; Encrypted tunnel module, which connects to the SSL VPN gateway via TCP / UDP protocol; The PC is installed with an SSL VPN client, which establishes a virtual tunnel with the SSL VPN gateway; The SSL VPN client is installed on the PC. Establishing a virtual tunnel with the SSL VPN gateway involves the following steps: S1: The PC has an SSL VPN client installed and a VPN configuration file. S2: Load and configure the virtual network device and start the VPN connection thread; S3: Connect to the SSL VPN gateway. If the connection fails, perform server verification. If verification succeeds, verify the encryption algorithm, set the virtual IP address, and set the routing table. S4: Establish a virtual tunnel with the VPN server and perform data encryption or data compression; S5: If the VPN tunnel is stopped, the server will be notified that the tunnel will be closed and the system data will be released; Uninstall the virtual network card device.

2. The PC-side SSL VPN secure tunnel application method according to claim 1, characterized in that: The encrypted tunnel module uses commercial cryptographic algorithms for encryption and decryption, and uses the SM2, SM3, and SM4 algorithms of commercial cryptographic algorithms to ensure data transmission security.

3. The PC-side SSL VPN secure tunnel application method according to claim 2, characterized in that: The SSL VPN client process module includes the SSL VPN tunnel function module, the SSL VPN Web proxy function module, the SSL VPN certificate two-way authentication module, and the SSL VPN USB Key function module; the usage order is to first start the SSL VPN client, perform login authentication through the SSL VPN USBKey function module, enter the main interface and use the function of the SSL VPN tunnel function module to request the SSLVPN certificate two-way authentication module to perform the preliminary authentication preparations for tunnel establishment. The SSL VPN tunnel function module and the SSLVPN certificate two-way authentication module are the call return process. The SSL VPN Web proxy function module is an independent function, and the prerequisite is that the SSL VPN tunnel function module, the SSL VPN certificate two-way authentication module, and the SSL VPN USB Key function module steps must be completed; the SSL VPN tunnel function module is used to establish a secure VPN tunnel, and the SSL VPN certificate two-way authentication module will verify the identities of the client and server at the same time.

4. The PC-side SSL VPN secure tunnel application method according to claim 3, characterized in that: The SSL VPN tunnel function module is used to establish a secure VPN tunnel, including a tunnel control module, an encryption and decryption module, an intelligent IC card encryption and decryption module, a virtual network device module, and a traffic reporting module. in The tunnel control module is the SSL VPN module, which is used to control the tunnel extranet function, including starting, stopping, pausing, and resuming the connection. It starts the VPN service according to the content of the configuration file and can respond in real time and process quickly. An encryption and decryption module, used to encrypt the key; Smart IC card encryption and decryption module, providing encryption and decryption service module based on smart IC card, realizing the establishment of secure tunnel based on the encryption and decryption function provided by USBKey in accordance with the State Cryptography Administration specification; Virtual network device module: The virtual network device module provides tunnel layer and local network routing. The virtual network device module allows local traffic to be sent directly into the encrypted tunnel, allowing users to securely access encrypted resources on remote servers. The traffic reporting module monitors the traffic size / rate generated by the tunnel and displays the traffic / rate passing through the tunnel.

5. The PC-side SSL VPN secure tunnel application method according to claim 3, characterized in that: SSL VPN Web proxy function module, which includes traffic forwarding module and PAC web automatic proxy setting module; The traffic forwarding module determines the port based on the forwarding resource returned by the gateway, listens to the specified port locally, and acts as an HTTP proxy server; PAC web automatic proxy setting module, PAC proxy-free setting, for browsers that support PAC. Through this function, the proxy server can be automatically selected without the user having to set it up.

6. The PC-side SSL VPN secure tunnel application method according to claim 3, characterized in that: The SSL VPN certificate two-way authentication module includes the national secret certificate authentication module and the national secret certificate local storage encryption module; The national secret certificate authentication module is used to provide authentication based on the national secret certificate, which is a dual certificate of signature and encryption issued by the national secret issuing authority; The local storage encryption module of the national secret certificate is used for encrypted storage to ensure the security of local storage of certificates. By using national secret encrypted storage, customer keys are prevented from being stolen.

7. The PC-side SSL VPN secure tunnel application method according to claim 3, characterized in that: The SSL VPN USBKey function module includes the smart IC card authentication module and the smart IC card SKF encryption and decryption module; Smart IC card authentication module, used to provide smart IC card authentication based on national encryption, national encryption skf interface, and dual certificate import USBKey; The smart IC card SKF encryption and decryption module is used to provide encryption and decryption service modules during tunnel communication and adopts the ECC_SM4_SM3 cipher suite.

8. The PC-side SSL VPN secure tunnel application method according to claim 3, characterized in that: The SSL VPN client also includes a login function module, a resource list function module, a tunnel status control function module, a traffic report function module, and a settings function module; The login function module is a user interface module that implements basic functions; Includes login / resource list, setting web proxy port, and PAC automatic proxy switch user interface; The resource list function module is a resource list, including a list of authorized resources provided by the display gateway. Resources are usually returned directly by the gateway and need to be obtained through an encrypted tunnel. The flow reporting function module is used for tunnel status control and connection control; The flow reporting function module is used for flow reporting; The setting function module is used to set system parameters, which is conducive to the implementation of http proxy port / PAC automatic proxy.

Images