Authentication method, device and equipment for implementing VPN based on dual protocols, and medium

Abstract

The embodiment of the application provides a kind of authentication method, device, equipment and medium based on double protocol to realize VPN, it is related to the field of Internet.The method comprises the following steps: a VPN server determines a first protocol according to verification request information, and sends a first protocol authentication request;The client returns the authentication request information;The VPN server sends a dynamic token to the user after verification, and the user inputs the dynamic token into the client;The VPN server sends a challenge value to the client with the second protocol;The VPN server and the client generate first and second response authentication values according to the dynamic token and the challenge value respectively;The client sends the second response authentication value to the VPN server;The VPN server determines the authentication result according to the first and second response authentication values to indicate the completion of the authentication of the client.Therefore, the VPN two-factor authentication function is realized by the combination of two protocols, which reduces the system complexity and cost and improves the security of authentication.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of Internet, and in particular to an authentication method and device based on double protocols for implementing VPN, equipment and medium. BACKGROUND

[0002] In the field of Internet, Virtual Private Network (VPN) technology is used to build a virtual private network channel to ensure the safe transmission of data on the Internet. In order to ensure the security of data transmission and the accurate verification of user identity, the Internet Key Exchange (IKEv2) protocol provides multiple authentication methods to establish a secure association. In the remote access VPN scenario, a specific authentication method such as EAP-MSCHAPV2 is commonly used, but there are security limitations, so higher security requirements such as two-factor authentication are proposed.

[0003] In the prior art, in the remote access VPN scenario, the VPN gateway points the identity authentication server to the two-factor identity authentication server. The two-factor identity authentication server regards the VPN as its identity authentication agent, and in the authentication process, the remote user provides the correct user password and dynamic token. After the two-factor identity authentication server passes the authentication, it notifies the VPN gateway of the authentication success, allowing the user to access the internal network to implement Internet Protocol Security (IPSec) VPN two-factor authentication.

[0004] Since the two-factor authentication function of the existing IPSec VPN requires additional configuration and maintenance of the backend authentication server to implement it, the additional configuration increases the complexity and cost of the system, and if the later maintenance is not in place, it will cause security vulnerabilities and reduce the security of authentication. SUMMARY

[0005] The embodiments of the present application provide an authentication method and device based on double protocols for implementing VPN, equipment and medium, to achieve the technical effects of reducing system complexity and cost, and improving authentication security.

[0006] In a first aspect, the embodiments of the present application provide an authentication method based on double protocols for implementing VPN, applied to a VPN server, comprising:

[0007] receiving authentication request information sent by a client, determining that the client uses a first protocol for authentication according to the authentication request information, and sending a first protocol authentication request to the client;

[0008] receiving authentication request information sent by a client, sending a dynamic token to a user corresponding to the client according to the authentication request information;

[0009] determining a challenge value, and sending the challenge value to the client using a second protocol;

[0010] generating a first response authentication value according to the dynamic token and the challenge value, receiving a second response authentication value sent by the client, and determining an authentication result according to the first response authentication value and the second response authentication value, the authentication result being used to indicate that the authentication of the client is completed.

[0011] In a possible implementation, after the authentication result is determined according to the first response authentication value and the second response authentication value, the method further includes:

[0012] receiving a signature value sent by the client, and verifying the signature value to obtain a verification result, the verification result being used to indicate that the VPN tunnel is established after the verification of the signature value is successful.

[0013] In a possible implementation, before the verification request information sent by the client is received, the method further includes:

[0014] receiving an internet key exchange initial request sent by the client, replying to the internet key exchange initial request, and sending the reply to the client, the reply being configured to support the two-factor authentication.

[0015] In a second aspect, an authentication method for implementing VPN based on two protocols is provided by the embodiments of the present application, and is applied to a client, and includes:

[0016] receiving a first protocol authentication request sent by a VPN server, and sending authentication request information to the VPN server according to the first protocol authentication request, the authentication request information including a username and a static password;

[0017] receiving a dynamic token input by a user and a challenge value sent by the VPN server, generating a second response authentication value according to the dynamic token and the challenge value, sending the second response authentication value to the VPN server using a second protocol, and receiving a first response authentication value sent by the VPN server.

[0018] In a possible implementation, after the first response authentication value sent by the VPN server is received, the method further includes:

[0019] obtaining authentication data according to the second response authentication value;

[0020] signing the authentication data to obtain a signature value, and sending the signature value to the VPN server.

[0021] In a possible implementation, before the first protocol authentication request sent by the VPN server is received, the method further includes:

[0022] The authentication request information is sent to the VPN server.

[0023] In a possible implementation, the authentication request information is sent to the VPN server, including:

[0024] An Internet key exchange initial request is sent to the VPN server, and a response reply of the VPN server is received, the response reply being obtained according to the Internet key exchange initial request;

[0025] The authentication request information is determined according to the response reply, and the authentication request information is sent to the VPN server.

[0026] In a third aspect, an authentication device for implementing VPN based on dual protocols is provided, and the device is applied to a VPN server and includes:

[0027] A first processing module is configured to receive authentication request information sent by a client, determine that the client uses a first protocol for authentication according to the authentication request information, and send a first protocol authentication request to the client;

[0028] A second processing module is configured to receive authentication request information sent by the client, and send a dynamic token to a user corresponding to the client according to the authentication request information;

[0029] A sending module is configured to determine a challenge value, and send the challenge value to the client by using a second protocol;

[0030] An authentication module is configured to generate a first response authentication value according to the dynamic token and the challenge value, receive a second response authentication value sent by the client, determine an authentication result according to the first response authentication value and the second response authentication value, and use the authentication result to indicate that the authentication of the client is completed.

[0031] In a possible implementation, the first processing module is further configured to:

[0032] An Internet key exchange initial request sent by the client is received, a response reply is sent to the Internet key exchange initial request, and the response reply is sent to the client, the response reply being configured to support dual-factor authentication.

[0033] In a possible implementation, the authentication module is further configured to:

[0034] A signature value sent by the client is received, and the signature value is verified to obtain a verification result, the verification result being used to indicate that a VPN tunnel is established after the signature value is verified successfully.

[0035] In a fourth aspect, an authentication device for implementing VPN based on dual protocols is provided, and the device is applied to a client and includes:

[0036] The third processing module is configured to receive a first protocol authentication request sent by the VPN server, send authentication request information to the VPN server according to the first protocol authentication request, and the authentication request information comprises a username and a static password.

[0037] The fourth processing module is configured to receive a dynamic token input by a user and a challenge value sent by the VPN server, generate a second response authentication value according to the dynamic token and the challenge value, send the second response authentication value to the VPN server by using a second protocol, and receive a first response authentication value sent by the VPN server.

[0038] In a possible implementation, the third processing module is further configured to:

[0039] initiate a verification request information to the VPN server, and the verification request information is configured to support dual-factor authentication. In a possible implementation, the third processing module is further configured to:

[0040] initiate an internet key exchange initial request to the VPN server, and receive a response reply of the VPN server, wherein the response reply is obtained according to the internet key exchange initial request;

[0041] determine the verification request information according to the response reply, and send the verification request information to the VPN server.

[0042] In a possible implementation, the fourth processing module is further configured to:

[0043] obtain authentication data according to the second response authentication value;

[0044] sign the authentication data to obtain a signature value, and send the signature value to the VPN server.

[0045] In a fifth aspect, an embodiment of the present application provides an authentication device for implementing VPN based on dual protocols, comprising a memory and a processor.

[0046] The memory stores computer execution instructions.

[0047] The processor executes the computer execution instructions stored in the memory, so that the processor executes the authentication method for implementing VPN based on dual protocols according to any one of the first aspect or the second aspect.

[0048] In a sixth aspect, an embodiment of the present application provides a computer readable storage medium, which stores computer execution instructions, and the computer execution instructions are executed by a processor to implement the authentication method for implementing VPN based on dual protocols according to any one of the first aspect or the second aspect.

[0049] In a seventh aspect, an embodiment of the present application provides a computer program product, comprising a computer program which, when executed by a processor, implements the authentication method for implementing VPN based on dual protocols according to any one of the first aspect or the second aspect.

[0050] The authentication method for implementing VPN based on dual protocols, the device, the equipment and the medium provided by the embodiments of the present application realize the VPN dual-factor authentication function through the combination of the first protocol and the second protocol, and the challenge value and the dynamic token are used to generate the response value and verify the response value in the authentication process, thereby realizing the technical effects of reducing system complexity and cost and improving authentication security. BRIEF DESCRIPTION OF DRAWINGS

[0051] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the application.

[0052] Figure 1 An interaction diagram of the authentication method for implementing VPN based on dual protocols provided by an embodiment of the present application Figure 1 ;

[0053] Figure 2 An interaction diagram of the authentication method for implementing VPN based on dual protocols provided by an embodiment of the present application Figure 2 ;

[0054] Figure 3 A structure diagram of the authentication device for implementing VPN based on dual protocols provided by an embodiment of the present application Figure 1 ;

[0055] Figure 4 A structure diagram of the authentication device for implementing VPN based on dual protocols provided by an embodiment of the present application Figure 2 ;

[0056] Figure 5 A structure diagram of the authentication device for implementing VPN based on dual protocols provided by an embodiment of the present application

[0057] Through the above drawings, the specific embodiments of the present application have been shown, and more detailed descriptions will be given hereinafter. These drawings and textual descriptions are not intended to limit the scope of the concept of the present application by any means, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0058] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The following description is made with reference to the accompanying drawings in which like reference numerals designate identical or similar elements in the several views. The following description of exemplary embodiments is not representative of all embodiments consistent with the present application. Rather, it is merely an example of apparatus and methods consistent with some aspects of the present application as detailed in the appended claims.

[0059] The current technical solution to achieve IPSec VPN dual-factor authentication is usually achieved by cooperation of an IPSec VPN gateway and a backend dual-factor authentication server. The backend dual-factor authentication server usually needs to be selected and purchased. At the same time, the above-mentioned authentication method is not applicable to the case where the user account is maintained locally by the VPN gateway itself. Therefore, in the prior art, there are technical problems of high complexity and cost of the VPN authentication system and low authentication security.

[0060] The authentication method for implementing VPN based on dual protocols provided by the embodiments of the present application realizes VPN dual-factor authentication by means of the collocation of the first protocol and the second protocol between the client and the VPN server, and generates and verifies the response value by using the challenge value and the dynamic token in the authentication process, thereby solving the technical problems of high complexity and cost of the VPN authentication system and low authentication security in the prior art.

[0061] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0062] Figure 1 Interaction diagram of the authentication method for implementing VPN based on dual protocols provided by the embodiments of the present application Figure 1 As shown in Figure 1 The authentication method for implementing VPN based on dual protocols provided by the embodiments of the present application, the method comprises:

[0063] S101, the VPN server determines that the client uses the first protocol for authentication according to the verification request information.

[0064] In the present embodiment, the VPN server analyzes and identifies the verification request information sent by the client, and determines that the client selects to use the first protocol for identity authentication. This means that the server will interact with the client according to the rules and processes of the first protocol to complete the authentication process and confirm the legitimacy of the client's identity and the right, etc.

[0065] It should be noted that the first protocol refers to a specific authentication protocol in the extensible authentication (Ethernet for Plant Automation, EPA) protocol, and the first protocol may be, for example, an extensible authentication protocol-Microsoft challenge handshake authentication protocol version 2 (EAP-MSCHAPV2) protocol, which is an MSCHAPV2 protocol encapsulated in an EPA protocol framework and is mainly used for user identity authentication in a network environment. In this protocol, the identity information of the user is verified through a series of challenges and responses between the client and the VPN server.

[0066] S102, the VPN server sends a first protocol authentication request to the client.

[0067] In this embodiment, when the VPN server sends the first protocol authentication request to the client, it indicates that the VPN server has started the process of using a specific first protocol to authenticate the client.

[0068] S103, the client sends authentication request information to the VPN server according to the first protocol authentication request, and the authentication request information includes a username and a static password.

[0069] In this embodiment, after receiving the first protocol authentication request from the VPN server, the client feeds back authentication request information to the VPN server according to the requirement. The authentication request information includes a username and a static password. The username is a unique identifier for identifying the identity of the user, and the username may include, for example, a user mobile phone field, an email address field, and an authentication type field (which indicates whether to select an SMS verification code or an email verification code). The static password is a secret character combination set by the user in advance for identity verification.

[0070] S104, the VPN server verifies that the authentication request information is passed.

[0071] In this embodiment, the VPN server receives the authentication request information and compares it with the correct information stored in advance to determine whether the client has legitimate access rights or has passed the authentication, so as to decide whether to allow the client to continue subsequent operations or access specific resources.

[0072] It should be noted that when the VPN server verifies the authentication request information, the VPN server sends a verification success notification to the client. After the client receives the verification success notification, the client sends a first protocol authentication success message to the VPN server, and the message carries a notification load of using the two-factor authentication, which indicates that the client requires the VPN server to use the second protocol to verify the dynamic token in the subsequent authentication process.

[0073] S105, the VPN server sends a dynamic token to the user corresponding to the client.

[0074] In this embodiment, the authentication request information provided by the VPN server client obtains the contact information of the user, which can be a mobile phone number or an email address, for example. The dynamic token is sent to the user terminal according to the contact information.

[0075] S106, the client receives the dynamic token input by the user.

[0076] In this embodiment, the client receives the dynamic token input by the user through a dynamic verification code input window.

[0077] S107, the VPN server sends a challenge value to the client using the second protocol.

[0078] In this embodiment, the VPN server generates a challenge value and sends the challenge value to the client through the second protocol.

[0079] It should be noted that the second protocol refers to another specific authentication protocol in the EPA protocol, which can be an Extensible Authentication Protocol-One-Time Password (EAP-OTP) protocol, for example. The EAP-OTP protocol is an authentication protocol based on one-time password, which mainly uses one-time dynamic password to enhance the security of authentication.

[0080] S108, the VPN server generates a first response authentication value according to the dynamic token and the challenge value.

[0081] In this embodiment, the dynamic token is usually constantly changing, and the first response authentication value is generated in combination with the challenge value, which can further improve the security and reliability of authentication and ensure the legality and credibility of the interaction between the client and the VPN server.

[0082] S109, the client generates a second response authentication value according to the dynamic token and the challenge value.

[0083] In this embodiment, the client also generates a second response authentication value by using the dynamic token and the challenge value. In this way, the VPN server and the client interact and verify by using the authentication values generated by themselves, and only when the authentication values of both sides match, the legitimacy and authorization of the client can be confirmed, and the security and accuracy of the whole communication process are ensured.

[0084] S110, the client sends the second response authentication value to the VPN server by using the second protocol.

[0085] In this embodiment, the client sends the generated second response authentication value to the VPN server by using the second protocol, so that the VPN server authenticates the client.

[0086] S111, the VPN server determines an authentication result according to the first response authentication value and the second response authentication value, and the authentication result is used to indicate that the authentication of the client is completed.

[0087] In this embodiment, the VPN server compares the second response authentication value with the first response authentication value generated by itself, and if they are consistent, it indicates that the client passes the authentication.

[0088] The authentication method for implementing VPN based on double protocols provided by the embodiment of the application includes the following steps.

[0089] Figure 2 The authentication method for implementing VPN based on double protocols provided by the embodiment of the application includes the following steps. Figure 2 As shown in Figure 1 the embodiment, the authentication method for implementing VPN based on double protocols includes the following steps. Figure 3 The embodiment is based on the authentication method for implementing VPN based on double protocols, and a possible implementation manner of the authentication method for implementing VPN based on double protocols is described in detail.

[0090] S201, the client sends an Internet key exchange initial request to the VPN server.

[0091] In this embodiment, in order to start the Internet Key Exchange process with the terminal, the client initiates an Internet Key Exchange initial request to the VPN server to establish a secure association. The Internet Key Exchange initial request is a step in the Internet Key Exchange protocol negotiation process, and is used to start the initialization phase of the key exchange.

[0092] S202, the VPN server replies to the Internet Key Exchange initial request.

[0093] In this embodiment, the VPN server receives the Internet Key Exchange initial request sent by the client and replies, and negotiates the Internet Key Exchange secure association in this process, which is used to encrypt and protect the subsequent protocol negotiation messages.

[0094] S203, the VPN server sends a reply to the client.

[0095] In this embodiment, the VPN server configures the support of the two-factor authentication in the reply sent to the client, indicating that the VPN server supports the two-factor authentication function.

[0096] S204, the client determines the verification request information according to the reply.

[0097] In this embodiment, the verification request information is used to indicate the authentication request without authentication data.

[0098] S205, the client sends the verification request information to the VPN server.

[0099] In this embodiment, the client sends the verification request information to the VPN server, which indicates that the client uses the EPA (Extensible Authentication Protocol) method to perform authentication, and the verification request information needs to be configured with the support of the two-factor authentication, indicating that the client also supports the two-factor authentication function.

[0100] S206, the VPN server determines that the client uses the first protocol for authentication according to the verification request information.

[0101] S207, the VPN server sends a first protocol authentication request to the client.

[0102] S208, the client sends authentication request information including a username and a static password to the VPN server according to the first protocol authentication request.

[0103] S209, the VPN server verifies that the authentication request information is passed.

[0104] S210, the VPN server sends a dynamic token to the user corresponding to the client.

[0105] S211, the client receives a dynamic token input by the user.

[0106] S212, the VPN server sends a challenge value to the client using the second protocol.

[0107] S213, the VPN server generates a first response authentication value based on the dynamic token and the challenge value.

[0108] S214, the client generates a second response authentication value based on the dynamic token and the challenge value.

[0109] S215, the client sends the second response authentication value to the VPN server using the second protocol.

[0110] S216, the VPN server determines an authentication result based on the first response authentication value and the second response authentication value, the authentication result being used to indicate that the authentication of the client is completed.

[0111] Steps S206-S216 are similar to steps S101-S111 described above, and will not be described here.

[0112] S217, the client obtains authentication data based on the second response authentication value, signs the authentication data to obtain a signature value.

[0113] In this embodiment, the client first obtains authentication data based on the second response authentication value, and then signs the authentication data, so that the VPN server can confirm the authenticity and integrity of the data and the identity legitimacy of the client by verifying the signature after receiving the signature value. This signature mechanism further enhances the security and credibility of the entire system.

[0114] S218, the client sends the signature value to the VPN server.

[0115] S219, the VPN server verifies the signature value to obtain a verification result, the verification result being used to indicate that the VPN tunnel is established after the verification of the signature value is successful.

[0116] In this embodiment, the VPN server receives the signature value sent by the client, verifies the signature value, and if the signature value is verified successfully, it indicates that the identity authentication of the client is successful, and then the VPN tunnel is established to ensure the message intercommunication between the client and the VPN server.

[0117] The authentication method for implementing VPN based on double protocols provided by the embodiment of the application comprises the following steps: a client sends an Internet key exchange initial request to a VPN server; the client determines verification request information after the VPN server replies, and sends the verification request information to the VPN server; the client adopts a first protocol for authentication and sends an authentication request according to the verification request information; the client returns authentication request information containing a username and a static password; the VPN server sends a dynamic token to the user after passing the authentication, and the dynamic token is transmitted to the client by the user; the VPN server sends a challenge value by using a second protocol; the client and the VPN server generate a response authentication value; the VPN server determines an authentication result; the client sends a signature value to the VPN server after signing the authentication data; the VPN server checks the signature value; and the VPN tunnel is established if the checking is successful. Therefore, the double-factor authentication function of VPN is realized by the mutual combination of two protocols, and the technical effects of reducing system complexity and cost, improving authentication security and the like are realized.

[0118] Figure 1 The authentication device for implementing VPN based on double protocols provided by the embodiment of the application Figure 3 As shown in Figure 4 The authentication device for implementing VPN based on double protocols provided by the embodiment of the application is applied to a VPN server, and comprises the following:

[0119] A first processing module 301 is configured to receive verification request information sent by a client, determine that the client adopts a first protocol for authentication according to the verification request information, and send a first protocol authentication request to the client.

[0120] A second processing module 302 is configured to receive authentication request information sent by the client, and send a dynamic token to a user corresponding to the client according to the authentication request information.

[0121] A sending module 303 is configured to determine a challenge value, and send the challenge value to the client by using a second protocol.

[0122] A verification module 304 is configured to generate a first response authentication value according to the dynamic token and the challenge value, receive a second response authentication value sent by the client, determine an authentication result according to the first response authentication value and the second response authentication value, and use the authentication result to indicate that the authentication of the client is completed.

[0123] In a possible implementation, the first processing module 301 is further configured to:

[0124] receive an Internet key exchange initial request sent by the client, reply to the Internet key exchange initial request, and send the reply to the client, wherein the reply is configured to support double-factor authentication.

[0125] In a possible implementation, the verification module 304 is further configured to:

[0126] receive the signature value sent by the client, and check the signature value to obtain a check result, the check result being used to indicate that the VPN tunnel is established after the signature value is checked successfully.

[0127] The authentication device for implementing VPN based on dual protocols provided in this embodiment can execute the method provided in the method embodiments, and has similar implementation principles and technical effects, which will not be repeated here.

[0128] Figure 2 A structure of the authentication device for implementing VPN based on dual protocols provided in this embodiment Figure 4 As shown in Figure 5 The authentication device for implementing VPN based on dual protocols provided in this embodiment is applied to a client, and includes:

[0129] The third processing module 401 is configured to receive the first protocol authentication request sent by the VPN server, and send authentication request information to the VPN server according to the first protocol authentication request, the authentication request information including a username and a static password.

[0130] The fourth processing module 402 is configured to receive a dynamic token input by a user and a challenge value sent by the VPN server, generate a second response authentication value according to the dynamic token and the challenge value, send the second response authentication value to the VPN server by using a second protocol, and receive a first response authentication value sent by the VPN server.

[0131] In a possible implementation, the third processing module 401 is further configured to:

[0132] initiate verification request information to the VPN server, the verification request information being configured to support dual-factor authentication.

[0133] In a possible implementation, the third processing module 401 is further configured to:

[0134] initiate an Internet key exchange initial request to the VPN server, and receive a response reply of the VPN server, the response reply being obtained according to the Internet key exchange initial request;

[0135] determine verification request information according to the response reply, and send the verification request information to the VPN server.

[0136] In a possible implementation, the fourth processing module 402 is further configured to:

[0137] obtain authentication data according to the second response authentication value;

[0138] Sign the authentication data to obtain a signature value, and send the signature value to the VPN server.

[0139] The authentication device for implementing VPN based on dual protocols provided in the embodiment can execute the method provided in the method embodiment, and has similar implementation principles and technical effects. Details are not described herein again.

[0140] Figure 5 A structural schematic diagram of an authentication device for implementing VPN based on dual protocols provided in the embodiment is shown in FIG. 5. As shown in the figure, the authentication device 50 for implementing VPN based on dual protocols provided in the embodiment includes at least one processor 501 and a memory 502. Optionally, the device 50 further includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected through a bus 504. ​

[0141] In the specific implementation process, the at least one processor 501 executes the computer execution instructions stored in the memory 502, so that the at least one processor 501 executes the method described above.

[0142] The specific implementation process of the processor 501 can refer to the method embodiment described above, and has similar implementation principles and technical effects. Details are not described herein again.

[0143] In the above embodiment, it should be understood that the processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC) and the like. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor and the like. The steps of the method disclosed in the application can be directly embodied as execution completed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

[0144] The memory can include a random access memory (RAM), and can also include a non-volatile memory (NVM), for example, at least one disk memory.

[0145] ​The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the embodiments of the present application is not limited to only one bus or one type of bus.

[0146] The embodiments of the present application also provide a computer program product, comprising a computer program, which, when executed by a processor, implements the method described above.

[0147] The embodiments of the present application also provide a computer readable storage medium, which stores computer execution instructions, and when a processor executes the computer execution instructions, the method described above is implemented.

[0148] The readable storage medium described above can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0149] An exemplary readable storage medium is coupled to the processor, so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be an integral part of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist as discrete components in the device.

[0150] The division of units is only a logical functional division, and in actual implementation, there can be another division manner, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0151] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit.

[0152] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in the various embodiments of the present application. The aforementioned storage medium includes various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0153] Those skilled in the art can understand that all or part of the steps of the above-mentioned method embodiments can be completed by program instruction-related hardware. The aforementioned program can be stored in a computer readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes various media that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

[0154] The terms "first", "second", "third", "fourth" and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the application described herein, for example, can be implemented in other than the order shown or described herein. In addition, the terms "comprise" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, system, product or device that includes a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, products or devices.

[0155] It should be noted that in the embodiments of the present application, the words "exemplary" or "for example" are used to mean example, instance, or illustration. Any embodiment or design scheme described as "exemplary" or "for example" in the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the use of "exemplary" or "for example" is intended to present the relevant concept in a specific manner.

[0156] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the embodiments of the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards in the relevant region, and provide corresponding operation portal for the user to choose authorization or refusal.

[0157] Finally, it should be noted that: other embodiments of the application will be readily apparent to those skilled in the art with the consideration of the specification and practice of the application disclosed herein. The application is intended to cover any variations, uses or adaptive changes of the application that follow the general principles of the application and include common knowledge or conventional technical means in the art that are not disclosed by the application, and are not limited to the precise structure described above and shown in the drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the application is only limited by the appended claims.

Claims

1. A VPN authentication method based on dual protocols, characterized in that, Applied to VPN servers, including: Receive verification request information sent by the client, determine that the client uses the first protocol for authentication based on the verification request information, and send the first protocol authentication request to the client; Receive authentication request information sent by the client, and send a dynamic token to the user corresponding to the client based on the authentication request information; The challenge value is determined, and the challenge value is sent to the client using the second protocol; A first response authentication value is generated based on the dynamic token and the challenge value. A second response authentication value is received from the client. An authentication result is determined based on the first response authentication value and the second response authentication value. The authentication result is used to indicate that the authentication of the client is complete.

2. The method according to claim 1, characterized in that, After determining the authentication result based on the first response authentication value and the second response authentication value, the method further includes: The system receives the signature value sent by the client, verifies the signature value, and obtains a verification result. The verification result is used to indicate that a VPN tunnel is established after the signature value is successfully verified.

3. The method according to claim 1, characterized in that, Before receiving the verification request information sent by the client, the method further includes: The system receives an Internet key exchange initial request sent by the client, responds to the Internet key exchange initial request, and sends the response back to the client. The response includes configuration for two-factor authentication support.

4. A VPN authentication method based on dual protocols, characterized in that, Applied to the client side, including: Receive a first protocol authentication request sent by a VPN server, and send authentication request information to the VPN server according to the first protocol authentication request, wherein the authentication request information includes a username and a static password; The system receives a dynamic token input by the user and a challenge value sent by the VPN server, generates a second response authentication value based on the dynamic token and the challenge value, sends the second response authentication value to the VPN server using a second protocol, and receives a first response authentication value sent by the VPN server.

5. The method according to claim 4, characterized in that, After receiving the first response authentication value sent by the VPN server, the method further includes: Based on the second response authentication value, the authentication data is obtained; The authentication data is signed to obtain a signature value, and the signature value is sent to the VPN server.

6. The method according to claim 4, characterized in that, Before receiving the first protocol authentication request sent by the VPN server, the method further includes: A verification request is sent to the VPN server, and the verification request is configured to support two-factor authentication.

7. The method according to claim 6, characterized in that, The information sent to the VPN server to initiate the verification request includes: Initiate an initial request for Internet key exchange to the VPN server and receive a response reply from the VPN server, the response reply being obtained based on the initial request for Internet key exchange; The verification request information is determined based on the response reply, and the verification request information is sent to the VPN server.

8. An authentication device for VPN based on dual protocols, characterized in that, The device is used in VPN clients and includes: The first processing module is used to receive verification request information sent by the client, determine that the client uses the first protocol for authentication based on the verification request information, and send the first protocol authentication request to the client. The second processing module is used to receive authentication request information sent by the client and send a dynamic token to the user corresponding to the client according to the authentication request information; A sending module is used to determine the challenge value and send the challenge value to the client using a second protocol; The verification module is configured to generate a first response authentication value based on the dynamic token and the challenge value, receive a second response authentication value sent by the client, and determine an authentication result based on the first response authentication value and the second response authentication value, wherein the authentication result is used to indicate that the authentication of the client is complete.

9. An authentication device for VPN based on dual protocols, characterized in that, The device is applied to a client and includes: The third processing module is used to receive a first protocol authentication request sent by the VPN server, and send authentication request information to the VPN server according to the first protocol authentication request. The authentication request information includes a username and a static password. The fourth processing module is used to receive a dynamic token input by the user and a challenge value sent by the VPN server, generate a second response authentication value based on the dynamic token and the challenge value, send the second response authentication value to the VPN server using a second protocol, and receive a first response authentication value sent by the VPN server.

10. An authentication device for VPN based on dual protocols, characterized in that, The device includes: a memory and a processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the VPN authentication method based on dual protocols as described in any one of claims 1-3 or 4-7.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the VPN authentication method based on dual protocols as described in any one of claims 1-3 or 4-7.

12. A computer program product comprising a computer program that, when executed by a processor, implements the VPN authentication method based on dual protocols as described in any one of claims 1-3 or 4-7.

Images