Data flow verification method and security authentication gateway system

Abstract

The present application relates to a data flow verification method and a security authentication gateway system. The method includes: capturing data flow packets for accessing a business system to obtain a message header of the data flow; parsing the message header to obtain first resource data of the user end initiating the data flow and second resource data of the business system that the data flow needs to access; and verifying the first resource data and the second resource data respectively. The present application solves the technical problem that the scheme for identity authentication of users accessing business systems in the prior art has complex deployment and low efficiency.

Description

Technical Field

[0001] The present application relates to the field of data security, and in particular to a data flow verification method and a security authentication gateway system. Background Art

[0002] Before users access the business system, they generally need to be authenticated. Existing technologies generally use virtual private network (VPN) tunnel technology to re-encapsulate network data at the network exit to ensure that the traffic reaches the main gateway, and then parse the message for identity authentication. This technology has two disadvantages:

[0003] 1) The user's computer needs to install a virtual network card driver, which brings inconvenience to the user;

[0004] 2) Reassembling and parsing messages will inevitably affect performance and reduce efficiency.

[0005] The solutions for identity authentication of users accessing business systems in related technologies have the problems of complex deployment and low efficiency, and no effective solution has been proposed yet. Summary of the invention

[0006] A data flow verification method and a security authentication gateway system provided in an embodiment of the present application at least solve the problems of complex deployment and low efficiency in the prior art scheme for identity authentication of users accessing a business system.

[0007] According to one aspect of an embodiment of the present application, a method for verifying data traffic is provided, including: capturing packets of data traffic accessing a business system to obtain a message header of the data traffic; parsing the message header to obtain first resource data of a user terminal initiating the data traffic and second resource data of a business system that the data traffic needs to access; and verifying the first resource data and the second resource data respectively.

[0008] Optionally, the first resource data includes at least one of the following: an IP address and a MAC address of a user terminal; and the second resource data includes at least one of the following: an IP address, a port, and a communication protocol of a service system that the data traffic needs to access.

[0009] Optionally, the second resource data is verified, including: comparing the resource data of the target business system included in the firewall policy with the second resource data, wherein the target business system is the business system that needs to be protected; if the resource data of the target business system is the same as the second resource data, determining that the business system that the data traffic needs to access is the target business system, and verifying the first resource data; if the resource data of the target business system is different from the second resource data, determining that the business system that the data traffic needs to access is not the target business system, and releasing the data traffic.

[0010] Optionally, before verifying the second resource data, the method further includes: acquiring resource data of the target business system, and generating a protection policy based on the resource data of the target business system; and converting the protection policy into a firewall policy through an iptables firewall mechanism.

[0011] Optionally, the first resource data is verified, including: determining whether the IP address and MAC address of the user terminal are in the user online list; if the IP address and MAC address of the user terminal are in the user online list, determining that the first resource data verification has passed, and releasing data traffic; if the IP address and MAC address of the user terminal are not in the user online list, determining that the first resource data verification has failed, blocking data traffic, and jumping to the gateway authentication page, wherein the gateway authentication page is used for the user terminal to verify through a digital certificate authentication method.

[0012] Optionally, after jumping to the gateway authentication page, the above method also includes: obtaining the verification result of the user terminal through the digital certificate authentication method; if the verification result is a verification failure, blocking the data traffic; if the verification result is a verification success, updating the IP address and MAC address of the user terminal to the user online list, and judging whether the user terminal has the authority to access the target business system; if the user terminal has the authority to access the target business system, releasing the data traffic; if the user terminal does not have the authority to access the target business system, prohibiting the data traffic from accessing the target business system.

[0013] Optionally, the above method also includes: if the number of times a user terminal accesses a business system for which it does not have permission through a first account within a preset time period exceeds a preset number, the user terminal is prohibited from accessing the target business system through the first account, and the user terminal is marked; if it is detected that the marked user terminal accesses the target business system through a second account, the marked user terminal is prohibited from accessing the target business system through the second account, wherein the second account is a different account from the first account.

[0014] Optionally, after the first account is successfully authenticated by at least two different types of verification methods, the user terminal is allowed to access the target business system through the first account, and the user terminal is unmarked and allowed to access the target business system through the second account.

[0015] According to another aspect of an embodiment of the present application, a security authentication gateway system is also provided, including: a first switch, a second switch and a gateway device, wherein the first switch is arranged between the gateway device and the user end, and is arranged to realize communication between the user end and the gateway device; the second switch is arranged between the gateway device and the business system, and is arranged to realize communication between the gateway device and the business system; the gateway device is arranged to execute the above method.

[0016] According to another aspect of an embodiment of the present application, there is also provided an electronic device, including: a processor, and a memory for storing a program, wherein the program includes instructions, and when the instructions are executed by the processor, the processor executes the above method.

[0017] According to another aspect of the embodiments of the present application, a non-transitory machine-readable medium storing computer instructions is also provided, where the computer instructions are used to enable a computer to execute the above method.

[0018] According to another aspect of the embodiments of the present application, a computer program product is provided, including a computer program, which is used to enable the computer to execute the above method when executed by a processor of the computer.

[0019] Beneficial effects of the embodiments of the present application:

[0020] In the embodiment of the present application, the data flow packets accessing the business system are captured to obtain the message header of the data flow; the message header is parsed to obtain the first resource data of the user end initiating the data flow and the second resource data of the business system that the data flow needs to access; the first resource data and the second resource data are verified respectively, and the traffic at the network exit is guided and filtered through the firewall policy to ensure that the traffic that needs to access the business system behind the authentication gateway must be filtered and authenticated by the authentication gateway before it can flow to the business system. Thus, the technical effect of using simple deployment to authenticate the user accessing the business system and improving the processing efficiency is achieved, thereby solving the technical problem of complex deployment and low efficiency in the scheme of authenticating the user accessing the business system in the prior art.

[0021] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other embodiments can be obtained based on these drawings without creative work.

[0023] Figure 1 is a flow chart of a method for verifying data flow according to an embodiment of the present application;

[0024] Figure 2 is a deployment diagram of a security authentication gateway according to an embodiment of the present application;

[0025] Figure 3 is a structural block diagram of a security authentication gateway system according to an embodiment of the present application;

[0026] Figure 4 Schematic diagram of the structure of the electronic device of this embodiment. DETAILED DESCRIPTION

[0027] Embodiments of the present embodiment will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present embodiment are shown in the accompanying drawings, it should be understood that the present embodiment can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein, which are instead provided for a more thorough and complete understanding of the present embodiment. It should be understood that the drawings and embodiments of the present embodiment are only for exemplary purposes and are not intended to limit the scope of protection of the present embodiment.

[0028] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:

[0029] A firewall is a system composed of computer hardware and software. It is deployed at the network boundary and serves as a connecting bridge between the internal network and the external network. It protects data entering and leaving the network boundary, prevents malicious intrusion, the spread of malicious code, etc., and ensures the security of internal network data.

[0030] IP address, English name is Internet Protocol Address, refers to Internet Protocol address, also translated as Internet Protocol address. It is a unified address format provided by IP protocol, which assigns a logical address to each network and each host on the Internet to shield the difference of physical address.

[0031] MAC address, whose English name is Media Access Control Address, is literally translated as media access control address. It is also called local area network address, Ethernet address, hardware address or physical address. It can be seen that "MAC address" is actually the adapter address or adapter identifier.

[0032] In the related art, before a user accesses a business system, it is generally necessary to authenticate the user. The scheme for authenticating the user accessing the business system in the prior art has the problems of complex deployment and low efficiency. In order to solve this problem, the embodiments of the present application provide a related solution, which is described in detail below.

[0033] Figure 1 is a flow chart of a method for verifying data flow according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0034] Step S102: Capture data traffic for accessing the service system to obtain a message header of the data traffic.

[0035] The above solution provided in the embodiment of the present application is implemented through a secure authentication gateway. Figure 2 is a schematic diagram of a deployment of a security authentication gateway according to an embodiment of the present application, such as Figure 2 As shown, the security authentication gateway is deployed in the local area network on the main road of the network topology diagram, and the business system is connected to the back of the authentication gateway.

[0036] In this step, the security authentication gateway sets a HOOK point, the purpose of which is to intercept all data traffic accessing the protected business system to the security authentication gateway first, and then capture the data traffic to the gateway program through the HOOK point. Then, the packet header of the data traffic is obtained.

[0037] HOOK points are a technique for inserting code or functions at specific locations to modify the behavior of software while it is running. This technique is often used in areas such as network security, software development, and debugging. Specifically, HOOK points refer to preset locations on the critical execution path of the software. By inserting custom code or functions at these locations, the behavior of the software can be monitored, modified, or enhanced.

[0038] In the field of network security, HOOK points are often used in network filtering frameworks, allowing developers to insert custom hook functions into the network message processing of the Linux kernel. These functions can check, modify or block the transmission of messages, thereby implementing network security policies.

[0039] Step S104 , parsing the message header to obtain first resource data of the user terminal initiating the data traffic and second resource data of the business system that the data traffic needs to access.

[0040] According to an optional embodiment of the present application, the first resource data includes at least one of the following: the IP address and MAC address of the user terminal; the second resource data includes at least one of the following: the IP address, port and communication protocol of the business system that the data traffic needs to access.

[0041] In this step, the message header obtained in step S102 is parsed to obtain the IP address and MAC address of the user terminal initiating the data traffic, as well as the IP address, port and communication protocol of the business system that the data traffic needs to access.

[0042] It should be noted that the above MAC address is used to mark the uniqueness of the user end.

[0043] Step S106, verifying the first resource data and the second resource data respectively.

[0044] When executing step S106, the above-mentioned resource data obtained by analysis are verified respectively to guide and filter the data traffic at the network exit, ensuring that the data traffic that needs to access the business system behind the authentication gateway must be filtered and authenticated by the authentication gateway before it can flow to the business system.

[0045] The above-mentioned solution provided in the embodiment of the present application realizes the technical effect of authenticating the identity of users accessing the business system by using simple deployment and improving the processing efficiency.

[0046] According to an optional embodiment of the present application, step S106 is executed to verify the second resource data, which is achieved by the following method: the resource data of the target business system included in the firewall policy is compared with the second resource data, wherein the target business system is the business system that needs to be protected; if the resource data of the target business system is the same as the second resource data, it is determined that the business system that the data traffic needs to access is the target business system, and the first resource data is verified; if the resource data of the target business system is different from the second resource data, it is determined that the business system that the data traffic needs to access is not the target business system, and the data traffic is released.

[0047] As an optional embodiment of the present application, before verifying the second resource data, it is necessary to obtain the resource data of the target business system and generate a protection policy based on the resource data of the target business system; through the iptables firewall mechanism, the protection policy is converted into a firewall policy.

[0048] In this application, the security authentication gateway first inputs the IP address, port, and protocol of the business system to be protected (i.e., the target business system mentioned above), configures and generates a protection policy, and then converts the protection policy into a firewall policy through the iptables firewall mechanism.

[0049] The firewall has a set of rules to follow and compose when making packet filtering decisions. These rules are stored in dedicated packet filtering tables, which are integrated into the Linux kernel. In the packet filtering table, the rules are grouped in so-called chains. The iptables IP packet filtering system is a powerful tool that can be used to add, edit and remove rules.

[0050] Next, after parsing the message header of the data traffic, the firewall policy is used to determine whether the IP address, port, and communication protocol of the business system that the data traffic needs to access are the resources of the protected business system. If the IP address, port, and communication protocol of the business system that the data traffic needs to access are the same as the IP address, port, and protocol of the protected business system, the next step of verification is required (mainly to verify the first resource data of the user end that initiated the data traffic, which is explained in detail below). If the IP address, port, and communication protocol of the business system that the data traffic needs to access are different from the IP address, port, and protocol of the protected business system, the data traffic is released, and the user end can access the business system that needs to be accessed normally.

[0051] In some optional embodiments of the present application, step S106 is executed to verify the first resource data, including the following steps: determining whether the IP address and MAC address of the user terminal are located in the user online list; if the IP address and MAC address of the user terminal are located in the user online list, determining that the first resource data verification is passed and releasing the data traffic; if the IP address and MAC address of the user terminal are not located in the user online list, determining that the first resource data verification is not passed, blocking the data traffic, and jumping to the gateway authentication page, wherein the gateway authentication page is used for the user terminal to verify through a digital certificate authentication method.

[0052] In an embodiment of the present application, a security authentication gateway maintains a user online list, in which the IP addresses and MAC addresses of the user terminals that have completed the authentication are stored. When verifying the first resource data, it is only necessary to detect whether the IP address and MAC address included in the first resource data are stored in the user online list. If the IP address and MAC address included in the first resource data are stored in the user online list and the user terminal authentication is successful, the data traffic is released and the user terminal can normally access the business system that needs to be accessed; if the IP address and MAC address included in the first resource data are not stored in the user online list and the user terminal authentication is failed, the data traffic is blocked and the authentication page of the security authentication gateway is automatically jumped to require the user terminal to insert the KEY and verify through the authentication method of the digital certificate.

[0053] A digital certificate is a digital certificate that marks the identity information of the parties in Internet communication. People can use it to identify each other online. Therefore, a digital certificate is also called a digital ID. A digital certificate ensures the integrity and security of information and data in the form of encryption or decryption of information and data of network users in computer network communication.

[0054] It should be noted that before blocking the data traffic, the IP address, port, and protocol of the business system that the data traffic needs to access will be recorded first, so that after successful authentication, it can directly jump to the business system that needs to be accessed. Through this solution, the access efficiency of the user end to the business system can be improved.

[0055] In other optional embodiments of the present application, after jumping to the gateway authentication page, the above method also includes: obtaining the verification result of the user terminal through the digital certificate authentication method; if the verification result is a verification failure, blocking the data traffic; if the verification result is a verification success, updating the IP address and MAC address of the user terminal to the user online list, and determining whether the user terminal has the authority to access the target business system; if the user terminal has the authority to access the target business system, releasing the data traffic; if the user terminal does not have the authority to access the target business system, prohibiting the data traffic from accessing the target business system.

[0056] If the user fails to authenticate through the digital certificate, the data traffic is blocked, that is, the user cannot access the business system that needs to be protected. If the user succeeds in the digital certificate authentication, the user with the IP address or MAC address is recorded as online, and the IP address or MAC address of the user is updated to the online user list mentioned above, and then the next step of verification is carried out.

[0057] It is understandable that if the user terminal is successfully authenticated through the digital certificate authentication method, by updating the user terminal's IP address or MAC address to the user online list, the next time the user terminal accesses the business system that needs to be protected, there is no need to authenticate the user terminal again through the digital certificate authentication method, which can also improve the access efficiency of the user terminal to the business system.

[0058] Finally, determine whether the user terminal has the authority to access the protected business system. If it has the authority, the data traffic will be released, and the user terminal can access the business system that needs to be protected normally; if it does not have the authority, the data traffic will be blocked, the user terminal cannot access the business system that needs to be protected, and jump to the rejection page.

[0059] As an optional embodiment of the present application, when the user clicks to exit on the page, the user online list record of the security authentication gateway is deleted.

[0060] According to an optional embodiment of the present application, if the number of times a user terminal accesses a business system for which it does not have permission through a first account exceeds a preset number within a preset time period, the user terminal is prohibited from accessing the target business system through the first account and the user terminal is marked; if it is detected that the marked user terminal accesses the target business system through a second account, the marked user terminal is prohibited from accessing the target business system through the second account, wherein the second account is a different account from the first account.

[0061] In an embodiment of the present application, user behavior profiling (User and Entity Behavior Analytics, UEBA) analysis is used to dynamically shrink user access rights.

[0062] UEBA is a security analysis technology that identifies abnormal behaviors and detects potential security threats by collecting and analyzing behavioral data of users and entities (such as devices, applications, etc.). UEBA uses machine learning and big data analysis technologies to build a user behavior baseline and detect behaviors that deviate from normal patterns on this basis, thereby helping organizations to more effectively discover internal threats, malicious activities, and misuse of resources.

[0063] In an optional embodiment, if user A (corresponding to the first account mentioned above) frequently accesses an unauthorized business system on a certain computer within a certain period of time, the gateway will then reduce permissions, that is, for the core business system (that is, the target business system mentioned above), even if the account has permission to access the core business system, the account's access rights will be automatically disabled; at the same time, the computer will be marked as a risky computer by the gateway, and subsequent access requests initiated by the computer will also be subject to permission reduction (that is, user B (corresponding to the second account mentioned above), user B's access rights on the computer will also be reduced, that is, user B cannot access the core business system through this marked computer).

[0064] As an optional embodiment of the present application, after the first account is successfully authenticated through at least two different types of verification methods, the user terminal is allowed to access the target business system through the first account, and the user terminal is unmarked and allowed to access the target business system through the second account.

[0065] If user A re-authenticates through two-factor strong authentication (such as smart card, collaborative signature, SMS verification code), the gateway automatically unlocks the permissions of the user's corresponding account and restores the permissions before locking, that is, allowing the user to access the target business system through the first account. For the release of the risk terminal, user A must pass the two-factor authentication successfully to unlock the computer's pre-lock permissions. Even if user B passes the two-factor authentication, the risk terminal cannot be restored.

[0066] Two-Factor Authentication (2FA) is a security measure that requires users to provide two different types of credentials to verify their identity. This authentication method greatly enhances the security of your account because it does not rely on just a single authentication factor, but instead combines two independent factors.

[0067] By adopting user behavior profiling and dynamically reducing user access rights, the security of the system can be further improved.

[0068] Figure 3 is a structural block diagram of a security authentication gateway system according to an embodiment of the present application, such as Figure 3 As shown, the security authentication gateway system includes: a first switch 30, a second switch 32 and a gateway device 34, wherein:

[0069] The first switch 30 is arranged between the gateway device 34 and the user end, and is arranged to realize communication between the user end and the gateway device 34 .

[0070] The second switch 32 is arranged between the gateway device 34 and the business system, and is arranged to realize communication between the gateway device 34 and the business system.

[0071] The gateway device 34 is configured to execute the method in any of the above embodiments.

[0072] It should be noted that Figure 3 The preferred implementation of the embodiment shown can be referred to Figure 1 The relevant description of the illustrated embodiment will not be repeated here.

[0073] The embodiment of the present application also provides an electronic device, comprising: at least one processor; and a memory connected to the at least one processor in communication. The memory stores a computer program executable by the at least one processor, and the computer program is used to enable the electronic device to perform the method of the embodiment of the present application when executed by the at least one processor.

[0074] According to an optional embodiment of the present application, the above-mentioned processor is used to process a program that performs the following functions: capture packets of data traffic accessing a business system to obtain a message header of the data traffic; parse the message header to obtain first resource data of the user end initiating the data traffic and second resource data of the business system that the data traffic needs to access; and verify the first resource data and the second resource data respectively.

[0075] According to an optional embodiment of the present application, the above-mentioned memory is used to store a program that performs the following functions: capture data traffic accessing the business system to obtain the message header of the data traffic; parse the message header to obtain the first resource data of the user end initiating the data traffic and the second resource data of the business system that the data traffic needs to access; and verify the first resource data and the second resource data respectively.

[0076] An embodiment of the present application also provides a non-transitory machine-readable medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to execute the method of the embodiment of the present application.

[0077] The embodiment of the present application also provides a computer program product, including a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to execute the method of the embodiment of the present application.

[0078] refer to Figure 4, the structural block diagram of the electronic device that can be used as the server or client of the embodiment of the present application will now be described, which is an example of the hardware device that can be applied to various aspects of the present application. The electronic device is intended to represent various forms of digital electronic computer equipment, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices and other similar computing devices. The components shown herein, their connections and relationships, and their functions are only examples, and are not intended to limit the implementation of the present application described and / or required herein.

[0079] like Figure 4 As shown, the electronic device includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded from a storage unit 408 to a random access memory (RAM) 403. In RAM 403, various programs and data required for the operation of the electronic device can also be stored. The computing unit 401, ROM 402, and RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0080] Multiple components in the electronic device are connected to the I / O interface 405, including: an input unit 406, an output unit 407, a storage unit 408, and a communication unit 409. The input unit 406 can be any type of device that can input information to the electronic device, and the input unit 406 can receive input digital or character information, and generate key signal input related to user settings and / or function control of the electronic device. The output unit 407 can be any type of device that can present information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 408 can include but is not limited to a disk, an optical disk. The communication unit 409 allows the electronic device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include but is not limited to a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0081] The computing unit 401 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a CPU, a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 401 performs the various methods and processes described above. For example, in some embodiments, the method embodiments of the present application may be implemented as a computer program, which is tangibly contained in a machine-readable medium, such as a storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on an electronic device via ROM 402 and / or communication unit 409. In some embodiments, the computing unit 401 may be configured to perform the above method in any other appropriate manner (e.g., by means of firmware).

[0082] The computer program for implementing the method of the embodiment of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0083] In the context of the embodiments of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or apparatus. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable signal medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, or infrared system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0084] It should be noted that the term "including" and its variations used in the embodiments of the present application are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". The modifications of "one" and "multiple" mentioned in the embodiments of the present application are illustrative and not restrictive. Those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0085] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of the present application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0086] The various steps described in the method implementation methods provided in the embodiments of the present application can be performed in different orders and / or in parallel. In addition, the method implementation methods may include additional steps and / or omit the steps shown. The scope of protection of the present application is not limited in this respect.

[0087] The term "embodiment" in this specification refers to specific features, structures or characteristics described in conjunction with the embodiment that can be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily mean the same embodiment, nor does it mean that it is mutually exclusive with other embodiments and is independent or optional. The various embodiments in this specification are described in a related manner, and the same or similar parts between the various embodiments refer to each other. In particular, for the device, equipment, and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts refer to the partial description of the method embodiment.

[0088] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the attached claims.

Claims

1. A method for verifying data flow, characterized in that: include: Capturing data traffic for accessing the business system to obtain a message header of the data traffic; Parsing the message header to obtain first resource data of the user end initiating the data traffic and second resource data of the service system that the data traffic needs to access; verifying the first resource data and the second resource data respectively; The first resource data includes at least one of the following: an IP address and a MAC address of the user terminal; The second resource data includes at least one of the following: an IP address, a port, and a communication protocol of a business system that the data traffic needs to access; Verifying the second resource data includes: comparing the resource data of the target business system included in the firewall policy with the second resource data, wherein the target business system is the business system to be protected; if the resource data of the target business system is the same as the second resource data, determining that the business system to be accessed by the data traffic is the target business system, and verifying the first resource data; if the resource data of the target business system is different from the second resource data, determining that the business system to be accessed by the data traffic is not the target business system, and releasing the data traffic; Verifying the first resource data includes: determining whether the IP address and MAC address of the user terminal are in the user online list; if the IP address and MAC address of the user terminal are in the user online list, determining that the first resource data verification is passed, and releasing the data traffic; if the IP address and MAC address of the user terminal are not in the user online list, determining that the first resource data verification is not passed, blocking the data traffic, and jumping to a gateway authentication page, wherein the gateway authentication page is used for the user terminal to verify through a digital certificate authentication method; After jumping to the gateway authentication page, the method also includes: obtaining the verification result of the user terminal through the digital certificate authentication method; if the verification result is a verification failure, blocking the data traffic; if the verification result is a verification success, updating the IP address and MAC address of the user terminal to the user online list, and judging whether the user terminal has the authority to access the target business system; if the user terminal has the authority to access the target business system, releasing the data traffic; if the user terminal does not have the authority to access the target business system, prohibiting the data traffic from accessing the target business system.

2. The method according to claim 1, characterized in that Before verifying the second resource data, the method further includes: Acquiring resource data of the target business system, and generating a protection strategy based on the resource data of the target business system; The protection strategy is converted into the firewall strategy through the iptables firewall mechanism.

3. The method according to claim 1, characterized in that The method further comprises: If the number of times that the user terminal accesses the business system for which it does not have permission through the first account exceeds a preset number within a preset time period, prohibiting the user terminal from accessing the target business system through the first account and marking the user terminal; If it is detected that the marked user terminal accesses the target business system through a second account, the marked user terminal is prohibited from accessing the target business system through the second account, wherein the second account is an account different from the first account.

4. The method according to claim 3, characterized in that After the first account is successfully authenticated by at least two different types of verification methods, the user terminal is allowed to access the target business system through the first account, the user terminal is unmarked, and the user terminal is allowed to access the target business system through the second account.

5. A security authentication gateway system, characterized in that: include: A first switch, a second switch and a gateway device, wherein: The first switch is arranged between the gateway device and the user terminal, and is arranged to realize communication between the user terminal and the gateway device; The second switch is arranged between the gateway device and the service system, and is arranged to realize communication between the gateway device and the service system; The gateway device is configured to execute the method according to any one of claims 1 to 4.

6. An electronic device comprising: A processor and a memory storing a program, wherein the program comprises instructions, which, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 4.

7. A non-transitory machine-readable medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 4.

8. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor of a computer, the computer is used to cause the computer to execute the method according to any one of claims 1 to 4.

Images