A method, system and medium for securely accessing protected applications in a mobile network environment

Abstract

The present application relates to a method, system and medium for securely accessing protected applications in a mobile network environment, and belongs to the field of communication technology. When an application access request is detected, the user information is initialized / verified to obtain the user information after the initialization / verification operation, and the IPv6 address corresponding to the domain name of the protected application is queried according to the DNS, and the IPv6 prefix corresponding to the IPv6 stealth protection application gateway is determined. The IPv6 prefix, data certificate, application ID corresponding to the protected application, and current timestamp are comprehensively calculated to obtain a dynamic encryption standard, and the IPv6 address is encrypted according to the dynamic encryption standard to obtain an encrypted IPv6 address, and the data payload in the transmission message is encrypted according to the encrypted IPv6 address and the data certificate to obtain an encrypted IPv6 message, and the encrypted IPv6 message is sent to the IPv6 stealth protection application gateway through the IPv6 network. The present application improves the security of accessing protected applications in a mobile network environment.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method, system and medium for securely accessing protected applications in a mobile network environment. Background Art

[0002] With the popularization of Internet technology, the network has penetrated into every aspect of people's daily life due to its convenient and efficient communication characteristics, bringing great convenience to our study and work, but the various security risks that come with it (information leakage and virus transmission, etc.) threaten the entire server communication system. Therefore, in today's digital communication era, the security issues of network connection and server communication are also receiving more and more attention.

[0003] As the core component of the information system, the server carries the key business services of the information system. With the continuous improvement of informatization, various business services are increasing. While these business services are running normally, they are also facing serious security issues, such as illegal access, identity impersonation, sniffing and eavesdropping, and other attacks, as well as the invasion of worms and malicious programs, which lead to the destruction of information systems or the theft, tampering and abuse of sensitive data and information, posing a serious threat to the security of information systems. The root cause of these security risks is that the server will expose a fixed IP address to the outside, which makes it impossible to guarantee the security of accessing protected applications in a mobile network environment. Summary of the invention

[0004] In order to ensure the security of users accessing protected applications through a mobile network environment, the present application provides a method, system and medium for securely accessing protected applications in a mobile network environment.

[0005] In a first aspect, the present application provides a method for securely accessing a protected application in a mobile network environment, using the following technical solution:

[0006] A method for securely accessing a protected application in a mobile network environment, applied to an IPv6 stealth access soft terminal, comprising:

[0007] Receive a first user identity certificate and a data certificate assigned by the IPv6 stealth communication management platform, wherein the first user identity certificate includes an organization name, a user name, and an identity certificate private key, and the data certificate is used to generate an encrypted IPv6 address and encrypt a transmission message during IPv6 stealth security communication;

[0008] When an application access request is detected, initializing / verifying the user information based on the application access request and the first user identity certificate to obtain the user information after the initialization / verification operation;

[0009] Determine the IPv6 prefix corresponding to the IPv6 stealth protection application gateway;

[0010] Perform dynamic encryption calculation on the IPv6 prefix, the data certificate, the application ID corresponding to the protected application, and the current timestamp according to the dynamic DNS module to obtain an encrypted IPv6 address, and encapsulate the encrypted IPv6 address in an AAAA record of the DNS and return it to the user application;

[0011] When a user accesses the encrypted IPv6 address, the data payload in the transmission message is encrypted according to the encrypted IPv6 address and the data certificate to obtain an encrypted IPv6 message;

[0012] The encrypted IPv6 message is sent to the IPv6 stealth protection application gateway through the IPv6 network.

[0013] By adopting the above technical solution, when a user accesses a protected application through a mobile network environment, a first user identity certificate and a data certificate assigned by the IPv6 stealth communication management platform are received, wherein the first user identity certificate includes an organization name, a user name, and an identity certificate private key, and the data certificate is used to generate an encrypted IPv6 address and encrypt a transmission message during IPv6 stealth security communication. When an application access request is detected, the user information is initialized / verified based on the application access request and the first user identity certificate to obtain the user information after the initialization / verification operation, and then the IPv6 prefix corresponding to the IPv6 stealth protection application gateway is determined, and the user information is initialized / verified based on the mobile network environment. The dynamic DNS module performs dynamic encryption calculation on the IPv6 prefix, the data certificate, the application ID corresponding to the protected application, and the current timestamp to obtain the encrypted IPv6 address, and encapsulates the encrypted IPv6 address in the AAAA record of DNS and returns it to the user application. When the user accesses the encrypted IPv6 address, the data payload in the transmission message is encrypted according to the encrypted IPv6 address and the data certificate to obtain the encrypted IPv6 message, and then the encrypted IPv6 message is sent to the IPv6 stealth protection application gateway through the IPv6 network, so that the user can securely access the protected application through the IPv6 network. And the communication access process in the middle cannot be scanned, sniffed, and the content cannot be restored, thereby improving the security of accessing protected applications in a mobile network environment.

[0014] In a possible implementation, the initializing / verifying the user information based on the application access request and the first user identity certificate to obtain the user information after the initialization / verification operation includes:

[0015] Detect whether the access application corresponding to the application access request is a protected application. If so, monitor the first user identity certificate to be non-empty and determine whether the first user identity certificate is empty. When the first user identity certificate is not empty, determine whether the user corresponding to the IPv6 stealth access soft terminal is an initial user. If the user is an initial user, perform an initialization / verification operation on the user information according to the first user identity certificate to obtain the user information after the initialization / verification operation.

[0016] If the user is not an initial user, user verification information is generated and sent to the user for verification.

[0017] In a possible implementation, performing an initialization / verification operation on the user information according to the first user identity certificate to obtain the user information after the initialization / verification operation includes:

[0018] Determine the associated organization, verify the user name and the user password based on the user information;

[0019] Verify whether the organization name corresponding to the associated organization corresponds to the organization name in the first user identity certificate; if so, determine the mapping relationship between the organization name and the user name based on the first user identity name, and perform a secondary verification on the verification user name according to the mapping relationship to determine whether the verification user name belongs to the organization name;

[0020] If the verification user name belongs to the organization name, the user is subjected to enhanced verification processing, and after the user passes the enhanced verification processing, the preset designated information of the identity certificate private key in the first user's identity certificate is extracted for digital signature;

[0021] The digital signature is verified three times to determine whether the digital signature is time-effective. If so, an access control rule is obtained, and based on the access control rule, it is determined whether the user corresponding to the application access request has permission parameters to access the protected application. If so, an initialization / verification operation is performed through the user information to obtain the user information after the initialization / verification operation. The access control rule is a rule for controlling users with different identity information to access specified protected applications.

[0022] In a possible implementation, the detecting whether the access application corresponding to the application access request is a protected application includes:

[0023] If the access application corresponding to the application access request is not the protected application, the message in the application access request is directly forwarded to the corresponding access application.

[0024] In a possible implementation, performing a secondary check on the verification user name according to the mapping relationship to determine whether the verification user name belongs to the organization name includes:

[0025] If the verification user name does not belong to the organization name, identity abnormality information is generated and the identity abnormality information is controlled to be displayed.

[0026] In a second aspect, the present application provides a method for securely accessing a protected application in a mobile network environment, which adopts the following technical solution:

[0027] A method for securely accessing protected applications in a mobile network environment, applied to an IPv6 stealth protection application gateway, comprising:

[0028] Receive an encrypted IPv6 message sent from the IPv6 stealth access soft terminal, wherein the encrypted IPv6 message is obtained by receiving a first user identity certificate and a data certificate assigned by the IPv6 stealth communication management platform, wherein the first user identity certificate includes an organization name, a user name, and an identity certificate private key, and the data certificate is used to generate an encrypted IPv6 address and encrypt the transmission message during IPv6 stealth secure communication. When an application access request is detected, the user information is initialized / verified based on the application access request and the first user identity certificate to obtain an initialization / verification operation. The user information after the operation determines the IPv6 prefix corresponding to the IPv6 stealth protection application gateway, and dynamically encrypts and calculates the IPv6 prefix, the data certificate, the application ID corresponding to the protected application, and the current timestamp according to the dynamic DNS module to obtain an encrypted IPv6 address, and encapsulates the encrypted IPv6 address in the AAAA record of the DNS and returns it to the user application. When the user accesses the encrypted IPv6 address, the data payload in the transmission message is encrypted according to the encrypted IPv6 address and the data certificate to obtain an encrypted IPv6 message;

[0029] Determine a target IPv6 address according to the IPv6 message, and restore information of parameters in the target IPv6 address based on the cryptographic algorithm to obtain message record parameters;

[0030] Verify different types of parameters in the message record parameters one by one to determine whether there is a situation where the parameters do not meet the preset standards, and if so, discard the IPv6 message;

[0031] If not, decrypting the data payload in the IPv6 message based on the preset data certificate to obtain a decrypted IPv6 message;

[0032] The decrypted IPv6 message is sent to the protected application.

[0033] By adopting the above technical solution, after the IPv6 stealth protection application gateway receives the IPv6 message sent from the IPv6 stealth access soft terminal, the target IPv6 address is determined according to the IPv6 message, and the parameters in the target IPv6 address are restored based on the cryptographic algorithm to obtain the message record parameters, and then the different types of parameters in the message record parameters are checked one by one to determine whether there are parameters that do not meet the preset standards. If so, the IPv6 message is discarded. If not, the data payload in the IPv6 message is decrypted based on the preset data certificate to obtain the decrypted IPv6 message, and then the decrypted IPv6 message is sent to the protected application, thereby improving the security of access to the protected application through the double decryption and verification of the IPv6 stealth protection application gateway.

[0034] In a possible implementation manner, before sending the decrypted IPv6 message to the protected application, the step further includes:

[0035] Determine whether the protected application has an IPv6 address. If so, modify the source address of the decrypted IPv6 message to the IPv6 address of the IPv6 stealth protection application gateway and modify the destination address of the decrypted IPv6 message to the IPv6 address of the protected application.

[0036] If the protected application does not have an IPv6 address, the decrypted IPv6 message is translated into an IPv4 message, and the source address of the IPv4 message is modified to the IPv4 address of the IPv6 stealth protection application gateway and the target address of the IPv4 message is modified to the IPv4 address of the protected application.

[0037] In a third aspect, the present application provides a system for securely accessing protected applications in a mobile network environment, which adopts the following technical solutions:

[0038] A mobile network environment secure access protected application system, applied to IPv6 stealth access soft terminal, comprising:

[0039] A certificate receiving module, used to receive a first user identity certificate and a data certificate allocated by the IPv6 stealth communication management platform, wherein the first user identity certificate includes an organization name, a user name, and an identity certificate private key, and the data certificate is used to generate an encrypted IPv6 address and encrypt a transmission message during IPv6 stealth secure communication;

[0040] An information initialization module, configured to, upon detecting an application access request, perform an initialization / verification operation on user information based on the application access request and the first user identity certificate to obtain user information after the initialization / verification operation;

[0041] A prefix determination module, used to determine the IPv6 prefix corresponding to the IPv6 stealth protection application gateway;

[0042] A dynamic DNS module is used to perform dynamic encryption calculation on the IPv6 prefix, the data certificate, the application ID corresponding to the protected application, and the current timestamp according to the dynamic DNS module to obtain an encrypted IPv6 address, and encapsulate the encrypted IPv6 address in an AAAA record of the DNS and return it to the user application;

[0043] A message encryption module, used for encrypting the data payload in the transmission message according to the encrypted IPv6 address and the data certificate when the user accesses the encrypted IPv6 address to obtain an encrypted IPv6 message;

[0044] The message sending module is used to send the encrypted IPv6 message to the IPv6 stealth protection application gateway through the IPv6 network.

[0045] In a fourth aspect, the present application provides a system for securely accessing protected applications in a mobile network environment, which adopts the following technical solutions:

[0046] A mobile network environment secure access to protected application system, applied to an IPv6 stealth protection application gateway, comprising:

[0047] A message receiving module is used to receive an encrypted IPv6 message sent from the IPv6 stealth access soft terminal, wherein the encrypted IPv6 message is obtained by receiving a first user identity certificate and a data certificate assigned by the IPv6 stealth communication management platform, wherein the first user identity certificate includes an organization name, a user name, and an identity certificate private key, and the data certificate is used to generate an encrypted IPv6 address and encrypt the transmission message during IPv6 stealth secure communication. When an application access request is detected, the user information is initialized or verified based on the application access request and the first user identity certificate to obtain an initial The user information after the initialization or verification operation is used to determine the IPv6 prefix corresponding to the IPv6 stealth protection application gateway, and the IPv6 prefix, the data certificate, the application ID corresponding to the protected application and the current timestamp are dynamically encrypted and calculated according to the dynamic DNS module to obtain an encrypted IPv6 address, and the encrypted IPv6 address is encapsulated in the AAAA record of the DNS and returned to the user application. When the user accesses the encrypted IPv6 address, the data payload in the transmission message is encrypted according to the encrypted IPv6 address and the data certificate to obtain an encrypted IPv6 message;

[0048] An information restoration module, which determines a target IPv6 address according to the IPv6 message, and performs information restoration on parameters in the target IPv6 address based on the cryptographic algorithm to obtain message record parameters;

[0049] A message discarding module, used to check different types of parameters in the message record parameters one by one, to determine whether there is a situation where the parameters do not meet the preset standards, and if so, discard the IPv6 message;

[0050] A message decryption module, used for decrypting the data payload in the IPv6 message based on a preset data certificate to obtain a decrypted IPv6 message when there is no situation that does not meet the preset standard;

[0051] An application access module is used to send the decrypted IPv6 message to the protected application.

[0052] In a fifth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution:

[0053] A computer-readable storage medium stores a computer program that can be loaded by a processor and executes any one of the methods in the first aspect or the second aspect.

[0054] In summary, the present application includes at least one of the following beneficial technical effects:

[0055] 1. By adopting the above technical solution, when a user accesses a protected application through a mobile network environment, a first user identity certificate and a data certificate assigned by the IPv6 stealth communication management platform are received, wherein the first user identity certificate includes an organization name, a user name, and an identity certificate private key, and the data certificate is used to generate an encrypted IPv6 address and encrypt a transmission message during IPv6 stealth security communication. When an application access request is detected, the user information is initialized / verified based on the application access request and the first user identity certificate to obtain the user information after the initialization / verification operation, and then the IPv6 frontend corresponding to the IPv6 stealth protection application gateway is determined. The dynamic DNS module dynamically encrypts and calculates the IPv6 prefix, data certificate, application ID corresponding to the protected application, and the current timestamp to obtain the encrypted IPv6 address, and encapsulates the encrypted IPv6 address in the AAAA record of DNS and returns it to the user application. When the user accesses the encrypted IPv6 address, the data payload in the transmission message is encrypted according to the encrypted IPv6 address and data certificate to obtain the encrypted IPv6 message, and then the encrypted IPv6 message is sent to the IPv6 stealth protection application gateway through the IPv6 network, so that the user can access the protected application through the IPv6 network securely. In addition, the communication access process in the middle cannot be scanned, sniffed, or restored, thereby improving the security of accessing protected applications in a mobile network environment;

[0056] 2. By adopting the above technical solution, after the IPv6 stealth protection application gateway receives the IPv6 message sent from the IPv6 stealth access soft terminal, the target IPv6 address is determined according to the IPv6 message, and the parameters in the target IPv6 address are restored based on the cryptographic algorithm to obtain the message record parameters, and then the different types of parameters in the message record parameters are checked one by one to determine whether there are any parameters that do not meet the preset standards. If so, the IPv6 message is discarded. If not, the data payload in the IPv6 message is decrypted based on the preset data certificate to obtain the decrypted IPv6 message, and then the decrypted IPv6 message is sent to the protected application, thereby improving the security of access to the protected application through the double decryption and verification of the IPv6 stealth protection application gateway. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a first flow chart of a method for securely accessing a protected application in a mobile network environment according to one of the embodiments of the present application.

[0058] Figure 2 This is a second flow chart of securely accessing a protected application system in a mobile network environment according to one of the embodiments of the present application.

[0059] Figure 3 This is a third flow chart of a method for securely accessing a protected application in a mobile network environment according to one of the embodiments of the present application.

[0060] Figure 4 This is a fourth flow chart of securely accessing a protected application system in a mobile network environment according to one of the embodiments of the present application. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solutions and advantages of this application more clear, the following Figure 1-4 It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0062] First, the terms of the embodiments of the present application are explained:

[0063] IPv6 stealth access soft terminal: a network device that performs user identity authentication for users who want to access protected applications. After the authentication is passed, the traffic accessing the protected application is dynamically processed with the IPv6 address and encrypted with the message payload, and then sent to the target IPv6 stealth protection application gateway.

[0064] IPv6 Stealth Protection Application Gateway: A network device that publishes dynamic IPv6 addresses for protected applications, receives access traffic from IPv6 Stealth Access Soft Terminals, and discards traffic that fails verification. For legitimate access requests from IPv6 Stealth Access Soft Terminals, the IPv6 Stealth Protection Application Gateway will forward them to the corresponding application server.

[0065] The embodiment of the present application discloses a method for securely accessing a protected application in a mobile network environment based on an IPv6 stealth access soft terminal side.

[0066] Reference Figure 1 , a method for securely accessing protected applications in a mobile network environment, applied to an IPv6 stealth access soft terminal, comprising:

[0067] Step S101, receiving a first user identity certificate and a data certificate allocated by an IPv6 stealth communication management platform.

[0068] The first user identity certificate includes the organization name, user name and identity certificate private key, and the data certificate is used to generate an encrypted IPv6 address and encrypt the transmission message during IPv6 stealth security communication;

[0069] For the embodiments of the present application, when securely accessing a protected application in a mobile network environment, the IPv6 stealth communication management platform pre-collects user identity information and generates identity certificates for different users based on the user identity information, wherein the identity certificate includes: organization name, user name, identity certificate public key and identity certificate private key, and then determines the first user identity certificate and the second identity certificate based on the identity certificate, wherein the first user identity certificate includes: organization name, user name and identity certificate private key, and the second identity certificate includes: organization name, user name and identity certificate public key, and then associates each user in the identity certificate to generate an encrypted IPv6 address and a data certificate for encrypting the transmission message for IPv6 stealth secure communication, and finally sends the first user identity certificate and the data certificate to the IPv6 stealth access soft terminal.

[0070] After the IPv6 stealth communication management platform generates the first user identity certificate and the second user identity certificate, the second user identity certificate is sent to the IPv6 stealth protection application gateway, and the first user identity certificate is sent to the IPv6 stealth access soft terminal in the form of hardware or software, where the hardware sending form includes U-shield and the software sending form includes encrypted password package.

[0071] For the embodiment of the present application, the data certificate is a data certificate for secure communication created by the IPv6 stealth communication management platform for the above-mentioned soft terminal user, and the created data certificate is sent online to the IPv6 stealth access soft terminal for certificate synchronization.

[0072] Step S102: when an application access request is detected, an initialization / verification operation is performed on the user information based on the application access request and the first user identity certificate to obtain the user information after the initialization / verification operation.

[0073] Specifically, during the initialization / verification process of user information, it is detected whether the access application corresponding to the application access request is a protected application. If so, the first user identity certificate is monitored to be non-empty, and it is determined whether the first user identity certificate is empty. When the first user identity certificate is not empty, it is determined whether the user corresponding to the user's IPv6 stealth application is an initial user. If the user is the initial user, the user information is initialized / verified according to the first user identity certificate. If the user is not the initial user, user verification information is generated and sent to the user for verification, so as to obtain the user information after the initialization / verification operation.

[0074] The specific initialization / verification operation includes: determining the associated organization, verifying the user name and the user password based on the user information, and then verifying whether the organization name corresponding to the associated organization corresponds to the organization name in the first user's identity certificate. If yes, determining the mapping relationship between the organization name and the user name based on the first user's identity name, and performing a secondary verification on the verification user name based on the mapping relationship to determine whether the verification user name belongs to the organization name. If the verification user name belongs to the organization name, performing enhanced verification processing on the user, and after the user passes the enhanced verification processing, extracting the preset designated information of the identity certificate private key in the first user's identity certificate for digital signature, and verifying the digital signature three times to determine whether the digital signature is time-effective. If yes, obtaining the control access rule, and determining whether the user corresponding to the application access request has the permission parameters to access the protected application based on the control access rule. If yes, performing hash value synchronization on the user password, and obtaining the user information after the initialization / verification operation based on the user password, associated organization and verification user name after hash value synchronization. The control access rule is a rule for controlling users with different identity information to access designated protected applications.

[0075] Step S103, determine the IPv6 prefix corresponding to the IPv6 stealth protection application gateway.

[0076] Step S104, dynamically encrypt and calculate the IPv6 prefix, data certificate, application ID corresponding to the protected application and current timestamp according to the dynamic DNS module to obtain an encrypted IPv6 address, and encapsulate the encrypted IPv6 address in the AAAA record of DNS and return it to the user application.

[0077] Specifically, for IPv4 applications, both A records and AAAA records need to be configured for access by IPv4 terminals and IPv6 terminals in the mobile network. Among them, the A record is the real application IPv4 address; the AAAA record is calculated by (the IPv6 prefix of the IPv6 stealth application gateway associated with the application, the user's secure communication data certificate, the application ID, and the timestamp). It is dynamically changing, different for each user, and updated at short intervals. For IPv6 applications, only the AAAA record needs to be configured. The generation method is the same as the above-mentioned IPv4 terminal AAAA record generation method, which will not be repeated here.

[0078] The specific calculation method is to use a hash function to hash the above parameters to generate a unique hash value, namely, an AAAA record. The corresponding target IPv6 address is determined according to the A record and AAAA record configured in the IPv4 application and the AAAA record configured in the IPv6 application.

[0079] Step S105: When the user accesses the encrypted IPv6 address, the data payload in the transmission message is encrypted according to the encrypted IPv6 address and the data certificate to obtain an encrypted IPv6 message.

[0080] Step S106, sending the encrypted IPv6 message to the IPv6 stealth protection application gateway through the IPv6 network.

[0081] In the above implementation, when a user accesses a protected application through a mobile network environment, a first user identity certificate and a data certificate assigned by the IPv6 stealth communication management platform are received, wherein the first user identity certificate includes an organization name, a user name, and an identity certificate private key, and the data certificate is used to generate an encrypted IPv6 address and encrypt a transmission message during IPv6 stealth security communication. When an application access request is detected, the user information is initialized / verified based on the application access request and the first user identity certificate to obtain the user information after the initialization / verification operation, and then the IPv6 prefix corresponding to the IPv6 stealth protection application gateway is determined. According to the dynamic DNS module, the IPv6 prefix, data certificate, application ID corresponding to the protected application and the current timestamp are dynamically encrypted and calculated to obtain the encrypted IPv6 address, and the encrypted IPv6 address is encapsulated in the AAAA record of DNS and returned to the user application. When the user accesses the encrypted IPv6 address, the data payload in the transmission message is encrypted according to the encrypted IPv6 address and data certificate to obtain the encrypted IPv6 message, and then the encrypted IPv6 message is sent to the IPv6 stealth protection application gateway through the IPv6 network, so that the user can access the protected application through the IPv6 network securely. In addition, the communication access process in the middle cannot be scanned, sniffed, or restored, thereby improving the security of accessing protected applications in the mobile network environment.

[0082] In a possible implementation of the embodiment of the present application, detecting whether the access application corresponding to the application access request is a protected application includes: if the access application corresponding to the application access request is not a protected application, directly forwarding the message in the application access request to the corresponding access application.

[0083] In a possible implementation of the embodiment of the present application, the verification user name is double-checked according to the mapping relationship to determine whether the verification user name belongs to the organization name, including: if the verification user name does not belong to the organization name, identity exception information is generated and the identity exception information is controlled to be displayed.

[0084] In the embodiment of the present application, it is predetermined which users can access which protected applications. These rules can be manually written into the IPv6 stealth access soft terminal and the IPv6 stealth protection application gateway, or they can be uniformly issued through the IPv6 communication authorization component of the IPv6 stealth communication management platform, which is not limited here.

[0085] Reference Figure 2 The embodiment of the present application also discloses a mobile network environment secure access to a protected application system 20 based on the initiator's IPv6 stealth access soft terminal side.

[0086] A mobile network environment secure access protected application system 20, applied to an IPv6 stealth access soft terminal, comprising:

[0087] The certificate receiving module 21 is used to receive the first user identity certificate and the data certificate allocated by the IPv6 stealth communication management platform. The first user identity certificate includes the organization name, the user name and the identity certificate private key. The data certificate is used to generate an encrypted IPv6 address and encrypt the transmission message during IPv6 stealth security communication;

[0088] The information initialization module 22 is used to, when an application access request is detected, perform an initialization / verification operation on the user information based on the application access request and the first user identity certificate to obtain the user information after the initialization / verification operation;

[0089] The prefix determination module 23 is used to determine the IPv6 prefix corresponding to the IPv6 stealth protection application gateway;

[0090] The dynamic DNS module 24 is used to perform dynamic encryption calculation on the IPv6 prefix, the data certificate, the application ID corresponding to the protected application and the current timestamp according to the dynamic DNS module to obtain an encrypted IPv6 address, and encapsulate the encrypted IPv6 address in the AAAA record of the DNS and return it to the user application;

[0091] The message encryption module 25 is used to encrypt the data payload in the transmission message according to the encrypted IPv6 address and the data certificate when the user accesses the encrypted IPv6 address to obtain the encrypted IPv6 message;

[0092] The message sending module 26 is used to send the encrypted IPv6 message to the IPv6 stealth protection application gateway through the IPv6 network.

[0093] The mobile network environment secure access to protected applications system based on IPv6 stealth access soft terminal side in the embodiment of the present application can implement any of the above-mentioned methods for secure access to protected applications in a mobile network environment based on IPv6 stealth access soft terminal side, and the specific working process of each module in the mobile network environment secure access to protected applications system can refer to the corresponding process in the above-mentioned method embodiment.

[0094] The embodiment of the present application also discloses a method for securely accessing protected applications in a mobile network environment based on the IPv6 stealth protection application gateway side.

[0095] Reference Figure 3 , a method for securely accessing protected applications in a mobile network environment, applied to an IPv6 stealth protection application gateway, comprising:

[0096] Step S301, receiving an encrypted IPv6 message sent from an IPv6 stealth access soft terminal.

[0097] Among them, the encrypted IPv6 message is obtained by receiving the first user identity certificate and data certificate allocated by the IPv6 stealth communication management platform. The first user identity certificate includes the organization name, user name and identity certificate private key. The data certificate is used to generate an encrypted IPv6 address and encrypt the transmission message during IPv6 stealth security communication. When an application access request is detected, the user information is initialized / verified based on the application access request and the first user identity certificate to obtain the user information after the initialization / verification operation, and the IPv6 prefix corresponding to the IPv6 stealth protection application gateway is determined. According to the dynamic DNS module, the IPv6 prefix, the data certificate, the application ID corresponding to the protected application and the current timestamp are dynamically encrypted and calculated to obtain the encrypted IPv6 address, and the encrypted IPv6 address is encapsulated in the AAAA record of the DNS and returned to the user application. When the user accesses the encrypted IPv6 address, the data payload in the transmission message is encrypted according to the encrypted IPv6 address and the data certificate to obtain the encrypted IPv6 message.

[0098] Step S302, determining the target IPv6 address according to the IPv6 message, and restoring the parameters in the target IPv6 address based on a cryptographic algorithm to obtain message record parameters.

[0099] For the embodiment of the present application, the cryptographic algorithm is a digital signature algorithm. In the present application, since the target IPv6 address is calculated by the digital signature algorithm, the original parameters in the target IPv6 address can be restored by reverse deduction through the digital signature algorithm, thereby obtaining the message record parameters, so as to subsequently verify the authenticity of the target IPv6 address.

[0100] Step S303, verify different types of parameters in the message record parameters one by one to determine whether there is a situation where the parameters do not meet the preset standards. If so, discard the IPv6 message.

[0101] Specifically, the preset standard is a reference numerical standard for different types of parameters in the message record parameters, that is, different types of parameters in the message record parameters need to match the parameters in the preset standard. Not only must they conform to the parameter types in the preset standard, but they must also ensure that the type parameter values ​​in the message record parameters satisfy the reference numerical values ​​corresponding to the parameter types.

[0102] Step S304: If the data certificate does not exist, the data payload in the IPv6 message is decrypted based on the preset data certificate to obtain a decrypted IPv6 message.

[0103] Specifically, the preset data certificate is a certificate created by the IPv6 stealth communication management platform for each user who needs to access the protected application, and after creation, it is pre-configured in the IPv6 stealth access soft terminal and the IPv6 stealth protection application gateway to encrypt the IPv6 address generated during IPv6 secure communication and the data payload in the message.

[0104] Step S305: Send the decrypted IPv6 message to the protected application.

[0105] In an embodiment of the present application, the initiator's IPv6 gateway uses the encryption algorithm and key in the security communication information to encrypt the IPv6 message, so that the encrypted IPv6 message will become unreadable. Only the recipient holding the correct key can decrypt and read the message content. When the recipient's IPv6 gateway obtains the inner IPv6 message, it uses the same encryption algorithm and key in the security communication information as when it was encrypted to decrypt the message. The decrypted message will be restored to its original form and can be read and processed by the recipient.

[0106] In the above implementation, after the IPv6 stealth protection application gateway receives the IPv6 message sent from the IPv6 stealth access soft terminal, it determines the target IPv6 address according to the IPv6 message, and restores the information of the parameters in the target IPv6 address based on the cryptographic algorithm to obtain the message record parameters, and then verifies the different types of parameters in the message record parameters one by one to determine whether there are any parameters that do not meet the preset standards. If so, the IPv6 message is discarded. If not, the data payload in the IPv6 message is decrypted based on the preset data certificate to obtain the decrypted IPv6 message, and then the decrypted IPv6 message is sent to the protected application, thereby improving the security of access to the protected application through the double decryption and verification of the IPv6 stealth protection application gateway.

[0107] In a possible implementation method of an embodiment of the present application, the decrypted IPv6 message is sent to the protected application, and the process also includes: determining whether the protected application has an IPv6 address; if so, modifying the source address of the decrypted IPv6 message to the IPv6 address of the IPv6 stealth protection application gateway and modifying the target address of the decrypted IPv6 message to the IPv6 address of the protected application; if the protected application does not have an IPv6 address, translating the decrypted IPv6 message into an IPv4 message, modifying the source address of the IPv4 message to the IPv4 address of the IPv6 stealth protection application gateway and modifying the target address of the IPv4 message to the IPv4 address of the protected application.

[0108] Reference Figure 4 The embodiment of the present application also discloses a mobile network environment secure access to a protected application system 40 based on the receiving party's IPv6 gateway side.

[0109] A mobile network environment secure access protected application system 40, applied to an IPv6 stealth protection application gateway, comprising:

[0110] The message receiving module 41 is used to receive the encrypted IPv6 message sent from the IPv6 stealth access soft terminal, wherein the encrypted IPv6 message is obtained by receiving the first user identity certificate and the data certificate assigned by the IPv6 stealth communication management platform, the first user identity certificate includes the organization name, the user name and the identity certificate private key, the data certificate is used to generate an encrypted IPv6 address and encrypt the transmission message during the IPv6 stealth security communication, and when the application access request is detected, the user information is initialized or verified based on the application access request and the first user identity certificate. To the user information after the initialization or verification operation, determine the IPv6 prefix corresponding to the IPv6 stealth protection application gateway, perform dynamic encryption calculation on the IPv6 prefix, data certificate, application ID corresponding to the protected application and current timestamp according to the dynamic DNS module, obtain the encrypted IPv6 address, and encapsulate the encrypted IPv6 address in the AAAA record of DNS and return it to the user application. When the user accesses the encrypted IPv6 address, encrypt the data payload in the transmission message according to the encrypted IPv6 address and data certificate to obtain the encrypted IPv6 message;

[0111] The information restoration module 42 determines the target IPv6 address according to the IPv6 message, and restores the parameters in the target IPv6 address based on the cryptographic algorithm to obtain the message record parameters;

[0112] The message discarding module 43 is used to check different types of parameters in the message record parameters one by one to determine whether there is a situation where the parameters do not meet the preset standards. If so, the IPv6 message is discarded;

[0113] A message decryption module 44, configured to decrypt the data payload in the IPv6 message based on a preset data certificate to obtain a decrypted IPv6 message when there is no situation that does not meet the preset standard;

[0114] The application access module 45 is used to send the decrypted IPv6 message to the protected application.

[0115] In the above implementation, the security verification process is optimized and the encryption and decryption operations are simplified, while allowing the terminal to quickly process and forward legal messages, thereby improving communication security while reducing the consumption of system resources and improving the forwarding performance of the entire system.

[0116] The system for securely accessing protected applications in a mobile network environment based on the IPv6 stealth protection application gateway side in the embodiment of the present application can implement any of the above-mentioned methods for securely accessing protected applications in a mobile network environment based on the IPv6 stealth protection application gateway side, and the specific working process of each module in the system for securely accessing protected applications in a mobile network environment can refer to the corresponding process in the above-mentioned method embodiment.

[0117] In the several embodiments provided in this application, it should be understood that the provided methods and systems can be implemented in other ways. For example, the system embodiments described above are only illustrative; for example, the division of a certain module is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed.

[0118] The embodiment of the present application also discloses a computer-readable storage medium.

[0119] A computer-readable storage medium stores a computer program that can be loaded by a processor and execute any one of the above-mentioned methods for securely accessing a protected application in a mobile network environment.

[0120] Among them, computer-readable storage media can be any tangible medium that contains or stores a program, which can be used by or in conjunction with an instruction execution system, apparatus or device; the program code contained on the computer-readable medium can be transmitted using any appropriate medium, including but not limited to wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0121] It should be noted that in the above embodiments, the description of each embodiment has different emphases, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0122] The above are all preferred embodiments of the present application, and are not intended to limit the protection scope of the present application. Any feature disclosed in this specification (including the abstract and drawings), unless otherwise stated, can be replaced by other equivalent or alternative features with similar purposes. That is, unless otherwise stated, each feature is only an example of a series of equivalent or similar features.

Claims

1. A method for securely accessing protected applications in a mobile network environment, characterized in that: Applied to IPv6 stealth access soft terminal, including: Receive a first user identity certificate and a data certificate assigned by the IPv6 stealth communication management platform, wherein the first user identity certificate includes an organization name, a user name, and an identity certificate private key, and the data certificate is used to generate an encrypted IPv6 address and encrypt a transmission message during IPv6 stealth security communication; When an application access request is detected, initializing / verifying the user information based on the application access request and the first user identity certificate to obtain the user information after the initialization / verification operation; Determine the IPv6 prefix corresponding to the IPv6 stealth protection application gateway; Perform dynamic encryption calculation on the IPv6 prefix, the data certificate, the application ID corresponding to the protected application, and the current timestamp according to the dynamic DNS module to obtain an encrypted IPv6 address, and encapsulate the encrypted IPv6 address in an AAAA record of the DNS and return it to the user application; When a user accesses the encrypted IPv6 address, the data payload in the transmission message is encrypted according to the encrypted IPv6 address and the data certificate to obtain an encrypted IPv6 message; The encrypted IPv6 message is sent to the IPv6 stealth protection application gateway through the IPv6 network.

2. A method for securely accessing protected applications in a mobile network environment according to claim 1, characterized in that: The initializing / verifying the user information based on the application access request and the first user identity certificate to obtain the user information after the initialization / verification operation includes: Detect whether the access application corresponding to the application access request is a protected application. If so, monitor the first user identity certificate to be non-empty and determine whether the first user identity certificate is empty. When the first user identity certificate is not empty, determine whether the user corresponding to the IPv6 stealth access soft terminal is an initial user. If the user is an initial user, perform an initialization / verification operation on the user information according to the first user identity certificate to obtain the user information after the initialization / verification operation. If the user is not an initial user, user verification information is generated and sent to the user for verification.

3. A method for securely accessing protected applications in a mobile network environment according to claim 2, characterized in that: The initializing / verifying the user information according to the first user identity certificate to obtain the user information after the initialization / verification operation includes: Determine the associated organization, verify the user name and the user password based on the user information; Verify whether the organization name corresponding to the associated organization corresponds to the organization name in the first user identity certificate; if so, determine the mapping relationship between the organization name and the user name based on the first user identity name, and perform a secondary verification on the verification user name according to the mapping relationship to determine whether the verification user name belongs to the organization name; If the verification user name belongs to the organization name, the user is subjected to enhanced verification processing, and after the user passes the enhanced verification processing, the preset designated information of the identity certificate private key in the first user's identity certificate is extracted for digital signature; The digital signature is verified three times to determine whether the digital signature is time-effective. If so, an access control rule is obtained, and based on the access control rule, it is determined whether the user corresponding to the application access request has permission parameters to access the protected application. If so, an initialization / verification operation is performed through the user information to obtain the user information after the initialization / verification operation. The access control rule is a rule for controlling users with different identity information to access specified protected applications.

4. A method for securely accessing protected applications in a mobile network environment according to claim 2, characterized in that: The detecting whether the access application corresponding to the application access request is a protected application includes: If the access application corresponding to the application access request is not the protected application, the message in the application access request is directly forwarded to the corresponding access application.

5. A method for securely accessing protected applications in a mobile network environment according to claim 3, characterized in that: The performing a secondary check on the verification user name according to the mapping relationship to determine whether the verification user name belongs to the organization name includes: If the verification user name does not belong to the organization name, identity abnormality information is generated and the identity abnormality information is controlled to be displayed.

6. A method for securely accessing protected applications in a mobile network environment, characterized in that: Applied to IPv6 stealth protection application gateway, including: Receive an encrypted IPv6 message sent from an IPv6 stealth access soft terminal, wherein the encrypted IPv6 message is a first user identity certificate and a data certificate allocated by an IPv6 stealth communication management platform, the first user identity certificate includes an organization name, a user name, and an identity certificate private key, the data certificate is used to generate an encrypted IPv6 address and encrypt the transmission message during IPv6 stealth secure communication, and when an application access request is detected, the user information is initialized / verified based on the application access request and the first user identity certificate to obtain an initialization / verification operation The user information after the authentication is obtained, the IPv6 prefix corresponding to the IPv6 stealth protection application gateway is determined, and the IPv6 prefix, the data certificate, the application ID corresponding to the protected application and the current timestamp are dynamically encrypted and calculated according to the dynamic DNS module to obtain an encrypted IPv6 address, and the encrypted IPv6 address is encapsulated in the AAAA record of the DNS and returned to the user application. When the user accesses the encrypted IPv6 address, the data payload in the transmission message is encrypted according to the encrypted IPv6 address and the data certificate to obtain an encrypted IPv6 message; Determine a target IPv6 address according to the IPv6 message, and restore information of parameters in the target IPv6 address based on a cryptographic algorithm to obtain message record parameters; Verify different types of parameters in the message record parameters one by one to determine whether there is a situation where the parameters do not meet the preset standards, and if so, discard the IPv6 message; If not, decrypting the data payload in the IPv6 message based on the preset data certificate to obtain a decrypted IPv6 message; The decrypted IPv6 message is sent to the protected application.

7. A method for securely accessing protected applications in a mobile network environment according to claim 6, characterized in that: The step of sending the decrypted IPv6 message to the protected application further includes: Determine whether the protected application has an IPv6 address. If so, modify the source address of the decrypted IPv6 message to the IPv6 address of the IPv6 stealth protection application gateway and modify the destination address of the decrypted IPv6 message to the IPv6 address of the protected application. If the protected application does not have an IPv6 address, the decrypted IPv6 message is translated into an IPv4 message, and the source address of the IPv4 message is modified to the IPv4 address of the IPv6 stealth protection application gateway and the target address of the IPv4 message is modified to the IPv4 address of the protected application.

8. A mobile network environment secure access to protected application system, characterized in that: Applied to IPv6 stealth security access soft terminal, including: A certificate receiving module, used to receive a first user identity certificate and a data certificate allocated by the IPv6 stealth communication management platform, wherein the first user identity certificate includes an organization name, a user name, and an identity certificate private key, and the data certificate is used to generate an encrypted IPv6 address and encrypt a transmission message during IPv6 stealth secure communication; An information initialization module, configured to, upon detecting an application access request, perform an initialization / verification operation on user information based on the application access request and the first user identity certificate to obtain user information after the initialization / verification operation; A prefix determination module, used to determine an IPv6 prefix corresponding to an IPv6 stealth protection application gateway; A dynamic DNS module is used to perform dynamic encryption calculation on the IPv6 prefix, the data certificate, the application ID corresponding to the protected application, and the current timestamp according to the dynamic DNS module to obtain an encrypted IPv6 address, and encapsulate the encrypted IPv6 address in an AAAA record of the DNS and return it to the user application; A message encryption module, used for encrypting the data payload in the transmission message according to the encrypted IPv6 address and the data certificate when the user accesses the encrypted IPv6 address to obtain an encrypted IPv6 message; The message sending module is used to send the encrypted IPv6 message to the IPv6 stealth protection application gateway through the IPv6 network.

9. A mobile network environment secure access to protected application system, characterized in that: Applied to IPv6 stealth protection application gateway, including: A message receiving module is used to receive an encrypted IPv6 message sent from an IPv6 stealth access soft terminal, wherein the encrypted IPv6 message is obtained by receiving a first user identity certificate and a data certificate assigned by the IPv6 stealth communication management platform, wherein the first user identity certificate includes an organization name, a user name, and an identity certificate private key, and the data certificate is used to generate an encrypted IPv6 address and encrypt the transmission message during IPv6 stealth secure communication. When an application access request is detected, the user information is initialized or verified based on the application access request and the first user identity certificate to obtain an initial The user information after the digitization or verification operation is determined, the IPv6 prefix corresponding to the IPv6 stealth protection application gateway is determined, and the IPv6 prefix, the data certificate, the application ID corresponding to the protected application and the current timestamp are dynamically encrypted and calculated according to the dynamic DNS module to obtain an encrypted IPv6 address, and the encrypted IPv6 address is encapsulated in the AAAA record of the DNS and returned to the user application. When the user accesses the encrypted IPv6 address, the data payload in the transmission message is encrypted according to the encrypted IPv6 address and the data certificate to obtain an encrypted IPv6 message; An information restoration module determines a target IPv6 address according to the IPv6 message, and performs information restoration on parameters in the target IPv6 address based on a cryptographic algorithm to obtain message record parameters; A message discarding module, used to check different types of parameters in the message record parameters one by one, to determine whether there is a situation where the parameters do not meet the preset standards, and if so, discard the IPv6 message; A message decryption module, used for decrypting the data payload in the IPv6 message based on a preset data certificate to obtain a decrypted IPv6 message when there is no situation that does not meet the preset standard; An application access module is used to send the decrypted IPv6 message to the protected application.

10. A computer-readable storage medium, characterized in that: The device stores a computer program that can be loaded by a processor and executes a method for securely accessing a protected application in a mobile network environment as claimed in any one of claims 1 to 5 or any one of claims 6 to 7.

Images