A trust boundary implementation method based on trusted terminal proxy service

Abstract

The present invention relates to a trust boundary implementation method based on a trusted terminal proxy service. The present invention adopts a trusted terminal proxy service to collect device information and uses a trusted access security control center service to verify the device information and device signature of the terminal device. After successful verification, the terminal device is registered with the server and a unique device token is allocated and bound to the device. An access token is obtained by using the device token. The trusted terminal proxy service intercepts each request from a third-party business system to access the server's external interface. The trusted terminal proxy service generates a one-time token. The request information is encrypted with the access token and sent to a trusted access gateway carrying the one-time token. The trusted access gateway verifies the one-time token and decrypts the request information before transmitting the request information to the server. After the server completes the business processing of the corresponding request, it returns a response information to the corresponding terminal device.

Description

Technical Field

[0001] The present invention relates to a trust boundary implementation method based on a trusted terminal proxy service, belonging to the technical field of computer network security. Background Art

[0002] Computer network security refers to the protection of software, hardware and the data carried in networks and information systems to prevent them from being damaged, altered or leaked due to accidental or malicious reasons, ensuring that the system operates continuously, reliably and normally and that network services are not interrupted.

[0003] Existing invention patents with patent numbers such as "CN112187724B" disclose an access control method, device, gateway, client and security token service. The client sends an API access request to the gateway. The API access request contains parameters for requesting signature verification and parameters for permission identification. Therefore, after the gateway receives the API access request, it can directly perform request signature verification based on the parameters for requesting signature verification carried in the API access request, and perform permission identification based on the parameters for permission identification. There is no need to access the database to obtain the required parameters, which reduces the network I / O and database query time. If the request signature verification passes and the permission identification passes, the gateway forwards the API access request to the corresponding business line interface, thereby improving the API access efficiency.

[0004] Existing invention patents such as "CN102984252B" disclose a cloud resource access control method based on dynamic cross-domain security tokens. The specific steps are as follows: an access agent is preset at the cloud resource service provider; after the agent authenticates the dynamic temporary user, it requests a dynamic security token from the cloud resource provider for each dynamic temporary user; the cloud resource provider generates a dynamic security token and sets its access policy, and sends it to the dynamic temporary user; a shared key is set between each dynamic temporary user and the cloud resource provider; the dynamic temporary user signs the access request with the shared key and sends an authentication request message to the cloud resource provider; the cloud resource provider signs the authentication request message with the shared key. If the signatures are the same, the authentication is passed; the access policy of the dynamic security token and its access agent is determined, and the access request of the dynamic temporary user is responded to according to the determination result. The present invention realizes an efficient cross-domain authentication mechanism with high determination efficiency.

[0005] Traditional third-party system interface docking generally uses APPID and APPKEY for identity authentication. If the APPID and APPKEY are leaked or improperly designed, it may lead to unauthorized access and attacks. At the same time, it is impossible to bind the third-party system terminal device and identity, and it is impossible to trace the source when abnormal activities or violations occur. Summary of the Invention

[0006] In order to solve the above problems in the prior art, the present invention proposes a trust boundary implementation method based on a trusted terminal proxy service.

[0007] The technical solutions of the present invention are as follows:

[0008] In one aspect, the present invention provides a method for implementing a trust boundary based on a trusted terminal proxy service, comprising the following steps:

[0009] The trusted terminal agent collects device information and signs the device information through the local signature server. The device information and device signature are sent to the server. After receiving the device information and device signature, the trusted access security control center on the server verifies whether the device is a trusted device based on the device signature. If it is a trusted device, the device is registered and a unique device token is generated for the device and returned to the trusted terminal agent for storage.

[0010] The trusted terminal agent generates an access token for the device based on the device token of the corresponding device through the trusted access security control center and returns it to the trusted terminal agent for storage. When a request is sent to the server through the trusted terminal agent on the device, the trusted terminal agent generates a one-time token, encrypts the request information with the access token, and sends it to the trusted access gateway with the one-time token. The trusted access gateway verifies the one-time token and decrypts the encrypted request information. The decrypted request information is responded to and processed by the service in the server, and the response processing result is finally returned to the trusted terminal agent.

[0011] As a preferred embodiment of the present invention, the server stores a public key, the local signature server stores a private key paired with the public key, the device information is signed with the private key by the local signature server, and the trusted access security control center decrypts and verifies the signature using the public key stored in the server.

[0012] As a preferred embodiment of the present invention, the trusted access security control center generates a device token for the corresponding device, encrypts it using the public key in the server, and then returns it to the trusted terminal agent for storage.

[0013] As a preferred embodiment of the present invention, the trusted terminal agent decrypts the stored device token through the private key stored in the local signature server, generates a request code based on the decrypted device token, signs the request code through the local signature server, and sends the device token, request code and request code signature to the server. The trusted access security control center in the server verifies whether the request code is trusted based on the request code signature. If the request code is trusted, an access token is generated and encrypted with the public key in the server and returned to the trusted terminal agent.

[0014] As a preferred embodiment of the present invention, the access token is provided with an expiration time, and the trusted terminal agent needs to regularly update the access token through the trusted access security control center.

[0015] On the other hand, the present invention also provides a trust boundary system based on a trusted terminal agent service, including a local trusted terminal agent, a signature server, a trusted access gateway, a trusted access security control center, and a remote server;

[0016] The trusted terminal agent and signature server are set locally, and the trusted access security control center and remote server are set on the server side. The local device information is collected through the trusted terminal agent service, and the device information is signed by the local signature server. The device information and device signature are sent to the server side. After receiving the device information and device signature, the trusted access security control center on the server side verifies whether the device is a trusted device through the device signature. If it is verified to be a trusted device, the device is registered and a unique device token is generated for the device and returned to the trusted terminal agent for storage;

[0017] The trusted terminal agent generates an access token for the device based on the device token of the corresponding device through the trusted access security control center and returns it to the trusted terminal agent for storage. When a request is sent to the server through the trusted terminal agent on the device, the trusted terminal agent generates a one-time token, encrypts the request information with the access token, and sends it to the trusted access gateway with the one-time token. The trusted access gateway verifies the one-time token and decrypts the encrypted request information. The decrypted request information is responded to and processed by the service in the server, and the response processing result is finally returned to the trusted terminal agent.

[0018] On the other hand, the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any embodiment of the present invention when executing the program.

[0019] In another aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method as described in any embodiment of the present invention.

[0020] The present invention has the following beneficial effects:

[0021] 1. This invention increases the reliability of identity authentication by binding terminal device information with third-party system identities. Device registration ensures that only third-party systems with legitimate terminal devices can make interface calls, thereby preventing unauthorized devices from accessing the system or performing sensitive operations.

[0022] 2. The device token and access token generation algorithm and encrypted storage mechanism of the present invention enhance system security. Device tokens ensure that only trusted terminal agent services with legitimate devices can request the security control center service to generate valid access tokens, thereby preventing unauthorized terminal devices from attempting to access the system. Access tokens have a short lifecycle and expiration time, limiting the window of opportunity for potential attackers and reducing the risk of token abuse.

[0023] 3. Device registration in this invention binds terminal device information to third-party system identities, making it easy to track and audit unusual activities or violations. When an anomaly occurs, the issue can be traced and analyzed using device information and related token usage records, improving security monitoring and risk management. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 Flow chart of the method of the present invention. DETAILED DESCRIPTION

[0025] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0026] It should be understood that the step numbers used herein are only for convenience of description and are not intended to limit the order in which the steps are to be executed.

[0027] It should be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0028] The terms “include” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0029] The term "and / or" refers to and includes any and all possible combinations of one or more of the associated listed items.

[0030] Example 1:

[0031] See also Figure 1 In this embodiment, we take the online invoicing unit's request for the financial management system interface as an example:

[0032] The online invoicing unit is equipped with multiple terminal devices and a local signature server, and requests responses from the server through the trusted access terminal agent service built into the terminal. The server is equipped with a trusted access gateway, a trusted access security control center, a financial bill service, and a financial signature server;

[0033] The local signature server is provided with a private key, and the financial signature server in the server is provided with a public key. The public key and the private key are paired and can decrypt each other's encrypted data.

[0034] Each terminal device is equipped with a trusted access terminal agent service, which collects terminal device information and signs the device information with a private key through a local signature server;

[0035] The trusted access terminal agent service sends the device information and device signature to the server. The trusted access security control center in the server receives the device information and device signature, verifies the device signature is authentic using the public key in the financial signature server. If the device is verified to be a trusted device, the trusted access security control center registers the device and generates a unique device token for the device. The device token is encrypted again with the public key of the financial signature server and returned to the terminal device for storage.

[0036] The trusted access terminal agent service in the terminal device decrypts the device token through the private key in the local signature server and generates a request code, and then signs the request code again through the local signature server. The trusted access terminal agent service sends the decrypted device token, request code, and request code signature to the server. The trusted access security control center on the server receives the decrypted device token, request code, and request code signature, verifies whether the request code signature is credible through the decrypted device token, and then verifies the request code signature through the fiscal bill service. After successful verification, an access token is generated, and finally the access token is encrypted by the fiscal signature server and returned to the terminal device for storage.

[0037] When the terminal device of an online invoicing unit needs to request a financial interface, the trusted access terminal proxy service first generates a one-time token, encrypts the request information with the access token, and sends it to the server with the one-time token. The trusted access gateway on the server verifies the one-time token and decrypts the encrypted request information, then authorizes the trusted access security control center to allow the request information to pass. After the request information is processed by the financial bill service, the response result is returned to the terminal device.

[0038] As a preferred implementation of this embodiment, the access token is set with an expiration time, and the trusted terminal agent needs to regularly update the access token through the trusted access security control center.

[0039] As a preferred implementation of this embodiment, the server is further provided with a key manager for backing up the generated device token and access token.

[0040] Example 2:

[0041] A trust boundary system based on a trusted terminal agent service, comprising a local trusted terminal agent, a signature server, a trusted access gateway, a trusted access security control center, and a remote server;

[0042] The trusted terminal agent and signature server are set locally, and the trusted access security control center and remote server are set on the server side. The local device information is collected through the trusted terminal agent service, and the device information is signed by the local signature server. The device information and device signature are sent to the server side. After receiving the device information and device signature, the trusted access security control center on the server side verifies whether the device is a trusted device through the device signature. If it is verified to be a trusted device, the device is registered and a unique device token is generated for the device and returned to the trusted terminal agent for storage;

[0043] The trusted terminal agent generates an access token for the device based on the device token of the corresponding device through the trusted access security control center and returns it to the trusted terminal agent for storage. When a request is sent to the server through the trusted terminal agent on the device, the trusted terminal agent generates a one-time token, encrypts the request information with the access token, and sends it to the trusted access gateway with the one-time token. The trusted access gateway verifies the one-time token and decrypts the encrypted request information. The decrypted request information is responded to and processed by the service in the server, and the response processing result is finally returned to the trusted terminal agent.

[0044] This embodiment is used to implement the functions of the first embodiment and will not be described in detail here.

[0045] Example 3:

[0046] This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the method described in any embodiment of the present invention is implemented.

[0047] Example 4:

[0048] This embodiment provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the method described in any embodiment of the present invention is implemented.

[0049] In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can represent: a, b, c, a and b, a and c, b and c or a and b and c, where a, b, c can be single or multiple.

[0050] Those skilled in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented using a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0051] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0052] In the several embodiments provided in this application, if any function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of this application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory; hereinafter referred to as: ROM), random access memory (Random Access Memory; hereinafter referred to as: RAM), magnetic disk or optical disk, and other media that can store program code.

[0053] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention's description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A trust boundary implementation method based on a trusted terminal proxy service, characterized in that: The following steps are involved: The trusted terminal agent collects device information and signs the device information through the local signature server. The device information and device signature are sent to the server. After receiving the device information and device signature, the trusted access security control center on the server verifies whether the device is a trusted device based on the device signature. If it is a trusted device, the device is registered and a unique device token is generated for the device and returned to the trusted terminal agent for storage. The trusted terminal agent generates an access token for the device based on the device token of the corresponding device through the trusted access security control center and returns it to the trusted terminal agent for storage. When a request is sent to the server through the trusted terminal agent on the device, the trusted terminal agent generates a one-time token, encrypts the request information with the access token, and sends it to the trusted access gateway with the one-time token. The trusted access gateway verifies the one-time token and decrypts the encrypted request information. The decrypted request information is responded to and processed by the service in the server, and the response processing result is finally returned to the trusted terminal agent. The trusted terminal agent decrypts the stored device token using the private key stored in the local signature server, generates a request code based on the decrypted device token, signs the request code through the local signature server, and sends the device token, request code, and request code signature to the server. The trusted access security control center in the server verifies whether the request code is trusted based on the request code signature. If the request code is trusted, an access token is generated and encrypted with the public key in the server and returned to the trusted terminal agent.

2. A trust boundary implementation method based on a trusted terminal proxy service according to claim 1, characterized in that: The server stores a public key, and the local signature server stores a private key paired with the public key. The local signature server signs the device information with the private key, and the trusted access security control center decrypts and verifies the signature using the public key stored in the server.

3. The method for implementing a trust boundary based on a trusted terminal proxy service according to claim 1, characterized in that: The trusted access security control center generates a device token for the corresponding device and encrypts it using the public key in the server, and then returns it to the trusted terminal agent for storage.

4. The method for implementing a trust boundary based on a trusted terminal proxy service according to claim 1, characterized in that: The access token has an expiration time, and the trusted terminal agent needs to regularly update the access token through the trusted access security control center.

5. A trust boundary system based on trusted terminal proxy service, characterized in that: The method according to any one of claims 1 to 4, comprising a local trusted terminal agent, a signature server, a trusted access gateway, a trusted access security control center, and a remote server; The trusted terminal agent and signature server are set locally, and the trusted access security control center and remote server are set on the server side. The local device information is collected through the trusted terminal agent service, and the device information is signed by the local signature server. The device information and device signature are sent to the server side. After receiving the device information and device signature, the trusted access security control center on the server side verifies whether the device is a trusted device through the device signature. If it is verified to be a trusted device, the device is registered and a unique device token is generated for the device and returned to the trusted terminal agent for storage; The trusted terminal agent generates an access token for the device based on the device token of the corresponding device through the trusted access security control center and returns it to the trusted terminal agent for storage. When a request is sent to the server through the trusted terminal agent on the device, the trusted terminal agent generates a one-time token, encrypts the request information with the access token, and sends it to the trusted access gateway with the one-time token. The trusted access gateway verifies the one-time token and decrypts the encrypted request information. The decrypted request information is responded to and processed by the service in the server, and the response processing result is finally returned to the trusted terminal agent.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 4 is implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images