Cloud network identity authentication security access gateway

Abstract

The invention discloses a cloud network identity authentication security access gateway, which comprises a plurality of virtual gateway units, each virtual gateway unit is mutually independent and has the same virtual machine resource, and the virtual machine resource comprises a CPU (Central Processing Unit) general computing resource, a memory resource, a hard disk storage resource and a password card. Each virtual gateway unit is distributed and combined to form one or more virtual identity authentication gateways, and one virtual network identity authentication gateway is composed of one or more virtual gateway units; and each virtual gateway unit is provided with an independent operating system (OS) and an identity authentication gateway service system. The virtual network identity authentication security gateway resources are independent and comprise password operation resources, and the situation that the resources are mutually preempted does not exist. And meanwhile, expansion is facilitated. And each virtual network identity authentication security gateway is safer due to the respective independent password cards.

Description

Technical Field

[0001] The present invention relates to the technical field of network identity authentication gateways, and in particular to a cloud network identity authentication secure access gateway. Background Art

[0002] The network identity authentication security access gateway is a front-end security device / gateway for accessing various network identity authentication services through application servers. It can also be considered as the "gatekeeper" of the network identity authentication platform. Its purpose is to prevent illegal use by applications and users who do not have access rights, while ensuring the normal use of legal applications and users.

[0003] The network identity authentication security access gateway is a physical device. The processing capabilities of different devices may vary. However, it is extremely inconvenient to use it on a public cloud or private cloud. Usually, many physical machines are configured according to the needs of different applications. Moreover, for a specific physical machine, the performance is fixed and its processing capabilities cannot be allocated on demand. Its disadvantages are:

[0004] (1) Multiple devices occupy more rack resources;

[0005] (2) The performance of a single device cannot be adjusted, and processing capacity cannot be allocated on demand;

[0006] (3) It does not support operations such as cloud migration and remote key management, making it inconvenient to use.

[0007] Currently in the cryptography field, there are also many cloud cryptographic machines that use virtual architectures, but the main disadvantages of these architectures are:

[0008] (1) It is usually used for the virtualization of financial cryptographic machines, server cryptographic machines, and signature verification servers, and does not support the core security functions of the network identity authentication secure access gateway, such as identity authentication.

[0009] (2) During the virtualization process, the cryptographic card, the core component of security, usually uses a high-speed cryptographic card to share cryptographic computing functions, or uses SRIOv technology for logical isolation, but cannot guarantee physical isolation. The disadvantage is that security performance is reduced. At the same time, the cryptographic computing resources of each virtual machine are in a shared mode, and cannot achieve accurate computing power allocation and computing power guarantee. Summary of the invention

[0010] In view of the deficiencies in the prior art, the present invention aims to provide a cloud network identity authentication secure access gateway.

[0011] In order to achieve the above object, the present invention adopts the following technical solution:

[0012] A cloud network identity authentication security access gateway includes a plurality of virtual gateway units, each of which is independent of each other and has the same virtual machine resources, wherein the virtual machine resources include CPU general computing resources, memory resources, hard disk storage resources and password cards, the CPU general computing resources of each virtual machine resource, the memory resources of each virtual machine resource and the hard disk storage resources of each virtual machine resource are independent of each other and have the same size, and the password cards of each virtual machine resource are independent of each other and have the same performance;

[0013] By allocating and combining the virtual gateway units, one or more virtual identity authentication gateways are formed. A virtual network identity authentication gateway is composed of one or more virtual gateway units; each virtual gateway unit is installed with an independent operating system OS and identity authentication gateway service system.

[0014] Furthermore, when the virtual network identity authentication gateway is composed of multiple virtual gateway units, the password card in each virtual gateway unit is synchronized with the key through the management program during initialization to ensure that the keys of each password card are consistent, and the entire key life cycle is managed uniformly through the management program.

[0015] Furthermore, the cloud network identity authentication security access gateway also includes a host machine, which has the same virtual machine resources as the virtual gateway unit and is used to configure and manage each virtual gateway unit. Its password card is used for identity authentication and root key management for administrator secure login.

[0016] The beneficial effects of the present invention are:

[0017] (1) The present invention adopts SRIOv virtualization technology to deploy the functions of network identity authentication secure access gateway on virtual machines, realizing dynamic allocation and elastic expansion of resources. Through virtualization technology, the functions of multiple physical devices can be integrated into one physical server, reducing the occupation of rack resources, and the processing capacity of virtual machines can be adjusted according to actual needs to realize on-demand allocation.

[0018] (2) The present invention supports the specific functions and core security functions of the network identity authentication security access gateway through a special virtualization architecture. During the virtualization process, a physical isolation method is used to allocate an independent password card to each virtual machine to ensure security performance. At the same time, through the management and classification of virtual gateway units, accurate computing power allocation and computing power guarantee can be achieved to meet the network identity authentication security access gateway's demand for cryptographic computing resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a schematic diagram of the structure of the cloud network identity authentication security access gateway in Example 1 of the present invention. DETAILED DESCRIPTION

[0020] The present invention will be further described below in conjunction with the accompanying drawings. It should be noted that this embodiment is based on the technical solution and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to this embodiment.

[0021] Example 1

[0022] This embodiment provides a cloud network identity authentication secure access gateway, such as Figure 1 As shown, n virtual gateway units are included, each of which is independent of each other and has the same virtual machine resources. The virtual machine resources include CPU general computing resources, memory resources, hard disk storage resources and password cards. The CPU general computing resources of each virtual machine resource, the memory resources of each virtual machine resource and the hard disk storage resources of each virtual machine resource are independent of each other and have the same size, and the password cards of each virtual machine resource are independent of each other and have the same performance.

[0023] Specifically, through resource partitioning, the CPU general computing resources are divided into n parts of the same size (such as cores or independent threads), and the memory resources and hard disk resources are also divided into n parts of the same size. Each CPU general computing resource, memory resource, hard disk resource and independent password card resource together constitute a virtual gateway unit.

[0024] By allocating and combining the virtual gateway units, one or more virtual identity authentication gateways are formed. A virtual network identity authentication gateway is composed of m virtual gateway units, m ≥ 1, and the total number of virtual network identity authentication gateways is M. The total number of virtual gateway units used to form all virtual network identity authentication gateways does not exceed the total number of virtual gateway units n, that is, m 1 +m 2 +…+m M ≤n, where m i is the number of virtual gateway units used by the i-th virtual identity authentication gateway, i=1,2,…,M.

[0025] In this embodiment, each virtual gateway unit is installed with an independent operating system OS and an identity authentication gateway service system. The functions of the identity authentication gateway service system comply with the relevant interfaces, services, instructions, workflows and security specifications of the network identity authentication gateway specified in the "Security Access Equipment of the National Network Identity Authentication Public Service Platform".

[0026] In the above structure, the virtual network identity authentication gateway can be composed of one virtual gateway unit or multiple virtual gateway units. The more virtual gateway units there are, the more powerful the performance of the virtual network identity authentication gateway composed of them is. Specifically, the performance of a virtual network identity authentication gateway composed of m (when m>1) virtual gateway units with the same virtual machine resources is m times that of a virtual network identity authentication gateway composed of 1 virtual gateway unit.

[0027] Furthermore, when the virtual network identity authentication gateway is composed of multiple virtual gateway units, the password card in each virtual gateway unit is synchronized with the key through the management program during initialization to ensure that the keys of each password card in the virtual identity authentication gateway are consistent, and the entire key life cycle is managed uniformly through the management program.

[0028] In this embodiment, the cloud network identity authentication security access gateway also includes a host machine, which has the same virtual machine resources as the virtual gateway unit, and is used to configure and manage each virtual gateway unit. Its password card is used for the identity authentication and root key management of the administrator's secure login. A cloud network identity authentication security gateway has a unique root key, and the master key of each virtual network identity authentication gateway is XORed with the root key and saved in its own security environment. That is, the master key of each virtual machine consists of two key components. When the root key is deleted, the master key of each virtual network identity authentication gateway cannot be restored.

[0029] Furthermore, the host machine also has EFP or ETT physical protection components. When the environment (external power supply, temperature, etc.) changes, or the chassis is opened, triggering the EFP / EFT response, the root key is eliminated immediately and the cloud network identity authentication security access gateway is shut down to prevent physical attacks.

[0030] The advantage of the structure of the cloud network identity authentication security access gateway is that each virtual network identity authentication security gateway has independent resources, including cryptographic computing resources, and there is no situation of mutual resource grabbing. At the same time, it is easy to expand. The independent password cards make each virtual network identity authentication security gateway more secure.

[0031] The above-mentioned cloud network identity authentication security access gateway also supports the adaptation operation of the cloud gateway and the cloud management platform, which can easily perform cloud migration operations and migrate virtual machines to different physical cloud network identity authentication security access gateways to achieve cloud security operation and maintenance requirements.

[0032] Example 2

[0033] This embodiment provides an application example of the cloud network identity authentication security access gateway described in Embodiment 1. The cloud network identity authentication security access gateway of this embodiment is a high-end server, whose CPU has 32 cores, and the server has 64GB memory and 2T hard disk. At the same time, through the SATA expansion card, 16 SATA interfaces are expanded, and 16 SATA interface password cards are installed respectively for password core calculation and key life cycle management. The server resources are allocated to a host machine and 15 identical virtual gateway units, and the hardware configuration of the host machine and the 15 virtual gateway units includes 2 CPU cores, 4GB memory, 128GB hard disk and 1 SATA interface password card.

[0034] The host is used for resource configuration and management of the cloud network identity authentication security gateway, and its password card is used for identity authentication and root key management for administrators' secure login. 15 virtual gateway units are allocatable resources used to form each virtual network identity authentication security gateway.

[0035] First, 10 virtual gateway units are configured to obtain 10 virtual network identity authentication security gateways, each of which is composed of one virtual gateway unit. The remaining 5 virtual gateway units are reserved as spare resources.

[0036] When the processing capabilities of three of the virtual network identity authentication security gateways are enhanced according to actual needs, the resources for the three virtual network identity authentication security gateways are reconfigured through the management system on the host machine, so that the three virtual network identity authentication security gateways are composed of two virtual gateway units, becoming doubled virtual network identity authentication security gateways, and the remaining two virtual gateway units are reserved as backup resources.

[0037] When one of the doubled virtual network identity authentication security gateways needs stronger processing power, the management system on the host machine reconfigures resources for the doubled virtual network identity authentication security gateway so that the doubled virtual network identity authentication security gateway consists of three virtual gateway units, becoming a triple virtual network identity authentication security gateway, and the remaining one virtual gateway unit continues to be retained as a backup resource.

[0038] For those skilled in the art, various corresponding changes and modifications can be made according to the above technical solutions and concepts, and all of these changes and modifications should be included in the protection scope of the claims of the present invention.

Claims

1. A cloud network identity authentication secure access gateway, It is characterized in that It includes multiple virtual gateway units, each of which is independent of each other and has the same virtual machine resources, the virtual machine resources include CPU general computing resources, memory resources, hard disk storage resources and password cards, the CPU general computing resources of each virtual machine resource, the memory resources of each virtual machine resource and the hard disk storage resources of each virtual machine resource are independent of each other and have the same size, and the password cards of each virtual machine resource are independent of each other and have the same performance; By allocating and combining the virtual gateway units, one or more virtual identity authentication gateways are formed. A virtual network identity authentication gateway is composed of one or more virtual gateway units; each virtual gateway unit is installed with an independent operating system OS and identity authentication gateway service system.

2. The cloud network identity authentication secure access gateway according to claim 1, It is characterized in that When the virtual network identity authentication gateway is composed of multiple virtual gateway units, the password card in each virtual gateway unit is synchronized with the management program during initialization to ensure that the keys of each password card are consistent, and the entire key life cycle is managed uniformly through the management program.

3. The cloud network identity authentication secure access gateway according to claim 1, It is characterized in that It also includes a host machine, which has the same virtual machine resources as the virtual gateway unit and is used to configure and manage each virtual gateway unit. Its password card is used for identity authentication and root key management of administrators' secure login.

Images