A method, system and medium for securely accessing protected applications in a fixed network environment

Abstract

The present application relates to a method, system and medium for securely accessing protected applications in a fixed network environment, and belongs to the field of communication technology. Obtain domain name resolution records, detect whether the access application corresponding to the application access request is a protected application, and if so, determine whether the user authentication information meets the preset login authentication information. If so, determine whether the message corresponding to the application access request is an IPv6 message. If so, determine the target IPv6 address based on the application configuration record, and encrypt the data payload in the message according to the preset data certificate and the target IPv6 address. If not, translate the message to obtain the processed message, encrypt the data payload in the processed message according to the preset data certificate and the target IPv6 address, and send the encrypted IPv6 message to the IPv6 stealth protection application gateway through the IPv6 network. The present application improves the security of accessing protected applications in a fixed network environment.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method, system and medium for securely accessing protected applications in a fixed network environment. Background Art

[0002] With the popularization of Internet technology, the network has penetrated into every aspect of people's daily life due to its convenient and efficient communication characteristics, bringing great convenience to our study and work, but the various security risks that come with it (information leakage and virus transmission, etc.) threaten the entire server communication system. Therefore, in today's digital communication era, the security issues of network connection and server communication are also receiving more and more attention.

[0003] As the core component of the information system, the server carries the key business services of the information system. With the continuous improvement of informatization, various business services are increasing. While these business services are running normally, they are also facing serious security issues, such as illegal access, identity impersonation, sniffing and eavesdropping, and other attacks, as well as the invasion of worms and malicious programs, which lead to the destruction of information systems or the theft, tampering and abuse of sensitive data and information, posing a serious threat to the security of information systems. The root cause of these security risks is that the server will expose a fixed IP address to the outside, which makes it impossible to guarantee the security of accessing protected applications in the network environment. Summary of the invention

[0004] In order to ensure the security of users accessing protected applications through a fixed network environment, the present application provides a method, system and medium for securely accessing protected applications in a fixed network environment.

[0005] In a first aspect, the present application provides a method for securely accessing a protected application in a fixed network environment, using the following technical solution:

[0006] A method for securely accessing a protected application in a fixed network environment, applied to an IPv6 stealth access hard terminal, comprising:

[0007] When detecting an application access request, detecting whether the access application corresponding to the application access request is the protected application, and if so, controlling the display of a user authentication page, obtaining user authentication information input by the user into the user authentication page, and determining whether the user authentication information conforms to the preset login authentication information;

[0008] If the user authentication information meets the preset login authentication information, the application configuration record is determined based on the domain name resolution record and the protected application, and it is determined whether the message corresponding to the application access request is an IPv6 message. If so, the target IPv6 address is determined based on the application configuration record, and the data payload in the message is encrypted according to the preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message. The domain name resolution record is a domain name address mapping resolution record corresponding to different protected applications;

[0009] If not, determining whether the message is an IPv4 message, and when the message is an IPv4 message, translating the message to obtain a processed message, calculating the target IPv6 address according to the cryptographic algorithm and the application configuration record, and encrypting the data payload in the processed message according to the preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message;

[0010] The encrypted IPv6 message is sent to the IPv6 stealth protection application gateway through the IPv6 network.

[0011] By adopting the above technical solution, when a user accesses a protected application through a fixed network environment, a domain name resolution record is obtained, wherein the domain name resolution record is a domain name address mapping resolution record corresponding to different protected applications, so as to facilitate subsequent application configuration of different protected applications according to the domain name resolution record, and then when detecting an application access request, it is detected whether the access application corresponding to the application access request is the protected application, and if so, the user authentication page is controlled to be displayed, and the user authentication information input by the user into the user authentication page is obtained, and it is determined whether the user authentication information conforms to the preset login authentication information, so as to improve the verification of the authenticity of the user identity, and if the user authentication information conforms to the preset login authentication information, the application configuration record is determined based on the domain name resolution record and the protected application, and the message corresponding to the application access request is determined. Whether it is an IPv6 message, if so, determine the target IPv6 address based on the application configuration record, and encrypt the data payload in the message according to the preset data certificate and the target IPv6 address to obtain the encrypted IPv6 message, if not, determine whether the message is an IPv4 message, and when the message is an IPv4 message, translate the message to obtain a processed message, calculate the target IPv6 address according to the cryptographic algorithm and the application configuration record, and encrypt the data payload in the processed message according to the preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message, and send the encrypted IPv6 message to the IPv6 stealth protection application gateway through the IPv6 network, so that users can securely access protected applications through the IPv6 network. And the communication access process in the middle cannot be scanned, sniffed, or restored, thereby improving the security of accessing protected applications in the network environment.

[0012] In a possible implementation, the detecting whether the access application corresponding to the application access request is the protected application further includes:

[0013] If the access application corresponding to the application access request is not the protected application, the message in the application access request is directly forwarded to the corresponding access application.

[0014] In a possible implementation, the determining whether the user authentication information meets the preset login authentication information further includes:

[0015] If the user authentication information does not conform to the preset login authentication information, identity abnormality information is generated and the identity abnormality information is controlled to be displayed.

[0016] In a possible implementation, the determining the application configuration record based on the domain name resolution record and the protected application includes:

[0017] Determine the mapping relationship between the domain names and addresses of different protected applications according to the domain name resolution record;

[0018] Determine whether the protected application is an IPv4 application. If so, determine the first record and the second record corresponding to the protected application based on the mapping relationship, where the first record is the real application IPv4 address corresponding to the protected application domain name, and the second record is the target IPv6 address obtained by comprehensive calculation based on the IPv6 prefix of the IPv6 stealth protection application gateway associated with the protected application, the preset data certificate, the ID of the protected application, and the current timestamp;

[0019] If the protected application is not an IPv4 application but an IPv6 application, a target IPv6 address is obtained by comprehensive calculation based on the IPv6 prefix of the IPv6 stealth protection application gateway associated with the protected application, a preset data certificate, the ID of the protected application, and the current timestamp, and the target IPv6 address is bound to the protected application as the third record;

[0020] Application configuration records of different protected applications are determined based on the first record, the second record, and the third record.

[0021] In a possible implementation, the controlling and displaying of the user authentication page also includes:

[0022] Acquire access control rules, where the access control rules are rules for controlling users with different identity information to access a specified protected application;

[0023] Based on the access control rule, it is determined whether the user corresponding to the application access request has the authority to access the protected application. If so, a user authentication page is controlled to be displayed.

[0024] In a second aspect, the present application provides a method for securely accessing a protected application in a fixed network environment, using the following technical solution:

[0025] A method for securely accessing protected applications in a fixed network environment, applied to an IPv6 stealth protection application gateway, comprising:

[0026] Receive an IPv6 message sent from an IPv6 stealth access hard terminal, wherein the IPv6 message is obtained by obtaining a domain name resolution record, the domain name resolution record is a domain name address mapping resolution record corresponding to different protected applications, and when detecting an application access request, detect whether the access application corresponding to the application access request is the protected application, and if so, control the display of a user authentication page, and obtain user authentication information input by the user into the user authentication page, and determine whether the user authentication information conforms to the preset login authentication information, and if the user authentication information conforms to the preset login authentication information, determine the application configuration record based on the domain name resolution record and the protected application, and determine whether the message corresponding to the application access request is an IPv6 message, and if so, determine based on the application configuration record Determine a target IPv6 address, and encrypt the data payload in the message according to a preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message, and determine whether the message is an IPv4 message, and when the message is an IPv4 message, translate the message to obtain a processed message, calculate the target IPv6 address according to a cryptographic algorithm and the application configuration record, and encrypt the data payload in the processed message according to the preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message, calculate the target IPv6 address according to the cryptographic algorithm and the application configuration record, and encrypt the data payload in the processed message according to the target IPv6 address to obtain an encrypted IPv6 message;

[0027] Determine a target IPv6 address according to the IPv6 message, and restore information of parameters in the target IPv6 address based on the cryptographic algorithm to obtain message record parameters;

[0028] Verify different types of parameters in the message record parameters one by one to determine whether there is a situation where the parameters do not meet the preset standards, and if so, discard the IPv6 message;

[0029] If not, decrypting the data payload in the IPv6 message based on the preset data certificate to obtain a decrypted IPv6 message;

[0030] The decrypted IPv6 message is sent to the protected application.

[0031] By adopting the above technical solution, after the IPv6 stealth protection application gateway receives the IPv6 message sent from the IPv6 stealth access hard terminal, it retrieves the target IPv6 address in the IPv6 message, and then restores the parameters in the target IPv6 address based on the cryptographic algorithm to obtain the message record parameters, and then verifies the message record parameters one by one to determine whether there are any conditions in the parameters that do not meet the preset standards. If so, it means that the message has been stolen and modified, so the IPv6 message is discarded. Otherwise, if not, the IPv6 message is decrypted for the next step of data payload to obtain the final request IPv6 message, which is sent to the protected application for application access, thereby improving the security of access to the protected application through double decryption and verification of the IPv6 stealth protection application gateway.

[0032] In a possible implementation manner, the sending the decrypted IPv6 message to the protected application also includes:

[0033] Determine whether the protected application has an IPv6 address. If so, modify the source address of the decrypted IPv6 message to the IPv6 address of the IPv6 stealth protection application gateway and modify the destination address of the decrypted IPv6 message to the IPv6 address of the protected application.

[0034] If the protected application does not have an IPv6 address, the decrypted IPv6 message is translated into an IPv4 message, and the source address of the IPv4 message is modified to the IPv4 address of the IPv6 stealth protection application gateway and the target address of the IPv4 message is modified to the IPv4 address of the protected application.

[0035] In a third aspect, the present application provides a fixed network environment for securely accessing a protected application system, using the following technical solution:

[0036] A fixed network environment secure access to protected application system, applied to IPv6 stealth access hard terminal, including:

[0037] An application detection module is used to detect whether the access application corresponding to the application access request is the protected application when detecting an application access request. If so, control the display of a user authentication page, obtain user authentication information input by the user into the user authentication page, and determine whether the user authentication information conforms to the preset login authentication information;

[0038] A first encryption module is used to determine the application configuration record based on the domain name resolution record and the protected application when the user authentication information meets the preset login authentication information, determine whether the message corresponding to the application access request is an IPv6 message, and if so, determine the target IPv6 address based on the application configuration record, and encrypt the data payload in the message according to the preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message, wherein the domain name resolution record is a domain name address mapping resolution record corresponding to different protected applications;

[0039] A second encryption module is used for translating the message to obtain a processed message when the message is an IPv4 message, calculating a target IPv6 address according to a cryptographic algorithm and the application configuration record, and encrypting a data payload in the processed message according to a preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message;

[0040] The first sending module is used to send the encrypted IPv6 message to the IPv6 stealth protection application gateway through the IPv6 network.

[0041] In a fourth aspect, the present application provides a fixed network environment for securely accessing a protected application system, using the following technical solution:

[0042] A fixed network environment secure access to protected application system, applied to an IPv6 stealth protection application gateway, comprising:

[0043] A message receiving module is used to receive an IPv6 message sent from an IPv6 stealth access hard terminal, wherein the IPv6 message is obtained by obtaining a domain name resolution record, the domain name resolution record is a domain name address mapping resolution record corresponding to different protected applications, and when detecting an application access request, it is detected whether the access application corresponding to the application access request is the protected application, and if so, the user authentication page is controlled to be displayed, and the user authentication information input by the user into the user authentication page is obtained, and it is determined whether the user authentication information conforms to the preset login authentication information, and if the user authentication information conforms to the preset login authentication information, the application configuration record is determined based on the domain name resolution record and the protected application, and it is determined whether the message corresponding to the application access request is an IPv6 message, and if so, based on the application The configuration record determines the target IPv6 address, and encrypts the data payload in the message according to the preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message, and determines whether the message is an IPv4 message, and when the message is an IPv4 message, translates the message to obtain a processed message, calculates the target IPv6 address according to the cryptographic algorithm and the application configuration record, and encrypts the data payload in the processed message according to the preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message, calculates the target IPv6 address according to the cryptographic algorithm and the application configuration record, and encrypts the data payload in the processed message according to the target IPv6 address to obtain an encrypted IPv6 message;

[0044] An information restoration module, used to determine a target IPv6 address according to the IPv6 message, and perform information restoration on parameters in the target IPv6 address based on the cryptographic algorithm to obtain message record parameters;

[0045] A parameter checking module is used to check different types of parameters in the message record parameters one by one to determine whether there is a situation where the parameters do not meet the preset standards. If so, the IPv6 message is discarded;

[0046] A message decryption module, used for decrypting the data payload in the IPv6 message based on a preset data certificate to obtain a decrypted IPv6 message when there is no situation where different types of parameters in the message record parameters do not fail to meet the preset standard;

[0047] The second sending module is used to send the decrypted IPv6 message to the protected application.

[0048] In a fifth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution:

[0049] A computer-readable storage medium stores a computer program that can be loaded by a processor and executes any one of the methods in the first aspect or the second aspect.

[0050] In summary, the present application includes at least one of the following beneficial technical effects:

[0051] 1. By adopting the above technical solution, when a user accesses a protected application through a fixed network environment, a domain name resolution record is obtained, wherein the domain name resolution record is a domain name address mapping resolution record corresponding to different protected applications, so as to facilitate subsequent application configuration of different protected applications according to the domain name resolution record, and then when detecting an application access request, it is detected whether the access application corresponding to the application access request is a protected application. If so, the user authentication page is controlled to be displayed, and the user authentication information input by the user into the user authentication page is obtained, and it is determined whether the user authentication information conforms to the preset login authentication information, so as to improve the verification of the authenticity of the user identity. If the user authentication information conforms to the preset login authentication information, the application configuration record is determined based on the domain name resolution record and the protected application, and the corresponding application of the application access request is determined. Whether the message is an IPv6 message, if so, determine the target IPv6 address based on the application configuration record, and encrypt the data payload in the message according to the preset data certificate and the target IPv6 address to obtain the encrypted IPv6 message, if not, determine whether the message is an IPv4 message, and when the message is an IPv4 message, translate the message to obtain the processed message, calculate the target IPv6 address according to the cryptographic algorithm and the application configuration record, and encrypt the data payload in the processed message according to the preset data certificate and the target IPv6 address to obtain the encrypted IPv6 message, and send the encrypted IPv6 message to the IPv6 stealth protection application gateway through the IPv6 network, so that users can access the protected application through the IPv6 network securely. And the communication access process in the middle cannot be scanned, sniffed, and the content cannot be restored, thereby improving the security of accessing protected applications in the network environment;

[0052] 2. By adopting the above technical solution, after the IPv6 stealth protection application gateway receives the IPv6 message sent from the IPv6 stealth access hard terminal, it retrieves the target IPv6 address in the IPv6 message, and then restores the parameters in the target IPv6 address based on the cryptographic algorithm to obtain the message record parameters, and then verifies the message record parameters one by one to determine whether there are any conditions in the parameters that do not meet the preset standards. If so, it means that the message has been stolen and modified, so the IPv6 message is discarded. Otherwise, if not, the IPv6 message is decrypted for the next step of data payload to obtain the final request IPv6 message, which is sent to the protected application for application access, thereby improving the security of access to the protected application through double decryption and verification of the IPv6 stealth protection application gateway. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a first flow chart of a method for securely accessing a protected application in a fixed network environment according to one of the embodiments of the present application.

[0054] Figure 2 This is a second flow chart of securely accessing a protected application system in a fixed network environment in one of the embodiments of the present application.

[0055] Figure 3 This is a third flow chart of a method for securely accessing a protected application in a fixed network environment according to one of the embodiments of the present application.

[0056] Figure 4 This is a fourth flow chart of secure access to a protected application system in a fixed network environment in one of the embodiments of the present application. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solutions and advantages of this application more clear, the following Figure 1-4 It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0058] First, the terms of the embodiments of the present application are explained:

[0059] IPv6 stealth access hard terminal: a network device that performs user identity authentication for users who want to access protected applications. After the authentication is passed, the traffic accessing the protected application is dynamically processed with the IPv6 address and encrypted with the message payload, and then sent to the target IPv6 stealth protection application gateway.

[0060] IPv6 Stealth Protection Application Gateway: A network device that publishes dynamic IPv6 addresses for protected applications, receives access traffic from IPv6 Stealth Access Hard Terminals, and discards traffic that fails verification. For legitimate access requests from IPv6 Stealth Access Hard Terminals, the IPv6 Stealth Protection Application Gateway forwards them to the corresponding application server.

[0061] The embodiment of the present application discloses a method for securely accessing a protected application in a fixed network environment based on the initiator's IPv6 gateway side.

[0062] Reference Figure 1 , a method for securely accessing protected applications in a fixed network environment, applied to IPv6 stealth access hard terminals, comprising:

[0063] Step S101, when detecting an application access request, detecting whether the access application corresponding to the application access request is a protected application, if so, controlling the display of a user authentication page, obtaining user authentication information input by the user into the user authentication page, and determining whether the user authentication information conforms to the preset login authentication information;

[0064] Specifically, a user is created and login authentication information is associated with the user. The login authentication information can be created and configured with a corresponding login username and password by the management plane, or can be associated with other authentication servers (such as LDAP servers, etc.) in a fixed network environment.

[0065] Step S102: If the user authentication information meets the preset login authentication information, the application configuration record is determined based on the domain name resolution record and the protected application, and it is determined whether the message corresponding to the application access request is an IPv6 message. If so, the target IPv6 address is determined based on the application configuration record, and the data payload in the message is encrypted according to the preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message.

[0066] The domain name resolution record is a domain name address mapping resolution record corresponding to different protected applications.

[0067] In an embodiment of the present application, when a user terminal accesses an application, the user terminal obtains the domain name resolution record of the corresponding IPv6 stealth access hard terminal, and sends the domain name resolution record together with the application access request to the IPv6 stealth access hard terminal. After receiving the domain name resolution record, the IPv6 stealth access hard terminal configures access to the domain name resolution record.

[0068] Step S103: if not, determine whether the message is an IPv4 message, and when the message is an IPv4 message, translate the message to obtain a processed message, calculate the target IPv6 address according to the cryptographic algorithm and the application configuration record, and encrypt the data payload in the processed message according to the preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message;

[0069] Specifically, for IPv4 applications, both A records and AAAA records need to be configured for access by IPv4 terminals and IPv6 terminals in the fixed network. Among them, the A record is the real application IPv4 address; the AAAA record is calculated by (the IPv6 prefix of the IPv6 stealth application gateway associated with the application, the user's secure communication data certificate, the application ID, and the timestamp). It is dynamically changing, different for each user, and updated at short intervals. For IPv6 applications, only the AAAA record needs to be configured, and the generation method is the same as the above-mentioned IPv4 terminal AAAA record generation method.

[0070] The specific calculation method is to use a hash function to hash the above parameters to generate a unique hash value, namely, an AAAA record. The corresponding target IPv6 address is determined according to the A record and AAAA record configured in the IPv4 application and the AAAA record configured in the IPv6 application.

[0071] Step S104, sending the encrypted IPv6 message to the IPv6 stealth protection application gateway through the IPv6 network.

[0072] In the above implementation, when a user accesses a protected application through a fixed network environment, a domain name resolution record is obtained, wherein the domain name resolution record is a domain name address mapping resolution record corresponding to different protected applications, so as to facilitate subsequent application configuration of different protected applications according to the domain name resolution record, and then when detecting an application access request, it is detected whether the access application corresponding to the application access request is a protected application. If so, the user authentication page is controlled to be displayed, and the user authentication information entered by the user into the user authentication page is obtained, and it is determined whether the user authentication information conforms to the preset login authentication information, so as to improve the verification of the authenticity of the user identity. If the user authentication information conforms to the preset login authentication information, the application configuration record is determined based on the domain name resolution record and the protected application, and the message corresponding to the application access request is determined. Whether it is an IPv6 message, if so, the target IPv6 address is determined based on the application configuration record, and the data payload in the message is encrypted according to the preset data certificate and the target IPv6 address to obtain the encrypted IPv6 message, if not, it is determined whether the message is an IPv4 message, and when the message is an IPv4 message, the message is translated and processed to obtain the processed message, the target IPv6 address is calculated according to the cryptographic algorithm and the application configuration record, and the data payload in the processed message is encrypted according to the preset data certificate and the target IPv6 address to obtain the encrypted IPv6 message, and the encrypted IPv6 message is sent to the IPv6 stealth protection application gateway through the IPv6 network, so that users can securely access the protected application through the IPv6 network. And the communication access process in the middle cannot be scanned, sniffed, and the content cannot be restored, thereby improving the security of accessing protected applications in the network environment.

[0073] In a possible implementation of the embodiment of the present application, detecting whether the access application corresponding to the application access request is a protected application also includes: if the access application corresponding to the application access request is not a protected application, directly forwarding the message in the application access request to the corresponding access application.

[0074] In a possible implementation of the embodiment of the present application, determining whether the user authentication information conforms to the preset login authentication information also includes: if the user authentication information does not conform to the preset login authentication information, generating identity abnormality information, and controlling the display of the identity abnormality information.

[0075] In a possible implementation of the embodiment of the present application, an application configuration record is determined based on a domain name resolution record and a protected application, including: determining a mapping relationship between domain names and addresses of different protected applications based on the domain name resolution record, judging whether the protected application is an IPv4 application, and if so, determining a first record and a second record corresponding to the protected application based on the mapping relationship, the first record being a real application IPv4 address corresponding to the domain name of the protected application, and the second record being a target IPv6 address obtained by comprehensive calculation based on the IPv6 prefix of the IPv6 stealth protection application gateway associated with the protected application, a preset data certificate, an ID identifier of the protected application, and a current timestamp; if the protected application is not an IPv4 application but an IPv6 application, then a target IPv6 address is obtained by comprehensive calculation based on the IPv6 prefix of the IPv6 stealth protection application gateway associated with the protected application, a preset data certificate, an ID identifier of the protected application, and a current timestamp, and the target IPv6 address is bound to the protected application as a third record, and application configuration records of different protected applications are determined based on the first record, the second record, and the third record.

[0076] The first record is an A record, and the second record and the third record are AAAA records.

[0077] In a possible implementation method of the embodiment of the present application, controlling the display of a user authentication page also includes: obtaining control access rules, the control access rules are rules for controlling users with different identity information to access specified protected applications, and determining based on the control access rules whether the user corresponding to the application access request has the authority to access the protected application; if so, controlling the display of the user authentication page.

[0078] In the embodiment of the present application, it is predetermined which users can access which protected applications. These rules can be manually written into the IPv6 stealth access hard terminal and the IPv6 stealth protection application gateway, or they can be uniformly issued through the IPv6 communication authorization component of the management plane, which is not limited here.

[0079] Reference Figure 2 The embodiment of the present application also discloses a fixed network environment secure access to a protected application system 20 based on the initiator's IPv6 gateway side.

[0080] A fixed network environment secure access protected application system 20, applied to IPv6 stealth access hard terminal, comprising:

[0081] The application detection module 21 is used to detect whether the access application corresponding to the application access request is a protected application when detecting an application access request. If so, control the display of a user authentication page, obtain user authentication information input by the user into the user authentication page, and determine whether the user authentication information conforms to the preset login authentication information;

[0082] The first encryption module 22 is used to determine the application configuration record based on the domain name resolution record and the protected application when the user authentication information meets the preset login authentication information, determine whether the message corresponding to the application access request is an IPv6 message, and if so, determine the target IPv6 address based on the application configuration record, and encrypt the data payload in the message according to the preset data certificate and the target IPv6 address to obtain the encrypted IPv6 message, and the domain name resolution record is a domain name address mapping resolution record corresponding to different protected applications;

[0083] The second encryption module 23 is used to translate the message when the message is an IPv4 message to obtain a processed message, calculate the target IPv6 address according to the cryptographic algorithm and the application configuration record, and encrypt the data payload in the processed message according to the preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message;

[0084] The first sending module 24 is used to send the encrypted IPv6 message to the IPv6 stealth protection application gateway through the IPv6 network.

[0085] The system for securely accessing protected applications in a fixed network environment based on IPv6 stealth access to a hard terminal side in an embodiment of the present application can implement any of the above-mentioned methods for securely accessing protected applications in a fixed network environment based on IPv6 stealth access to a hard terminal side, and the specific working process of each module in the system for securely accessing protected applications in a fixed network environment can refer to the corresponding process in the above-mentioned method embodiments.

[0086] The embodiment of the present application also discloses a method for securely accessing protected applications in a fixed network environment based on the IPv6 stealth protection application gateway side.

[0087] Reference Figure 3 , a method for securely accessing protected applications in a fixed network environment, applied to an IPv6 stealth protection application gateway, comprising:

[0088] Step S301, receiving an IPv6 message sent from an IPv6 stealth access hard terminal.

[0089] Among them, the IPv6 message is obtained by obtaining the domain name resolution record, which is the domain name address mapping resolution record corresponding to different protected applications. When detecting the application access request, it is detected whether the access application corresponding to the application access request is a protected application. If so, the user authentication page is controlled to be displayed, and the user authentication information entered by the user into the user authentication page is obtained to determine whether the user authentication information conforms to the preset login authentication information. If the user authentication information conforms to the preset login authentication information, the application configuration record is determined based on the domain name resolution record and the protected application to determine whether the message corresponding to the application access request is an IPv6 message. If so, the target IPv6 address is determined based on the application configuration record, and the root An encrypted IPv6 message is obtained by encrypting the data payload in the message according to a preset data certificate and a target IPv6 address, and determining whether the message is an IPv4 message, and when the message is an IPv4 message, translating the message to obtain a processed message, calculating the target IPv6 address according to a cryptographic algorithm and an application configuration record, and encrypting the data payload in the processed message according to the preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message, calculating the target IPv6 address according to the cryptographic algorithm and the application configuration record, and encrypting the data payload in the processed message according to the target IPv6 address to obtain an encrypted IPv6 message.

[0090] Step S302, determining the target IPv6 address according to the IPv6 message, and restoring the information of the parameters in the target IPv6 address based on the cryptographic algorithm to obtain the message record parameters.

[0091] For the embodiment of the present application, the cryptographic algorithm is a hash function algorithm. In the present application, since the target IPv6 address is calculated by the hash function algorithm, the original parameters in the target IPv6 address can be restored by reverse deduction through the hash function algorithm, thereby obtaining the message record parameters, so as to subsequently verify the authenticity of the target IPv6 address.

[0092] Step S303, verify different types of parameters in the message record parameters one by one to determine whether there is a situation where the parameters do not meet the preset standards. If so, discard the IPv6 message.

[0093] Specifically, the preset standard is a reference numerical standard for different types of parameters in the message record parameters, that is, different types of parameters in the message record parameters need to match the parameters in the preset standard. Not only must they conform to the parameter types in the preset standard, but they must also ensure that the type parameter values ​​in the message record parameters satisfy the reference numerical values ​​corresponding to the parameter types.

[0094] Step S304: If the data certificate does not exist, the data payload in the IPv6 message is decrypted based on the preset data certificate to obtain a decrypted IPv6 message.

[0095] Specifically, the preset data certificate is a certificate created for each user who needs to access the protected application, and after creation, it is pre-configured in the IPv6 stealth access hard terminal and the IPv6 stealth protection application gateway to encrypt the IPv6 address generated during IPv6 secure communication and the data payload in the message.

[0096] Step S305: Send the decrypted IPv6 message to the protected application.

[0097] In an embodiment of the present application, the initiator's IPv6 gateway uses the encryption algorithm and key in the security communication information to encrypt the IPv6 message, so that the encrypted IPv6 message will become unreadable. Only the recipient holding the correct key can decrypt and read the message content. When the recipient's IPv6 gateway obtains the inner IPv6 message, it uses the same encryption algorithm and key in the security communication information as when it was encrypted to decrypt the message. The decrypted message will be restored to its original form and can be read and processed by the recipient.

[0098] In the above implementation, after the IPv6 stealth protection application gateway receives the IPv6 message sent from the IPv6 stealth access hard terminal, it retrieves the target IPv6 address in the IPv6 message, and then restores the parameters in the target IPv6 address based on the cryptographic algorithm to obtain the message record parameters, and then verifies the message record parameters one by one to determine whether there are any conditions in the parameters that do not meet the preset standards. If so, it means that the message has been stolen and modified, so the IPv6 message is discarded. Otherwise, if not, the IPv6 message is decrypted for the next step of data payload to obtain the final request IPv6 message, and the message is sent to the protected application for application access, thereby improving the security of access to the protected application through double decryption and verification of the IPv6 stealth protection application gateway.

[0099] In a possible implementation method of an embodiment of the present application, the decrypted IPv6 message is sent to the protected application, and the process also includes: determining whether the protected application has an IPv6 address; if so, modifying the source address of the decrypted IPv6 message to the IPv6 address of the IPv6 stealth protection application gateway and modifying the target address of the decrypted IPv6 message to the IPv6 address of the protected application; if the protected application does not have an IPv6 address, translating the decrypted IPv6 message into an IPv4 message, modifying the source address of the IPv4 message to the IPv4 address of the IPv6 stealth protection application gateway and modifying the target address of the IPv4 message to the IPv4 address of the protected application.

[0100] Reference Figure 4 The embodiment of the present application also discloses a fixed network environment secure access to a protected application system 40 based on the receiving party's IPv6 gateway side.

[0101] A fixed network environment secure access protected application system 40, applied to an IPv6 stealth protection application gateway, comprising:

[0102] The message receiving module 41 is used to receive the IPv6 message sent from the IPv6 stealth access hard terminal, wherein the IPv6 message is obtained by obtaining the domain name resolution record, the domain name resolution record is the domain name address mapping resolution record corresponding to different protected applications, when detecting the application access request, detecting whether the access application corresponding to the application access request is a protected application, if so, controlling the display of the user authentication page, and obtaining the user authentication information input by the user into the user authentication page, judging whether the user authentication information conforms to the preset login authentication information, if the user authentication information conforms to the preset login authentication information, then determining the application configuration record based on the domain name resolution record and the protected application, determining whether the message corresponding to the application access request is an IPv6 message, if so, then determining whether the application access request is an IPv6 message based on the application configuration record, and determining whether the application access request is an IPv6 message. Determine the target IPv6 address using the configuration record, and encrypt the data payload in the message according to the preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message, determine whether the message is an IPv4 message, and when the message is an IPv4 message, translate the message to obtain a processed message, calculate the target IPv6 address according to the cryptographic algorithm and the application configuration record, encrypt the data payload in the processed message according to the preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message, calculate the target IPv6 address according to the cryptographic algorithm and the application configuration record, and encrypt the data payload in the processed message according to the target IPv6 address to obtain an encrypted IPv6 message;

[0103] An information restoration module 42 is used to determine a target IPv6 address according to the IPv6 message, and restore information of parameters in the target IPv6 address based on a cryptographic algorithm to obtain message record parameters;

[0104] The parameter checking module 43 is used to check different types of parameters in the message record parameters one by one to determine whether there is a situation where the parameters do not meet the preset standards. If so, the IPv6 message is discarded;

[0105] A message decryption module 44, configured to decrypt the data payload in the IPv6 message based on a preset data certificate to obtain a decrypted IPv6 message when there is no situation where the different types of parameters in the message record parameters do not fail to meet the preset standard;

[0106] The second sending module 45 is used to send the decrypted IPv6 message to the protected application.

[0107] In the above implementation, the security verification process is optimized and the encryption and decryption operations are simplified, while allowing the terminal to quickly process and forward legal messages, thereby improving communication security while reducing the consumption of system resources and improving the forwarding performance of the entire system.

[0108] The system for securely accessing protected applications in a fixed network environment based on the IPv6 stealth protection application gateway side in the embodiment of the present application can implement any of the above-mentioned methods for securely accessing protected applications in a fixed network environment based on the IPv6 stealth protection application gateway side, and the specific working process of each module in the system for securely accessing protected applications in a fixed network environment can refer to the corresponding process in the above-mentioned method embodiment.

[0109] In the several embodiments provided in this application, it should be understood that the provided methods and systems can be implemented in other ways. For example, the system embodiments described above are only illustrative; for example, the division of a certain module is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed.

[0110] The embodiment of the present application also discloses a computer-readable storage medium.

[0111] A computer-readable storage medium stores a computer program that can be loaded by a processor and execute any one of the above-mentioned methods for securely accessing a protected application in a fixed network environment.

[0112] Among them, computer-readable storage media can be any tangible medium that contains or stores a program, which can be used by or in conjunction with an instruction execution system, apparatus or device; the program code contained on the computer-readable medium can be transmitted using any appropriate medium, including but not limited to wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0113] It should be noted that in the above embodiments, the description of each embodiment has different emphases, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0114] The above are all preferred embodiments of the present application, and are not intended to limit the protection scope of the present application. Any feature disclosed in this specification (including the abstract and drawings), unless otherwise stated, can be replaced by other equivalent or alternative features with similar purposes. That is, unless otherwise stated, each feature is only an example of a series of equivalent or similar features.

Claims

1. A method for securely accessing protected applications in a fixed network environment, characterized in that: Applied to IPv6 stealth security access hard terminals, including: When an application access request is detected, detecting whether the access application corresponding to the application access request is the protected application, and if so, controlling the display of a user authentication page, obtaining user authentication information input by the user into the user authentication page, and determining whether the user authentication information conforms to the preset login authentication information; If the user authentication information meets the preset login authentication information, the application configuration record is determined based on the domain name resolution record and the protected application, and it is determined whether the message corresponding to the application access request is an IPv6 message. If so, the target IPv6 address is dynamically generated based on the application configuration record, and the data payload in the message is encrypted according to the preset data certificate and the target IPv6 address to obtain the encrypted IPv6 message. The domain name resolution record is a domain name address mapping resolution record corresponding to different protected applications; The determining the application configuration record based on the domain name resolution record and the protected application includes: Determine the mapping relationship between the domain names and addresses of different protected applications according to the domain name resolution record; Determine whether the protected application is an IPv4 application. If so, determine the first record and the second record corresponding to the protected application based on the mapping relationship, where the first record is the real application IPv4 address corresponding to the protected application domain name, and the second record is the target IPv6 address obtained by comprehensive calculation based on the IPv6 prefix of the IPv6 stealth protection application gateway associated with the protected application, the preset data certificate, the ID of the protected application, and the current timestamp; If the protected application is not an IPv4 application but an IPv6 application, a target IPv6 address is obtained by comprehensive calculation based on the IPv6 prefix of the IPv6 stealth protection application gateway associated with the protected application, a preset data certificate, the ID of the protected application, and the current timestamp, and the target IPv6 address is bound to the protected application as the third record; Determining application configuration records of different protected applications based on the first record, the second record, and the third record; If not, determining whether the message is an IPv4 message, and when the message is an IPv4 message, translating the message to obtain a processed message, dynamically generating a target IPv6 address according to a cryptographic algorithm and the application configuration record, and encrypting a data payload in the processed message according to a preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message; The encrypted IPv6 message is sent to the IPv6 stealth protection application gateway through the IPv6 network.

2. A method for securely accessing protected applications in a fixed network environment according to claim 1, characterized in that: The detecting whether the access application corresponding to the application access request is the protected application further includes: If the access application corresponding to the application access request is not the protected application, the message in the application access request is directly forwarded to the corresponding access application.

3. The method for securely accessing protected applications in a fixed network environment according to claim 1, characterized in that: The determining whether the user authentication information conforms to the preset login authentication information further includes: If the user authentication information does not conform to the preset login authentication information, identity abnormality information is generated and the identity abnormality information is controlled to be displayed.

4. The method for securely accessing protected applications in a fixed network environment according to claim 1, characterized in that: The control displays the user authentication page, and previously includes: Acquire access control rules, where the access control rules are rules for controlling users with different identity information to access a specified protected application; Based on the access control rule, it is determined whether the user corresponding to the application access request has the authority to access the protected application. If so, a user authentication page is controlled to be displayed.

5. A method for securely accessing protected applications in a fixed network environment, characterized in that: Applied to IPv6 stealth protection application gateway, including: An IPv6 message is received from an IPv6 stealth security access hard terminal, wherein the IPv6 message is obtained by obtaining a domain name resolution record, wherein the domain name resolution record is a domain name address mapping resolution record corresponding to different protected applications. When an application access request is detected, whether the access application corresponding to the application access request is the protected application is detected. If so, a user authentication page is controlled to be displayed, and user authentication information input by the user into the user authentication page is obtained, and it is determined whether the user authentication information meets the preset login authentication information. If the user authentication information meets the preset login authentication information, an application configuration record is determined based on the domain name resolution record and the protected application. The method further comprises: determining an application configuration record based on the domain name resolution record and the protected application, including: determining a mapping relationship between domain names and addresses of different protected applications based on the domain name resolution record, judging whether the protected application is an IPv4 application, and if so, determining a first record and a second record corresponding to the protected application based on the mapping relationship, wherein the first record is a real application IPv4 address corresponding to the protected application domain name, and the second record is a target IPv6 address obtained by comprehensive calculation based on the IPv6 prefix of the IPv6 stealth protection application gateway associated with the protected application, a preset data certificate, the ID of the protected application, and the current timestamp; if the protected application is When the application is not an IPv4 application but an IPv6 application, a target IPv6 address is obtained by comprehensively calculating the IPv6 prefix of the IPv6 stealth protection application gateway associated with the protected application, a preset data certificate, the ID of the protected application, and the current timestamp, and the target IPv6 address is bound to the protected application as a third record, and application configuration records of different protected applications are determined based on the first record, the second record, and the third record, and it is determined whether the message corresponding to the application access request is an IPv6 message. If so, the target IPv6 address is determined based on the application configuration record, and the target IPv6 address is bound to the protected application according to the preset data certificate and the target IPv6 address. an encrypted IPv6 message obtained by encrypting a data payload in a message, and determining whether the message is an IPv4 message, and when the message is an IPv4 message, translating the message to obtain a processed message, calculating a target IPv6 address according to a cryptographic algorithm and the application configuration record, and encrypting the data payload in the processed message according to a preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message, calculating a target IPv6 address according to a cryptographic algorithm and the application configuration record, and encrypting the data payload in the processed message according to the target IPv6 address to obtain an encrypted IPv6 message; Determine a target IPv6 address according to the IPv6 message, and restore information of parameters in the target IPv6 address based on the cryptographic algorithm to obtain message record parameters; Verify different types of parameters in the message record parameters one by one to determine whether there is a situation where the parameters do not meet the preset standards, and if so, discard the IPv6 message; If not, decrypting the data payload in the IPv6 message based on the preset data certificate to obtain a decrypted IPv6 message; The decrypted IPv6 message is sent to the protected application.

6. A method for securely accessing protected applications in a fixed network environment according to claim 5, characterized in that: The step of sending the decrypted IPv6 message to the protected application further includes: Determine whether the protected application has an IPv6 address. If so, modify the source address of the decrypted IPv6 message to the IPv6 address of the IPv6 stealth protection application gateway and modify the destination address of the decrypted IPv6 message to the IPv6 address of the protected application. If the protected application does not have an IPv6 address, the decrypted IPv6 message is translated into an IPv4 message, and the source address of the IPv4 message is modified to the IPv4 address of the IPv6 stealth protection application gateway and the target address of the IPv4 message is modified to the IPv4 address of the protected application.

7. A fixed network environment secure access to a protected application system, characterized in that: Applied to IPv6 stealth security access hard terminals, including: An application detection module is used to detect whether the access application corresponding to the application access request is the protected application when detecting an application access request. If so, control the display of a user authentication page, obtain user authentication information input by the user into the user authentication page, and determine whether the user authentication information conforms to the preset login authentication information; A first encryption module is used to determine the application configuration record based on the domain name resolution record and the protected application when the user authentication information meets the preset login authentication information, determine whether the message corresponding to the application access request is an IPv6 message, and if so, determine the target IPv6 address based on the application configuration record, and encrypt the data payload in the message according to the preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message, wherein the domain name resolution record is a domain name address mapping resolution record corresponding to different protected applications; When the first encryption module determines the application configuration record based on the domain name resolution record and the protected application, it is specifically used to: Determine the mapping relationship between the domain names and addresses of different protected applications according to the domain name resolution record; Determine whether the protected application is an IPv4 application. If so, determine the first record and the second record corresponding to the protected application based on the mapping relationship, where the first record is the real application IPv4 address corresponding to the protected application domain name, and the second record is the target IPv6 address obtained by comprehensive calculation based on the IPv6 prefix of the IPv6 stealth protection application gateway associated with the protected application, the preset data certificate, the ID of the protected application, and the current timestamp; If the protected application is not an IPv4 application but an IPv6 application, a target IPv6 address is obtained by comprehensive calculation based on the IPv6 prefix of the IPv6 stealth protection application gateway associated with the protected application, a preset data certificate, the ID of the protected application, and the current timestamp, and the target IPv6 address is bound to the protected application as the third record; Determining application configuration records of different protected applications based on the first record, the second record, and the third record; A second encryption module is used for translating the message to obtain a processed message when the message is an IPv4 message, calculating a target IPv6 address according to a cryptographic algorithm and the application configuration record, and encrypting a data payload in the processed message according to a preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message; The first sending module is used to send the encrypted IPv6 message to the IPv6 stealth protection application gateway through the IPv6 network.

8. A fixed network environment secure access to a protected application system, characterized in that: Applied to IPv6 stealth protection application gateway, including: A message receiving module is used to receive an IPv6 message sent from an IPv6 stealth security access hard terminal, wherein the IPv6 message is obtained by obtaining a domain name resolution record, the domain name resolution record is a domain name address mapping resolution record corresponding to different protected applications, and when detecting an application access request, it is detected whether the access application corresponding to the application access request is the protected application, and if so, the user authentication page is controlled to be displayed, and the user authentication information input by the user into the user authentication page is obtained, and it is determined whether the user authentication information meets the preset login authentication information, and if the user authentication information meets the preset login authentication information, the application configuration is determined based on the domain name resolution record and the protected application. The method further comprises: determining a mapping relationship between domain names and addresses of different protected applications according to the domain name resolution record, judging whether the protected application is an IPv4 application, and if so, determining a first record and a second record corresponding to the protected application based on the mapping relationship, wherein the first record is a real application IPv4 address corresponding to the protected application domain name, and the second record is a target IPv6 address obtained by comprehensively calculating the IPv6 prefix of the IPv6 stealth protection application gateway associated with the protected application, a preset data certificate, the ID of the protected application, and the current timestamp. If the When the protected application is not an IPv4 application but an IPv6 application, a target IPv6 address is obtained by comprehensive calculation based on the IPv6 prefix of the IPv6 stealth protection application gateway associated with the protected application, a preset data certificate, the ID of the protected application, and the current timestamp, and the target IPv6 address is bound to the protected application as a third record, and application configuration records of different protected applications are determined based on the first record, the second record, and the third record, and it is determined whether the message corresponding to the application access request is an IPv6 message. If so, the target IPv6 address is determined based on the application configuration record, and the preset data certificate and the target IPv6 address are used to determine the target IPv6 address. The encrypted IPv6 message obtained by encrypting the data payload in the message, and determining whether the message is an IPv4 message, and when the message is an IPv4 message, translating the message to obtain a processed message, calculating a target IPv6 address according to a cryptographic algorithm and the application configuration record, and encrypting the data payload in the processed message according to a preset data certificate and the target IPv6 address to obtain an encrypted IPv6 message, calculating the target IPv6 address according to the cryptographic algorithm and the application configuration record, and encrypting the data payload in the processed message according to the target IPv6 address to obtain an encrypted IPv6 message; An information restoration module, used to determine a target IPv6 address according to the IPv6 message, and perform information restoration on parameters in the target IPv6 address based on the cryptographic algorithm to obtain message record parameters; A parameter checking module is used to check different types of parameters in the message record parameters one by one to determine whether there is a situation where the parameters do not meet the preset standards. If so, the IPv6 message is discarded; A message decryption module, used for decrypting the data payload in the IPv6 message based on a preset data certificate to obtain a decrypted IPv6 message when there is no situation where different types of parameters in the message record parameters do not fail to meet the preset standard; The second sending module is used to send the decrypted IPv6 message to the protected application.

9. A computer-readable storage medium, characterized in that: The device stores a computer program that can be loaded by a processor and executes a method for securely accessing a protected application in a fixed network environment as claimed in any one of claims 1 to 4 or any one of claims 5 to 6.

Images