A method and system for implementing dynamic access control in Android devices

Abstract

This invention relates to a method and system for implementing dynamic access control in an Android device. The method includes: a VPN client and a dynamic access control client negotiating and determining a data exchange port and interest stream; the VPN client reading data packets from the TUN network interface card (NIC) for the first time, and forwarding the data packets to the dynamic access control client according to the negotiated data exchange port and interest stream; the dynamic access control client performing a first encapsulation, and the operating system forwarding the encapsulated data packets to the TUN NIC; the VPN client reading data packets from the TUN NIC for the second time, performing a second encapsulation, and the operating system forwarding the encapsulated data packets to the physical NIC, and then sending them to the VPN gateway; the VPN gateway forwarding the first decapsulated data packets to the dynamic access control gateway; and the dynamic access control gateway forwarding the second decapsulated data packets to the application server. This invention enables dynamic access control even when the Android device's virtual NIC is already occupied by a VPN client.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, and specifically relates to a method and system for implementing dynamic access control in Android devices. Background Technology

[0002] In the Android system, existing dynamic access technology is implemented through collaboration between virtual network interface card (NIC) technology and a cloud-based dynamic access control gateway. For example... Figure 1 As shown, the basic idea is to install a client program on the Android device and use this client program to establish a data transmission tunnel with the dynamic access control gateway, performing dynamic access control at the tunnel level. The basic principle is that the client program reads data from the Android system's TUN virtual network interface card, encapsulates the data packets according to the tunnel encapsulation format, thereby establishing a data transmission tunnel with the dynamic access control gateway. This allows application data from the Android system to be sent to the dynamic access control gateway via the transmission tunnel, and then forwarded / proxied by the dynamic access control gateway to the application server.

[0003] The basic process of the existing solution is as follows:

[0004] a) When the system starts, the dynamic access control client starts the TUN network card and binds to the network card. At the same time, it configures routing table entries in the operating system to specify the data packets that need to be routed to the TUN network card.

[0005] b) When the application client initiates a service access, the terminal operating system forwards the data packet to the TUN network card according to the routing table information;

[0006] c) The dynamic access control client listens to the TUN network card and reads data packets, and encapsulates the data packets according to the communication protocol format between itself and the dynamic access control gateway;

[0007] d) The dynamic access control client will send the encapsulated data packet out again via the operating system protocol stack;

[0008] e) The terminal operating system forwards the data packets encapsulated by the dynamic access control client to the physical network card based on the routing information;

[0009] f) Data is sent to the dynamic access control gateway via the physical network card;

[0010] g) The dynamic access control gateway decapsulates data packets according to the protocol format and forwards or proxies the business data to the application server.

[0011] Existing Android dynamic access control technology will not function properly if the user device's TUN network card is already occupied by another application. Due to limitations of the Android operating system, only one TUN network card can be active on an Android device at a time. If the dynamic access control client starts another TUN network card, the original TUN network card will stop working, thus affecting the normal operation of services.

[0012] For example, when an Android device uses a VPN to remotely access a corporate internal network, dynamic access control (DAP) and VPN technologies cannot function simultaneously. This is because VPN technology also relies on the TUN network interface card (NIC). Its basic principle is that a VPN client runs on the Android device, reads data from the Android system's TUN virtual NIC, encapsulates the data according to the VPN protocol format, and finally sends it to the VPN gateway via the Android device's physical NIC, thus establishing a secure VPN transmission channel. However, due to limitations of the Android operating system, only one TUN NIC can be used at a time. This makes it impossible to perform dynamic access control on an Android device with a VPN client running. However, in daily corporate operations, scenarios where employees may travel for work and need to access the corporate internal network via the internet from outside the company are very common. Therefore, it is necessary to solve the problem of simultaneous operation of the DAP client and the VPN client. Summary of the Invention

[0013] The purpose of this invention is to solve the problem of how to implement dynamic access control when the TUN network card in an Android device is occupied by a VPN client.

[0014] The technical solution adopted in this invention is as follows:

[0015] A method for implementing dynamic access control in an Android device includes the following steps:

[0016] The VPN client negotiates with the dynamic access control client to determine the data exchange port and interest stream;

[0017] The VPN client reads the data packet from the TUN network card for the first time, and forwards the corresponding data packet to the dynamic access control client through the negotiated data interaction port according to the interest flow negotiated with the dynamic access control client;

[0018] The dynamic access control client encapsulates the data packet for the first time according to the communication protocol format between itself and the dynamic access control gateway. The operating system forwards the encapsulated data packet to the TUN network card according to the routing table information.

[0019] The VPN client reads the data packet a second time from the TUN network card, performs a second encapsulation according to the VPN format, and the operating system forwards the second encapsulated data packet to the physical network card according to the routing table information. The physical network card then sends the second encapsulated data packet to the VPN gateway.

[0020] Furthermore, the above method also includes the following steps:

[0021] After receiving the data packet, the VPN gateway performs the first decapsulation operation and forwards the decapsulated data packet to the dynamic access control gateway.

[0022] The dynamic access control gateway performs a second decapsulation operation on the data packets and forwards the decapsulated data packets to the application server.

[0023] Furthermore, when the dynamic access control client performs the first encapsulation of the data packet, it fills in the destination address of the data packet as the dynamic access control gateway address, and then sends the encapsulated data packet out through the operating system protocol stack; after the VPN client performs the second encapsulation of the data packet, it sends the encapsulated data packet out through the operating system protocol stack.

[0024] Furthermore, when the TUN network card is already occupied by the VPN client, the dynamic access control client uses a normal user-mode App to interact with the VPN client, and encapsulates data packets sequentially.

[0025] Furthermore, the VPN client interacts with the dynamic access control client via AIDL or local socket communication, etc.; the information exchanged between the VPN client and the dynamic access control client includes interest streams, data interaction port numbers, and dynamic access control gateway IP address information.

[0026] Furthermore, the keep-alive mechanism between the VPN client and the dynamic access control client includes: adding the dynamic access control client to the operating system whitelist, or the VPN client checking the services of the dynamic access control client, and if the services do not exist, actively starting the dynamic access control client.

[0027] Furthermore, the dynamic access control gateway obtains the current environmental status changes of the Android terminal, automatically arranges access control policies, and dynamically blocks user access behavior.

[0028] An Android terminal, comprising a VPN client, a dynamic access control client, a TUN network interface card (NIC), and a physical NIC; wherein:

[0029] The VPN client negotiates with the dynamic access control client to determine the data exchange port and interest stream;

[0030] The VPN client reads the data packet from the TUN network card for the first time, and forwards the corresponding data packet to the dynamic access control client through the negotiated data interaction port according to the interest flow negotiated with the dynamic access control client;

[0031] The dynamic access control client encapsulates the data packet for the first time according to the communication protocol format between itself and the dynamic access control gateway. The operating system forwards the encapsulated data packet to the TUN network card according to the routing table information.

[0032] The VPN client reads the data packet a second time from the TUN network card, performs a second encapsulation according to the VPN format, and the operating system forwards the second encapsulated data packet to the physical network card according to the routing table information. The physical network card then sends the second encapsulated data packet to the VPN gateway.

[0033] A system for implementing dynamic access control in an Android device includes an Android terminal, a VPN gateway, a dynamic access control gateway, and an application server; the Android terminal includes a VPN client, a dynamic access control client, a TUN network interface card (NIC), and a physical NIC; wherein:

[0034] The VPN client negotiates with the dynamic access control client to determine the data exchange port and interest stream;

[0035] The VPN client reads the data packet from the TUN network card for the first time, and forwards the corresponding data packet to the dynamic access control client through the negotiated data interaction port according to the interest flow negotiated with the dynamic access control client;

[0036] The dynamic access control client encapsulates the data packet for the first time according to the communication protocol format between itself and the dynamic access control gateway. The operating system forwards the encapsulated data packet to the TUN network card according to the routing table information.

[0037] The VPN client reads the data packet a second time from the TUN network card, performs a second encapsulation according to the VPN format, and the operating system forwards the second encapsulated data packet to the physical network card according to the routing table information. The physical network card then sends the second encapsulated data packet to the VPN gateway.

[0038] After receiving the data packet, the VPN gateway performs the first decapsulation operation and forwards the decapsulated data packet to the dynamic access control gateway.

[0039] The dynamic access control gateway performs a second decapsulation operation on the data packets and forwards the decapsulated data packets to the application server.

[0040] The beneficial effects of this invention are as follows:

[0041] a) When the virtual network card of the Android device is occupied by the VPN client, dynamic access control can be implemented without the awareness of the upper-layer application client.

[0042] b) This method does not change the existing business access methods, does not subvert the existing business integration results, and the way application clients and application system servers call data interaction remains unchanged. The user experience is unchanged and it is easier for users to use.

[0043] c) In this method, the dynamic access control gateway can be deployed either in a bypass or in series manner. The bypass method does not change the existing equipment deployment pattern of the business system, requiring minimal system modifications; the in series deployment makes the dynamic access control gateway a necessary pathway for business system data, further enhancing the security of the business system. Attached Figure Description

[0044] Figure 1 This is the overall architecture diagram of the existing solution.

[0045] Figure 2 This is the overall architecture diagram of the present invention. Detailed Implementation

[0046] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to specific examples and accompanying drawings.

[0047] 1. Overall Workflow

[0048] The overall architecture of the present invention is as follows Figure 2As shown, on the Android terminal, the VPN client occupies the TUN network card, while the dynamic access control client runs as a regular user-space app. On the server side, the dynamic access control gateway is placed after the VPN gateway. The present invention discloses a method for implementing dynamic access control in an Android device. The basic idea is as follows: A VPN client and a dynamic access control client negotiate to determine a data exchange port and interest flow. The VPN client reads data packets from the TUN network interface card (NIC) for the first time and forwards the corresponding data packets to the NIC through the negotiated data exchange port according to the interest flow negotiated with the NIC. The NIC performs a first encapsulation of the data packets according to its communication protocol format with the NIC gateway, and then sends the first encapsulated data packets via the operating system protocol stack. The operating system forwards the first encapsulated data packets to the TUN NIC according to routing table information. The VPN client reads data packets from the TUN NIC for the second time, performs a second encapsulation according to the VPN format, and then sends the second encapsulated data packets via the operating system protocol stack. The operating system forwards the second encapsulated data packets to the physical NIC according to routing table information, and finally sends the second encapsulated data packets to the VPN gateway through the Android device's physical NIC. After receiving the data packets, the VPN gateway performs a first decapsulation operation, forwards the first decapsulated data packets to the NIC gateway, and then performs a second decapsulation operation on the data packets, forwarding / proxying the second decapsulated data packets to the application server.

[0049] 2. Business Access Process

[0050] a) When the system starts up, the dynamic access control client negotiates with the VPN client. The negotiation includes, but is not limited to, the data exchange port and which data packets dynamic access control targets, i.e., the interest streams of dynamic access control, and configures the relevant routing table entries of the operating system.

[0051] b) When the APP client initiates a service access request, the operating system forwards the data packet to the TUN network card according to the routing table information;

[0052] c) The VPN client reads data packets from the TUN network card (first time reading data packets);

[0053] d) Based on the negotiation information in step a), the VPN client sends the eligible data packets to the dynamic access control client;

[0054] e) The dynamic access control client encapsulates the data packet for the first time according to its own communication protocol format with the dynamic access control gateway, fills the destination address of the data packet with the address of the dynamic access control gateway, and then sends the data packet out through the operating system protocol stack.

[0055] f) The operating system forwards the first encapsulated data packet to the TUN network card according to the routing table. The VPN client reads the data packet from the TUN network card again (second data packet reading), encapsulates the data packet a second time according to the VPN protocol format, and sends the encapsulated data packet out through the operating system protocol stack. The VPN client and the dynamic access control client do not decide which network card to send the data packet; the operating system decides which network card to send the data packet according to the system routing table.

[0056] g) The operating system forwards the data packets from step f) to the Android device's physical network card based on the routing table information, and finally sends them out through the physical network card;

[0057] h) When the data packet arrives at the VPN gateway, the VPN gateway performs the first decapsulation of the data packet and forwards the decapsulated data packet to the dynamic access control gateway;

[0058] i) The dynamic access control gateway receives the first decapsulated data packet, performs a second decapsulation of the data packet according to its own protocol format, and forwards or proxies the decapsulated data packet to the application server.

[0059] 3. Key points of the invention

[0060] a) When the Android device's virtual network card is already occupied by the VPN client, the dynamic access control client uses the interaction method between a regular user-mode App and the VPN client to encapsulate data packets sequentially.

[0061] b) The way the VPN client interacts with the dynamic access control client, including but not limited to AIDL, local socket communication, etc.; the information that the VPN client interacts with the dynamic access control client, including but not limited to interest streams, data interaction port numbers, dynamic access control gateway IP address information, etc.

[0062] c) VPN client and dynamic access control client keep-alive mechanism (the VPN client and dynamic access control client processes cannot be killed by the user), including but not limited to adding the dynamic access control client to the operating system whitelist, or the VPN client checking the dynamic access control client's service, and actively starting the dynamic access control client if the service does not exist, etc.

[0063] d) The dynamic access control gateway can obtain the current environmental status changes of Android terminals such as mobile phones, automatically arrange access control policies, and dynamically block user access behavior.

[0064] Specifically, "automatically orchestrating access control policies and dynamically blocking user access behavior" refers to the following: through modules such as Mobile Device Management (MDM), Mobile Application Management (MAM), mobile virus scanning, and vulnerability scanning, the device information, user information, security risk information, geographical location information, and network connection information of Android terminals are collected and uploaded to the access control policy center that works in conjunction with the dynamic access control gateway. The access control policy center then orchestrates access control policies based on the collected terminal information and distributes these policies to the dynamic access control gateway. The dynamic access control gateway then decides whether to block certain user behaviors based on the access control policies.

[0065] In this invention, the dynamic access control gateway can support two deployment methods: bypass deployment and in-line deployment. In-line deployment means the dynamic access control gateway is deployed on the path that users must take to access the server, while bypass deployment means the dynamic access control gateway is not deployed on the necessary path.

[0066] Another embodiment of the present invention provides an Android terminal, the Android terminal including a VPN client, a dynamic access control client, a TUN network card, and a physical network card; wherein:

[0067] The VPN client negotiates with the dynamic access control client to determine the data exchange port and interest stream;

[0068] The VPN client reads the data packet from the TUN network card for the first time, and forwards the corresponding data packet to the dynamic access control client through the negotiated data interaction port according to the interest flow negotiated with the dynamic access control client;

[0069] The dynamic access control client encapsulates the data packet for the first time according to the communication protocol format between itself and the dynamic access control gateway. The operating system forwards the encapsulated data packet to the TUN network card according to the routing table information.

[0070] The VPN client reads the data packet a second time from the TUN network card, performs a second encapsulation according to the VPN format, and the operating system forwards the second encapsulated data packet to the physical network card according to the routing table information. The physical network card then sends the second encapsulated data packet to the VPN gateway.

[0071] Another embodiment of the present invention provides a system for implementing dynamic access control in an Android device, including an Android terminal, a VPN gateway, a dynamic access control gateway, and an application server; the Android terminal includes a VPN client, a dynamic access control client, a TUN network card, and a physical network card; wherein:

[0072] The VPN client negotiates with the dynamic access control client to determine the data exchange port and interest stream;

[0073] The VPN client reads the data packet from the TUN network card for the first time, and forwards the corresponding data packet to the dynamic access control client through the negotiated data interaction port according to the interest flow negotiated with the dynamic access control client;

[0074] The dynamic access control client encapsulates the data packet for the first time according to the communication protocol format between itself and the dynamic access control gateway. The operating system forwards the encapsulated data packet to the TUN network card according to the routing table information.

[0075] The VPN client reads the data packet a second time from the TUN network card, performs a second encapsulation according to the VPN format, and the operating system forwards the second encapsulated data packet to the physical network card according to the routing table information. The physical network card then sends the second encapsulated data packet to the VPN gateway.

[0076] After receiving the data packet, the VPN gateway performs the first decapsulation operation and forwards the decapsulated data packet to the dynamic access control gateway.

[0077] The dynamic access control gateway performs a second decapsulation operation on the data packets and forwards the decapsulated data packets to the application server.

[0078] The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and to implement it accordingly. Those skilled in the art will understand that various substitutions, changes, and modifications are possible without departing from the spirit and scope of the present invention. The present invention should not be limited to the content disclosed in the embodiments of this specification; the scope of protection of the present invention is defined by the claims.

Claims

1. A method for implementing dynamic access control in an Android device, characterized in that, Includes the following steps: The VPN client negotiates with the dynamic access control client to determine the data exchange port and interest stream; The VPN client reads the data packet from the TUN network card for the first time, and forwards the corresponding data packet to the dynamic access control client through the negotiated data interaction port according to the interest flow negotiated with the dynamic access control client; The dynamic access control client encapsulates the data packet for the first time according to the communication protocol format between itself and the dynamic access control gateway. The operating system forwards the encapsulated data packet to the TUN network card according to the routing table information. The VPN client reads the data packet a second time from the TUN network card, performs a second encapsulation according to the VPN format, and the operating system forwards the second encapsulated data packet to the physical network card according to the routing table information. The physical network card then sends the second encapsulated data packet to the VPN gateway.

2. The method according to claim 1, characterized in that, It also includes the following steps: After receiving the data packet, the VPN gateway performs the first decapsulation operation and forwards the decapsulated data packet to the dynamic access control gateway. The dynamic access control gateway performs a second decapsulation operation on the data packets and forwards the decapsulated data packets to the application server.

3. The method according to claim 1 or 2, characterized in that, When the dynamic access control client performs the first encapsulation of the data packet, it fills in the destination address of the data packet as the dynamic access control gateway address, and then sends the encapsulated data packet out through the operating system protocol stack; after the VPN client performs the second encapsulation of the data packet, it sends the encapsulated data packet out through the operating system protocol stack.

4. The method according to claim 1 or 2, characterized in that, When the TUN network card is already occupied by the VPN client, the dynamic access control client interacts with the VPN client in a normal user-mode App manner, and encapsulates data packets sequentially.

5. The method according to claim 1, characterized in that, The VPN client interacts with the dynamic access control client via AIDL or local socket communication; the information exchanged between the VPN client and the dynamic access control client includes interest streams, data interaction port numbers, and dynamic access control gateway IP address information.

6. The method according to claim 1, characterized in that, The keep-alive mechanism for the VPN client and the dynamic access control client includes: adding the dynamic access control client to the operating system whitelist, or the VPN client checking the services of the dynamic access control client and actively starting the dynamic access control client if the service does not exist.

7. The method according to claim 1, characterized in that, The dynamic access control gateway obtains the current environmental status changes of the Android terminal, automatically arranges access control policies, and dynamically blocks user access behavior.

8. An Android terminal, characterized in that, The Android terminal includes a VPN client, a dynamic access control client, a TUN network card, and a physical network card; wherein: The VPN client negotiates with the dynamic access control client to determine the data exchange port and interest stream; The VPN client reads the data packet from the TUN network card for the first time, and forwards the corresponding data packet to the dynamic access control client through the negotiated data interaction port according to the interest flow negotiated with the dynamic access control client; The dynamic access control client encapsulates the data packet for the first time according to the communication protocol format between itself and the dynamic access control gateway. The operating system forwards the encapsulated data packet to the TUN network card according to the routing table information. The VPN client reads the data packet a second time from the TUN network card, performs a second encapsulation according to the VPN format, and the operating system forwards the second encapsulated data packet to the physical network card according to the routing table information. The physical network card then sends the second encapsulated data packet to the VPN gateway.

9. A system for implementing dynamic access control in an Android device, characterized in that, It includes an Android terminal, a VPN gateway, a dynamic access control gateway, and an application server; the Android terminal includes a VPN client, a dynamic access control client, a TUN network card, and a physical network card; wherein: The VPN client negotiates with the dynamic access control client to determine the data exchange port and interest stream; The VPN client reads the data packet from the TUN network card for the first time, and forwards the corresponding data packet to the dynamic access control client through the negotiated data interaction port according to the interest flow negotiated with the dynamic access control client; The dynamic access control client encapsulates the data packet for the first time according to the communication protocol format between itself and the dynamic access control gateway. The operating system forwards the encapsulated data packet to the TUN network card according to the routing table information. The VPN client reads the data packet a second time from the TUN network card, performs a second encapsulation according to the VPN format, and the operating system forwards the second encapsulated data packet to the physical network card according to the routing table information. The physical network card then sends the second encapsulated data packet to the VPN gateway. After receiving the data packet, the VPN gateway performs the first decapsulation operation and forwards the decapsulated data packet to the dynamic access control gateway. The dynamic access control gateway performs a second decapsulation operation on the data packets and forwards the decapsulated data packets to the application server.

Images