A hardened network admission system and method

Abstract

The application belongs to the technical field of network security, and specifically provides a reinforced network access system and method, the system comprising a network access control terminal, a client connected with the network access control terminal, an authentication server and a network management terminal; the authentication server and the network management terminal are connected; the client saves an access credential, sends the access credential to the network access control terminal when accessing the network, and accesses the network according to the authentication result of the access credential forwarded by the network access control terminal; the network management terminal receives the access credential forwarded by the network access control terminal, judges whether the access credential is an initial access credential, generates a new access credential and sends the new access credential to the authentication server for storage, and simultaneously forwards the new access credential to the client through the network access control terminal. The security problem of the access system caused by user input of authentication credentials is solved, and the non-sensing access of the client improves the network use efficiency and user experience.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to an enhanced network access control system and method. Background Technology

[0002] 802.1x is a widely used communication protocol in network access control systems, characterized by port-based network access control. Clients are denied network access by default unless they pass authentication and obtain authorization. The entire 802.1x implementation consists of three parts: the requester system, the authentication system, and the authentication server system. The requester is an entity located at one end of the local area network link, authenticated by the authentication system connected to the other end of the link. The requester is typically a user terminal device that supports 802.1x authentication; the user initiates 802.1x authentication by launching client software. The authentication system authenticates the authentication requester connected to the other end of the link. The authentication system is typically a network device that supports the 802.1x protocol, providing a service port for the requester. This port can be a physical port or a logical port, and 802.1x authentication is generally implemented on user access devices (such as LAN switches and access points). The authentication server is the entity that provides authentication services to the authentication system; typically, a RADIUS server is used to implement the authentication and authorization functions of the authentication server.

[0003] Most handheld devices currently support EAP authentication based on 802.1x; simply enter the corresponding username and password to complete the authentication automatically. On PCs, authentication is typically done by entering a username and password in a browser and then authorizing access to the network. Other methods also exist, such as SMS authentication and guest authentication.

[0004] The current solutions have several drawbacks: first, users must enter authentication credentials, such as username and password, which results in low network access efficiency; second, account and other credential data are easily obtained and used illegally; and third, privacy data is easily leaked. Summary of the Invention

[0005] To address the problems existing in the current network access process, this invention provides an enhanced network access system and method.

[0006] In a first aspect, the present invention provides an enhanced network access control system, comprising a network access control terminal and a client, an authentication server, and a network management terminal connected to the network access control terminal; the authentication server and the network management terminal are connected.

[0007] The client is used to store network access credentials. When accessing the network, it sends the network access credentials to the network access control terminal and accesses the network based on the authentication result of the network access credentials forwarded by the network access control terminal.

[0008] The network access control terminal is used to forward the network access credentials sent by the client to the authentication server, and at the same time send the client's identifier and the client's network access credentials to the network management terminal, receive the authentication result of the network access credentials returned by the authentication server, and control the client's access to the network based on the authentication result.

[0009] An authentication server is used to receive network access credentials forwarded by a network access control terminal, authenticate the network access credentials, and return the authentication result to the network access control terminal.

[0010] The network management terminal is used to receive the network access credential forwarded by the network access control terminal. When it determines that the network access credential is an initial network access credential, it generates a new network access credential and sends the new network access credential to the authentication server for storage. At the same time, the new network access credential is forwarded to the client through the network access control terminal.

[0011] As a preferred embodiment of the technical solution of the present invention, the client is equipped with a trusted execution environment, which is used to store network access credentials and submit the stored network access credentials to the network access control terminal when accessing the network.

[0012] As a preferred embodiment of the technical solution of the present invention, the network access control terminal is equipped with a trusted execution environment;

[0013] The network management terminal is used to monitor network intrusion events and / or receive intrusion event messages sent by external intrusion detection systems, and send blocking instructions to the network access control terminal when an intrusion is detected.

[0014] A network access control terminal is used to switch to its own trusted execution environment after receiving a blocking instruction and send a clearing instruction to the client from the trusted execution environment.

[0015] The client is used to respond to the clear command, switch to its own trusted execution environment, clear the authentication credentials, and disconnect the network connection within the trusted execution environment.

[0016] As a preferred embodiment of the technical solution of the present invention, the number of clients and network access control terminals is several;

[0017] Each client has a built-in IP address for a network access control terminal. When joining the network, the client sends the network access credentials to the network access control terminal corresponding to the IP address.

[0018] When a network access control terminal receives a network access credential from a client, it sends its own NAC identifier, the identifier of the client requesting network access, and the client's network access credential to the network management terminal.

[0019] The network management terminal is used to update the locally stored list of network access control terminals when it determines that the network access control terminal is a new network access control terminal based on the NAC identifier sent by the network access control terminal; it is also used to generate and store an NAC-client mapping table based on the received NAC identifier and the identifier of the client requesting network access.

[0020] The trusted execution environment of the network access control terminal is equipped with a network access service program; the network management terminal instructs the network access control terminal to start the network access service program set in the trusted execution environment, and at the same time, according to the NAC-client correspondence table, notifies the corresponding client to use the designated network access control terminal and the flag for using the trusted execution environment service in the message.

[0021] As a preferred embodiment of the technical solution of the present invention, the network management terminal is used to monitor the connection status between the network access control terminal and the client. When the monitored data volume of the client connected to the network access control terminal exceeds the set threshold, a portion of the clients connected to the network access control terminal are selected, and the network access control terminal forwards the message of using a new network access control terminal to the selected clients, and updates the NAC-client correspondence table.

[0022] The client is used to switch to its own trusted execution environment to save the data received from the new network access control terminal after receiving a message about using a new network access control terminal.

[0023] As a preferred embodiment of the technical solution of the present invention, the network management terminal is equipped with a manual maintenance interface, which is used to receive the client identifier and NAC identifier input by the user through the manual maintenance interface to select the client.

[0024] As a preferred embodiment of the technical solution of the present invention, the network management module communicates with a network access control terminal, which is defined as the first network access control terminal. The module sends a message to the first network access control terminal, requesting the first network access control terminal to start a new network access service program in the local trusted execution environment. After the first network access control terminal starts the network access service program running in the trusted execution environment, at least two network access services using different service ports exist simultaneously on the first network access control terminal. The two network access services include one network access service outside the executable environment and one network access service inside the executable environment.

[0025] The trusted execution environment of the network access control terminal contains a network access service program;

[0026] The network management terminal is used to designate a network access control terminal to start the network access service program set in the Trusted Execution Environment (TEE). At the same time, it notifies the corresponding client to use the designated network access control terminal and the flag of using the TEE service in the message according to the NAC-client mapping table. Specifically, it is used to look up the NAC-client mapping table to determine the network access control terminal currently used by the client with privacy requirements, forward the message of changing the network access control terminal and using the TEE network access service to the client with privacy requirements through the found network access control terminal, and update the local NAC-client mapping table.

[0027] The client, upon receiving the message, switches to its own trusted execution environment, saves the data of the new network access control terminal, sets the trusted execution environment service flag, connects to the network access service in the trusted execution environment on the new network access control terminal, and re-initiates the network access credential for authentication. After successful authentication, all network communication data of the client is forwarded by the network access service program in the trusted execution environment on the new network access control terminal.

[0028] Secondly, the present invention also provides an enhanced network access method based on the system described in the first aspect, comprising the following steps:

[0029] The client sends the network access credentials to the network access control terminal;

[0030] The network access control terminal forwards the network access credentials sent by the client to the authentication server; at the same time, it sends the client's identifier and the client's network access credentials to the network management terminal.

[0031] The authentication server receives the network access credential forwarded by the network access control terminal, and compares the received network access credential with the locally stored credential; if they match, it replies with a permission message to the network access control terminal.

[0032] The network access control terminal forwards the received permission message to the client, the link between the client and the network access control terminal is established, and the network access control terminal forwards the client's data normally.

[0033] The network management terminal receives the network access control terminal forwarding the network access credential. If the network access credential is an initial network access credential, it generates a new network access credential and sends the new network access credential to the authentication server for storage. At the same time, the new network access credential is forwarded to the client through the network access control terminal.

[0034] As a preferred embodiment of the technical solution of the present invention, the step of the client sending the network access certificate to the network access control terminal includes:

[0035] The trusted execution environment within the client submits the stored network access credentials to the network access control terminal.

[0036] As a preferred embodiment of the technical solution of the present invention, the method further includes:

[0037] The network management terminal monitors network intrusion events and / or receives intrusion event messages sent by external intrusion detection systems. When an intrusion is detected, it sends a blocking command to the network access control terminal.

[0038] After receiving the blocking command, the network access control terminal switches to the trusted execution environment of the network access control terminal and sends a clearing command to the client in the trusted execution environment;

[0039] The client responds to the cleanup command, switches to the client's trusted execution environment, and clears the authentication credentials within the trusted execution environment before disconnecting the network connection.

[0040] As a preferred embodiment of the technical solution of the present invention, the method further includes: when the network access control terminal receives the network access certificate sent by the client, it sends its own NAC identifier, the identifier of the client requesting network access, and the client's network access certificate to the network management terminal.

[0041] When the network management terminal determines that the network access control terminal is a new network access control terminal based on the NAC identifier sent by the network access control terminal, it updates the locally stored list of network access control terminals; at the same time, it generates and stores an NAC-client mapping table based on the received NAC identifier and the identifier of the client requesting network access.

[0042] As a preferred embodiment of the technical solution of the present invention, the method further includes:

[0043] The network management terminal monitors the connection status between the network access control terminal and the client. When the monitored client data volume connected to the network access control terminal exceeds the set threshold, it selects some of the clients connected to the network access control terminal, forwards the message to use the new network access control terminal to the selected clients through the network access control terminal, and updates the NAC-client mapping table.

[0044] After receiving a message to use a new network access control terminal, the client switches to its own trusted execution environment to save the data received from the new network access control terminal.

[0045] As a preferred embodiment of the technical solution of the present invention, the method further includes: the network management terminal instructs the network access control terminal to start the network access service program set in the trusted execution environment, and at the same time notifies the corresponding client to use the designated network access control terminal and the flag of using the trusted execution environment service in the message according to the NAC-client correspondence table.

[0046] As a preferred embodiment of the technical solution of the present invention, the steps of the network management terminal designating the network access control terminal to start the network access service program set in the trusted execution environment, and simultaneously notifying the corresponding client to use the designated network access control terminal and using the trusted execution environment service flag in the message according to the NAC-client correspondence table include:

[0047] The network management terminal designates a network access control terminal to initiate the network access service program set up in the Trusted Execution Environment (TEE). Simultaneously, based on the NAC-client mapping table, it notifies the corresponding client to use the designated network access control terminal and to use the TEE service flag in the message. Specifically, it searches the NAC-client mapping table to determine the network access control terminal currently used by clients with privacy requirements. Through the found network access control terminal, it forwards the message to the client with privacy requirements to change the network access control terminal and use the TEE network access service, and updates the local NAC-client mapping table.

[0048] After receiving the message, the client switches to its own Trusted Execution Environment (TEE), saves the data of the new network access control terminal, sets the TEE service flag, connects to the network access service in the TEE on the new network access control terminal, and re-initiates the network access credential authentication. After successful authentication, all network communication data of the client is forwarded by the network access service program in the TEE on the new network access control terminal.

[0049] As can be seen from the above technical solutions, this invention has the following advantages: it expands the business application scenarios of the network access control system, enriches the network management and control methods in complex application scenarios, solves the security problem of the access control system itself caused by the requirement for users to input authentication credentials, and improves network efficiency and user experience through the seamless access method for clients. The combination of TEE technology strengthens the system's protection of data confidentiality, enhances the confidentiality and integrity of authentication credential data, strengthens the confidentiality and integrity of sensitive data such as financial data, and enhances the confidentiality of the network access control method. By introducing network management components, it brings high availability and load balancing characteristics to the network access control system.

[0050] Furthermore, the design principle of this invention is reliable, the structure is simple, and it has a very wide range of application prospects.

[0051] Therefore, it is evident that the present invention has outstanding substantive features and significant progress compared with the prior art, and the beneficial effects of its implementation are also obvious. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 This is a schematic block diagram of a system according to an embodiment of the present invention.

[0054] Figure 2 This is a schematic diagram of a user-seamless access scenario in an embodiment of the present invention.

[0055] Figure 3 This is a schematic diagram of a scenario for restricting intrusion and cross-traffic in an embodiment of the present invention.

[0056] Figure 4 This is a schematic diagram of a network partitioning scenario in an embodiment of the present invention.

[0057] Figure 5 This is a schematic diagram of a sensitive data protection scenario in an embodiment of the present invention.

[0058] Figure 6 This is a schematic flowchart of a method according to an embodiment of the present invention. Detailed Implementation

[0059] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0060] This invention provides an enhanced network access control system, including a network access control terminal and a client, an authentication server, and a network management terminal connected to the network access control terminal; the authentication server and the network management terminal are connected.

[0061] The client is used to store network access credentials. When accessing the network, it sends the network access credentials to the network access control terminal and accesses the network based on the authentication result of the network access credentials forwarded by the network access control terminal.

[0062] The network access control terminal is used to forward the network access credentials sent by the client to the authentication server, and at the same time send the client's identifier and the client's network access credentials to the network management terminal, receive the authentication result of the network access credentials returned by the authentication server, and control the client's access to the network based on the authentication result.

[0063] An authentication server is used to receive network access credentials forwarded by a network access control terminal, authenticate the network access credentials, and return the authentication result to the network access control terminal.

[0064] The network management terminal receives network access credentials forwarded by the network access control terminal. When it determines that the access credential is an initial access credential, it generates a new access credential and sends it to the authentication server for storage. Simultaneously, it forwards the new access credential to the client through the network access control terminal. In this embodiment, the number of clients is set to three, and the number of network access control terminals is two, with connections as follows: Figure 1 As shown.

[0065] When a client first joins the network, it authenticates using its initial access credential. After successful authentication, it receives a new access credential from the network management terminal, forwarded by the network access control terminal. Subsequent network access attempts are made using this new access credential. This system does not limit the number of clients, and the number of network access control terminal entities can be expanded as needed. The authentication server and network management terminal can be highly available services. This enhanced network access control not only controls the initial network access but also subsequent network connections, and implements special access restrictions or customizations for clients.

[0066] In some embodiments, the client is configured with a Trusted Execution Environment (TEE) for storing network access credentials. Upon network access, the stored credentials are submitted to the network access control terminal (NAC). The client automatically starts an 802.1x client program upon boot, and its TEE portion automatically submits authentication data to the NAC. Upon receiving the authentication pass message from the authentication service, the NAC allows the client access but defaults to denying network access. Network access credentials are provided and distributed by the network control terminal and are not disclosed to users. The network control terminal distributes client access credentials as needed and synchronizes them with the authentication server. The client sends its access credentials to the NAC, which forwards them to the authentication server. The authentication server compares the received access credentials with the locally stored credentials; if they match, access is granted and a pass message is sent back to the NAC. Upon receiving this, the NAC notifies the client that authentication is successful. At this point, the link between the client and the NAC is established, and the NAC forwards the client's data normally. This enables a seamless network access scenario for the client user, such as… Figure 2 As shown, seamless access means that users do not need to enter usernames, passwords, or other credentials to access network resources and can only do so after the system authorizes them; instead, the device will automatically connect to the network.

[0067] In practice, the network access credentials used by the client when joining the network are stored in the client's TEE (Transaction Entity Execution Environment). The client submits these credentials to the NAC (Network Access Control Terminal) upon initial network access. When the client first joins the network, it submits an initial access credential. Upon receiving a client's network access request, the NAC sends a message to the authentication server requesting verification of the credential information, along with its own NAC identifier, the client's identifier, and the client's access credential, to the network management terminal. If the network management terminal detects that the client's access credential from the NAC is the initial access credential, it generates a new access credential and notifies the authentication server and the NAC; if it detects a new NAC, it updates its local network access control terminal list. The NAC receives the new access credential from the network management terminal and forwards it to the client. The client updates its access credential locally and provides this new access credential for future network access attempts.

[0068] In some embodiments, this system also provides restrictions on lateral intrusion scenarios, such as... Figure 3 As shown, the network access control terminal is equipped with a trusted execution environment;

[0069] The network management terminal is used to monitor network intrusion events and / or receive intrusion event messages sent by external intrusion detection systems, and send blocking instructions to the network access control terminal when an intrusion is detected.

[0070] A network access control terminal is used to switch to its own trusted execution environment after receiving a blocking instruction and send a clearing instruction to the client from the trusted execution environment.

[0071] The client is used to respond to the clear command, switch to its own trusted execution environment, clear the authentication credentials, and disconnect the network connection within the trusted execution environment.

[0072] The NAC blocking logic triggers the client to clear the authentication pass flag. This clearing logic is executed in the client's TEE, preventing the compromised host from being completely controlled by the hacker.

[0073] In some embodiments, this system also provides network partitioning scenarios, such as... Figure 4 As shown, there are several clients and network access control terminals; in this embodiment, there are three clients, namely client01, client02 and client03, and two network access control terminals, namely NAC-1 and NAC-2.

[0074] Each client has a built-in IP address for a network access control terminal. When joining the network, the client sends the network access credentials to the network access control terminal corresponding to the IP address.

[0075] When a network access control terminal receives a network access credential from a client, it sends its own NAC identifier, the identifier of the client requesting network access, and the client's network access credential to the network management terminal.

[0076] The network management terminal is used to update the locally stored list of network access control terminals when it determines that the network access control terminal is a new network access control terminal based on the NAC identifier sent by the network access control terminal; it is also used to generate and store an NAC-client mapping table based on the received NAC identifier and the identifier of the client requesting network access.

[0077] The trusted execution environment of the network access control terminal is equipped with a network access service program; the network management terminal instructs the network access control terminal to start the network access service program set in the trusted execution environment, and at the same time, according to the NAC-client correspondence table, notifies the corresponding client to use the designated network access control terminal and the flag for using the trusted execution environment service in the message.

[0078] The client locally stores the NAC information it will connect to when joining the network. After successful client authentication, all network traffic is forwarded through this NAC. When the number of clients in the network is large, a single NAC may not be sufficient to meet their traffic demands. This system uses multiple NACs to improve network quality. The network management terminal itself maintains a list of network access control terminals and a list of NAC-client mappings. The network management terminal monitors the connection status between network access control terminals and clients. When the monitored client data volume connected to a network access control terminal exceeds a set threshold, it selects some clients connected to that network access control terminal, forwards messages to the selected clients requesting the use of a new network access control terminal, and updates the NAC-client mapping table.

[0079] The client, upon receiving a message about using a new network access control terminal, switches to its own trusted execution environment to save the received data from the new network access control terminal. It then uses this new network access control terminal to re-initiate network access authentication.

[0080] In response, the network management terminal is equipped with a manual maintenance interface to receive client identifiers and NAC identifiers input by the user through this interface for client selection. It also updates the local NAC-client mapping list. Upon receiving the message, the client executes the corresponding procedure for using the new NAC. The network management terminal's resource balancing algorithm also automatically adjusts the client-NAC mapping in batches. This balancing algorithm can be disabled.

[0081] In some embodiments, the system also provides privacy data protection scenarios, such as... Figure 5As shown, the trusted execution environment of the network access control terminal is equipped with a network access service program to prevent client request or response data from being accessed, tampered with, or deleted after the NAC is compromised.

[0082] The network management terminal is used to designate network access control terminals to start network access service programs set in the Trusted Execution Environment (TEE). Simultaneously, based on the NAC-client mapping table, it notifies the corresponding clients to use the designated network access control terminal and the flag indicating the use of the TEE service in the messages. For example, financial data, being sensitive information, should use the network access service program in the TEE for communication between the financial client and the financial server. The network management module communicates with a network access control terminal, defining it as the first network access control terminal, and sends a message to the first network access control terminal requesting it to start a new network access service program in its local TEE. After the first network access control terminal starts the network access service program running in the TEE, at least two network access services using different service ports exist simultaneously on the first network access control terminal. These two network access services include one network access service outside the execution environment and one network access service within the execution environment.

[0083] Specifically, the network management terminal is used to look up the NAC-client mapping table to determine the network access control terminal currently used by the client with privacy requirements. It forwards the message of changing the network access control terminal and using the trusted execution environment network access service to the client with privacy requirements through the found network access control terminal, and updates the local NAC-client mapping table.

[0084] The client, upon receiving the message, switches to its own trusted execution environment, saves the data of the new network access control terminal, sets the trusted execution environment service flag, connects to the network access service in the trusted execution environment on the new network access control terminal, and re-initiates the network access credential for authentication. After successful authentication, all network communication data of the client is forwarded by the network access service program in the trusted execution environment on the new network access control terminal.

[0085] In practice, the network management terminal looks up the local NAC-client mapping table to determine the NAC (Number 2) currently used by the client with privacy requirements (NAC2). The network management module forwards the message to client2 via NAC2 to change the NAC and use the TEE service, and updates the local NAC-client mapping table. After receiving the message, client2 switches to the TEE environment, saves the new NAC data, sets the TEE service flag, and then connects to the network access service in the TEE on the new NAC (NAC1) to re-initiate authentication. After successful authentication, all network communication data of this client (client2) is forwarded by the access program in the TEE, thus providing data privacy protection. By combining TEE technology, the system's data privacy protection is strengthened, preventing data leakage. The addition of the network management terminal expands the functionality and scope of the network access control system, including the four scenarios mentioned above: seamless network access for client users, restricting cross-intrusion, corporate network segmentation, and privacy data protection.

[0086] like Figure 6 As shown, this embodiment of the invention also provides an enhanced network access control method. The method is based on an enhanced network access control system, which includes a network access control terminal and a client, an authentication server, and a network management terminal connected to the network access control terminal. The authentication server and the network management terminal are connected. The method includes the following steps:

[0087] Step 1: The client sends the network access certificate to the network access control terminal;

[0088] Step 2: The network access control terminal forwards the network access credential sent by the client to the authentication server; at the same time, it sends the client's identifier and the client's network access credential to the network management terminal; then steps 3 and 5 are executed respectively.

[0089] Step 3: The authentication server receives the network access credential forwarded by the network access control terminal, and checks whether the received network access credential matches the locally stored credential; if they match, it replies with a permission message to the network access control terminal.

[0090] Step 4: The network access control terminal forwards the received permission message to the client, the link between the client and the network access control terminal is established, and the network access control terminal forwards the client's data normally;

[0091] Step 5: The network management terminal receives the network access control terminal forwarding the network access credential. If the network access credential is the initial network access credential, it generates a new network access credential and sends the new network access credential to the authentication server for storage. At the same time, the new network access credential is forwarded to the client through the network access control terminal.

[0092] It should be noted that the steps for the client to send the network access credential to the network access control terminal include: the trusted execution environment within the client submits the stored network access credential to the network access control terminal.

[0093] In some embodiments, the method further includes:

[0094] The network management terminal monitors network intrusion events and / or receives intrusion event messages sent by external intrusion detection systems. When an intrusion is detected, it sends a blocking command to the network access control terminal.

[0095] After receiving the blocking command, the network access control terminal switches to the trusted execution environment of the network access control terminal and sends a clearing command to the client in the trusted execution environment;

[0096] The client responds to the cleanup command, switches to the client's trusted execution environment, and clears the authentication credentials within the trusted execution environment before disconnecting the network connection.

[0097] In some embodiments, the method further includes: when the network access control terminal receives the network access credential sent by the client, it sends its own NAC identifier, the identifier of the client requesting network access, and the client's network access credential to the network management terminal.

[0098] When the network management terminal determines that the network access control terminal is a new network access control terminal based on the NAC identifier sent by the network access control terminal, it updates the locally stored list of network access control terminals; at the same time, it generates and stores an NAC-client mapping table based on the received NAC identifier and the identifier of the client requesting network access.

[0099] In some embodiments, the method further includes:

[0100] The network management terminal monitors the connection status between the network access control terminal and the client. When the monitored client data volume connected to the network access control terminal exceeds the set threshold, it selects some of the clients connected to the network access control terminal, forwards the message to use the new network access control terminal to the selected clients through the network access control terminal, and updates the NAC-client mapping table.

[0101] After receiving a message to use a new network access control terminal, the client switches to its own trusted execution environment to save the data received from the new network access control terminal.

[0102] In some embodiments, the method further includes: the network management terminal instructing the network access control terminal to start the network access service program set in the trusted execution environment, and simultaneously notifying the corresponding client to use the designated network access control terminal and the flag indicating the use of the trusted execution environment service in the message according to the NAC-client mapping table. Specifically, this includes:

[0103] The network management terminal designates a network access control terminal to initiate the network access service program set up in the Trusted Execution Environment (TEE). Simultaneously, based on the NAC-client mapping table, it notifies the corresponding client to use the designated network access control terminal and to use the TEE service flag in the message. Specifically, it searches the NAC-client mapping table to determine the network access control terminal currently used by clients with privacy requirements. Through the found network access control terminal, it forwards the message to the client with privacy requirements to change the network access control terminal and use the TEE network access service, and updates the local NAC-client mapping table.

[0104] After receiving the message, the client switches to its own Trusted Execution Environment (TEE), saves the data of the new network access control terminal, sets the TEE service flag, connects to the network access service in the TEE on the new network access control terminal, and re-initiates the network access credential authentication. After successful authentication, all network communication data of the client is forwarded by the network access service program in the TEE on the new network access control terminal.

[0105] This system resolves the security issues inherent in access control systems that require users to input authentication credentials. The seamless client-side access method improves network efficiency and user experience. The integration of TEE technology enhances data confidentiality, strengthening the confidentiality and integrity of access credentials, sensitive data such as financial data, and the confidentiality of network access control methods. The introduction of a network management terminal brings high availability and load balancing capabilities to the network access control system.

[0106] The enhanced network access control system and method of the present invention, as described in conjunction with the embodiments disclosed herein, comprises units and algorithmic steps that can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can implement the described functions using different methods for each specific application, but such implementations should not be considered beyond the scope of the present invention.

[0107] Although the present invention has been described in detail with reference to the accompanying drawings and preferred embodiments, the invention is not limited thereto. Various equivalent modifications or substitutions can be made to the embodiments of the invention by those skilled in the art without departing from the spirit and essence of the invention, and such modifications or substitutions should all be within the scope of the invention. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the invention should also be covered within the protection scope of the invention. Therefore, the protection scope of the invention should be determined by the scope of the claims.

Claims

1. An enhanced network access control system, characterized in that, This includes network access control terminals and clients, authentication servers, and network management terminals connected to the network access control terminals; and connections between authentication servers and network management terminals. The client is used to store network access credentials. When accessing the network, it sends the network access credentials to the network access control terminal and accesses the network based on the authentication result of the network access credentials forwarded by the network access control terminal. The network access control terminal is used to forward the network access credentials sent by the client to the authentication server, and at the same time send the client's identifier and the client's network access credentials to the network management terminal, receive the authentication result of the network access credentials returned by the authentication server, and control the client's access to the network based on the authentication result. An authentication server is used to receive network access credentials forwarded by a network access control terminal, authenticate the network access credentials, and return the authentication result to the network access control terminal. The network management terminal is used to receive the network access certificate forwarded by the network access control terminal. When it determines that the network access certificate is the initial network access certificate, it generates a new network access certificate and sends the new network access certificate to the authentication server for storage. At the same time, the new network access certificate is forwarded to the client through the network access control terminal. The client is equipped with a trusted execution environment, which is used to store network access credentials. When accessing the network, the stored network access credentials are submitted to the network access control terminal. The network access control terminal is equipped with a trusted execution environment; The network management terminal is used to monitor network intrusion events and / or receive intrusion event messages sent by external intrusion detection systems, and send blocking instructions to the network access control terminal when an intrusion is detected. A network access control terminal is used to switch to its own trusted execution environment after receiving a blocking instruction and send a clearing instruction to the client from the trusted execution environment. The client is used to respond to the clear command, switch to its own trusted execution environment, clear the authentication pass flag in the trusted execution environment, and disconnect the network connection; The trusted execution environment of the network access control terminal contains a network access service program; The network management terminal is used to designate a network access control terminal to start the network access service program set in the Trusted Execution Environment (TEE). At the same time, it notifies the corresponding client to use the designated network access control terminal and the flag of using the TEE service in the message according to the NAC-client mapping table. Specifically, it is used to look up the NAC-client mapping table to determine the network access control terminal currently used by the client with privacy requirements, forward the message of changing the network access control terminal and using the TEE network access service to the client with privacy requirements through the found network access control terminal, and update the local NAC-client mapping table. The client is used to switch to its own trusted execution environment after receiving the message, save the data of the new network access control terminal and set the trusted execution environment service flag, connect to the network access service in the trusted execution environment on the new network access control terminal, and re-initiate the network access credential for authentication. After successful authentication, all network communication data of the client is forwarded by the network access service program in the trusted execution environment on the new network access control terminal. After the first network access control terminal starts running the network access service program in the trusted execution environment, there are at least two network access services using different service ports on the first network access control terminal at the same time. The two network access services include one network access service outside the executable environment and one network access service inside the executable environment.

2. The enhanced network access control system according to claim 1, characterized in that, The number of clients and network access control terminals is several; Each client has a built-in IP address for a network access control terminal. When joining the network, the client sends the network access credentials to the network access control terminal corresponding to the IP address. When a network access control terminal receives a network access credential from a client, it sends its own NAC identifier, the identifier of the client requesting network access, and the client's network access credential to the network management terminal. The network management terminal is used to update the locally stored list of network access control terminals when it determines that the network access control terminal is a new network access control terminal based on the NAC identifier sent by the network access control terminal. It is also used to generate and store a table of correspondence between NACs and clients based on the received NAC identifier and the identifier of the client requesting network access.

3. The enhanced network access control system according to claim 2, characterized in that, The network management terminal is used to monitor the connection status between the network access control terminal and the client. When the amount of client data connected to the network access control terminal exceeds the set threshold, it selects some of the clients connected to the network access control terminal, forwards the message to the selected clients to use the new network access control terminal through the network access control terminal, and updates the NAC-client mapping table. The client is used to switch to its own trusted execution environment to save the data received from the new network access control terminal after receiving a message about using a new network access control terminal.

4. The enhanced network access control system according to claim 3, characterized in that, The network management terminal is equipped with a manual maintenance interface, which is used to receive client identifiers and NAC identifiers input by users through the manual maintenance interface to select clients.

5. An enhanced network access method based on the system described in any one of claims 1-4, characterized in that, Includes the following steps: The client sends the network access credentials to the network access control terminal; The network access control terminal forwards the network access credentials sent by the client to the authentication server; at the same time, it sends the client's identifier and the client's network access credentials to the network management terminal. The authentication server receives the network access credential forwarded by the network access control terminal, and compares the received network access credential with the locally stored credential; if they match, it replies with a permission message to the network access control terminal. The network access control terminal forwards the received permission message to the client, the link between the client and the network access control terminal is established, and the network access control terminal forwards the client's data normally. The network management terminal receives the network access control terminal forwarding the network access credential. When it determines that the network access credential is the initial network access credential, it generates a new network access credential and sends the new network access credential to the authentication server for storage. At the same time, the new network access credential is forwarded to the client through the network access control terminal. The method also includes: The network management terminal monitors network intrusion events and / or receives intrusion event messages sent by external intrusion detection systems. When an intrusion is detected, it sends a blocking command to the network access control terminal. After receiving the blocking command, the network access control terminal switches to the trusted execution environment of the network access control terminal and sends a clearing command to the client in the trusted execution environment; The client responds to the clear command, switches to the client's trusted execution environment, clears the authentication pass flag in the trusted execution environment, and disconnects the network connection.

6. The enhanced network access method according to claim 5, characterized in that, The method also includes: The method also includes: The network management terminal monitors the connection status between the network access control terminal and the client. When the monitored client data volume connected to the network access control terminal exceeds the set threshold, it selects some of the clients connected to the network access control terminal, forwards the message to use the new network access control terminal to the selected clients through the network access control terminal, and updates the NAC-client mapping table. After receiving a message to use a new network access control terminal, the client switches to its own trusted execution environment to save the data received from the new network access control terminal.

Images