Access control method based on application protocol and equipment thereof

Abstract

The invention provides an access control method and equipment based on an application protocol, and the method comprises the steps: receiving identity authentication information from a terminal application, and enabling the identity authentication information to be used for confirming the identity of a terminal; confirming the legality of the terminal according to the identity authentication information; acquiring authorized access information of the legal terminal application, wherein the authorized access information is used for accessing a corresponding application on an internal application network or an external network; and accessing a corresponding application on the internal application network or the external network according to the authorized access information. According to the method provided by the invention, the terminal can be authorized to access the corresponding application on the internal application network / external network through the access control equipment, and the same terminal can be selectively limited to be incapable of accessing two target networks at the same time, namely, the terminal accesses the application of the external network or the internal application network; and the local network of the terminal and the target network route do not need to be communicated, so that route isolation between the local network of the terminal and the target network is realized.

Description

Technical Field

[0001] The present application relates to the field of information technology, and more specifically, to an access control method and device based on an application protocol. Background Art

[0002] With the rapid development of information technology and the Internet, governments and enterprises are facing increasingly severe network security threats. In traditional network access methods, when a local terminal accesses a non-local target network (for example, an external network (also known as the Internet) or an internal application network), the local network of the terminal must be connected to the target network routing, and then all requests from the terminal (including hackers, viruses, backdoors, etc.) are automatically forwarded through the local routing gateway, which poses a huge challenge to network security. Since the local terminal is connected to the target network routing, the routing pass and programs (for example, hackers, viruses, backdoors) have network access permissions, which can easily lead to data leakage or extortion, and the risk of being attacked by the network is significantly increased.

[0003] Therefore, there is an urgent need for a new access control method and device, which aims to enable the local terminal to access the application on the target network without the need for the local terminal to be connected to the target network, and only forward the corresponding application layer protocol after the corresponding application request is authenticated, thereby realizing the routing isolation between the local terminal and the target network, so that the loopholes in the external network cannot use this terminal as a springboard to threaten the internal application network. In other words, even if this terminal is invaded or has programs (such as hackers, viruses, backdoors), it cannot be used as a springboard to attack other networks as a bot, nor can it be used as a springboard to leak data to the external network. In addition, it is optional to restrict the same terminal from accessing two target networks at the same time. Even if this terminal accesses applications on the external network or the internal application network, the local network of the terminal and the target network do not need to be connected, thereby realizing the routing isolation between the local network of the terminal and the target network. Summary of the invention

[0004] In view of this, the present application provides an access control method and device based on an application protocol, which can realize routing isolation between a terminal local network and an external network and an internal application network, and optionally restrict the same terminal from accessing two target networks at the same time. Even if the terminal accesses an application of an external network or an internal application network, the routing of the terminal local network and the target network does not need to be connected, thereby realizing routing isolation between the terminal local network and the target network, and effectively enhancing network security.

[0005] In a first aspect, an access control method based on an application protocol is provided, which acts on the application layer, and includes: receiving identity authentication information from a terminal application, wherein the identity authentication information is used to confirm the identity of the terminal; confirming the legitimacy of the terminal based on the identity authentication information; obtaining authorized access information of the terminal application, wherein the authorized access information is used to access a corresponding application on an internal application network or an external network; and accessing the corresponding application on the internal application network or the external network based on the authorized access information.

[0006] Optionally, the identity authentication information includes an identifier of the terminal and a user credential, wherein the identifier is used to determine a legal identity of the terminal; and the user credential is used to determine authentication information of a terminal application.

[0007] Optionally, the terminal identification includes an international mobile equipment identity (IMEI) and a media access control address (MAC); user credentials include a user name and password, a smart card-based security token and its personal identification number (PIN code), a public key certificate, a one-time password, etc., which are not limited here.

[0008] Optionally, the authorized access information includes the address and port of the local corresponding application gateway exit on the internal application network or the external network and at least one of the following: a data key, an access password, and an authorization permission code.

[0009] In a second aspect, an access control device based on an application protocol is provided, which acts on an application layer, and includes: a transceiver module, which is used to receive identity authentication information from a terminal application, and the identity authentication information is used to confirm the identity of the terminal; a processing module, which is used to confirm the legitimacy of the terminal according to the identity authentication information;

[0010] The transceiver module is also used to receive authorization access information from the terminal application, and the authorization access information is used to access the corresponding application on the internal application network or the external network; the processing module is also used to access the corresponding application on the internal application network or the external network according to the authorization access information.

[0011] Optionally, the identity authentication information includes an identifier of the terminal and a user credential, wherein the identifier is used to determine a legal identity of the terminal; and the user credential is used to determine authentication information of a terminal application.

[0012] Optionally, the terminal identification includes an international mobile equipment identity (IMEI) and a media access control address (MAC); user credentials include a user name and password, a smart card-based security token and its personal identification number (PIN code), a public key certificate, a one-time password, etc., which are not limited here.

[0013] Optionally, the authorized access information includes the address and port of the local corresponding application gateway exit on the internal application network or the external network and at least one of the following: a data key, an access password, and an authorization permission code.

[0014] In a third aspect, a device is provided, which may be an access control device or a chip in the access control device. The device has the function of implementing the first aspect. The function may be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0015] In one possible design, the device includes: a receiving module and a sending module. Optionally, the device also includes a processing module. The transceiver module may be, for example, at least one of a transceiver, a receiver, and a transmitter. The receiving module and the sending module may include a radio frequency circuit or an antenna. The processing module may be a processor. Optionally, the device also includes a storage module, which may be, for example, a memory. When the storage module is included, the storage module is used to store instructions. The processing module is connected to the storage module, and the processing module may execute instructions stored in the storage module or instructions derived from other sources, so that the device performs the method of the first aspect above.

[0016] In another possible design, when the device is a chip, the chip includes: a receiving module and a sending module. Optionally, the device also includes a processing module. The receiving module and the sending module may be, for example, an input / output interface, a pin or a circuit on the chip. The processing module may be, for example, a processor. The processing module may execute instructions so that the chip in the terminal executes the method of the first aspect above. Optionally, the processing module may execute instructions in a storage module, and the storage module may be a storage module in the chip, such as a register, a cache, etc. The storage module may also be located in the communication device but outside the chip, such as a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM), etc.

[0017] The processor mentioned in any of the above places may be a general-purpose central processing unit (CPU),

[0018] A microprocessor, an application specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of programs of the above-mentioned communication methods.

[0019] According to a fourth aspect, a computer storage medium is provided, wherein a program code is stored in the computer storage medium, and the program code is used to indicate instructions for executing the method in the first aspect.

[0020] In a fifth aspect, a computer storage medium is provided, in which a program code is stored, and the program code is used to indicate instructions for executing the method in the first aspect.

[0021] In a sixth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the method in the first aspect.

[0022] In a seventh aspect, a processor is provided, which is coupled to a memory and is used to execute the method in the first aspect.

[0023] In an eighth aspect, a chip is provided, comprising a processor and a communication interface, wherein the communication interface is used to communicate with an external device or an internal device, and the processor is used to implement the method in the first aspect.

[0024] Optionally, the chip may further include a memory, in which instructions are stored, and the processor is used to execute the instructions stored in the memory or instructions from other sources. When the instructions are executed, the processor is used to implement the method in the first aspect above.

[0025] Based on the above technical solution, the application protocol-based access control method of the present application has the following beneficial effects: even if the terminal is invaded or has programs (such as hackers, viruses, backdoors), the terminal cannot be used as a springboard to attack other networks as a botnet, nor can the terminal be used as a springboard to leak data to the external network. Even if the terminal accesses an application on an external network or an internal application network, the local network of the terminal does not need to be connected to the target network routing, thus achieving routing isolation between the local network of the terminal and the target network. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a schematic diagram of a traditional network access structure provided according to an embodiment of the present application.

[0027] Figure 2 It is a schematic diagram of a new network access structure provided according to an embodiment of the present application.

[0028] Figure 3 It is a schematic flowchart of an access control method provided according to an embodiment of the present application.

[0029] Figure 4 It is a schematic block diagram of a device for access control provided according to an embodiment of the present application.

[0030] Figure 5 It is a schematic block diagram of another device for access control provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0032] Unless otherwise defined, all technical and scientific terms used in this application have the same meanings as those commonly understood by technicians in the technical field to which this application belongs; the terms used in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned figure descriptions are intended to cover non-exclusive inclusions.

[0033] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0034] The "storage" involved in the embodiments of the present application may refer to storage in one or more memories. The one or more memories may be separately set or integrated in an encoder or decoder, a processor, or a communication device. The one or more memories may also be partially separately set and partially integrated in a decoder, a processor, or a communication device. The type of memory may be any form of storage medium, which is not limited by the present application.

[0035] The terminal in the embodiments of the present application may refer to a user device, an access terminal, a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a terminal, a wireless communication device, a user agent or a user device. The terminal may also be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a handheld device with wireless communication function, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a terminal in a future 5G network or a terminal in a future evolved public land mobile communication network (PLMN), etc., and the embodiments of the present application are not limited to this.

[0036] Figure 1 A schematic diagram of a traditional network access structure provided by an embodiment of the present application is shown. Figure 1 As shown, the terminal can access multiple target networks, including internal application networks and external networks. Among them, the internal application network is the application of the intranet of an enterprise or government, for example, the government's data center, and another example is the enterprise's office automation (OA) system, enterprise resource planning (ERP) system, etc. The external network includes Internet applications, such as Baidu, QQ, WeChat, etc.

[0037] If users want to access applications on these target networks, they must first allow the local connected terminal to access the target network before communication can be carried out. For example, when the local terminal switches from accessing the external network to accessing the internal application network, the terminal can reduce the threat of the external network to the terminal when accessing the internal application network through routing and firewalls. Although this network access method improves convenience, it also increases network security risks. Since the local terminal is connected to the target network through routing, the security vulnerabilities of any network may affect other networks. For example, hackers or viruses on the external network may spread to the internal application network through the terminal, posing a threat to the security of the internal application network, for example, causing internal data leakage or extortion.

[0038] Therefore, the present application proposes a new access control method, which aims to make the local terminal and the target network route not connected, and only access the application on the target network at the application layer. Even if this terminal accesses the application of the external network or the internal application network, the terminal local network and the target network route do not need to be connected, and the route isolation between the terminal local network and the target network is achieved, so that the loopholes in the external network cannot use this terminal as a springboard to threaten the internal application network, that is, even if the terminal is invaded or has programs (such as hackers, viruses, backdoors), it cannot use this terminal as a springboard to attack other networks as a brute force, nor can it use this terminal as a springboard to leak data to the external network, effectively enhancing network security. In addition, it is optional to restrict the same terminal from accessing two target networks at the same time, effectively reducing network security risks and improving the overall security of the network.

[0039] Figure 2 A schematic diagram of a new network access structure provided by an embodiment of the present application is shown, where a local terminal needs to access an internal application network or an external network through an access control device. Figure 2 As shown, the access control device is located between the terminal and the internal application network / external network, and connects the terminal to the internal application network / external network. It is a device that interacts with the terminal for application data. Specifically, the access control device is a gateway at the application layer, including an application gateway corresponding to the internal application network and an application gateway corresponding to the external network. Optionally, the access control device can be implemented by a single server or a server cluster consisting of multiple servers, with high availability and load balancing capabilities. The access control device is used to authenticate the terminal and authorize access to the application on the terminal after the identity authentication. For example, when the terminal needs to access an Internet application, it must first complete identity authentication on the local application gateway of the external network corresponding to the access control device. After the authentication is passed, the access control device will authorize access to the terminal application, and the terminal can safely access the corresponding Internet application.

[0040] It should be understood that the access control device only forwards the corresponding application layer protocol of the terminal corresponding application request after authentication, and the application layer protocol is the communication rule provided between the terminal system or application. They define how the application sends and receives data, as well as the format and meaning of the data. The application layer protocol includes the hypertext transfer protocol (HTTP), the file transfer protocol (FTP), the simple mail transfer protocol (SMTP), etc. These protocols are located in the application layer of the open system interconnection model (OSI), and are mainly responsible for processing the interaction between users and applications. Therefore, the access control device in this application is different from the traditional routing gateway (located in the network layer of the OSI model). Even if this terminal accesses the application of the external network or the internal application network, the terminal local network and the target network routing do not need to be connected, and the routing isolation between the terminal local network and the target network is realized. That is, even if the terminal is invaded or has programs (such as hackers, viruses, backdoors), this terminal cannot be used as a springboard as a broiler to attack other networks, nor can this terminal be used as a springboard to leak data to the external network.

[0041] The following example uses a terminal accessing an application on an external network (i.e., an Internet application). When a terminal needs to access an application on an external network, it can complete identity authentication on the access control device. After authentication, the access control device authorizes the terminal application to access the application. The terminal obtains the corresponding accessible Internet application (e.g., Baidu, QQ, WeChat, etc.) through the application interface, and the access control device releases the access traffic according to the preset access policy. During this process, the access control device monitors the traffic in real time to ensure data security during the communication process and dynamically adjusts access rights according to the policy. The entire external network access process is designed to be safe, flexible, and efficient, and realizes the routing isolation of the local terminal and the external network, effectively isolating the risks of the local terminal from the external network. When the terminal accesses the internal application network, since the routing networks of the two are always isolated, the viruses on the external network (e.g., hackers, viruses, backdoors) cannot use this terminal as a springboard to attack other network terminals as a botnet, nor can it use this terminal as a springboard to leak data to the external network.

[0042] It should be noted that the above-mentioned access control device only processes data packets for designated applications, realizes permanent routing isolation between the terminal and the target network (external network / internal application network), and thus realizes routing isolation between the external network and the internal application network. Therefore, for external devices in the external network (for example, non-designated applications, or system vulnerabilities and viruses in the operating system), it is impossible to attack the internal application network through the terminal. In addition, the access control device can actively block unnecessary traffic, further reducing the possibility of external threats to the internal application network. In particular, the access control device can also implement dynamic access control policies, monitor and record all inbound and outbound traffic, so as to timely detect and respond to potential security threats.

[0043] Accordingly, refer to Figure 3 The embodiment of the present application also provides an access control method, which acts on the application layer and includes the following steps:

[0044] S110, the terminal application sends identity authentication information to the access control device, where the identity authentication information is used to confirm the identity of the terminal.

[0045] The identity authentication information includes the terminal's identifier and user credentials. The identifier is used to determine the legal identity of the terminal; the user credentials are used to determine the authentication information of the terminal application.

[0046] Optionally, the terminal identification includes an international mobile equipment identity (IMEI) and a media access control address (MAC); user credentials include a user name and password, a smart card-based security token and its personal identification number (PIN code), a public key certificate, a one-time password, etc., which are not limited here.

[0047] Specifically, the terminal will encrypt its IMEI and pre-registered user name and password through a secure encryption algorithm (for example, symmetric encryption algorithm (Advanced Encryption Standard, AES), public key encryption algorithm (Rivers-Shamir-Adleman, RSA)), and send it to the access control device to ensure the security of the authentication information during transmission.

[0048] Based on the above, illegal terminal access can be prevented, and legal terminals can be prevented from being unable to perform access operations normally due to attacks or control by external devices.

[0049] S120: The access control device confirms the legitimacy of the terminal according to the identity authentication information.

[0050] Specifically, after receiving the identity authentication information sent by the terminal application, the access control device first decrypts the received identity authentication information and extracts the terminal's identifier and user credentials. Subsequently, the access control device checks the two pieces of information with its internal database to confirm the legitimacy of the terminal. Optionally, it checks whether the terminal's identifier is in the whitelist to determine whether the terminal is authorized to access the network; or, it verifies whether the user credentials are correct to determine whether the terminal application is authorized to access the network application. If the identity authentication information is valid and consistent, the access control device will grant the terminal application access rights; if the identity authentication information does not match, an error message is returned.

[0051] S130, the access control device requests the terminal application to obtain the authorization access information, and correspondingly, the terminal application sends the authorization access information to the access control device, and the authorization access information includes the address and port of the local corresponding application gateway exit and at least one of the following: data key, access password, and authorization permission code.

[0052] It should be understood that for a local terminal to access an application on a target network (internal application network or external network), the local corresponding application gateway address, port and at least one of the following items are required: a data key, an access password, and an authorization license code.

[0053] Specifically, after confirming that the terminal is legitimate, the access control device will query the local or remote access control list (ACL) to obtain the authorized access information of the terminal application. The authorized access information will be recorded and encrypted to ensure that it is not leaked during transmission. The authorized access information mainly includes: the address and port of the Internet application to indicate the application and services allowed to be accessed; the data key to ensure secure communication with external network applications; the access password, which may be used for further identity authentication or session management; the authorization permission code to ensure that the user has appropriate permissions during the session.

[0054] S140, the access control device accesses the internal application network / external network according to the authorized access information, specifically, accesses the application corresponding to the internal application network or the corresponding Internet application on the external network.

[0055] Optionally, when the terminal needs to access the application corresponding to the internal application network, the application gateway of the internal application network in the access control device accesses the corresponding application on the internal application network according to the authorized access information; or, when the terminal needs to access the application corresponding to the external network, the application gateway of the external network in the access control device accesses the corresponding application on the external network according to the authorized access information.

[0056] In this step, the access control device uses the previously obtained authorized access information to securely establish a connection with the internal application network / external network by configuring the corresponding routing policies and firewall rules. The access control device will set up a virtual private network (VPN) or secure transmission channel based on the authorized application address and port to ensure the encryption and integrity of data during transmission. At the same time, the access control device will migrate the relevant access passwords and data keys to further ensure the secure transmission of data and limit access to sensitive information to avoid unauthorized access. When establishing a connection, the access control device will also monitor the connection status of the terminal and evaluate traffic and activities in real time to prevent potential security threats.

[0057] It should be noted that the above access control device does not directly map and convert the network address and port of the internal application network / external network, but uses the reference of the application ID (Application ID) and the conversation ID (Conversation ID) in the middle.

[0058] It should also be noted that the above-mentioned routing isolation between the terminal local network and the internal application network and the external network means that there is no condition for connecting the terminal with any of its networks or establishing a reverse shell.

[0059] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0060] It should also be understood that in the above-mentioned embodiments, the methods and operations implemented by the access control device may also be implemented by components (such as chips or circuits) that can be used in the access control device.

[0061] From the above, it can be seen that the access control method provided by the present application makes it unnecessary for the local terminal to be connected to the route of the target network, and only authorizes access to the application on the target network through the access control device at the application layer, thereby realizing the route isolation of the local terminal from the external network and the internal application network, so that the loopholes in the external network (such as hackers, viruses, backdoors) cannot use this terminal as a springboard to threaten the internal application network. In other words, even if this terminal is invaded or has programs (such as hackers, viruses, backdoors), it cannot use this terminal as a springboard as a bot to attack other network terminals, nor can it use this terminal as a springboard to leak data to the external network; and it is optional to restrict the same terminal from accessing two target networks at the same time. Even if this terminal accesses an application on an external network or an internal application network, the route of the terminal local network and the target network do not need to be connected, thereby realizing the route isolation between the terminal local network and the target network, effectively enhancing network security.

[0062] The embodiment of the present application can divide the functional modules of the access control device according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation. The following is an example of dividing each functional module according to each function.

[0063] Figure 4 A schematic block diagram of a device 400 for network access control according to an embodiment of the present application is shown.

[0064] It should be understood that the device 400 may correspond to Figure 3 The access control device in the illustrated embodiment may have any function of the access control device in the method. The device 400 includes a transceiver module 410 and a processing module 420 .

[0065] In a possible design, the transceiver module 410 is used to receive identity authentication information sent by the terminal application; the processing module 410 is used to determine the legitimacy of the terminal according to the identity authentication information;

[0066] Optionally, the identity authentication information includes an identifier of the terminal and a user credential, wherein the identifier is used to determine a legal identity of the terminal; and the user credential is used to determine authentication information of the terminal application.

[0067] Optionally, the terminal identification includes an international mobile equipment identity (IMEI) and a media access control address (MAC); the user credentials include a user name and password, a smart card-based security token and its personal identification number (PIN code), a public key certificate, and a one-time password.

[0068] In another possible design, the transceiver module 410 is used to receive authorization information sent by the terminal application; the processing module 410 is used to access the internal application network / external network, specifically, to access the corresponding application on the internal application network / external network;

[0069] Optionally, the authorized access information includes the address and port of the local corresponding application gateway exit and at least one of the following: a data key, an access password, and an authorization permission code.

[0070] It should be understood that for a local terminal to access an application on a target network (internal application network or external network), the local corresponding application gateway address, port and at least one of the following items are required: a data key, an access password, and an authorization license code.

[0071] Figure 5 The device 500 for network access control provided in the embodiment of the present application is shown. The device 500 can be Figure 3 The access control device described in . The device can be used as follows Figure 5 The hardware architecture shown in FIG. 1 may include a processor 510 and a transceiver 520 , and optionally, the device may further include a memory 530 , wherein the processor 510 , the transceiver 520 and the memory 530 communicate with each other via an internal connection path. Figure 4 The related functions implemented by the processing module 410 in the embodiment can be implemented by the processor 510, and the related functions implemented by the transceiver module 420 can be implemented by the processor 510 controlling the transceiver 520.

[0072] Optionally, the processor 510 may be a general-purpose central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), a dedicated processor, or one or more integrated circuits for executing the technical solutions of the embodiments of the present application. Alternatively, the processor may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions). For example, it may be a baseband processor or a central processing unit. The baseband processor may be used to process communication protocols and communication data, and the central processing unit may be used to control equipment used for RRM measurement (e.g., base stations, terminals, or chips, etc.), execute software programs, and process data of software programs.

[0073] Optionally, the processor 510 may include one or more processors, for example, one or more central processing units (CPUs). When the processor is a CPU, the CPU may be a single-core CPU or a multi-core CPU.

[0074] Optionally, the transceiver 520 is used to send and receive data and / or signals, and receive data and / or signals. The transceiver may include a transmitter and a receiver, the transmitter is used to send data and / or signals, and the receiver is used to receive data and / or signals.

[0075] Optionally, the memory 530 includes but is not limited to random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM), and compact disc read only memory (CD-ROM), and the memory 540 is used to store relevant instructions and data.

[0076] Optionally, the memory 530 is used to store program codes and data of the device, and can be a separate device or integrated in the processor 510. Specifically, the processor 510 is used to control the transceiver to transmit information with the terminal. For details, please refer to the description in the method embodiment, which will not be repeated here.

[0077] In a specific implementation, as an embodiment, the device 500 may also include an output device and an input device. The output device communicates with the processor 510 and may display information in a variety of ways. For example, the output device may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device communicates with the processor 510 and may receive user input in a variety of ways. For example, the input device may be a mouse, a keyboard, a touch screen device, or a sensor device.

[0078] Understandably, Figure 5 Only a simplified design of a device for network access control is shown. In practical applications, the device may also include other necessary components, including but not limited to any number of transceivers, processors, controllers, memories, etc., and all access control devices that can implement the present application are within the protection scope of the present application.

[0079] In a possible design, the device 500 may be a chip, for example, a communication chip that can be used in an access control device, and is used to implement the relevant functions of the processor 510 in the access control device. The chip may be a field programmable gate array, a dedicated integrated chip, a system chip, a central processing unit, a network processor, a digital signal processing circuit, a microcontroller, and a programmable controller or other integrated chips for implementing relevant functions. The chip may optionally include one or more memories for storing program codes, and when the codes are executed, the processor implements the corresponding functions.

[0080] As another form of this embodiment, a computer-readable storage medium is provided, on which instructions are stored, and when the instructions are executed, the method in the above method embodiment is executed.

[0081] As another form of this embodiment, a computer program product including instructions is provided, and when the instructions are executed, the method in the above method embodiment is performed.

[0082] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a high-density digital video disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0083] It should be understood that the processor can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method embodiment can be completed by the hardware integrated logic circuit in the processor or the instruction in the form of software. The above processor can be a general processor, a digital signal processor (digital signal processor, DSP), an application specific integrated circuit (application specific integrated circuit, ASIC), a field programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor can be combined to perform. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0084] It can be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct memory bus random access memory.

[0085] The terms "component", "module", "device", etc. used in this specification are used to represent computer-related entities, hardware, firmware, a combination of hardware and software, software, or software in execution. For example, a component can be, but is not limited to, a process running on a processor, a processor, an object, an executable file, an execution thread, a program and / or a computer. By way of illustration, both applications running on a computing device and a computing device can be components. One or more components may reside in a process and / or an execution thread, and a component may be located on a computer and / or distributed between two or more computers. In addition, these components may be executed from various computer-readable media having various data structures stored thereon. Components may, for example, communicate through local and / or remote processes based on signals having one or more data packets (e.g., data from two components interacting with another component between a local system, a distributed system and / or a network, such as the Internet interacting with other systems through signals).

[0086] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0087] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0088] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. An access control method based on application protocol, characterized in that: The following steps are involved: Receiving identity authentication information from a terminal application, the identity authentication information being used to confirm the identity of the terminal; Confirming the legitimacy of the terminal according to the identity authentication information; Obtaining authorization access information of the terminal application, where the authorization access information is used to access a corresponding application on an internal application network or an external network; Access the corresponding application on the internal application network or the external network according to the authorized access information.

2. The method according to claim 1, characterized in that: The identity authentication information includes the identifier of the terminal and the user credentials; The identifier is used to determine the legal identity of the terminal; The user credentials are used to determine authentication information of the terminal application.

3. The method according to claim 1, characterized in that The authorized access information includes the address, port and at least one of the following items of the corresponding application on the internal application network or the external network: a data key, an access password, and an authorization permission code.

4. An access control device based on an application protocol, characterized in that: include: A transceiver module, used to receive identity authentication information from a terminal application, wherein the identity authentication information is used to confirm the identity of the terminal; A processing module, used to confirm the legitimacy of the terminal according to the identity authentication information; The transceiver module is further used to receive authorization access information from the terminal application, and the authorization access information is used to access the corresponding application on the internal application network or the external network; The processing module is further used to access the corresponding application on the internal application network or the external network according to the authorized access information.

5. The device according to claim 4, characterized in that The identity authentication information includes the identifier of the terminal and the user credentials; The identifier is used to determine the legal identity of the terminal; The user credentials are used to determine authentication information of the terminal application.

6. The device according to claim 4, characterized in that The authorized access information includes the address, port and at least one of the following items of the corresponding application on the internal application network or the external network: a data key, an access password, and / or an authorization permission code.

7. A computer storage medium, characterized in that: The computer storage medium stores program codes, and the program codes are used to instruct execution of the method according to any one of claims 1 to 3.

8. A chip, characterized in that: include: A processor and a communication interface, wherein the communication interface is used to communicate with an external device or an internal device, and the processor is used to implement the method according to any one of claims 1 to 3.

9. A computer program product, characterized in that The method comprises computer executable codes or computer executable instructions. When the computer executable codes or computer executable instructions are executed by a computer, the method according to any one of claims 1 to 3 is implemented.

Images