Mobile terminal multi-service access control method

Abstract

The invention discloses a multi-service access control method for a mobile terminal, and the method carries out the control and shunting of the access of a private network application and an Internet application through APP service recognition and dynamic port control, guarantees that the multi-service access of the mobile terminal meets the safety requirement that only one network can be connected at any time, and improves the safety of the multi-service access of the mobile terminal. Meanwhile, when residing in one space, an update message of another space application can be received in time, so that performance influence and internet service interruption caused by traditional gatekeeper isolation are avoided, and the isolation strength of a single-system terminal reaches or is higher than that of a dual-system terminal while multi-service access is supported.

Description

Technical Field

[0001] The present invention relates to the technical field of mobile terminal communication, and in particular to a method for controlling multi-service access of a mobile terminal. Background Art

[0002] The purpose of deploying virtualization technology on mobile terminals is to use one device for multiple purposes, such as balancing work and life. However, a single-system terminal that carries multiple services cannot be connected to the Internet in a dual-channel manner, otherwise it is equivalent to connecting two physically isolated networks with a mobile terminal. Figure 1 Taking the private network terminal as an example, the networking method of the single-system terminal is presented.

[0003] In this case, the security isolation strength between the private network and the Internet depends entirely on terminal virtualization technology. For mobile terminals with Linux kernel, both OS-level containers and application-level containers are isolated based on namespaces, and application-level virtualization technology does not virtualize the terminal's networking module, which reduces the isolation strength. Once an Internet attacker breaks through the container isolation, he will use the legitimate identity of the private network terminal to enter the private network, and all security protection boundaries will become invalid. If it is a BYOD terminal, the workspace is generally limited to a container or sandbox, and the same problem exists when the BYOD terminal is connected to the Internet.

[0004] In order to avoid this situation, it is generally strictly required that the mobile terminal can only connect to one network at any time, such as Figure 2 shown.

[0005] However, if the mobile terminal is connected to the Internet in a single-pass mode, when the private network link is connected, many Internet applications will not be able to cross the security isolation boundary (gateway) because of the inability to perform protocol conversion; when the Internet link is connected, many private network services based on long connections will also be unable to cross the security isolation boundary, resulting in the terminal being unable to support multi-service access and forming an information island.

[0006] Chinese patent application CN113422772A discloses a method, device and electronic device for processing access to a private network terminal, including obtaining target location information and service information of a private network terminal, determining a target access list corresponding to the target location information based on the correspondence between the pre-stored location information and the access list, judging whether the private network terminal matches the target access list based on the service information, and if the judgment result is a match, sending the service information to the service server so that the service server implements the corresponding service based on the service information, wherein the service server is a server corresponding to the access address in the target access list. The solution is to obtain the service route on the network side, and divert the traffic to the Internet or the private network based on the destination address of the service route. From the network level, the terminal can connect to the Internet and the private network at the same time with only one SIM card, and this bridge-type networking has a large security risk. Once the security isolation between the terminal private network and the Internet service is breached, it is very easy to cause private network information leakage.

[0007] The paper Cells: A Virtual Mobile Smartphone Architecture (authors: Jeremy Andrus, Christoffer Dal l, Alexander Van't Hof, Oren Laadan, and Jason Nieh, institution: Department of Computer Science, Columbia University, publication time: Technical Report CUCS-022-11 May 2011) mainly describes an OS-level virtualization solution for smartphone-type mobile terminals. This solution can run multiple virtual phones (VPs) simultaneously on a physical smartphone in a secure and isolated manner. Cells uses the usage model of a smartphone with a front-end virtual phone + multiple background virtual phones, and proposes the concept of device namespace, which enables multiple virtual phones to efficiently and securely reuse mobile phone hardware resources while providing native hardware performance for all applications. This solution can reuse all terminal hardware resources, such as frame buffers, GPUs, networks, inputs such as touch screen buttons, sensors, etc., and all VPs can support full telecommunications capabilities.

[0008] The Cels framework uses OS-level virtualization technology to implement dual-system smartphone terminals. There are two virtual smartphone OS environments on one physical terminal. The cross-domain interaction channels of the two isolated OSs are strictly controlled, and the network links can maintain dual active, ensuring that when any system is resident, the update message of the application in the other system can be received in time. However, the customization cost of dual-system smartphones implemented by the Cels solution is very high. Summary of the invention

[0009] In view of the deficiencies in the prior art, the present invention aims to provide a method for managing and controlling multi-service access of a mobile terminal.

[0010] In order to achieve the above object, the present invention adopts the following technical solution:

[0011] A method for controlling multi-service access of a mobile terminal comprises the following steps:

[0012] 1. Multi-service access control component monitors the running status information of APP:

[0013] A1. The multi-service access control component is started, and authentication is completed based on the digital certificate and the multi-service access control gateway;

[0014] A2. The multi-service access control component monitors the running status changes of the APP;

[0015] A3. If the APP whose running status has changed is an Internet APP, and the APP is a dynamic port application, the destination port is not limited, and the multi-service access control component generates the signature information of the APP based on the source address, destination address and source port; if the APP is a private network APP, or the APP is an Internet APP and a static port application, the destination port is limited, and the multi-service access control component generates the signature information of the APP based on the source address, destination address, source port and destination port of the APP; the source address is the address of the mobile terminal, the destination address is the address of the server, the source port is the port of the mobile terminal, and the destination port is the port of the server;

[0016] The signature information of the APP includes the APP UID, type, subtype, source address, destination address, source port, destination port and running status; the type is Internet APP or private network APP, the subtype is dynamic port application or static port application; the destination port is empty when the destination port is not limited; the running status is start or sleep;

[0017] A4. The multi-service access control component encrypts the signature information of the APP generated in step A3 with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway;

[0018] 2. Multiple services access the control gateway for routing selection:

[0019] B1. The multi-service access control gateway receives the ciphertext of the signature information of the APP sent by the multi-service access control component;

[0020] B2. The multi-service access control gateway uses the digital certificate public key or the derived shared key to decrypt the ciphertext and obtain the signature information of the APP;

[0021] B3. The multi-service access control gateway selects routes based on the type and subtype of the APP contained in the APP signature information:

[0022] If the running status of the APP is dormant, delete the policy routing corresponding to the APP;

[0023] If the running status of the APP is startup, and the APP is an Internet APP and a dynamic port application, the destination port is not limited, and the policy route is generated based on the source address, destination address and source port;

[0024] If the running status of the APP is started, and the APP is a private network APP and a dynamic port application, first limit the destination port, that is, generate a policy route based on the source address, destination address, source port and destination port of the APP, then monitor the dynamic port reporting interface, and receive the port status reported by the APP through the dynamic port reporting interface. If the port status reported by the APP from the dynamic port reporting interface is open, a new policy route is generated. If the port status reported by the APP from the dynamic port reporting interface is closed, the corresponding policy route is deleted;

[0025] If the running state of the APP is startup, and the APP is a static port application, the destination port is limited, that is, a policy route is generated based on the source address, destination address, source port, and destination port of the APP.

[0026] Furthermore, when the multi-service access control gateway creates a policy route, it is a bidirectional route.

[0027] Furthermore, the multi-service access control gateway maintains an APP policy routing table. When a new policy route for an APP is generated, the APP UID and policy route of the corresponding APP are entered into the APP policy routing table; when the policy route needs to be deleted, the APP policy routing table is queried according to the APP UID, and the corresponding policy route is deleted.

[0028] Furthermore, the format of the port status information reported by the APP through the dynamic port reporting interface is: APP UID, destination port and instruction, and the content of the instruction is open or closed.

[0029] The beneficial effects of the present invention are as follows: the present invention controls and diverts the access of private network applications and Internet applications through APP business identification and dynamic port management, ensuring that the multi-business access of mobile terminals meets the security requirement of only being able to connect to one network at any time, and at the same time, when residing in one space, it can promptly receive update messages of applications in another space, thereby avoiding the performance impact and Internet business interruption caused by traditional network firewall isolation, and while supporting multi-business access, the isolation strength of single-system terminals reaches or exceeds the isolation strength of dual-system terminals. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a dual-channel networking mode for existing single-system terminals;

[0031] Figure 2 A single-channel networking mode for existing single-system terminals;

[0032] Figure 3 This is a schematic diagram of the implementation architecture of the method in Example 1 of the present invention;

[0033] Figure 4 This is a schematic diagram of multi-service access control when a user resides in a workspace in Example 1 of the present invention;

[0034] Figure 5 This is a schematic diagram of multi-service access control when a user resides in a living space in Example 1 of the present invention (Internet service traffic is not routed on the private network side);

[0035] Figure 6 This is a schematic diagram of multi-service access control when a user resides in a living space in Example 1 of the present invention (Internet service traffic is routed on the private network side);

[0036] Figure 7 This is a business flow chart of the multi-service access control component monitoring the running status of APP in Example 1 of the present invention;

[0037] Figure 8 This is a flow chart of the routing service of the multi-service access control gateway in Embodiment 1 of the present invention;

[0038] Fig. 9 This is a flow chart of dynamic port control of a multi-service access control gateway in Example 1 of the present invention;

[0039] Fig.10 This is a schematic diagram of the implementation architecture of the method of Example 2 of the present invention;

[0040] Fig.11 This is a timing diagram for implementing the method of Example 2 of the present invention;

[0041] Fig.12 This is a schematic diagram of the implementation architecture of the method of Example 3 of the present invention;

[0042] Fig.13 This is a timing diagram for implementing the method of embodiment 3 of the present invention;

[0043] Fig.14 This is a schematic diagram of the implementation architecture of the method of Example 4 of the present invention;

[0044] Fig.15 This is a timing diagram for implementing the method of Example 4 of the present invention. DETAILED DESCRIPTION

[0045] The present invention will be further described below in conjunction with the accompanying drawings. It should be noted that this embodiment is based on the technical solution and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to this embodiment.

[0046] Example 1

[0047] This embodiment provides a method for controlling multi-service access of a mobile terminal. Figure 3 As shown, the method of this embodiment involves a multi-service access control component and a multi-service access control gateway. The multi-service access control component and the multi-service access control gateway complete the creation or removal of the encrypted channel. If the mobile terminal has multiple networking channels, it is ensured that when one networking channel is in a connected state, other networking channels are in a blocked state.

[0048] like Figure 4 As shown in the figure, when the user of the mobile terminal resides in the workspace, the multi-service access control component ensures that the mobile terminal has only one dedicated network connection channel. The multi-service access control component and the multi-service access control gateway complete the authentication based on the digital certificate. The multi-service access control component encrypts the signature information of the APP containing the running status information of the APP with the digital certificate private key or the derived shared key and sends it to the multi-service access control gateway.

[0049] After receiving the ciphertext of the signature information of the APP, the multi-service access control gateway uses the digital certificate public key or the derived shared key to decrypt and obtain the signature information of the APP. The multi-service access control gateway forms a policy route based on the signature information of the APP, and diverts the traffic of different APPs to different network interfaces. The multi-service access control gateway provides a dynamic port reporting interface. APPs using dynamic ports can report the status of dynamic ports to the multi-service access control gateway in a timely manner through the dynamic port reporting interface. The multi-service access control gateway can perform dynamic port control on the access of APPs to avoid the private network opening a large number of idle service ports to the terminal side.

[0050] like Figure 5 As shown in the figure, when the terminal user resides in the living space, the multi-service access control component ensures that the mobile terminal has only one Internet access channel. The multi-service access control component and the multi-service access control gateway complete the authentication based on the digital certificate and create an SSL VPN connection. According to the private network security requirements and the private network link carrying capacity, determine whether the business traffic of the Internet APP needs to be routed on the private network side. Figure 5 This is the service path when the business traffic of the Internet APP is not routed on the private network side. If the business traffic of the Internet APP is not routed on the private network side, the policy routing generated by the multi-service access control gateway will not work for the access to the Internet APP. In this case, the policy routing information can be used for user behavior auditing. If the business traffic of the Internet APP is also required to be routed on the private network side, the business path is as follows: Figure 6 As shown in the figure, the private network link has been blocked, so the service path cannot be connected to Figure 4 same.

[0051] The mobile terminal multi-service access control method of this embodiment includes the following steps:

[0052] 1. Multi-service access control components monitor the running status information of APP, such as Figure 7 As shown:

[0053] A1. The multi-service access control component is started, and authentication is completed based on the digital certificate and the multi-service access control gateway.

[0054] A2. The multi-service access control component monitors the running status changes of the APP.

[0055] A3. If the APP whose running status changes is an Internet APP, and the APP is a dynamic port application, the destination port is not limited, and the multi-service access control component generates the signature information of the APP based on the source address (the address of the mobile terminal), the destination address (the address of the server) and the source port (the port of the mobile terminal); if the APP is a private network APP, or the APP is an Internet APP and is a static port application, the destination port is limited, and the multi-service access control component generates the signature information of the APP based on the source address (the address of the mobile terminal), the destination address (the address of the server), the source port (the port of the mobile terminal) and the destination port (the port of the server).

[0056] The signature information of the APP includes the APP UID (unique identifier of the APP), type (Internet APP or private network APP), subtype (dynamic port application or static port application), source address, destination address, source port, destination port (empty when the destination port is not limited) and running status (started or dormant).

[0057] A4. The multi-service access control component encrypts the signature information of the APP generated in step A3 with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0058] 2. Multiple services access the control gateway for routing selection.

[0059] Some terminal SIM cards will sign up for two types of traffic at the same time, and have the ability to access two networks, one is the Internet, and the other is a private network, which is similar to a terminal that has both a dedicated WLAN and mobile Internet. The front-end multi-service access control component collects the type of the currently launched APP, and sends the signature information containing the state change to the back-end multi-service access control gateway. The multi-service access control gateway generates a policy route based on the signature information. When the APP is closed or switched to the background, the multi-service access control component sends the signature information containing the state change to the back-end multi-service access control gateway. The multi-service access control gateway deletes the corresponding policy route based on the signature information. Because the terminal only has one APP running in the foreground, only one policy route is in effect at any time. The specific process is as follows: Figure 8 As shown:

[0060] B1. The multi-service access control gateway receives the ciphertext of the signature information of the APP sent by the multi-service access control component.

[0061] B2. The multi-service access control gateway uses the digital certificate public key or the derived shared key to decrypt the ciphertext and obtain the signature information of the APP.

[0062] B3. The multi-service access control gateway selects routes based on the type and subtype of the APP contained in the APP signature information:

[0063] If the running status of the APP is dormant, delete the policy routing corresponding to the APP;

[0064] If the running status of the APP is startup, and the APP is an Internet APP and a dynamic port application, the destination port is not limited, and the policy route is generated based on the source address, destination address and source port;

[0065] If the running status of the APP is started, and the APP is a private network APP and a dynamic port application, first limit the destination port, that is, generate a policy route based on the source address, destination address, source port and destination port of the APP, and then monitor the dynamic port reporting interface, such as Fig. 9 As shown, the port status reported by the APP through the dynamic port reporting interface is received. If the port status reported by the APP from the dynamic port reporting interface is open, a new policy route is generated. If the port status reported by the APP from the dynamic port reporting interface is closed, the corresponding policy route is deleted.

[0066] If the running status of the APP is started, and the APP is a static port application (whether it is an Internet APP or a private network APP), the destination port is limited, that is, a policy route is generated based on the source address, destination address, source port and destination port of the APP.

[0067] Through the above process, for static port applications, whether Internet applications or private network applications, policies are formulated through source address, destination address, source port and destination port; if it is an Internet dynamic port application, policies are formulated through source address, destination address and source port. If it is a private network dynamic port application, policies (signaling) are first formulated through source and destination addresses and source and destination ports, and then policies (media streams) are added through the dynamic port reporting interface.

[0068] Voice call application is a typical dynamic application. The call connection (signaling) process is also a static port, and the policy can be turned on and off by the source destination address and the source and destination ports. After the call connection is established, the server port of the media stream is a dynamic port, that is, it is selected within a segment. The border firewall generally opens a section of ports (such as 1000, supporting 500 concurrent voice channels). The method of this embodiment is to obtain the dynamically allocated port of the server through dynamic port reporting, and generate refined policy routing (source destination address, source destination port) on the border gateway. For dynamic Internet applications, because the server cannot report the service port to the private network device, it can only formulate a routing policy that does not restrict the destination port (server port).

[0069] In this embodiment, when the multi-service access control gateway creates a policy route, it is a bidirectional route. In addition, the multi-service access control gateway maintains an APP policy route table. When a new APP policy route is generated, the APP UID and policy route of the corresponding APP are entered into the APP policy route table; when the policy route needs to be deleted, the APP policy route table is queried according to the APP UID, and the corresponding policy route is deleted.

[0070] Specifically, the message format for opening a port may be: APP UID, destination port (server port) and instruction (open), and the message format for closing a port may be: APP UID, destination port (server port) and instruction (close).

[0071] Example 2

[0072] This embodiment provides an application example of the method described in Embodiment 1.

[0073] like Fig.10 As shown, in this embodiment, the private network terminal only signs for private network traffic, and the terminal has only one network channel. A private network link can also be built through SSL VPN, requiring both Internet traffic and private network traffic to be routed to the private network side. Internet applications and private network applications on private network terminals are isolated through user-level virtualization technology, and all Internet applications are placed in a container, with the inside of the container as a living space and the outside of the container as a work space.

[0074] The multi-service access control component monitors the running status of the APPs in the workspace and living space on the private network terminal. If the running status of an APP changes (such as from sleep to start, from start to sleep), the multi-service access control component immediately reports the signature information of the APP to the multi-service access control gateway. The signature information contains the running status of the APP. When sending the signature information of the APP, it can be encrypted and protected by the digital certificate private key or the derived shared key. The multi-service access control gateway mainly completes routing selection and dynamic port control.

[0075] like Fig.11 As shown, the overall process of the method in this embodiment is as follows:

[0076] Step 1: The multi-service access control component is started and completes authentication with the multi-service access control gateway based on a digital certificate.

[0077] Step 2: Start the private network APP.

[0078] Step 3: The multi-service access control component monitors the startup of the private network APP and generates the signature information of the private network APP.

[0079] Step 4: The multi-service access control component encrypts the signature information of the private network APP with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0080] Step 5: The multi-service access control gateway receives the ciphertext of the signature information of the private network APP, decrypts it using the digital certificate public key or the derived shared key, and obtains the signature information of the private network APP.

[0081] Step 6: The private network APP is a dynamic port application. The multi-service access control gateway monitors the dynamic port control interface and generates or deletes policy routes based on the port status reported by the private network APP. The generated policy routes are recorded in the maintained APP policy routing table.

[0082] The dynamic APP policy routing table maintained by the multi-service access control gateway is shown in Table 1.

[0083] Table 1

[0084]

[0085] Step 7: The private network APP communicates normally with its server.

[0086] Step 8: Living Space Container Startup.

[0087] Step 9: Internet APP starts.

[0088] Step 10: The multi-service access control component detects that the Internet APP is started, generates signature information of the Internet APP, encrypts it with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0089] Step 11: The multi-service access control gateway receives the ciphertext of the signature information of the Internet APP, decrypts it using the digital certificate public key or the derived shared key, and obtains the signature information of the Internet APP.

[0090] Step 12: Complete routing based on the subtype of the Internet APP, and the generated policy entry is recorded in the APP policy routing table.

[0091] Step 13: The Internet APP communicates normally with its server.

[0092] Step 14: When the multi-service access control component detects that the Internet APP is dormant, it generates signature information of the Internet APP, encrypts it with a digital certificate private key or a derived shared key, and sends it to the multi-service access control gateway.

[0093] Step 15: The multi-service access control gateway receives the ciphertext of the signature information of the Internet APP, decrypts it using the digital certificate public key or the derived shared key, and obtains the signature information of the Internet APP.

[0094] Step 16: The multi-service access control gateway deletes the corresponding policy route in the APP policy routing table based on the APP UID of the Internet APP.

[0095] Example 3

[0096] In this embodiment, Fig.12 As shown in the figure, BYOD terminals only sign up for Internet traffic, and BYOD terminals have only one network channel. A private network link is established through an SSL VPN connection, and Internet APPs are not routed on the private network side. Internet applications and private network applications on BYOD terminals are isolated through user-level virtualization technology, and all private network applications are placed in a container, with the workspace inside the container and the living space outside the container. The multi-service access control component on the BYOD terminal monitors the status of APPs running on the BYOD terminal. After the SSL client and the multi-service access control gateway complete two-way authentication, an SSL VPN connection is created between the SSL client and the SSL service module of the multi-service access control gateway. At this time, the access traffic of the Internet APP does not pass through the multi-service access control gateway.

[0097] The multi-service access control component monitors the running status of the APP in the workspace on the BYOD terminal. If the running status of the APP changes (from sleep to start or from start to sleep), the multi-service access control component immediately reports the signature information of the APP to the multi-service access control gateway, and the signature information includes the running status of the APP. When sending the signature information of the APP, it can be encrypted and protected by the digital certificate private key or the derived shared key. The multi-service access control gateway mainly completes routing selection and dynamic port control. The Internet APP business traffic of this embodiment will not be routed to the private network side. At this time, the running status of the Internet APP is collected mainly for user behavior auditing. After the container of the workspace exits, the SSL VPN connection is dismantled, the private network APP is closed, and the message notification pushed by the server can no longer be received.

[0098] like Fig.13 As shown, the process of the method in this embodiment is:

[0099] Step 1: Start the Internet APP.

[0100] Step 2: The Internet APP communicates normally with its server.

[0101] Step 3: Start the workspace container.

[0102] Step 4: Start the multi-service access control component.

[0103] Step 5: The multi-service access control component and the multi-service access control gateway complete authentication based on the digital certificate.

[0104] Step 6: SSL client starts.

[0105] Step 7: The SSL client establishes an SSL VPN connection with the SSL service of the multi-service access control gateway.

[0106] Step 8: Start the private network APP.

[0107] Step 9: The multi-service access control component detects that the private network APP is started, generates signature information of the private network APP, encrypts it with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0108] Step 10: The multi-service access control gateway receives the ciphertext of the signature information of the private network APP, decrypts it using the public key of the digital certificate or the derived shared key, and obtains the signature information of the private network APP.

[0109] Step 11: The multi-service access control gateway completes the route selection based on the subtype of the private network APP, and records the generated policy route into the APP policy routing table.

[0110] Step 12: The private network APP communicates normally with its server.

[0111] Step 13: The multi-service access control component detects that the private network APP is dormant, generates signature information of the private network APP, encrypts it with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0112] Step 14: The multi-service access control gateway receives the ciphertext of the signature information of the private network APP, decrypts it using the digital certificate public key or the derived shared key, and obtains the signature information of the private network APP.

[0113] Step 15: The multi-service access control gateway deletes the corresponding policy route in the APP policy routing table based on the APP UID of the private network APP.

[0114] Example 4

[0115] like Fig.14 As shown, in this embodiment, the private network terminal simultaneously subscribes to Internet traffic and private network traffic, or the public mobile communication network SIM card subscribes to Internet traffic, and has the ability to connect to private network communication networks such as PWLAN. Internet applications and private network applications on the terminal are isolated through user-level virtualization technology, and all Internet applications are placed in a container, with the inside of the container as a living space and the outside of the container as a workspace. When the container is not opened, the multi-service access control component blocks the Internet link, and the private network link is in a connected state. After the container is opened, the private network link is blocked, the Internet link is activated, the SSL client is started, and an SSL VPN connection is established with the SSL service of the multi-service access control gateway.

[0116] The multi-service access control component monitors the running status of APPs in the workspace and living space on the private network terminal. If the running status of an APP is monitored to change (from sleep to start, from start to sleep), the multi-service access control component immediately reports the signature information of the APP to the multi-service access control gateway. The signature information contains the running status of the APP. When sending the signature information of the APP, it can be encrypted and protected by the digital certificate private key or the derived shared key. The multi-service access control gateway mainly completes routing selection and dynamic port control. When the container is opened, the terminal adopts the networking mode of BYOD terminal, and the Internet APP business traffic can be routed on the private network side. At this time, the collection of Internet APP running status is mainly for user behavior auditing.

[0117] like Fig.15 As shown, the process of the method in this embodiment is:

[0118] Step 1: The multi-service access control component is started and authenticated with the multi-service access control gateway.

[0119] Step 2: Block the Internet link and activate the private network link.

[0120] Step 3: Start the private network APP.

[0121] Step 4: The multi-service access control component detects that the private network APP is started, generates signature information of the private network APP, encrypts it with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0122] Step 5: The multi-service access control gateway receives the ciphertext and decrypts it using the digital certificate public key or the derived shared key to obtain the signature information of the private network APP.

[0123] Step 6: The multi-service access control gateway completes routing selection based on the subtype of the private network APP.

[0124] Step 7: If the private network APP is a dynamic port application, the multi-service access control gateway monitors the dynamic port reporting interface, generates or deletes policy routes based on the port status reported by the private network APP, and the generated policy routes are recorded in the APP policy routing table.

[0125] Step 8: The private network APP communicates normally with its server.

[0126] Step 9: Living Space Container Startup.

[0127] Step 10: Block the private network link and activate the Internet link.

[0128] Step 11: The SSL client is started and establishes an SSLVPN connection with the SSL service of the multi-service access control gateway.

[0129] Step 12: The multi-service access control component monitors the running private network APP, generates the signature information of the private network APP, encrypts it with the certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0130] Step 13: The multi-service access control gateway receives the ciphertext of the signature information of the private network APP, decrypts it with the certificate public key or the derived shared key, and obtains the signature information of the private network APP.

[0131] Step 14: The multi-service access control gateway completes routing selection based on the subtype of the private network APP.

[0132] Step 15: If the private network APP is a dynamic port application, the multi-service access control gateway monitors the dynamic port reporting interface, generates a policy route based on the port information reported by the private network APP, and records it in the APP policy routing table or deletes the corresponding policy route from the APP policy routing table.

[0133] Step 16: The private network APP communicates normally with its server.

[0134] Step 17: Internet APP starts.

[0135] Step 18: The Internet APP communicates normally with its server.

[0136] Step 19: The living space container is closed, the SSL client is closed, and the SSL VPN connection is removed.

[0137] Step 20: Block the Internet link and activate the private network link.

[0138] Step 21: The multi-service access control component monitors the running APP, generates the signature information of the APP, encrypts it with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0139] Step 22: The multi-service access control gateway receives the ciphertext of the signature information of the APP, decrypts it using the public key of the digital certificate or the derived shared key, and obtains the signature information of the APP.

[0140] Step 23: The multi-service access control gateway completes routing selection based on the APP type and subtype of the APP.

[0141] Step 24: If the APP is a private network APP and a dynamic port application, the multi-service access control gateway monitors the dynamic port reporting interface and generates or deletes the policy routing based on the reporting information.

[0142] Step 25: The APP communicates normally with its server.

[0143] Step 26: The multi-service access control component detects that the APP is dormant, generates signature information for the APP, encrypts it with a digital certificate private key or a derived shared key, and sends it to the multi-service access control gateway.

[0144] Step 27: The multi-service access control gateway receives the ciphertext of the signature information of the APP, decrypts it using the digital certificate public key or the derived shared key, and obtains the signature information of the APP.

[0145] Step 28: The multi-service access control gateway deletes the corresponding policy route based on the APP UID of the APP.

[0146] For those skilled in the art, various corresponding changes and modifications can be made according to the above technical solutions and concepts, and all of these changes and modifications should be included in the protection scope of the claims of the present invention.

Claims

1. A method for controlling multi-service access of a mobile terminal, characterized in that: The steps include:

1. Multi-service access control component monitors the running status information of APP: A1. The multi-service access control component is started, and authentication is completed based on the digital certificate and the multi-service access control gateway; A2. The multi-service access control component monitors the running status changes of the APP; A3. If the APP whose running status has changed is an Internet APP and the APP is a dynamic port application, the destination port is not limited, and the multi-service access control component generates the signature information of the APP based on the source address, destination address and source port; if the APP is a private network APP, or the APP is an Internet APP and is a static port application, the destination port is limited, and the multi-service access control component generates the signature information of the APP based on the source address, destination address, source port and destination port of the APP; The source address is the address of the mobile terminal, the destination address is the address of the server, the source port is the port of the mobile terminal, and the destination port is the port of the server; The signature information of the APP includes the APP UID, type, subtype, source address, destination address, source port, destination port and running status; the type is Internet APP or private network APP, and the subtype is dynamic port application or static port application; If the destination port is not limited, the destination port is empty; the running status is start or sleep; A4. The multi-service access control component encrypts the signature information of the APP generated in step A3 with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway; 2. Multiple services access the control gateway for routing selection: B1. The multi-service access control gateway receives the ciphertext of the signature information of the APP sent by the multi-service access control component; B2. The multi-service access control gateway decrypts the ciphertext with the digital certificate public key or the derived shared key to obtain the signature information of the APP; B3. The multi-service access control gateway selects routes based on the type and subtype of the APP contained in the APP signature information: If the running status of the APP is dormant, delete the policy routing corresponding to the APP; If the running status of the APP is started, and the APP is an Internet APP and a dynamic port application, the destination port is not limited, and a policy route is generated based on the source address, destination address, and source port; If the running status of the APP is started, and the APP is a private network APP and a dynamic port application, first limit the destination port, that is, generate a policy route based on the source address, destination address, source port and destination port of the APP, then monitor the dynamic port reporting interface, and receive the port status reported by the APP through the dynamic port reporting interface. If the port status reported by the APP from the dynamic port reporting interface is open, a new policy route is generated. If the port status reported by the APP from the dynamic port reporting interface is closed, the corresponding policy route is deleted; If the running state of the APP is startup, and the APP is a static port application, the destination port is limited, that is, a policy route is generated based on the source address, destination address, source port, and destination port of the APP.

2. The method according to claim 1, characterized in that When the multi-service access control gateway creates a policy route, it is a bidirectional route.

3. The method according to claim 1, characterized in that The multi-service access control gateway maintains an APP policy routing table. When a new APP policy route is generated, the APP UID and policy route of the corresponding APP are entered into the APP policy routing table; when the policy route needs to be deleted, the APP policy routing table is queried according to the APP UID and the corresponding policy route is deleted.

4. The method according to claim 1, characterized in that: The format of the port status information reported by the APP through the dynamic port reporting interface is: APP UID, destination port and command. The content of the command is open or closed.

Images