A mobile terminal multi-service access control method

Abstract

The present invention discloses a method for controlling multi-service access of mobile terminals. Through APP service identification and dynamic port control, the access of private network applications and Internet applications is controlled and diverted, ensuring that the multi-service access of mobile terminals meets the security requirement of only being able to connect to one network at any time. At the same time, when residing in one space, update messages of applications in another space can be received in a timely manner, thereby avoiding the performance impact and Internet service interruption caused by traditional network firewall isolation. While supporting multi-service access, the isolation strength of single-system terminals reaches or exceeds the isolation strength of dual-system terminals.

Description

Technical Field

[0001] The present invention relates to the technical field of mobile terminal communications, and in particular to a method for managing and controlling multi-service access of a mobile terminal. Background Art

[0002] The goal of deploying virtualization technology on mobile terminals is to enable multiple uses, such as balancing work and personal life. However, a single-system terminal carrying multiple services cannot use dual-connection networking. Doing so would be like connecting two physically isolated networks using a mobile terminal. Figure 1 Taking a private network terminal as an example, the networking method of a single-system terminal is presented.

[0003] In this case, the strength of the security isolation between the private network and the internet depends entirely on terminal virtualization technology. For Linux kernel-based mobile terminals, both OS-level and application-level containers implement namespace-based isolation. Application-level virtualization technology does not virtualize the terminal's networking module, weakening the isolation strength. Once an internet attacker breaches the container isolation, they can exploit the legitimate identity of the private network terminal to enter the private network, rendering all security boundaries ineffective. For BYOD terminals, the workspace is typically confined to a container or sandbox, and the same problem exists when BYOD terminals connect to the internet.

[0004] In order to avoid this situation, it is generally strictly required that the mobile terminal can only connect to one network at any time, such as Figure 2 shown.

[0005] However, if the mobile terminal is connected to the Internet in a single-pass mode, when the private network link is connected, many Internet applications will not be able to cross the security isolation boundary (gateway) because they cannot perform protocol conversion; when the Internet link is connected, many private network services based on long connections will also not be able to cross the security isolation boundary, resulting in the terminal being unable to support multi-service access, forming an information island.

[0006] Chinese patent application CN113422772A discloses a method, device, and electronic device for processing access to a private network terminal, including obtaining target location information and service information of the private network terminal, determining a target access list corresponding to the target location information based on the correspondence between the pre-stored location information and the access list, judging whether the private network terminal matches the target access list based on the service information, and if the judgment result is a match, sending the service information to the service server so that the service server implements the corresponding service based on the service information, wherein the service server is the server corresponding to the access address in the target access list. This solution is to obtain the service route on the network side and divert the traffic to the Internet or the private network based on the destination address of the service route. From the network level, the terminal can connect to the Internet and the private network at the same time with only one SIM card, but this bridge-type networking has a large security risk. Once the security isolation between the terminal private network and the Internet service is breached, it is very easy to cause the leakage of private network information.

[0007] The paper "Cells: A Virtual Mobile Smartphone Architecture" (authors: Jeremy Andrus, Christoffer Dal l, Alexander Van't Hof, Oren Laadan, and Jason Nieh, Department of Computer Science, Columbia University, published as Technical Report CUCS-022-11 May 2011) describes an OS-level virtualization solution for smartphone-type mobile terminals. This solution allows multiple virtual phones (VPs) to run simultaneously in a securely isolated manner on a single physical smartphone. Leveraging the smartphone model of a single front-end VP and multiple background VPs, Cells introduces the concept of device namespaces. This allows multiple VPs to efficiently and securely reuse phone hardware resources, while providing native hardware performance for all applications. This solution reuses all terminal hardware resources, such as the frame buffer, GPU, network, touchscreen inputs, and sensors, enabling all VPs to support full telecom capabilities.

[0008] The Cels framework uses OS-level virtualization technology to implement dual-OS smartphone terminals. Two virtual smartphone OS environments reside on a single physical terminal. Cross-domain interaction channels between the two isolated OSes are strictly controlled, and network links maintain active-active connectivity, ensuring that while either OS is active, updates from applications in the other OS are received promptly. However, the customization costs of dual-OS smartphones implemented with the Cels solution are high. Summary of the Invention

[0009] In view of the shortcomings of the existing technology, the present invention aims to provide a method for managing and controlling multi-service access of a mobile terminal.

[0010] In order to achieve the above object, the present invention adopts the following technical solutions:

[0011] A method for controlling multi-service access of a mobile terminal comprises the following steps:

[0012] 1. Multi-service access control component monitors the running status information of the APP:

[0013] A1. The multi-service access control component is started and authentication is completed with the multi-service access control gateway based on the digital certificate.

[0014] A2. The multi-service access control component monitors changes in the app's operating status;

[0015] A3. If the app whose running status changes is an Internet app and the app is a dynamic port application, the destination port is not limited, and the multi-service access control component generates the signature information of the app based on the source address, destination address, and source port. If the app is a private network app, or the app is an Internet app and a static port application, the destination port is limited, and the multi-service access control component generates the signature information of the app based on the source address, destination address, source port, and destination port of the app. The source address is the address of the mobile terminal, the destination address is the address of the server, the source port is the port of the mobile terminal, and the destination port is the port of the server.

[0016] The APP signature information includes the APP UID, type, subtype, source address, destination address, source port, destination port, and running status; the type is Internet APP or Private Network APP, and the subtype is Dynamic Port Application or Static Port Application; if the destination port is not specified, the destination port is left blank; the running status is Started or Sleeping;

[0017] A4. The multi-service access control component encrypts the APP signature information generated in step A3 using the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway;

[0018] 2. Multiple services access the control gateway for routing:

[0019] B1. The multi-service access control gateway receives the ciphertext of the APP signature information sent by the multi-service access control component;

[0020] B2. The multi-service access control gateway decrypts the ciphertext using the digital certificate public key or the derived shared key to obtain the APP's signature information;

[0021] B3. The multi-service access control gateway selects routes based on the APP type and subtype contained in the APP signature information:

[0022] If the running status of the APP is dormant, delete the policy routing corresponding to the APP;

[0023] If the running status of the APP is Started, and the APP is an Internet APP and a dynamic port application, the destination port is not limited, and the policy route is generated based on the source address, destination address and source port;

[0024] If the running status of the APP is started, and the APP is a private network APP and a dynamic port application, first limit the destination port, that is, generate a policy route based on the source address, destination address, source port and destination port of the APP, then monitor the dynamic port reporting interface, and receive the port status reported by the APP through the dynamic port reporting interface. If the port status reported by the APP from the dynamic port reporting interface is open, a new policy route is generated. If the port status reported by the APP from the dynamic port reporting interface is closed, the corresponding policy route is deleted;

[0025] If the running state of the APP is started and the APP is a static port application, the destination port is limited, that is, a policy route is generated based on the source address, destination address, source port, and destination port of the APP.

[0026] Furthermore, when the multi-service access control gateway creates a policy route, it is a bidirectional route.

[0027] Furthermore, the multi-service access control gateway maintains an APP policy routing table. When a new APP policy route is generated, the APP UID and policy route of the corresponding APP are entered into the APP policy routing table; when the policy route needs to be deleted, the APP policy routing table is queried according to the APP UID and the corresponding policy route is deleted.

[0028] Furthermore, the format of the port status information reported by the APP through the dynamic port reporting interface is: APP UID, destination port and instruction, and the content of the instruction is open or close.

[0029] The beneficial effects of the present invention are: the present invention controls and diverts the access of private network applications and Internet applications through APP business identification and dynamic port management, ensuring that the multi-service access of mobile terminals meets the security requirement of only being able to connect to one network at any time. At the same time, when residing in one space, it can promptly receive update messages of applications in another space, thereby avoiding the performance impact and Internet business interruption caused by traditional network firewall isolation. While supporting multi-service access, the isolation strength of single-system terminals reaches or exceeds the isolation strength of dual-system terminals. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a dual-channel networking mode for existing single-system terminals;

[0031] Figure 2 It is a single-pass networking mode for existing single-system terminals;

[0032] Figure 3 Schematic diagram of the implementation architecture of the method in Example 1 of the present invention;

[0033] Figure 4 This is a schematic diagram of multi-service access control when a user resides in a workspace in Example 1 of the present invention;

[0034] Figure 5 This is a schematic diagram of multi-service access control when a user resides in a living space in Example 1 of the present invention (Internet service traffic is not routed on the private network side);

[0035] Figure 6 This is a schematic diagram of multi-service access control when a user resides in a living space in Example 1 of the present invention (Internet service traffic is routed on the private network side);

[0036] Figure 7 This is a business flow chart of the multi-service access control component monitoring the APP running status in Example 1 of the present invention;

[0037] Figure 8 This is a flowchart of the multi-service access control gateway routing service in Example 1 of the present invention;

[0038] Figure 9 This is a flow chart of dynamic port control of a multi-service access control gateway in Example 1 of the present invention;

[0039] Figure 10 This is a schematic diagram of the implementation architecture of the method of Example 2 of the present invention;

[0040] Figure 11 This is a timing diagram for implementing the method of Example 2 of the present invention;

[0041] Figure 12 This is a schematic diagram of the implementation architecture of the method of Example 3 of the present invention;

[0042] Figure 13 This is a timing diagram for implementing the method of Example 3 of the present invention;

[0043] Figure 14 This is a schematic diagram of the implementation architecture of the method of Example 4 of the present invention;

[0044] Figure 15 This is a timing diagram for implementing the method of Example 4 of the present invention. DETAILED DESCRIPTION

[0045] The present invention will be further described below in conjunction with the accompanying drawings. It should be noted that this embodiment is based on the technical solution and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to this embodiment.

[0046] Example 1

[0047] This embodiment provides a method for controlling multi-service access of a mobile terminal. Figure 3 As shown, the method of this embodiment involves a multi-service access control component and a multi-service access control gateway. The multi-service access control component and the multi-service access control gateway complete the creation or removal of the encrypted channel. If the mobile terminal has multiple network channels, it ensures that when one network channel is connected, the other network channels are blocked.

[0048] like Figure 4 As shown in the figure, when a mobile terminal user is in a workspace, the multi-service access control component ensures that the mobile terminal has only one dedicated network connection. The multi-service access control component and the multi-service access control gateway perform authentication based on digital certificates. The multi-service access control component encrypts the app's signature information, which contains the app's operating status information, using the digital certificate's private key or a derived shared key, and then sends it to the multi-service access control gateway.

[0049] After receiving the ciphertext of the APP's signature information, the multi-service access control gateway decrypts it with the digital certificate public key or the derived shared key to obtain the APP's signature information. The multi-service access control gateway forms a policy route based on the APP's signature information, diverting the traffic of different APPs to different network interfaces. The multi-service access control gateway provides a dynamic port reporting interface. APPs using dynamic ports can promptly report the status of the dynamic ports to the multi-service access control gateway through the dynamic port reporting interface. The multi-service access control gateway can perform dynamic port control on APP access to avoid opening a large number of idle service ports on the terminal side of the private network.

[0050] like Figure 5 As shown in the figure, when the terminal user resides in the living space, the multi-service access control component ensures that the mobile terminal has only one Internet access channel. The multi-service access control component and the multi-service access control gateway complete the authentication based on the digital certificate and establish an SSL VPN connection. Based on the private network security requirements and the private network link carrying capacity, it is determined whether the business traffic of the Internet APP should be routed on the private network side. Figure 5 This is the service path when the business traffic of Internet APP is not routed on the private network side. If the business traffic of Internet APP is not routed on the private network side, the policy routing generated by the multi-service access control gateway will not work for the access of Internet APP. In this case, the policy routing information can be used for user behavior audit. If the business traffic of Internet APP is required to be routed on the private network side, the business path is as follows: Figure 6 As shown, the private network link has been blocked, so the service path cannot be connected to Figure 4 same.

[0051] The mobile terminal multi-service access control method of this embodiment includes the following steps:

[0052] 1. Multi-service access control component monitors the running status information of APP, such as Figure 7 As shown:

[0053] A1. The multi-service access control component is started and authentication is completed based on the digital certificate and the multi-service access control gateway.

[0054] A2. The multi-service access control component monitors changes in the running status of the APP.

[0055] A3. If the APP whose running status changes is an Internet APP and the APP is a dynamic port application, the destination port is not limited. The multi-service access control component generates the signature information of the APP based on the source address (mobile terminal address), destination address (server address) and source port (mobile terminal port); if the APP is a private network APP, or the APP is an Internet APP and a static port application, the destination port is limited. The multi-service access control component generates the signature information of the APP based on the source address (mobile terminal address), destination address (server address), source port (mobile terminal port) and destination port (server port).

[0056] The signature information of the APP includes the APP UID (unique identifier of the APP), type (Internet APP or private network APP), subtype (dynamic port application or static port application), source address, destination address, source port, destination port (blank if the destination port is not limited) and running status (starting or sleeping).

[0057] A4. The multi-service access control component encrypts the signature information of the APP generated in step A3 with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0058] 2. Multiple services access the control gateway for routing selection.

[0059] Some terminal SIM cards will sign up for two types of traffic at the same time, and have the ability to access two networks, one is the Internet, and the other is a private network, which is similar to a terminal that has both a dedicated WLAN and mobile Internet. The front-end multi-service access control component collects the type of the currently started APP, and sends the signature information containing the status change to the back-end multi-service access control gateway. The multi-service access control gateway generates a policy route based on the signature information. When the APP is closed or switched to the background, the multi-service access control component sends the signature information containing the status change to the back-end multi-service access control gateway. The multi-service access control gateway deletes the corresponding policy route based on the signature information. Because there is only one APP running in the foreground on the terminal, only one policy route is in effect at any time. The specific process is as follows. Figure 8 As shown:

[0060] B1. The multi-service access control gateway receives the ciphertext of the APP signature information sent by the multi-service access control component.

[0061] B2. The multi-service access control gateway uses the digital certificate public key or the derived shared key to decrypt the ciphertext and obtain the signature information of the APP.

[0062] B3. The multi-service access control gateway selects routes based on the APP type and subtype contained in the APP signature information:

[0063] If the running status of the APP is dormant, delete the policy routing corresponding to the APP;

[0064] If the running status of the APP is Started, and the APP is an Internet APP and a dynamic port application, the destination port is not limited, and the policy route is generated based on the source address, destination address and source port;

[0065] If the running status of the APP is started, and the APP is a private network APP and a dynamic port application, first limit the destination port, that is, generate a policy route based on the source address, destination address, source port and destination port of the APP, and then monitor the dynamic port reporting interface, such as Figure 9 As shown, the port status reported by the APP through the dynamic port reporting interface is received. If the port status reported by the APP from the dynamic port reporting interface is open, a new policy route is generated. If the port status reported by the APP from the dynamic port reporting interface is closed, the corresponding policy route is deleted.

[0066] If the running status of the APP is started and the APP is a static port application (whether it is an Internet APP or a private network APP), the destination port is limited, that is, a policy route is generated based on the source address, destination address, source port and destination port of the APP.

[0067] Through the above process, for static port applications, whether Internet applications or private network applications, policies are formulated based on the source address, destination address, source port, and destination port. For Internet dynamic port applications, policies are formulated based on the source address, destination address, and source port. For private network dynamic port applications, policies (signaling) are first formulated based on the source and destination addresses and source and destination ports, and then policies (media streams) are added through the dynamic port reporting interface.

[0068] Voice call application is a typical dynamic application. The call connection (signaling) process is also a static port, and the policy can be opened and closed by the source destination address and the source and destination ports. After the call connection is established, the server port of the media stream is a dynamic port, that is, it is selected within a segment. The border firewall will generally open a section of ports (such as 1000, supporting 500 concurrent voice channels). The method of this embodiment is to obtain the port dynamically allocated by the server through dynamic port reporting, and generate refined policy routing (source destination address, source destination port) on the border gateway. For dynamic applications on the Internet, since it is impossible for the server to report the service port to the private network device, it can only formulate a routing policy that does not restrict the destination port (server port).

[0069] In this embodiment, the multi-service access control gateway creates bidirectional policy routes. Furthermore, the gateway maintains an APP policy routing table. When a new policy route is generated for an APP, the corresponding APP's APP UID and policy route are entered into the APP policy routing table. When a policy route needs to be deleted, the APP policy routing table is queried based on the APP UID and the corresponding policy route is deleted.

[0070] Specifically, the message format for opening a port can be: APP UID, destination port (server port) and instruction (open), and the message format for closing a port can be: APP UID, destination port (server port) and instruction (close).

[0071] Example 2

[0072] This embodiment provides an application example of the method described in Embodiment 1.

[0073] like Figure 10 As shown, in this embodiment, the private network terminal only subscribes to private network traffic and has only one network connection. Alternatively, a private network link can be established through SSL VPN, requiring both internet and private network traffic to be routed to the private network. Internet applications and private network applications on the private network terminal are isolated using user-level virtualization technology, placing all internet applications into a single container, with the inside of the container serving as the living space and the outside of the container serving as the workspace.

[0074] The multi-service access control component monitors the running status of apps in the workspace and living space on private network terminals. If the running status of an app changes (such as from dormant to active, or from active to dormant), the multi-service access control component immediately reports the app's signature information to the multi-service access control gateway. The signature information includes the app's running status. When sending the app's signature information, it can be encrypted and protected using a digital certificate private key or a derived shared key. The multi-service access control gateway mainly performs routing selection and dynamic port control.

[0075] like Figure 11 As shown, the overall process of the method of this embodiment is as follows:

[0076] Step 1: The multi-service access control component is started and completes authentication with the multi-service access control gateway based on a digital certificate.

[0077] Step 2: Start the private network APP.

[0078] Step 3: The multi-service access control component monitors the startup of the private network APP and generates the signature information of the private network APP.

[0079] Step 4: The multi-service access control component encrypts the signature information of the private network APP with the digital certificate private key or the derived shared key and sends it to the multi-service access control gateway.

[0080] Step 5: The multi-service access control gateway receives the ciphertext of the signature information of the private network APP, decrypts it using the digital certificate public key or the derived shared key, and obtains the signature information of the private network APP.

[0081] Step 6: The private network app is a dynamic port application. The multi-service access control gateway monitors the dynamic port control interface and generates or deletes policy routes based on the port status reported by the private network app. The generated policy routes are recorded in the maintained app policy routing table.

[0082] The dynamic APP policy routing table maintained by the multi-service access control gateway is shown in Table 1.

[0083] Table 1

[0084]

[0085] Step 7: The private network app communicates normally with its server.

[0086] Step 8: The living space container starts.

[0087] Step 9: Internet APP starts.

[0088] Step 10: The multi-service access control component detects that the Internet APP is started, generates signature information of the Internet APP, encrypts it with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0089] Step 11: The multi-service access control gateway receives the ciphertext of the signature information of the Internet APP, decrypts it using the digital certificate public key or the derived shared key, and obtains the signature information of the Internet APP.

[0090] Step 12: Complete routing based on the subtype of the Internet APP, and the generated policy entry is recorded in the APP policy routing table.

[0091] Step 13: The Internet APP communicates normally with its server.

[0092] Step 14: When the multi-service access control component detects that the Internet APP is dormant, it generates signature information of the Internet APP, encrypts it with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0093] Step 15: The multi-service access control gateway receives the ciphertext of the signature information of the Internet APP, decrypts it using the digital certificate public key or the derived shared key, and obtains the signature information of the Internet APP.

[0094] Step 16: The multi-service access control gateway deletes the corresponding policy route in the APP policy routing table based on the APP UID of the Internet APP.

[0095] Example 3

[0096] In this embodiment, Figure 12 As shown in the figure, BYOD terminals only sign up for internet traffic and have only one network connection. A private network link is established via an SSL VPN connection, and internet apps are not routed on the private network side. Internet applications and private network applications on BYOD terminals are isolated using user-level virtualization technology, placing all private network applications into a single container. The container serves as the workspace, while the outside of the container serves as the living space. The multi-service access control component on BYOD terminals monitors the status of apps running on BYOD terminals. After the SSL client completes mutual authentication with the multi-service access control gateway, an SSL VPN connection is established between the SSL client and the SSL service module of the multi-service access control gateway. At this point, internet app access traffic does not pass through the multi-service access control gateway.

[0097] The multi-service access control component monitors the running status of the APP in the workspace on the BYOD terminal. If the running status of the APP changes (from sleep to start or from start to sleep), the multi-service access control component immediately reports the signature information of the APP to the multi-service access control gateway. The signature information includes the running status of the APP. When sending the signature information of the APP, it can be encrypted and protected by the digital certificate private key or the derived shared key. The multi-service access control gateway mainly completes routing and dynamic port control. The Internet APP business traffic of this embodiment will not be routed to the private network side. At this time, the running status of the Internet APP is collected mainly for user behavior auditing. After the container of the workspace exits, the SSL VPN connection is dismantled, the private network APP is closed, and the message notification pushed by the server can no longer be received.

[0098] like Figure 13 As shown, the process of the method in this embodiment is:

[0099] Step 1: Start the Internet APP.

[0100] Step 2: The Internet APP communicates normally with its server.

[0101] Step 3: The workspace container starts.

[0102] Step 4: Start the multi-service access control component.

[0103] Step 5: The multi-service access control component and the multi-service access control gateway complete authentication based on the digital certificate.

[0104] Step 6: Start the SSL client.

[0105] Step 7: The SSL client establishes an SSL VPN connection with the SSL service of the multi-service access control gateway.

[0106] Step 8: Start the private network APP.

[0107] Step 9: The multi-service access control component detects the startup of the private network APP, generates the signature information of the private network APP, encrypts it with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0108] Step 10: The multi-service access control gateway receives the ciphertext of the signature information of the private network APP, decrypts it using the public key of the digital certificate or the derived shared key, and obtains the signature information of the private network APP.

[0109] Step 11: The multi-service access control gateway completes routing selection based on the subtype of the private network APP and records the generated policy routing into the APP policy routing table.

[0110] Step 12: The private network APP communicates normally with its server.

[0111] Step 13: The multi-service access control component detects that the private network APP is dormant, generates signature information of the private network APP, encrypts it with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0112] Step 14: The multi-service access control gateway receives the ciphertext of the signature information of the private network APP, decrypts it using the digital certificate public key or the derived shared key, and obtains the signature information of the private network APP.

[0113] Step 15: The multi-service access control gateway deletes the corresponding policy route in the APP policy routing table based on the APP UID of the private network APP.

[0114] Example 4

[0115] like Figure 14 As shown, in this embodiment, a private network terminal subscribes to both internet and private network traffic, or a public mobile communication network SIM card subscribes to internet traffic and has connectivity to private communication networks such as PWLAN. Internet applications and private network applications on the terminal are isolated using user-level virtualization technology, placing all internet applications into a single container. The container serves as a living space, while the outer space serves as a workspace. When the container is closed, the multi-service access control component blocks the internet link, while the private network link remains connected. After the container is opened, the private network link is blocked, the internet link is activated, and the SSL client is started to establish an SSL VPN connection with the SSL service of the multi-service access control gateway.

[0116] The multi-service access control component monitors the running status of APPs in the workspace and living space on the private network terminal. If the running status of an APP is monitored to change (from sleep to start, from start to sleep), the multi-service access control component will immediately report the signature information of the APP to the multi-service access control gateway. The signature information contains the running status of the APP. When sending the signature information of the APP, it can be encrypted and protected by the digital certificate private key or the derived shared key. The multi-service access control gateway mainly completes routing and dynamic port control. When the container is opened, the terminal adopts the BYOD terminal networking method, and the Internet APP business traffic can be routed outside the private network side. At this time, the collection of Internet APP running status is mainly for user behavior auditing.

[0117] like Figure 15 As shown, the process of the method in this embodiment is:

[0118] Step 1: The multi-service access control component is started and authenticated with the multi-service access control gateway.

[0119] Step 2: Block the Internet link and activate the private network link.

[0120] Step 3: Start the private network APP.

[0121] Step 4: The multi-service access control component detects the startup of the private network APP, generates the signature information of the private network APP, encrypts it with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0122] Step 5: The multi-service access control gateway receives the ciphertext and decrypts it using the digital certificate public key or the derived shared key to obtain the signature information of the private network APP.

[0123] Step 6: The multi-service access control gateway completes routing based on the subtype of the private network APP.

[0124] Step 7: If the private network APP is a dynamic port application, the multi-service access control gateway monitors the dynamic port reporting interface, generates or deletes policy routes based on the port status reported by the private network APP, and records the generated policy routes in the APP policy routing table.

[0125] Step 8: The private network APP communicates normally with its server.

[0126] Step 9: Living Space Container Startup.

[0127] Step 10: Block the private network link and activate the Internet link.

[0128] Step 11: The SSL client is started and establishes an SSLVPN connection with the SSL service of the multi-service access control gateway.

[0129] Step 12: The multi-service access control component monitors the running private network APP, generates the signature information of the private network APP, encrypts it with the certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0130] Step 13: The multi-service access control gateway receives the ciphertext of the signature information of the private network APP, decrypts it with the certificate public key or the derived shared key, and obtains the signature information of the private network APP.

[0131] Step 14: The multi-service access control gateway completes routing based on the subtype of the private network APP.

[0132] Step 15: If the private network APP is a dynamic port application, the multi-service access control gateway monitors the dynamic port reporting interface, generates a policy route based on the port information reported by the private network APP, and records it in the APP policy routing table or deletes the corresponding policy route from the APP policy routing table.

[0133] Step 16: The private network APP communicates normally with its server.

[0134] Step 17: Internet APP starts.

[0135] Step 18: The Internet APP communicates normally with its server.

[0136] Step 19: The living space container is closed, the SSL client is closed, and the SSL VPN connection is removed.

[0137] Step 20: Block the Internet link and activate the private network link.

[0138] Step 21: The multi-service access control component monitors the running APP, generates the signature information of the APP, encrypts it with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0139] Step 22: The multi-service access control gateway receives the ciphertext of the signature information of the APP, decrypts it using the public key of the digital certificate or the derived shared key, and obtains the signature information of the APP.

[0140] Step 23: The multi-service access control gateway completes routing based on the APP type and subtype of the APP.

[0141] Step 24: If the APP is a private network APP and a dynamic port application, the multi-service access control gateway monitors the dynamic port reporting interface and generates or deletes the policy routing based on the reported information.

[0142] Step 25: The app communicates normally with its server.

[0143] Step 26: The multi-service access control component detects that the APP is dormant, generates signature information of the APP, encrypts it with the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway.

[0144] Step 27: The multi-service access control gateway receives the ciphertext of the signature information of the APP, decrypts it using the digital certificate public key or the derived shared key, and obtains the signature information of the APP.

[0145] Step 28: The multi-service access control gateway deletes the corresponding policy routing based on the APP UID of the APP.

[0146] Those skilled in the art can make various corresponding changes and modifications based on the above technical solutions and concepts, and all of these changes and modifications should be included in the scope of protection of the claims of the present invention.

Claims

1. A method for controlling multi-service access of a mobile terminal, characterized in that: The steps include:

1. Multi-service access control component monitors the running status information of the APP: A1. The multi-service access control component is started and authentication is completed with the multi-service access control gateway based on the digital certificate. A2. The multi-service access control component monitors changes in the app's operating status; A3. If the app whose running status changes is an Internet app and is a dynamic port application, the destination port is not limited, and the multi-service access control component generates the app's signature information based on the source address, destination address, and source port. If the app is a private network app, or an Internet app and a static port application, the destination port is limited, and the multi-service access control component generates the app's signature information based on the app's source address, destination address, source port, and destination port. The source address is the address of the mobile terminal, the destination address is the address of the server, the source port is the port of the mobile terminal, and the destination port is the port of the server; The APP signature information includes the APP UID, type, subtype, source address, destination address, source port, destination port, and running status; the type is Internet APP or Private Network APP, and the subtype is Dynamic Port Application or Static Port Application; If the destination port is not limited, the destination port is empty; the running status is start or sleep; A4. The multi-service access control component encrypts the APP signature information generated in step A3 using the digital certificate private key or the derived shared key, and sends it to the multi-service access control gateway; 2. Multiple services access the control gateway for routing: B1. The multi-service access control gateway receives the ciphertext of the APP signature information sent by the multi-service access control component; B2. The multi-service access control gateway decrypts the ciphertext using the digital certificate public key or the derived shared key to obtain the APP's signature information; B3. The multi-service access control gateway selects routes based on the APP type and subtype contained in the APP signature information: If the running status of the APP is dormant, delete the policy routing corresponding to the APP; If the running status of the app is started, and the app is an Internet app and a dynamic port application, the destination port is not limited, and a policy route is generated based on the source address, destination address, and source port; If the running status of the APP is started, and the APP is a private network APP and a dynamic port application, first limit the destination port, that is, generate a policy route based on the source address, destination address, source port and destination port of the APP, then monitor the dynamic port reporting interface, and receive the port status reported by the APP through the dynamic port reporting interface. If the port status reported by the APP from the dynamic port reporting interface is open, a new policy route is generated. If the port status reported by the APP from the dynamic port reporting interface is closed, the corresponding policy route is deleted; If the running state of the APP is started and the APP is a static port application, the destination port is limited, that is, a policy route is generated based on the source address, destination address, source port, and destination port of the APP.

2. The method according to claim 1, characterized in that When creating a policy route for the multi-service access control gateway, it is a bidirectional route.

3. The method according to claim 1, characterized in that The multi-service access control gateway maintains an APP policy routing table. When a new APP policy route is generated, the APP UID and policy route of the corresponding APP are entered into the APP policy routing table. When a policy route needs to be deleted, the APP policy routing table is queried based on the APP UID and the corresponding policy route is deleted.

4. The method according to claim 1, wherein The format of port status information reported by an APP through the dynamic port reporting interface is: APP UID, destination port, and command. The command content is open or closed.

Images