Service access control method, electronic equipment and storage medium

Abstract

The invention discloses a service access control method, electronic equipment and a storage medium, and the method comprises the steps that a user node sends a first access request message to a server node, the first access request message carries IP address information, the first access request message reaches the server node through at least one intermediate node, and the first access request message carries IP address information; the at least one intermediate node comprises an access node, and the first access request message indicates that the user node proposes an access request for the first time; the user node receives a first response message returned by the server node, wherein the first response message carries the access credential information and the identification information; and the user node sends the second access request message to the server node. In the embodiment of the invention, the malicious traffic can be identified by performing network multi-point cooperative verification on the user access request, and cooperative protection of the network to the service is realized.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to a service access control method, an electronic device, and a storage medium. Background Art

[0002] With the continuous integration of heterogeneous networks and the acceleration of enterprise business migration to the cloud, cross-trust domain access has become the norm. The traditional single-point protection method based on network boundaries has basically failed. Systematic cyberspace security requires collaboration between multiple trust domains. Access control can be performed not only at locations close to the service side, but also at all possible locations in the entire network. Near-source protection can be performed as much as possible to prevent the spread of malicious traffic as early as possible, improve the utilization rate of business resources, reduce the investment in core network equipment, and reduce the possibility of threats entering the business network.

[0003] The near-source protection methods provided by related technologies generally adopt passive protection methods such as "attack detection-analysis and tracing-traffic clearing", that is, the source of the attack can only be analyzed after the attack occurs, and then the nearby treatment is carried out. The protection effect is delayed, and additional proprietary equipment needs to be deployed, which increases the delay of business processing. In addition, near-source protection can only be carried out in a controllable intranet and cannot be implemented across domains. Summary of the invention

[0004] The embodiments of the present application provide a service access control method, an electronic device, and a storage medium, which can identify malicious traffic by performing network multi-point collaborative verification on user access requests, thereby realizing collaborative protection of services by the network.

[0005] In a first aspect, an embodiment of the present application provides a service access control method, the method comprising:

[0006] The user node sends a first access request message to the server node, wherein the first access request message carries IP address information, the first access request message reaches the server node via at least one intermediate node, the at least one intermediate node includes an access node, and the first access request message indicates that the user node makes an access request for the first time;

[0007] The user node receives a first response message returned by the server node, the first response message carrying access credential information and identification information, wherein the access credential information is determined at least according to a key of the server node and the IP address information, and the identification information includes identifications of other nodes other than the access node through which the first access request message passes;

[0008] The user node sends a second access request message to the server node, wherein the second access request message carries the access credential information, the identification information and the IP address information.

[0009] In a second aspect, an embodiment of the present application provides a service access control method, the method comprising:

[0010] The intermediate node receives the access request message sent by the user node;

[0011] When the access request message is a second access request message, the intermediate node obtains access credential information, an identifier of an unreached node, and IP address information from the second access request message, wherein the second access request message indicates that the user node is not requesting access for the first time;

[0012] The intermediate node determines the access verification information based on at least the key of the node, the identifier of the unreachable node and the IP address information;

[0013] The intermediate node compares the access verification information with the access credential information to obtain a verification result of the second access request message;

[0014] When the verification result is a verification passing result, the intermediate node forwards the second access request message to the next node.

[0015] In a third aspect, an embodiment of the present application provides a service access control method, the method comprising:

[0016] The server node receives the access request message sent by the user node;

[0017] When the access request message is a second access request message, the server node obtains access credential information and IP address information from the second access request message, wherein the second access request message indicates that the user node is not requesting access for the first time;

[0018] The server node determines the access verification information based on at least the key of the node and the IP address information;

[0019] The server node compares the access verification information with the access credential information to determine a verification result of the second access request message;

[0020] When the verification result is a verification pass result, the service end node returns the service to the user node.

[0021] In a fourth aspect, an embodiment of the present application provides an electronic device, including:

[0022] one or more processors;

[0023] A memory having one or more programs stored thereon, when the one or more programs are executed by the one or more processors, the one or more processors implement:

[0024] The service access control method as described in the first aspect; or,

[0025] The service access control method as described in the second aspect; or,

[0026] A service access control method as described in the third aspect.

[0027] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the following is implemented:

[0028] The service access control method as described in the first aspect; or,

[0029] The service access control method as described in the second aspect; or,

[0030] A service access control method as described in the third aspect.

[0031] The service access control method provided by the embodiment of the present application has at least the following beneficial effects: the user node sends a first access request message carrying IP address information to the server node, and the first access request message passes through at least one intermediate node to reach the server node, so that the intermediate node in the network can perform stateless filtering on the traffic of the user accessing the application, thereby realizing the active and near-source protection of the network for the application, so that trust collaboration can be performed based on the contract between the user node, the server node and the intermediate node. Afterwards, the user node receives the first response message carrying access credential information and identification information returned by the server node, wherein the first response message is obtained by the server node based on the comprehensive decision of the information of the collaborative domains whether to allow the user to access this time, and authorizes the user node, thereby realizing the decision and authorization of the user node's request message. Finally, the user node sends a second access request message carrying access credential information, identification information and IP address information to the server node, thereby being able to identify malicious traffic by performing network multi-point collaborative verification on the user's access request, realizing the process of collaborative forwarding verification of the user's access request message, so as to be able to collaboratively protect the service. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a structural diagram of a service access control system provided by an embodiment of the present application;

[0033] Figure 2 is a flow chart of a service access control method provided by an embodiment of the present application;

[0034] Figure 3 is a flow chart of a service access control method provided by another embodiment of the present application;

[0035] Figure 4 is a flow chart of a service access control method provided by another embodiment of the present application;

[0036] Figure 5 is a flow chart of a service access control method provided by another embodiment of the present application;

[0037] Figure 6 is a flow chart of a service access control method provided by another embodiment of the present application;

[0038] Figure 7 is a timing diagram of a service access control method provided by a specific example of the present application;

[0039] Figure 8 It is a structural diagram of a service access control system provided by a specific example of the present application;

[0040] Fig. 9 is a timing diagram of a service access control method provided by another specific example of the present application;

[0041] Fig.10 is a structural diagram of a service access control system provided by another specific example of the present application;

[0042] Fig.11 is a timing diagram of a service access control method provided by another specific example of the present application;

[0043] Fig.12 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0045] It should be noted that in the description of the embodiments of the present application, the terms "first", "second", etc. in the specification, claims and the above-mentioned drawings are used to distinguish similar objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features or implicitly indicating the order of the indicated technical features. "At least one" means one or more, and "more" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. Although the functional module division is performed in the device schematic diagram and the logical order is shown in the flow chart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flow chart.

[0046] In addition, the technical features involved in each embodiment of the present application described below can be combined with each other as long as they do not conflict with each other.

[0047] With the continuous integration of heterogeneous networks and the acceleration of enterprise business migration to the cloud, cross-trust domain access has become the norm. The traditional single-point protection method based on network boundaries has basically failed. Systematic cyberspace security requires collaboration between multiple trust domains. Access control can be performed not only at locations close to the service side, but also at all possible locations in the entire network. Near-source protection can be performed as much as possible to prevent the spread of malicious traffic as early as possible, improve the utilization rate of business resources, reduce the investment in core network equipment, and reduce the possibility of threats entering the business network.

[0048] Most of the existing near-source protection methods use passive protection methods such as "attack detection-analysis and tracing-traffic clearing", that is, the source of the attack can only be analyzed after the attack occurs, and then the nearby treatment is carried out. The protection effect is delayed, and additional proprietary equipment needs to be deployed, which increases the delay of business processing. In addition, near-source protection can only be carried out in a controllable intranet and cannot be implemented across domains.

[0049] In order to solve the above problems, an embodiment of the present application provides a service access control method, an electronic device and a storage medium, wherein a user node sends a first access request message carrying IP address information to a server node, and the first access request message passes through at least one intermediate node to reach the server node, so that the intermediate node in the network can perform stateless filtering on the traffic of the user accessing the application, thereby realizing the network's active and near-source protection of the application, so that it can perform trust collaboration based on the contract between the user node, the server node and the intermediate node. Afterwards, the user node receives a first response message carrying access credential information and identification information returned by the server node, wherein the first response message is a comprehensive decision made by the server node based on the information of the collaborative domains as to whether to allow the user to access this time, and authorizes the user node to realize the decision on the user node's request message. Finally, the user node sends a second access request message carrying access credential information, identification information and IP address information to the server node, thereby being able to identify malicious traffic by performing network multi-point collaborative verification on the user's access request, realizing the process of collaborative forwarding verification of the user's access request message, so as to be able to collaboratively protect the service.

[0050] The embodiments of the present application are further described below in conjunction with the accompanying drawings.

[0051] Reference Figure 1 , Figure 1 It is a schematic diagram of a system architecture for executing a service access control method provided by an embodiment of the present application.

[0052] exist Figure 1 In the embodiment of the present invention, the service access control system 100 includes but is not limited to a user node 200, a service node 300 and at least one intermediate node, wherein: Figure 1 Only an example with one intermediate node is given.

[0053] It should be noted that the service access control system 100 of this embodiment is a system for cross-domain collaborative refined service access control. Further, the user node 200 of this embodiment includes but is not limited to computers, mobile devices, IoT devices, etc.; the service end node 300 includes but is not limited to servers, routers, switches, etc., and this embodiment does not make specific restrictions.

[0054] It is worth noting that the user node 200 accesses the application in the service network through the access network and the relay node. The system architecture diagram is as follows: Figure 1As shown. Among them, the access network key manager 412 and the access gateway 411 belong to the access domain, the relay network key manager 422 and the router belong to the relay domain, and the service network key manager 320, the service authorization server 330 and the service gateway 310 belong to the service domain. The key managers and gateways of each domain are relatively independent in logical functions and can be separated or combined in physical form. For a clearer description, they are shown separately in the figure.

[0055] In some embodiments, the user node 200 is used to initiate an access request to a target application and receive an access response message sent by the target application.

[0056] The intermediate node includes an access node 410 and a relay node 420 , wherein the access node 410 includes an access gateway 411 and an access network key manager 412 , and the relay node 420 includes a relay gateway 421 and a relay network key manager 422 .

[0057] The access node 410 is used to receive the application access request sent by the user node 200, and the access gateway 411 can determine whether the access request message is the first packet based on the local cache table, the protocol field or the credential field in the message, and subsequently forward the message according to the judgment result.

[0058] The relay node 420 is used to receive the application access request sent by the user node 200, and the relay gateway determines whether the message is the first packet based on the local cache table, the protocol field in the message, or whether the voucher word is 0. The first packet is directly forwarded, and the non-first packet is verified, thereby realizing the verification and interception of the message;

[0059] The service end node 300 includes a service gateway 310, a service network key manager 320 and a service authorization server 330. The service end node 300 is used to receive an application access request sent by the user node 200, and the service gateway 310 can determine whether it is the first packet based on the local cache table, whether the protocol field or the voucher field in the message is 0.

[0060] It should be noted that before the user node 200 accesses the application, the service access control system 100 also needs to perform system-level collaborative key derivation, wherein the access key manager derives the relay domain key for the relay domain; further, based on the relay domain key and the service domain identifier, the relay key manager derives the service domain key for the service domain.

[0061] The service gateway 310 receives the service access request from the user node 200, determines that the user is accessing the service for the first time, and requests service access authorization from the service authorization server 330; the service gateway 310 can determine whether it is the first access based on a variety of methods such as the message protocol type, the local cache table, and whether the message credential field is 0.

[0062] The service authorization server 330 makes a unified decision on whether to allow the user to access the service based on multiple domain information such as the user's current trust, user access location information, current application load, network link congestion, and service access control list. The service access control list can be filtered based on source IP, destination IP, source port, destination port, protocol number, etc., and can also support filtering based on source address segment and destination address segment.

[0063] If access is allowed, the service authorization server 330 generates an application access credential based on the service domain key and the user source address, target service address, user identity ID, service identity ID, source port, destination port, protocol number, target URL, etc. The application access credential is transferred through the service gateway 310 and authorized to the user node 200, wherein the user identity ID, service identity ID, source port, destination port, protocol number, and target URL are optional information.

[0064] The user node 200 carries the authorized access credentials and service domain identifier, relay domain identifier and other information in the subsequent service access message. The access gateway 411, relay gateway and service gateway 310 respectively verify the access credentials in the message based on their own domain keys and session information such as source IP, destination IP and domain identifier in the message. If the verification fails, the message is blocked from passing, thereby realizing cross-domain collaborative refined service access control.

[0065] In some embodiments, the system architecture provided by this embodiment can perform stateless filtering on user access application traffic by multiple forwarding nodes in the network through collaborative key derivation, collaborative service authorization, and collaborative forwarding verification among access domains, relay domains, and service domains, thereby achieving active, near-source protection of applications by the network, avoiding the defects of single-point protection, and not introducing other equipment to increase business latency, reflecting the real-time, efficient, and systematic nature of the method.

[0066] Based on the structure of the above service access control system 100, various embodiments of the service access control method of the present application are proposed below.

[0067] Reference Figure 2 , Figure 2 It is a flowchart of a service access control method provided by an embodiment of the present application. The service access control method is applied to but not limited to the user node 200 of the system architecture, including but not limited to steps S101-S103.

[0068] Step S101: a user node sends a first access request message to a server node.

[0069] It should be noted that the first access request message carries IP address information, and the first access request message reaches the server node through at least one intermediate node, and the at least one intermediate node includes an access node. The first access request message indicates that the user node makes an access request for the first time.

[0070] In some embodiments, the user node sends a first access request message to the service node to request authorization for this access, and the first access request message sent by the user node carries IP address information, thereby facilitating the service node and the intermediate node to perform network positioning on the first access request message, thereby achieving traffic management and service quality control of the first request message, wherein the first access request message is the message in which the user node makes the first access request.

[0071] It should be noted that the IP address information in this embodiment includes user source address information and target service address information.

[0072] Step S102: The user node receives a first response message returned by the server node.

[0073] It should be noted that the first response message carries access credential information and identification information, the access credential information is determined at least based on the key and IP address information of the server node, and the identification information includes the identification of other nodes except the access node through which the first access request message passes.

[0074] In some embodiments, the user node receives the first response message returned by the service node, so that the user node can determine the authorized access credential information and identification information through the first response message, thereby achieving accurate analysis of the first access request message.

[0075] Step S103: The user node sends a second access request message to the server node.

[0076] It should be noted that the second access request message carries access credential information, identification information and IP address information.

[0077] In some embodiments, after the user node receives the first response message, the user node continues to send a second access request message carrying access credential information, identification information and IP address information to the server node, requesting continued access to the application, thereby implementing a process of collaborative forwarding and verification of the user's access request message.

[0078] It should be noted that the second access request message sent by the user node carries the authorized access credential information and the identification information of the relay domain passed through by this access, so as to facilitate further judgment by the intermediate node and the server node.

[0079] In some embodiments, during the process of the user node sending the first access request message to the service end node, it may happen that the first access request message reaches the service end node only through the access node, and in this case, the identification information includes the identification of the service end node;

[0080] Alternatively, the first access request message may pass through the access node and at least one relay node to reach the server node. In this case, the identification information includes the identification of each relay node passed through and the identification of the server node.

[0081] In some embodiments, the key of any relay node is sent to the relay node by the key manager of the previous node, and the key manager of the previous node determines the key of the relay node according to the identifier of the relay node and the key of the previous node.

[0082] It should be noted that before the user node sends the first access request message to the service end node, the access network key manager of the access node generates an access domain key and synchronizes it to the access gateway 411. The relay network key manager 422 of the relay node conducts trust negotiation with the signed access network key manager to confirm that key derivation can be performed, and the access network key manager 412 derives the relay domain key based on the access domain key and the relay domain identifier. Then, the relay network key manager 422 of the relay node derives the service domain key based on the service domain identifier and the relay domain key. The service network key manager 320 synchronizes the service domain key to the service gateway 310 and the application service authorization server 330. This can increase the security of communication. By deriving different keys at different stages of communication and between each node, the risk of keys being obtained by attackers can be reduced. Even if the key of a node is leaked, the keys of other nodes are still safe.

[0083] In some embodiments, the key of the service end node is sent to the service end node by a key manager of a previous node of the service end node, and the key manager of the previous node is generated according to the identifier of the service end node and the key of the previous node.

[0084] In some embodiments, when the message transmission does not pass through the relay node, the access network key manager of the access node performs trust collaboration with the service network key manager 320. The access network key manager derives the service domain key based on the randomly generated access network key and the service domain identifier. After the key derivation is completed, the service domain key manager synchronizes the service domain key to the service gateway 310 and the application service authorization server 330.

[0085] In some embodiments, the access credential information is also determined based on at least one of the following: user identity ID, service identification ID, source port information, destination port information, target service URL information or protocol number information, so as to accurately judge the access request message sent by the user node, filter the abnormal communication data flow, improve the accuracy of access request message identification, and accurately and quickly identify malicious traffic.

[0086] It should be noted that the user identity ID, service identification ID, source port information, destination port information, target service URL information or protocol number information are all optional information, and the access credential information may include one or more of the above information. For example, the access credential information includes the key of the server node, IP address information, user identity ID, and service identification ID; or the access credential information includes the key of the server node, IP address information, source port information, destination port information, etc., which are not listed one by one in this embodiment.

[0087] Reference Figure 3 , Figure 3 It is a flowchart of a service access control method provided by another embodiment of the present application. The service access control method is applied to but not limited to the intermediate node of the service access control system 100. The service access control method includes but is not limited to steps S201-S205.

[0088] Step S201: The intermediate node receives an access request message sent by a user node.

[0089] Step S202: When the access request message is a second access request message, the intermediate node obtains access credential information, an identifier of an unreached node, and IP address information from the second access request message.

[0090] It should be noted that the second access request message indicates that it is not the first access request by the user node.

[0091] Step S203: The intermediate node determines access verification information based on at least the key of the node, the identifier of the unreachable node, and the IP address information.

[0092] Step S204: the intermediate node compares the access verification information and the access credential information to obtain a verification result of the second access request message.

[0093] Step S205: When the verification result is a verification pass result, the intermediate node forwards the second access request message to the next node.

[0094] In some embodiments, after the intermediate node receives an access request message sent by the user node, it first determines whether the access request message is a message sent by the user node for the first time to make an access request or a message sent for a non-first time to make an access request. When the access request message is a second access request message, that is, a message sent by the user node for a non-first time to make an access request, the intermediate node needs to obtain the access credential information, the identifier of the unreached node, and the IP address information from the second access request message to perform message verification, and determine the access verification information corresponding to the second access request message. Afterwards, the intermediate node compares the access verification information with the access credential information to verify the second access request message, and obtains the verification result of the second access request message. Finally, when the verification result is a verification pass result, it means that the second access request message has been authorized and is a secure access request message. The intermediate node forwards the second access request message to the next node to realize forwarding of the second access request message.

[0095] It should be noted that when the verification result is a verification failure result, it means that the second access request message is not authorized, and there may be malicious traffic, dangerous information, etc., and the intermediate node will prevent the message from being further forwarded.

[0096] It is worth noting that the access verification information is also determined according to at least one of the following: user identity ID, service ID, source port information, destination port information, target service URL information or protocol number information. In the process of comparing the access verification information and the access credential information at the intermediate node, each information field of the access verification information and the access credential information is compared.

[0097] It can be understood that the result of a successful verification is that the access verification information is consistent with the access credential information, and the result of a failed verification is that the access verification information is inconsistent with the access credential information.

[0098] Reference Figure 4 , Figure 4 It is a flowchart of a service access control method provided by another embodiment of the present application, including but not limited to step S301.

[0099] Step S301: when the access request message is the first access request message, the intermediate node directly forwards the first access request message to the next node.

[0100] It should be noted that the first access request message indicates that the user node makes an access request for the first time.

[0101] In some embodiments, when the access request message is the first access request message, it means that the access request message is the first access request made by the user node, and the intermediate node can directly forward the first access request message to the next node without verification.

[0102] In some embodiments, the intermediate node can be an access node in the transmission path of the access request message, or it can be a relay node in the transmission path of the access request message. Both the access node and the relay node can compare the access verification information and the access credential information, thereby realizing active, near-source protection of the network for the application and avoiding the defects of single-point protection.

[0103] In some embodiments, the relay network key manager 422 conducts trust negotiation with the signed access network key manager to confirm that key derivation can be performed. The access network key manager then derives the relay domain key based on the relay domain identifier and the access domain key. The relay network key manager 422 synchronizes the relay domain key to the relay gateway. Therefore, the key of the relay node in this embodiment is sent to the relay node by the key manager of the previous node of the relay node, and the key manager of the previous node determines the key of the relay node based on the identifier of the relay node and the key of the previous node.

[0104] Reference Figure 5 , Figure 5 is a flowchart of a service access control method provided by another embodiment of the present application, and the service access control method is applied but not limited to Figure 1 On the server node of the system architecture, the service access control method includes but is not limited to steps S401-S405.

[0105] Step S401: The server node receives an access request message sent by the user node.

[0106] Step S402: When the access request message is a second access request message, the server node obtains access credential information and IP address information from the second access request message.

[0107] It should be noted that the second access request message indicates that it is not the first access request by the user node.

[0108] Step S403: The server node determines access verification information based at least on the key and IP address information of the node.

[0109] Step S404: The server node compares the access verification information and the access credential information to determine a verification result of the second access request message.

[0110] Step S405: When the verification result is a verification pass result, the server node returns the service to the user node.

[0111] In some embodiments, a service node receives an access request message sent by a user node, and determines whether the access request message is the first access request message sent by the user node. When it is determined that the access request message is a second access request message, the service node needs to obtain the access credential information and IP address information from the second access request message to verify the second access request message. After that, the service node determines the access verification information based on at least the key and IP address information of the node to verify the second access request message. Finally, when the verification result is a verification pass result, that is, the access verification information is consistent with the access credential information, it means that the second access request message has been authorized, and the service node returns the service to the user node, thereby improving the security of communication and realizing the network's collaborative protection of services.

[0112] It should be noted that when the verification result is a verification failure result, it means that the second access request message is not authorized, and there may be malicious traffic, dangerous information, etc. The server node will reject the second access request message sent by the user node and reject the access request.

[0113] It is worth noting that the access credential information is also determined based on at least one of the following: user identity ID, service ID, source port information, destination port information, target service URL information or protocol number information. In the process of comparing the access verification information and the access credential information at the server node, each information field of the access verification information and the access credential information is compared.

[0114] It can be understood that the result of a successful verification is that the access verification information is consistent with the access credential information, and the result of a failed verification is that the access verification information is inconsistent with the access credential information.

[0115] Reference Figure 6 , Figure 6 It is a flowchart of a service access control method provided by another embodiment of the present application, including but not limited to steps S501 to S504.

[0116] Step S501: when the access request message is a first access request message, the server node obtains IP address information from the first access request message.

[0117] Step S502: The server node determines whether to allow access authorization to the user node based on the status information.

[0118] It should be noted that the status information includes at least one of the following: current user trust, access status information, current application load level, current network link congestion level or service access control list.

[0119] Step S503: When it is determined that the access authorization to the user node is allowed, the server node determines the access credential information at least according to the key and IP address information of the node.

[0120] In some embodiments, in the process of determining the access credential information, the server node first decides whether to allow this access, that is, determines whether to allow access authorization to the user node based on the status information, wherein the status information is related information obtained by the server node from each trust domain. When it is determined that access authorization to the user node is allowed, the service node determines the access credential information based on at least the key and IP address information of this node, thereby enabling the server node to make a unified decision on whether to allow the user to access the service.

[0121] Step S504: the server node returns a first response message to the user node.

[0122] It should be noted that the first response message carries access credential information and identification information, the access credential information is determined at least based on the key of the server node and the IP address information, and the identification information includes the identification of other nodes except the access node through which the first access request message passes.

[0123] In some embodiments, when the access request message is the first access request message, the server node obtains the IP address information from the first access request message, and makes a unified decision on whether to allow the user access based on multiple domain information such as the user's current trust, access status information, current application load, current network link congestion, service access control list, etc. Afterwards, the server node determines the access credential information based on at least the node's key and IP address information to determine whether the first access request message can be accessed. Finally, the server node returns a first response message to the user node, wherein the first response message carries the access credential information and identification information for the user node to save.

[0124] It should be noted that the user's current trust is obtained by trust scoring the user's historical access behavior, and the access status information includes but is not limited to access location, access device, etc. The current load request of the application is used to characterize the resource usage based on memory, CPU, etc.

[0125] In some embodiments, the service network key manager 320 conducts trust negotiation with the contracted relay network key manager 422 to confirm that key derivation can be performed. The relay network key manager 422 then derives the service domain key based on the service domain identifier and the relay domain key. The service network key manager 320 synchronizes the service domain key to the service gateway 310 and the application service authorization server 330. Therefore, the key of the service end node is sent to the service end node by the key manager of the previous node of the service end node, and the key manager of the previous node is generated according to the identifier of the service end node and the key of the previous node.

[0126] In some embodiments, the access credential information is further determined based on at least one of the following: user identity ID, service ID, source port information, destination port information, target service URL information, or protocol number information.

[0127] In some embodiments, the access verification information is further determined based on at least one of the following: user identity ID, service ID, source port information, destination port information, target service URL information, or protocol number information.

[0128] In order to more clearly illustrate the process of the service access control method, a specific example is given below.

[0129] Example 1:

[0130] Example 1 Figure 1 The service access control method is described by taking the structure of the service access control system 100 in FIG.

[0131] In this example, after the system is started, the access network key manager, the relay network key manager 422, and the service network key manager 320 respectively conduct trust negotiation and determine that trust collaboration can be performed based on the mutual contract. The access network key manager derives the relay domain key MSK2 = KDF (MSK1, BR_ID) based on the randomly generated access network key MSK1 and the relay domain identifier BR_ID;

[0132] On this basis, the relay network key manager 422 derives the service domain identifier MSK3=KDF(MSK2, SR_ID) based on the relay domain key MSK2 and the service domain identifier SR_ID. After the key is derived, each domain key manager synchronizes the corresponding domain key to the intra-domain gateway for subsequent forwarding verification. The service domain key manager also synchronizes the service domain key MSK3 to the application service authorization server 330.

[0133] After receiving the authorization request for user access to the application, the service node 300 coordinates the information of each domain to comprehensively decide whether to allow the user to access this time. If allowed, the application access credential is generated and authorized to the user node 200. The service authorization server 330 makes a unified decision on whether to allow the user to access the application based on the user's current trust (trust scoring based on the user's historical access behavior), access status information (such as access location, access device, etc.), current application load (based on resource usage such as memory and CPU), current network link congestion, service access control list and other multi-domain information; among which, the service access control list supports filtering based on source IP, destination IP, source port (optional), destination port (optional), protocol number (optional), URL (optional), user ID (optional), application ID (optional), etc.; at the same time, in order to facilitate access control by subnet, filtering based on source address segment (IP+mask) and destination address segment (IP+mask) is also supported. For example, when the source IP is 10.1.1.1 and the destination IP is 20.1.1.1, it is determined that user node 200 is allowed to access; when the source IP is 10.2.1.0 / 24 and the destination IP is 20.2.1.0 / 24, it is determined that user node 200 is allowed to access; when the source IP is 10.3.0.0 / 16 and the destination IP is 20.3.1.0 / 24, user node 200 is prohibited from accessing, and so on. This embodiment does not make any specific restrictions on the setting of the source IP and the target IP.

[0134] It should be noted that if the user node 200 is allowed to access, the service node 300 generates the application access credential Credential = KDF (MSK3, IPs, IPd) based on the service domain key and the user source address, target service address, user identity ID (optional), service ID (optional), source port (optional), destination port (optional), protocol number (optional), target URL (optional) and other information. The application access credential is transferred through the service gateway 310 and authorized to the user node 200.

[0135] Reference Figure 7 , Figure 7 It is a timing diagram of a service access control method provided by an example of the present application, including but not limited to steps 1001-1018.

[0136] Among them, steps 1001-1003 are the system-level collaborative key derivation process before the user node accesses the application; steps 1004-1011 are the service authorization process when the user accesses the application for the first time.

[0137] Step 1001: When the system starts, the access network key manager generates an access domain key MSK1 and synchronizes it to the access gateway.

[0138] Step 1002: The relay network key manager conducts trust negotiation with the signed access network key manager to confirm that key derivation can be performed. The access network key manager then derives the relay domain key MSK2 based on the relay domain identifier and the access domain key MSK1. The relay network key manager synchronizes the relay domain key MSK2 to the relay gateway.

[0139] Step 1003: The service network key manager conducts trust negotiation with the contracted relay network key manager to confirm that key derivation can be performed. The relay network key manager then derives the service domain key MSK3 based on the service domain identifier and the relay domain key MSK2. The service network key manager synchronizes the service domain key MSK3 to the service gateway and the application service authorization server.

[0140] Step 1004: The user node starts to access the application for the first time, and the access gateway and the relay gateway determine that it is the first packet and forward the message. The determination method can be based on the local cache table, or based on the protocol field in the message, or based on whether the credential field Credential is 0 to determine whether it is the first packet.

[0141] Step 1005: According to the same method as above, after receiving the application access request, the service gateway determines that it is the first time for the user to access the application.

[0142] Step 1006: forward the message to the service authorization server to request authorization for this access.

[0143] Step 1007: After receiving the access authorization request, the service authorization server first decides whether to allow this access. Based on the relevant information obtained from each trust domain, such as the user's current trust, access status information, current application load, current network link congestion, service access control list and other multi-domain information, the service authorization server makes a unified decision on whether to allow the user to access the service.

[0144] Step 1008: If access is allowed, the service authorization server further generates an application access credential for this access. The service authorization server 330 generates the application access credential based on the service domain key and the user source address, target service address, user ID (optional), service ID (optional), source port (optional), destination port (optional), protocol number (optional), target URL (optional), and other information.

[0145] Step 1009: The service authorization server returns a service request response message to the user, carrying the authorized application access credentials and information such as the relay domain identifier BR_ID and the service domain identifier SR_ID of the access.

[0146] Step 1010: The service gateway sends the application access credential carrying the authorization and information such as the relay domain identifier BR_ID and the service domain identifier SR_ID of the access to the user node.

[0147] Step 1011: The user node saves the authorized access credentials and related information.

[0148] It should be noted that steps 1012-1018 are a collaborative forwarding verification process for the user's subsequent access to the application.

[0149] Step 1012: The user node continues to access the application, and the message carries the authorized application access credentials and information such as the relay domain identifier BR_ID and the service domain identifier SR_ID passed through during this access.

[0150] Step 1013: After receiving the data message, the access gateway generates a temporary authentication credential Credential based on the BR_ID, SR_ID, source IPs, destination IPd, etc. in the message and the access domain key MSK1 stored locally. Compare the temporary authentication credential Credential with the credential field Credential in the message to see if they are equal. If they are equal, the authentication is successful.

[0151] Step 1014: After the access gateway passes the verification, it continues to forward the application access request message. Otherwise, it rejects the access request.

[0152] Step 1015: After receiving the service request, the relay gateway performs verification in a similar manner: based on the SR_ID, source IPs, destination IPd, etc. in the message and the locally stored service domain key MSK2, a temporary verification credential Credential is generated. The temporary verification credential Credential is compared with the credential field Credential in the message to see if they are equal. If they are equal, verification is successful.

[0153] Step 1016: After the relay gateway passes the verification, it continues to forward the application access request message. Otherwise, it rejects the access request.

[0154] Step 1017, after receiving the service request, the service gateway performs access credential verification: based on the locally stored service domain key MSK3 and the source IPs, destination IPd, etc. in the message, a temporary verification credential Credential = KDF (MSK3, IPs, IPd) is generated, and the temporary verification credential Credential is compared with the credential field Credential in the message to see if they are equal. If they are equal, the verification is passed.

[0155] Step 1018: After the service gateway passes the verification, it forwards the application access request message to the corresponding application. Otherwise, it rejects the access request.

[0156] Example 2:

[0157] In some scenarios, the user node 200 may access the application without going through the relay node 420, and directly access the application in the service network through the access network.

[0158] Reference Figure 8 , Figure 8 This is a schematic diagram of a system architecture for executing a service access control method provided by an example of the present application.

[0159] In some embodiments, the service access control system 100 includes but is not limited to a user node 200, a service node 300 and an access node 410, wherein the access node 410 includes an access network key manager and an access gateway 411, the service node 300 includes a service network key manager 320, a service gateway 310 and a service authorization server 330, and the access node 410 is communicated with the user node 200 and the service node 300 respectively.

[0160] In this scenario, the processing flow of collaborative access control is basically similar to that of Example 1, except for some differences in key derivation and forwarding verification processing. The following is a detailed explanation.

[0161] Reference Fig. 9 , Fig. 9 is a timing diagram of a service access control method provided by another example of the present application, which is applied to Figure 8 The service access control system 100 includes but is not limited to steps 2001-2014.

[0162] Step 2001: After the system is started, the access network key manager and the service network key manager perform trust collaboration.

[0163] Step 2002: The access network key manager derives a service domain key MSK2 = KDF (MSK1, SR_ID) based on the randomly generated access network key MSK1 and the service domain identifier SR_ID.

[0164] Step 2003: The user node starts accessing the application for the first time.

[0165] Step 2004: After receiving the application access request, the service gateway determines that it is the first time for the user to access the application.

[0166] Step 2005: forward the message to the service authorization server to request authorization for this access.

[0167] Step 2006: After receiving the access authorization request, the service authorization server first decides whether to allow this access. Based on the relevant information obtained from each trust domain, such as the user's current trust, access status information, current application load, current network link congestion, service access control list and other multi-domain information, the service authorization server 330 makes a unified decision on whether to allow the user to access the service.

[0168] Step 2007: If access is allowed, the service authorization server further generates an application access credential for this access. The service authorization server generates the application access credential based on the service domain key and the user source address, target service address, user ID (optional), service ID (optional), source port (optional), destination port (optional), protocol number (optional), target URL (optional), and other information.

[0169] Step 2008: The service authorization server returns a service request response message to the user, carrying information such as the authorized application access credential and the service domain identifier SR_ID.

[0170] Step 2009: The user node saves the authorized access credentials and related information.

[0171] Step 2010: The user node applies an access request and carries the authorized application access credentials and related identifiers.

[0172] Step 211: After receiving the application access request message, the access gateway generates a temporary authentication credential Credential based on the SR_ID, source IPs, destination IPd, etc. in the message and the access domain key MSK1 stored locally. Compare the temporary authentication credential Credential with the credential field Credential in the message to see if they are equal. If they are equal, the authentication is successful.

[0173] Step 2012: After the access gateway passes the verification, it continues to forward the application access request message. Otherwise, it rejects the access request.

[0174] Step 213: After receiving the service request, the service gateway performs access credential verification: based on the locally stored service domain key MSK2 and the source IPs, destination IPd, etc. in the message, a temporary verification credential Credential = KDF (MSK2, IPs, IPd) is generated, and the temporary verification credential Credential is compared with the credential field Credential in the message to see if they are equal. If they are equal, the verification is successful.

[0175] Step 2014: After the service gateway passes the verification, it forwards the application access request message to the corresponding application. Otherwise, it rejects the access request.

[0176] It should be noted that after the system in Example 2 is started, the access network key manager and the service network key manager perform trust collaboration. The access network key manager derives the service domain key MSK2 = KDF (MSK1, SR_ID) based on the randomly generated access network key MSK1 and the service domain identifier SR_ID. After the key derivation is completed, the service domain key manager synchronizes the service domain key MSK2 to the service gateway and the application service authorization server.

[0177] In some embodiments, after the access gateway 411 in step 2011 receives the application access request message, the specific forwarding verification process is: first, based on the SR_ID in the message and the access domain key MSK1 saved this time, calculate MSK2=KDF(MSK1, SR_ID), and then generate a temporary verification credential Credential=KDF(MSK2, IPs, IPd) based on MSK2 and source IPs, destination IPd, etc. Finally, compare whether the temporary verification credential Credential is equal to the credential field Credential in the message. If they are equal, the verification is successful. If the verification fails, the message is prevented from being forwarded further. The verification process of the service gateway 310 is the same as that in Example 1.

[0178] Example 3:

[0179] In some scenarios, the user node 200 may access the application through multiple relay nodes 420 and then access the network to access the application in the service network.

[0180] Reference Fig.10 , Fig.10 It is a schematic diagram of a system architecture for executing a service access control method provided by another example of the present application.

[0181] In some embodiments, the service access control system 100 includes but is not limited to a user node 200, a service node 300, an access node 410, and a plurality of relay nodes 420 ( Fig.11 Take two relay nodes 420 as an example, named relay node 1 and relay node 2 respectively), wherein the access node 410 includes an access network key manager and an access gateway 411, the service node 300 includes a service network key manager 320, a service gateway 310 and a service authorization server 330, each relay node 420 includes a relay network key manager 422 and a relay gateway, the access node 410 is respectively communicated with the user node 200 and the relay node 420, and the relay node 420 is communicated with the service node 300.

[0182] In this scenario, the processing flow of collaborative access control is basically similar to that of Example 1, except for some differences in key derivation and forwarding verification processing. The following is a detailed explanation.

[0183] Reference Fig.11 , Fig.11 is a timing diagram of a service access control method provided by another example of the present application, which is applied to Fig.10 The service access control system 100 includes but is not limited to steps 3001-3021.

[0184] Step 3001, after the system is started, the access network key manager, relay network 1 key manager, relay network 2 key manager, and service network key manager respectively conduct trust negotiation and determine that trust collaboration can be performed based on the mutual contracts.

[0185] Step 3002: The access network key manager derives a relay domain key MSK2 = KDF (MSK1, BR_ID1) based on the randomly generated access network key MSK1 and the relay domain identifier BR_ID1.

[0186] Step 3003: The key manager of relay network 1 derives relay domain 2 key MSK3 = KDF (MSK2, BR_ID2) based on relay domain 1 key MSK2 and relay domain 2 identifier BR_ID2.

[0187] Step 3004: The key manager of relay network 2 derives the service domain key MSK4=KDF(MSK4, SR_ID) based on the relay domain 2 key MSK3 and the service domain identifier SR_ID.

[0188] Step 3005: The user node starts to access the application for the first time. The access gateway and the relay gateway determine that the packet is the first packet and forward the packet. The determination method can be based on the local cache table, or based on the protocol field in the packet, or based on whether the credential field Credential is 0 to determine whether it is the first packet.

[0189] Step 3006: According to the same method as above, after receiving the application access request, the service gateway determines that it is the first time for the user to access the application.

[0190] Step 3007: forward the message to the service authorization server to request authorization for this access.

[0191] Step 3008: After receiving the access authorization request, the service authorization server first decides whether to allow this access. Based on the relevant information obtained from each trust domain, such as the user's current trust, access status information, current application load, current network link congestion, service access control list and other multi-domain information, the service authorization server makes a unified decision on whether to allow the user to access the service.

[0192] Step 3009: If access is allowed, the service authorization server further generates an application access credential for this access. The service authorization server 330 generates the application access credential based on the service domain key and the user source address, target service address, user ID (optional), service ID (optional), source port (optional), destination port (optional), protocol number (optional), target URL (optional), and other information.

[0193] Step 3010: The service authorization server returns a service request response message to the user, carrying the authorized application access credentials and information such as the relay domain identifier BR_ID and the service domain identifier SR_ID of the access.

[0194] Step 3011: The service gateway sends the application access credential carrying the authorization and information such as the relay domain identifier BR_ID and the service domain identifier SR_ID of the access to the user node.

[0195] Step 3012: The user node saves the authorized access credentials and related information.

[0196] Step 3013: the user node continues to access the application, and the message carries the authorized application access credentials and information such as the relay domain identifier BR_ID and the service domain identifier SR_ID passed through during this access.

[0197] Step 3014: After receiving the data message, the access gateway generates a temporary authentication credential Credential based on the BR_ID, SR_ID, source IPs, destination IPd, etc. in the message and the access domain key MSK1 stored locally. Compare the temporary authentication credential Credential with the credential field Credential in the message to see if they are equal. If they are equal, the authentication is successful.

[0198] Step 3015: After the access gateway passes the verification, it continues to forward the application access request message. Otherwise, it rejects the access request.

[0199] Step 3016: Relay gateway node 1 receives the application access request and performs forwarding verification.

[0200] Step 3017: If the verification is successful, an application access request is sent to the relay gateway node 2.

[0201] Step 3018: Relay gateway node 2 receives the application access request and performs forwarding verification.

[0202] Step 3019: If the verification is successful, continue to forward the application access request message. Otherwise, deny the access request.

[0203] Step 3020, after receiving the service request, the service gateway performs access credential verification: based on the locally stored service domain key MSK4 and the source IPs, destination IPd, etc. in the message, a temporary verification credential Credential = KDF (MSK4, IPs, IPd) is generated, and the temporary verification credential Credential is compared with the credential field Credential in the message to see if they are equal. If they are equal, the verification is passed.

[0204] Step 3021: After the service gateway passes the verification, it forwards the application access request message to the corresponding application. Otherwise, it rejects the access request.

[0205] It should be noted that after the system in Example 3 is started, the access network key manager, relay network 1 key manager, relay network 2 key manager, and service network key manager 320 respectively conduct trust negotiation and determine that trust collaboration can be carried out based on the mutual contract. The access network key manager derives the relay domain key MSK2=KDF(MSK1, BR_ID1) based on the randomly generated access network key MSK1 and the relay domain identifier BR_ID1; on this basis, the relay network 1 key manager derives the relay domain 2 key MSK3=KDF(MSK2, BR_ID2) based on the relay domain 1 key MSK2 and the relay domain 2 identifier BR_ID2. The relay network 2 key manager derives the service domain key MSK4=KDF(MSK4, SR_ID) based on the relay domain 2 key MSK3 and the service domain identifier SR_ID. After the key is derived, each domain key manager synchronizes the corresponding domain key to the intra-domain gateway for subsequent forwarding verification. The service domain key manager also synchronizes the service domain key MSK4 to the application service authorization server 330 .

[0206] In some embodiments, the specific forwarding verification process from step 3016 to step 3018 is as follows:

[0207] The access gateway 411 performs forwarding verification on the received application access request: first, based on the relay domain 1 identifier BR_ID1 in the message and the access domain key MSK1 saved this time, calculate MSK2=KDF(MSK1, BR_ID1), then calculate MSK3=KDF(MSK1, BR_ID2) based on MSK2 and the relay domain 2 identifier BR_ID2 in the message, then calculate MSK4=KDF(MSK3, SR_ID) based on MSK3 and SR_ID, and finally generate a temporary verification credential Credential=KDF(MSK4, IPs, IPd) based on MSK4 and the source IPs and destination IPd. Finally, compare whether the temporary verification credential Credential is equal to the credential field Credential in the message. If they are equal, the verification is successful. If the verification fails, the message is prevented from being forwarded further.

[0208] Relay gateway 1 receives the application access request and performs forwarding verification: first, based on the locally stored MSK2 and the relay domain 2 identifier BR_ID2 in the message, MSK3=KDF(MSK2, BR_ID2) is calculated, then based on MSK3 and SR_ID, MSK4=KDF(MSK3, SR_ID) is calculated, and finally based on MSK4 and the source IPs and destination IPd, a temporary verification credential Credential=KDF(MSK4, IPs, IPd) is generated. Finally, the temporary verification credential Credential is compared with the credential field Credential in the message to see if they are equal. If they are equal, the verification is successful. If the verification fails, the message is prevented from being forwarded further.

[0209] Relay Gateway 2 receives the application access request and performs forwarding verification: first, based on the locally saved MSK3 and SR_ID, calculate MSK4 = KDF (MSK3, SR_ID), and then generate a temporary verification credential Credential = KDF (MSK4, IPs, IPd) based on MSK4 and the source IPs and destination IPd. Finally, compare whether the temporary verification credential Credential is equal to the credential field Credential in the message. If they are equal, the verification is successful. If the verification fails, the message is prevented from being forwarded further.

[0210] In addition, if Fig.12 As shown, an embodiment of the present application also provides an electronic device.

[0211] Specifically, the electronic device includes: one or more processors and a memory, Fig.12 A processor and a memory are taken as an example. The processor and the memory can be connected via a bus or other means. Fig.12 The example of connecting through bus is taken in the following.

[0212] A memory having one or more programs stored thereon, when the one or more programs are executed by the one or more processors, the one or more processors implement:

[0213] The memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer executable programs, such as the network data processing method in the above-mentioned embodiment of the present application. The processor implements the service access control method in the above-mentioned embodiment of the present application by running the non-transitory software programs and programs stored in the memory.

[0214] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data required for executing the network data processing method in the above-mentioned embodiment of the present application, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the network data processing device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0215] The non-transitory software program and instructions required to implement the service access control method of the above embodiment are stored in the memory, and when executed by the processor, the service access control method of the above embodiment is executed.

[0216] The processor and the memory may be connected via a bus or other means.

[0217] In addition, the embodiment of the present application further provides a computer-readable storage medium, which stores a computer-executable program, and the computer-executable program is executed by one or more control processors, for example, Fig.12 Execution by one of the processors may enable the one or more processors to execute the service access control method in the above-mentioned embodiment of the present application.

[0218] In addition, an embodiment of the present application also provides a computer program product, including a computer program or computer instructions, the computer program or computer instructions are stored in a computer-readable storage medium, a centralized management unit of a computer device reads the computer program or computer instructions from the computer-readable storage medium, and the centralized management unit executes the computer program or computer instructions, so that the computer device executes a network data processing method as in any of the previous embodiments.

[0219] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0220] It will be appreciated by those skilled in the art that all or some of the steps and systems in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. Some physical components or all physical components may be implemented as software executed by a centralized management unit, such as a central centralized management unit, a digital signal centralized management unit, or a micro-centralized management unit, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that may be used to store desired information and may be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

Claims

1. A service access control method, the method comprising: The user node sends a first access request message to the server node, wherein the first access request message carries IP address information, the first access request message reaches the server node via at least one intermediate node, the at least one intermediate node includes an access node, and the first access request message indicates that the user node makes an access request for the first time; The user node receives a first response message returned by the server node, the first response message carrying access credential information and identification information, wherein the access credential information is determined at least according to a key of the server node and the IP address information, and the identification information includes identifications of other nodes other than the access node through which the first access request message passes; The user node sends a second access request message to the server node, wherein the second access request message carries the access credential information, the identification information and the IP address information.

2. The method according to claim 1, characterized in that The first access request message reaches the server node only through the access node, and the identification information includes an identification of the server node; Alternatively, the first access request message reaches the server node via the access node and at least one relay node, and the identification information includes identifications of each of the relay nodes and the identification of the server node.

3. The method according to claim 2, characterized in that The key of any one of the relay nodes is sent to the relay node by the key manager of the previous node, and the key manager of the previous node determines the key of the relay node according to the identifier of the relay node and the key of the previous node.

4. The method according to claim 1, characterized in that The key of the service end node is sent to the service end node by a key manager of a node previous to the service end node, and the key manager of the previous node generates the key according to the identifier of the service end node and the key of the previous node.

5. The method according to claim 1, characterized in that The access credential information is also determined based on at least one of the following: user identity ID, service ID, source port information, destination port information, target service URL information or protocol number information.

6. A service access control method, the method comprising: The intermediate node receives the access request message sent by the user node; When the access request message is a second access request message, the intermediate node obtains access credential information, an identifier of an unreached node, and IP address information from the second access request message, wherein the second access request message indicates that the user node is not requesting access for the first time; The intermediate node determines the access verification information based on at least the key of the node, the identifier of the unreachable node and the IP address information; The intermediate node compares the access verification information with the access credential information to obtain a verification result of the second access request message; When the verification result is a verification passing result, the intermediate node forwards the second access request message to the next node.

7. The method according to claim 6, characterized in that The method further comprises: When the access request message is a first access request message, the intermediate node directly forwards the first access request message to the next node, wherein the first access request message indicates that the user node makes an access request for the first time.

8. The method according to claim 6, characterized in that The access verification information is also determined based on at least one of the following: user identity ID, service ID, source port information, destination port information, target service URL information or protocol number information.

9. The method according to claim 6, characterized in that The intermediate node is an access node or a relay node in the transmission path of the access request message.

10. The method according to claim 9, characterized in that The key of the relay node is sent to the relay node by a key manager of a previous node of the relay node, and the key manager of the previous node determines the key of the relay node according to the identifier of the relay node and the key of the previous node.

11. A service access control method, the method comprising: The server node receives the access request message sent by the user node; When the access request message is a second access request message, the server node obtains access credential information and IP address information from the second access request message, wherein the second access request message indicates that the user node is not requesting access for the first time; The server node determines the access verification information based on at least the key of the node and the IP address information; The server node compares the access verification information with the access credential information to determine a verification result of the second access request message; When the verification result is a verification pass result, the service end node returns the service to the user node.

12. The method according to claim 11, characterized in that The method further comprises: When the access request message is a first access request message, the server node obtains IP address information from the first access request message; The server node determines the access credential information based at least on the key of the node and the IP address information; The server node returns a first response message to the user node, the first response message carrying access credential information and identification information, the access credential information is determined at least based on the key of the server node and the IP address information, and the identification information includes the identification of other nodes other than the access node through which the first access request message passes.

13. The method according to claim 12, characterized in that The server node determines the access credential information at least according to the key of the node and the IP address information, including: The service end node determines whether to allow access authorization to the user node according to the status information, wherein the status information includes at least one of the following: the user's current trust, access status information, the current load level of the application, the current link congestion level of the network, or a service access control list; In the case of determining that the access authorization to the user node is allowed, the service end node determines the access credential information at least according to the key of the node and the IP address information.

14. The method according to claim 11 or 12, characterized in that: The key of the service end node is sent to the service end node by a key manager of a node previous to the service end node, and the key manager of the previous node generates the key according to the identifier of the service end node and the key of the previous node.

15. The method according to claim 12, characterized in that The access credential information is also determined based on at least one of the following: user identity ID, service ID, source port information, destination port information, target service URL information or protocol number information.

16. The method according to claim 11, characterized in that The access verification information is also determined based on at least one of the following: user identity ID, service ID, source port information, destination port information, target service URL information or protocol number information.

17. An electronic device comprising: one or more processors; A memory having one or more programs stored thereon, when the one or more programs are executed by the one or more processors, the one or more processors implement: The service access control method according to any one of claims 1 to 5; or The service access control method according to any one of claims 6 to 10; or, A service access control method as described in any one of claims 11 to 16.

18. A computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the program implements: The service access control method according to any one of claims 1 to 5; or The service access control method according to any one of claims 6 to 10; or, A service access control method as described in any one of claims 11 to 16.

Images