Gateway access method, gateway management system, electronic equipment and computer storage medium

Abstract

The embodiment of the invention provides a gateway access method, a gateway management system, electronic equipment and a computer storage medium. The method comprises the steps that an access request sent by security gateway equipment is acquired, the access request comprises equipment identification information, current positioning information and identity information of the security gateway equipment, and the equipment identification information corresponds to the current positioning and identity information; querying authorization registration information of the security gateway equipment by taking the equipment identification information as a query condition, and determining whether the current positioning information is consistent with the authorization positioning information of the security gateway equipment or not; and when the current positioning information is consistent with the authorized positioning information of the security gateway equipment, verifying the identity information of the security gateway equipment, and after the verification is passed, establishing a network connection channel with the security gateway equipment, so that extranet equipment accessed to the security gateway equipment accesses intranet resources through the network connection channel.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a gateway access method, a gateway management system, an electronic device and a computer storage medium. Background Art

[0002] Security gateway devices (also known as security gateway boxes) provide communication tunnels for external network devices such as robot devices, PCs (Personal Computers), notebooks, mobile phones, and smart terminals that access the security gateway by adopting network security technology, data encryption algorithms, access control, and regular updates and maintenance measures. It can achieve seamless connection and data transmission between different external network devices and networks, and provide users with strong network security and privacy protection. Each device can access the security gateway individually or in groups. When choosing to access the security gateway in groups, the device can connect to the security gateway device via wifi, wired, 4G / 5G, and access the corresponding application resources through the communication tunnel established between the security gateway device and the security gateway.

[0003] As an edge group access device, the security gateway device needs to establish a secure network connection channel with the security gateway under the condition of its own security, so that each device can access the corresponding application resources. However, in the related technology, when an external network device needs to access application resources, a communication tunnel is usually established directly through the security gateway device for the external network device connected to the security gateway, so that the external network device can access the application resources. There is a lack of security protection for the external network device to access the application resources, resulting in security risks for each external network device to access the application resources. Summary of the invention

[0004] In view of this, the embodiments of the present application provide a gateway access method, a gateway management system, an electronic device and a computer storage medium to solve or alleviate the problem of security risks in the access of various external network devices to application resources in the related technology.

[0005] According to a first aspect of an embodiment of the present application, a gateway access method is provided, comprising: obtaining an access request sent by a security gateway device, wherein the access request includes device identification information, current location information, and identity information of the security gateway device, wherein the device identification information and the current location and identity information are

[0006] [HZTC-HXJMJJ241007][HS2411172CCN] corresponds to the information; using the device identification information as the query condition, querying the authorized registration information of the security gateway device, and determining whether the current positioning information is consistent with the authorized positioning information of the security gateway device; when the current positioning information is consistent with the authorized positioning information of the security gateway device, verifying the identity information of the security gateway device, and after the verification is passed, establishing a network connection channel with the security gateway device, so that the external network device connected to the security gateway device can access the internal network resources via the network connection channel.

[0007] In some embodiments of the present application, the gateway access method also includes: obtaining preset positioning information set for each security gateway device; associating the preset positioning information with the device identification information of each security gateway device to obtain authorized positioning information of each security gateway device.

[0008] In some embodiments of the present application, device identification information is used as a query condition to query the authorized registration information of the security gateway device to determine whether the current positioning information is consistent with the authorized positioning information of the security gateway device, including: querying the authorized registration information based on the device identification information, and determining whether there is preset device identification information that is the same as the device identification information in the authorized registration information, wherein the preset device identification information is the identification information of the authorized registered security gateway device; when there is preset device identification information that is the same as the device identification information in the authorized registration information, determining whether the current positioning information is consistent with the authorized positioning information of the security gateway device.

[0009] In some embodiments of the present application, determining whether the current location information is consistent with the authorized location information of the security gateway device includes: determining whether the current location information is consistent with the authorized location information when the security gateway device is powered on or after a preset time period; when the current location information is inconsistent with the authorized location information, generating an alarm signal.

[0010] In some embodiments of the present application, the identity information of the security gateway device is verified, including: obtaining login request information in the identity information; sending the login request information to a server connected to the gateway management system for legitimacy verification, and sending the verification result of the login request information to the gateway management system.

[0011] In some embodiments of the present application, verifying the identity information corresponding to the device identification information also includes: obtaining a certificate report in the identity information; verifying the certificate report to determine that the security gateway device in the certificate report is consistent with the security gateway device indicated by the device identification information.

[0012] In some embodiments of the present application, obtaining the certificate report in the identity information includes:

[0013] [HZTC-HXJMJJ241007][HS2411172CCN] The full gateway device sends a certificate signing request to the certificate provider based on the key pair; the certificate provider obtains the device identification information of the security gateway device based on the certificate signing request for identity authentication, and generates and sends a certificate report based on the preset certificate template after the verification is passed.

[0014] According to a second aspect of an embodiment of the present application, a gateway management system is provided, including: an acquisition module, used to acquire an access request sent by a security gateway device, wherein the access request includes device identification information, current location information and identity information of the security gateway device; a query module, used to use the device identification information as a query condition, query the authorized registration information of the security gateway device, and determine whether the current location information is consistent with the authorized location information of the security gateway device; a verification module, used to verify the identity information of the security gateway device when the current location information is consistent with the authorized location information of the security gateway device, and after the verification is passed, establish a network connection channel with the security gateway device, so that an external network device connected to the security gateway device can access internal network resources via the network connection channel.

[0015] According to a third aspect of an embodiment of the present application, an electronic device is provided, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to the gateway access method of any of the above embodiments.

[0016] According to a fourth aspect of the embodiments of the present application, a computer storage medium is provided, on which a computer program is stored. When the program is executed by a processor, a gateway access method as in any of the above embodiments is implemented.

[0017] According to the gateway access method and its device, storage medium and electronic device provided in the embodiments of the present application, the device identification information, current location information and identity information of the security gateway device itself are verified for legitimacy through the gateway management system, so that when the security gateway device requests to connect to the security gateway, it can be ensured that the security gateway managed by the gateway management system and the security gateway device establish a reliable and secure network connection channel, so that external network devices connected to the security gateway device can securely access internal network resources via the network connection channel. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art description. Obviously, the following

[0019] The drawings in the description of [HZTC-HXJMJJ241007][HS2411172CCN] are only some embodiments described in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0020] Figure 1 A schematic diagram of a network structure of a security gateway device application scenario according to an embodiment of the present application;

[0021] Figure 2 A schematic diagram of a flow chart of a gateway access method according to an embodiment of the present application;

[0022] Figure 3 A schematic diagram of a process for setting a location range for a security gateway box according to an embodiment of the present application;

[0023] Figure 4 A schematic diagram of a process for setting a location range for a security gateway box according to another embodiment of the present application;

[0024] Figure 5 A schematic diagram of a process of identifying the location of a security gateway box by a gateway management system according to another embodiment of the present application;

[0025] Figure 6 A schematic diagram of the interaction between a security gateway device, a gateway management system and a token server according to an embodiment of the present application;

[0026] Figure 7 A schematic diagram of a process for generating a certificate report according to an embodiment of the present application;

[0027] Figure 8 A schematic diagram of the overall process of a gateway access method according to an embodiment of the present application;

[0028] Fig. 9 is a structural block diagram of a gateway management system according to an embodiment of the present application;

[0029] Fig.10 The figure is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.

[0031] The specific implementation of the embodiments of the present application is further explained below in combination with the embodiments of the present application and the accompanying drawings.

[0032] Figure 1 The present invention is a schematic diagram of a network structure of a security gateway device application scenario according to an embodiment of the present application.

[0033] like Figure 1 As shown in the figure, application resources are deployed on the application server, and the security gateway is located between the application resources and the application server.

[0034] [HZTC-HXJMJJ241007][HS2411172CCN] Between the external network, it is used to protect the internal network resources. The gateway management system is used to manage and configure each security gateway node. The security gateway can be deployed independently or in the cloud. A secure network connection channel is established between the security gateway box (i.e., the security gateway device) and the security gateway. When various access devices such as PCs or mobile phones are connected to the security gateway box using the access method provided by the security gateway box, the access device can securely access the application resources deployed on the application server.

[0035] Figure 2 The figure is a flow chart of a gateway access method according to an embodiment of the present application.

[0036] like Figure 2 As shown, the method includes:

[0037] S21: Acquire an access request sent by a security gateway device, wherein the access request includes device identification information, current location information, and identity information of the security gateway device, wherein the device identification information corresponds to the current location and identity information.

[0038] Specifically, the security gateway device (i.e., security gateway box), as an edge group access device, if you want to ensure the security of the box itself, you first need to obtain the location information of the box so that you can start the operation of the security gateway box normally when it is within the prescribed legal range, and then establish a secure network connection channel with the security gateway after it passes the identity authentication of the security gateway management system. After the network connection channel is established, other access devices can access the application resources protected by the security gateway through the security gateway box.

[0039] Before using the security gateway box, the location information of the security gateway box needs to be pre-set and configured in the security gateway management system. When the security gateway box needs to access the security gateway, the gateway management system verifies whether the location information of the security gateway box is legal, so as to start normally and build the subsequent network connection channel. Therefore, how to verify the legitimacy of the location of the security gateway box becomes an important part of verifying the legitimacy of the box identity.

[0040] Based on this, this application proposes to verify the legitimacy of the security gateway box. The security gateway device refers to Figure 1 The security gateway box shown is used to establish a secure network connection channel with the security gateway so that devices with access requirements can access application resources on the application server through the network connection channel.

[0041] When a device with access requirements needs to access application resources, the security gateway box will send an access request to the gateway management system. The access request includes the device serial number of the security gateway box.

[0042] [HZTC-HXJMJJ241007][HS2411172CCN] identification information, current location information consisting of the IP address and current location information of the security gateway box, and identity information consisting of tokens and identity certificates, so that the gateway management system can verify the legitimacy of the security gateway box.

[0043] S22: Using the device identification information as a query condition, query the authorization registration information of the security gateway device to determine whether the current positioning information is consistent with the authorized positioning information of the security gateway device.

[0044] The authorization registration information is a collection of serial numbers of successfully registered security gateway boxes. The authorization location information is the authorization location information corresponding to each security gateway box in the authorization registration information.

[0045] In some embodiments, the gateway access method further includes: obtaining preset positioning information set for each security gateway device; associating the preset positioning information with the device identification information of each security gateway device to obtain authorized positioning information of each security gateway device.

[0046] For example, Figure 3 FIG. 1 is a flow chart of setting the location range of a security gateway box according to an embodiment of the present application. Figure 3 As shown, the preset positioning information set for each security gateway box is pre-set by the staff in the security gateway box management system. The specific operations are as follows:

[0047] S31: Log in to the security gateway box management system;

[0048] S32: Enter the location setting interface. When the administrative district method is selected to set the location range of the security gateway box, enter S33. When the Beidou positioning method is selected to set the location range of the security gateway box, enter S34.

[0049] S33: Select the province, city, district and street information corresponding to each security gateway box to obtain the preset location information of the security gateway box, wherein the plurality of security gateway boxes may also be divided into different groups to set the preset location information of the security gateway boxes in each group;

[0050] S34: Use Beidou positioning to pre-define the area corresponding to each security gateway box and obtain its preset positioning information.

[0051] For example, Figure 4 FIG. 1 is a flow chart of setting the location range of a security gateway box according to another embodiment of the present application. Figure 4 As shown, the staff re-sets the legal use scope of each security gateway box in the gateway management system, and the authorized location information of each security gateway box in the gateway management system is the same as the preset location information of the security gateway box in the security gateway box system. The specific operations are as follows:

[0052] [HZTC-HXJMJJ241007][HS2411172CCN]

[0053] S41: Log in to the gateway management system;

[0054] S42: Enter the location setting interface. When the administrative district method is selected to set the location range of the security gateway box, enter S43. When the Beidou positioning method is selected to set the location range of the security gateway box, enter S44.

[0055] S43: According to the preset positioning information of each security gateway box in the security gateway box management, the corresponding province, city, district and street information of each security gateway box is selected in the gateway management system, wherein a plurality of security gateway boxes may also be divided into different groups, so as to set the authorized positioning information of the security gateway boxes in the group according to each group;

[0056] S44: According to the preset positioning information of each security gateway box in the security gateway box management, the area corresponding to each security gateway box is demarcated in the gateway management system by using Beidou positioning.

[0057] Furthermore, after the staff initially sets the positioning information of each security gateway box in the security gateway box management system, the preset positioning information of each security gateway box will be written into the gateway management system, so that the gateway management system can associate the preset positioning information with its corresponding device identification information to obtain the authorized positioning information of each security gateway box, so that when an access request is issued during the startup and operation of the security gateway box, the legitimacy of the area in which it is located is verified according to the preset positioning information.

[0058] S23: When the current location information is consistent with the authorized location information of the security gateway device, the identity information of the security gateway device is verified, and after the verification is passed, a network connection channel with the security gateway device is established to enable the external network device connected to the security gateway device to access the internal network resources via the network connection channel.

[0059] Extranet devices refer to Figure 1 As shown in the figure, various access devices such as PC or mobile phone, intranet resources refer to Figure 1 The application resources deployed on the application server are shown. When the security gateway box (i.e., security gateway device) passes the verification, a secure network connection channel is established between the security gateway box and the security gateway. After each external network device is connected to the security gateway box using the access method provided by the security gateway box, the external network device can securely access the internal network resources deployed on the application server.

[0060] Figure 5 FIG. 1 is a flow chart of the location identification of the security gateway box by the gateway management system according to another embodiment of the present application. Figure 5 As shown, the specific operations are as follows:

[0061] [HZTC-HXJMJJ241007][HS2411172CCN]

[0062] S51: The security gateway box sends an access request to the gateway management system;

[0063] S52: The gateway management system determines the current location information of the security gateway box according to the IP address or Beidou positioning information in the access request;

[0064] S53: The gateway management system determines whether the current positioning information is consistent with the authorized positioning information. If so, it enters S54. If not, it ends, that is, it determines whether the IP address or Beidou positioning information is consistent with the preset IP address or preset Beidou positioning information;

[0065] S54: Continue to verify the identity information of the security gateway box, and after the verification is passed, establish a network connection channel with the security gateway device.

[0066] In this way, the gateway management system verifies the legitimacy of the device identification information, current location information and identity information of the security gateway device itself, so that when the security gateway device requests to connect to the security gateway, it can ensure that the security gateway managed by the gateway management system and the security gateway device establish a reliable and secure network connection channel, so that external network devices connected to the security gateway device can securely access internal network resources via the network connection channel.

[0067] In some embodiments, the device identification information is used as a query condition to query the authorization registration information of the security gateway device to determine whether the current location information is consistent with the authorized location information of the security gateway device, including:

[0068] Query the authorized registration information based on the device identification information, and determine whether there is preset device identification information that is the same as the device identification information in the authorized registration information, wherein the preset device identification information is the identification information of the authorized registered security gateway device;

[0069] When there is preset device identification information identical to the device identification information in the authorized registration information, it is determined whether the current positioning information is consistent with the authorized positioning information of the security gateway device.

[0070] Among them, the preset device identification information refers to the serial number of the authorized and registered security gateway box.

[0071] That is to say, the gateway management system pre-stores a set consisting of the serial numbers of the authorized registered security gateway boxes, and uses the set as the authorized registration information. When the security gateway box needs to establish a network connection channel with the security gateway, the gateway management system will obtain the device identification information of the security gateway box, and query whether there is preset device identification information that is the same as the device identification information in the authorized registration information. If so, it is determined that the security gateway box has been successfully registered in the gateway management system.

[0072] [HZTC-HXJMJJ241007][HS2411172CCN]

[0073] Furthermore, the current location information of the security gateway box is obtained to determine whether the current location information is consistent with the authorized location information of the security gateway device. In some implementations, determining whether the current location information is consistent with the authorized location information of the security gateway device includes: when the security gateway device is powered on or after a preset time interval, determining whether the current location information is consistent with the authorized location information; when the current location information is inconsistent with the authorized location information, generating an alarm signal.

[0074] That is to say, when the security gateway box is powered on and started, the gateway management system will obtain the access request sent by the security gateway box, and after determining that the security gateway box is successfully registered in the gateway management system, it will continue to obtain the current location information of the security gateway box, and determine whether the current location information is consistent with the authorized location information pre-set in the gateway management system. When the current location information is inconsistent with the authorized location information, an alarm signal is generated, which can send the alarm signal to the server or terminal device connected to the gateway management system and interrupt the connection with the security gateway box, so that the staff can promptly understand the legality of the access of each security gateway box, and also ensure the security of the gateway management system itself and intranet application resources.

[0075] It should be noted that during the normal operation of the security gateway box, the current positioning information of the security gateway box also needs to be verified. This can be done by setting a preset time length and obtaining the current positioning information at preset time lengths during the operation of the security gateway box to verify whether the current positioning information is consistent with the authorized positioning information. When the current positioning information is inconsistent with the authorized positioning information, an alarm signal is generated and the connection with the security gateway box is interrupted.

[0076] In some embodiments, the identity information of the security gateway device is verified, including: obtaining login request information in the identity information; sending the login request information to a server connected to the gateway management system for legitimacy verification, and sending the verification result of the login request information to the gateway management system.

[0077] The login request information refers to the token of the security gateway device (i.e., the security gateway box). Figure 6 FIG. 1 is a schematic diagram of the interaction between a security gateway device, a gateway management system and a token server according to an embodiment of the present application. Figure 6 As shown, the specific operations are as follows:

[0078] First, the security gateway box sends a token acquisition request to the token server connected to it. After receiving the token acquisition request, the token server continues to obtain the serial number, administrative district information, Beidou positioning information and other related information of the security gateway box to generate the security gateway box based on the acquired information.

[0079] [HZTC-HXJMJJ241007][HS2411172CCN] The token (i.e., login request information) of the shutdown box is sent to the security gateway box; then when the security gateway box sends an access request to the gateway management system, the gateway management system will obtain the token and send it to the token server connected to it to verify the legitimacy of the token; finally, the token server sends the verification result of whether the token verification passes or fails to the gateway management system, so that the gateway management system can continue to verify other information in the identity information if the token verification passes.

[0080] It should be noted that the legitimacy verification of the token may include steps such as extracting the token, decoding the token, verifying the signature, verifying the validity period, etc. The legitimacy of the token may also be verified by other verification methods, which are not limited in this application.

[0081] In some embodiments, verifying the identity information corresponding to the device identification information also includes: obtaining a certificate report in the identity information; verifying the certificate report to determine that the security gateway device in the certificate report is consistent with the security gateway device indicated by the device identification information.

[0082] The certificate report refers to the certificate report issued by the certificate authority (CA) for each security gateway box.

[0083] Furthermore, in some embodiments, obtaining a certificate report in the identity information includes: sending a certificate signing request to a certificate provider based on a key pair through a security gateway device; obtaining device identification information of the security gateway device for identity authentication based on the certificate signing request through the certificate provider, and generating and sending a certificate report based on a preset certificate template after the verification is passed.

[0084] Figure 7 FIG. 1 is a flow chart of generating a certificate report according to an embodiment of the present application. Figure 7 As shown, the specific operations are as follows:

[0085] S71: Log in to the security gateway box management system, and in the initialization interface of the management system, call the password model of the security gateway box to generate an SM2 key pair;

[0086] S72: The security gateway box sends a certificate signing request (P10 certificate request) to the certificate provider CA organization based on the SM2 key pair, wherein the certificate signing request includes but is not limited to the SM2 public key, the device identification information of the security gateway box and other information;

[0087] S73: The CA agency obtains the device identification information of the security gateway box based on the P10 certificate request to authenticate the security gateway box. Authentication of the security gateway box refers to determining the security gateway box.

[0088] [HZTC-HXJMJJ241007][HS2411172CCN]Whether the gateway box exists, is it legal, and whether it owns the domain name, etc.;

[0089] S74: Generate a certificate report based on a preset certificate template after the security gateway box passes the verification, wherein the certificate report includes but is not limited to plain text and signature information of the certificate chain, the public key of the security gateway box, the device identification information of the security gateway box, the CA organization information, the certificate validity period, the certificate serial number, and other information;

[0090] S75: Send the certificate report to the security gateway box.

[0091] Furthermore, the gateway management system obtains the certificate report of the security gateway box, and reads the plain text information such as the public key of the security gateway box, the device identification information of the security gateway box, the CA organization information, the certificate validity period, the certificate serial number, etc. in the certificate report and calculates the information summary, and decrypts the signature information in the certificate report to obtain the decrypted information summary, and then compares it with the calculated information summary. If the two are consistent, it is determined that the security gateway box in the certificate report is consistent with the security gateway box indicated by the device identification information in the access request. In this way, the security of the gateway management system is guaranteed, and the security of the intranet resources protected by the security gateway is also guaranteed.

[0092] Figure 8 FIG. 1 is a schematic diagram of the overall process of a gateway access method according to an embodiment of the present application. Figure 8 As shown, the specific operations are as follows:

[0093] S81: The security gateway box sends an access request to the gateway management system;

[0094] S82: The gateway management system obtains the device identification information, current location information and identity information in the access request;

[0095] S83: The gateway management system queries whether there is preset device identification information in the authorization registration information that is the same as the device identification information of the security gateway box. If so, proceed to S84; if not, end;

[0096] S84: The gateway management system determines whether the current location information of the security gateway box is consistent with its authorized location information. If so, the process proceeds to S85; if not, the process ends.

[0097] S85: The gateway management system obtains the token of the security gateway box and sends it to the token server connected to it to verify the legitimacy of the token;

[0098] S86: The gateway management system receives the verification result of the token verification of the security gateway box;

[0099] S87: The gateway management system obtains the certificate report of the security gateway box;

[0100] S88: The gateway management system verifies whether the certificate report is passed. If so, it proceeds to S88. If not,

[0101] [HZTC-HXJMJJ241007][HS2411172CCN] ends;

[0102] S89: The security gateway box and the gateway management system negotiate an encryption key, and after the negotiation is successful, both parties activate the virtual network card to establish a network connection channel between the two.

[0103] In summary, the gateway management system verifies the legitimacy of the device identification information, current location information and identity information of the security gateway device itself, so that when the security gateway device requests to connect to the security gateway, it can ensure that the security gateway managed by the gateway management system and the security gateway device establish a reliable and secure network connection channel, so that external network devices connected to the security gateway device can securely access internal network resources via the network connection channel.

[0104] The gateway access method of this embodiment can be executed by any appropriate electronic device with data processing capability, including but not limited to: a server, a mobile terminal (such as a mobile phone, a PAD, etc.) and a PC, etc.

[0105] Fig. 9 The present invention is a block diagram of a gateway management system according to an embodiment of the present application.

[0106] like Fig. 9 As shown, the gateway management system 900 can execute Figure 2The gateway access method of the present invention comprises: an acquisition module 901, which is used to acquire an access request sent by a security gateway device, wherein the access request includes device identification information, current location information and identity information of the security gateway device; a query module 902, which is used to use the device identification information as a query condition, query the authorization registration information of the security gateway device, and determine whether the current location information is consistent with the authorized location information of the security gateway device; a verification module 903, which is used to verify the identity information of the security gateway device when the current location information is consistent with the authorized location information of the security gateway device, and establish a network connection channel with the security gateway device after the verification is passed, so that the external network device connected to the security gateway device can access the internal network resources via the network connection channel.

[0107] In some embodiments of the present application, the acquisition module 901 is also used to: obtain preset positioning information set for each security gateway device; associate the preset positioning information with the device identification information of each security gateway device to obtain authorized positioning information of each security gateway device.

[0108] In some embodiments of the present application, the query module 902 is specifically used to: query the authorized registration information based on the device identification information, determine whether there is preset device identification information that is the same as the device identification information in the authorized registration information, wherein the preset device identification information is the identification information of the authorized registered security gateway device; and determine whether there is preset device identification information that is the same as the device identification information in the authorized registration information.

[0109] [HZTC-HXJMJJ241007][HS2411172CCN], determine whether the current positioning information is consistent with the authorized positioning information of the security gateway device.

[0110] In some embodiments of the present application, the query module 902 is specifically used to: determine whether the current positioning information is consistent with the authorized positioning information when the security gateway device is powered on or after a preset time period; when the current positioning information is inconsistent with the authorized positioning information, generate an alarm signal.

[0111] In some embodiments of the present application, the verification module 903 is specifically used to: obtain login request information in the identity information; send the login request information to a server connected to the gateway management system for legitimacy verification, and send the verification result of the login request information to the gateway management system.

[0112] In some embodiments of the present application, the verification module 903 is specifically used to: obtain a certificate report in the identity information; verify the certificate report to determine that the security gateway device in the certificate report is consistent with the security gateway device indicated by the device identification information.

[0113] In some embodiments of the present application, the verification module 903 is specifically used to: send a certificate signing request to the certificate provider based on a key pair through a security gateway device; obtain the device identification information of the security gateway device through the certificate provider based on the certificate signing request for identity authentication, and generate and send a certificate report based on a preset certificate template after the verification is passed.

[0114] In addition, the technical solutions of the above-mentioned embodiments of the present application can be combined with each other and are not limited here.

[0115] According to the gateway management system of the embodiment of the present application, the legitimacy of the device identification information, current location information and identity information of the security gateway device itself is verified through the gateway management system, so that when the security gateway device requests to connect to the security gateway, it can ensure that the security gateway managed by the gateway management system and the security gateway device establish a reliable and secure network connection channel, so that external network devices connected to the security gateway device can securely access internal network resources via the network connection channel.

[0116] The gateway management system of this embodiment is used to implement the corresponding gateway access methods in the aforementioned multiple method embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here. In addition, the functional implementation of each module in the gateway management system of this embodiment can refer to the description of the corresponding parts in the aforementioned method embodiments, which will not be repeated here.

[0117] Fig.10 This is a structural block diagram of an electronic device according to an embodiment of the present application. The specific embodiment of the present application does not limit the specific implementation of the electronic device.

[0118] like Fig.10 As shown, the electronic device 1000 may include: a processor 1002, a memory 1003,

[0119] [HZTC-HXJMJJ241007][HS2411172CCN] communication interface 1004 and communication bus 1005, processor 1002, memory 1003 and communication interface 1004 complete mutual communication through communication bus 1005; memory 1003 is used to store at least one executable instruction, and the executable instruction enables the processor 1002 to perform the operation corresponding to the gateway access method of any of the above embodiments.

[0120] The processor 1002 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the smart device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0121] The memory 1003 is used to store programs, and may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0122] According to the electronic device of the embodiment of the present application, the gateway management system verifies the legitimacy of the device identification information, current location information and identity information of the security gateway device itself, so that when the security gateway device requests to connect to the security gateway, it can ensure that the security gateway managed by the gateway management system and the security gateway device establish a reliable and secure network connection channel, so that external network devices connected to the security gateway device can securely access internal network resources via the network connection channel.

[0123] An embodiment of the present application further provides a computer storage medium on which a computer program is stored. When the program is executed by a processor, the gateway access method of any of the above embodiments is implemented.

[0124] According to the computer storage medium of the embodiment of the present application, the device identification information, current location information and identity information of the security gateway device itself are verified for legitimacy through the gateway management system, so that when the security gateway device requests to connect to the security gateway, it can be ensured that the security gateway managed by the gateway management system and the security gateway device establish a reliable and secure network connection channel, so that external network devices connected to the security gateway device can securely access internal network resources via the network connection channel.

[0125] It should be pointed out that, according to the needs of implementation, the various components / steps described in the embodiments of the present application can be split into more components / steps, or two or more components / steps or partial operations of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present application.

[0126] The above method according to the embodiment of the present application can be implemented in hardware, firmware, or can be implemented as

[0127] [HZTC-HXJMJJ241007][HS2411172CCN] Software or computer code stored in a recording medium (such as a CD ROM, RAM, floppy disk, hard disk or magneto-optical disk), or computer code originally stored in a remote recording medium or a non-temporary machine-readable medium and to be stored in a local recording medium that is downloaded through a network, so that the method described herein can be stored in such software processing on a recording medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware (such as an ASIC or FPGA). It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component (e.g., RAM, ROM, flash memory, etc.) that can store or receive software or computer code, and when the software or computer code is accessed and executed by a computer, a processor, or hardware, the gateway access method described herein is implemented. In addition, when a general-purpose computer accesses the code for implementing the gateway access method shown herein, the execution of the code converts the general-purpose computer into a dedicated computer for executing the gateway access method shown herein.

[0128] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of the present application.

[0129] The above implementation methods are only used to illustrate the embodiments of the present application, and are not intended to limit the embodiments of the present application. Ordinary technicians in the relevant technical field can make various changes and modifications without departing from the spirit and scope of the embodiments of the present application. Therefore, all equivalent technical solutions also belong to the scope of the embodiments of the present application, and the scope of patent protection of the embodiments of the present application should be defined by the claims. The systems, devices or modules described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions.

Claims

1. A gateway access method, characterized in that: include: Acquire an access request sent by a security gateway device, wherein the access request includes device identification information, current location information, and identity information of the security gateway device, wherein the device identification information corresponds to the current location and the identity information; Using the device identification information as a query condition, querying the authorization registration information of the security gateway device, and determining whether the current positioning information is consistent with the authorized positioning information of the security gateway device; When the current location information is consistent with the authorized location information of the security gateway device, the identity information of the security gateway device is verified, and after the verification is passed, a network connection channel with the security gateway device is established to enable external network devices connected to the security gateway device to access internal network resources via the network connection channel.

2. The gateway access method according to claim 1, characterized in that: The method further comprises: Obtaining preset location information set for each security gateway device; The preset positioning information is associated with the device identification information of each security gateway device to obtain the authorized positioning information of each security gateway device.

3. The gateway access method according to claim 2, characterized in that: Using the device identification information as a query condition, querying the authorization registration information of the security gateway device, and determining whether the current location information is consistent with the authorized location information of the security gateway device, includes: Based on the device identification information, query the authorized registration information to determine whether there is preset device identification information that is the same as the device identification information in the authorized registration information, wherein the preset device identification information is the identification information of the authorized registered security gateway device; When preset device identification information identical to the device identification information exists in the authorized registration information, it is determined whether the current location information is consistent with the authorized location information of the security gateway device.

4. The gateway access method according to claim 3, characterized in that: Determining whether the current location information is consistent with the authorized location information of the security gateway device includes: When the security gateway device is powered on or after a preset time interval, determining whether the current location information is consistent with the authorized location information; When the positioning information is inconsistent with the authorized positioning information, an alarm signal is generated.

5. The gateway access method according to claim 1, characterized in that: Verifying the identity information of the security gateway device includes: Obtaining login request information from the identity information; The login request information is sent to a server connected to the gateway management system for legitimacy verification, and the verification result of the login request information is sent to the gateway management system.

6. The gateway access method according to claim 4, characterized in that: Verifying the identity information corresponding to the device identification information also includes: Obtaining a certificate report in the identity information; The certificate report is verified to determine that the security gateway device in the certificate report is consistent with the security gateway device indicated by the device identification information.

7. The gateway access method according to claim 6, characterized in that: Obtain a certificate report in the identity information, including: Sending a certificate signing request to a certificate provider based on the key pair through the security gateway device; The certificate provider obtains the device identification information of the security gateway device based on the certificate signing request for identity authentication, and generates and sends a certificate report based on a preset certificate template after the authentication is passed.

8. A gateway management system, characterized in that: include: An acquisition module, used to acquire an access request sent by a security gateway device, wherein the access request includes device identification information, current location information, and identity information of the security gateway device; A query module, used to use the device identification information as a query condition, query the authorization registration information of the security gateway device, and determine whether the current positioning information is consistent with the authorized positioning information of the security gateway device; The verification module is used to verify the identity information of the security gateway device when the current location information is consistent with the authorized location information of the security gateway device, and after the verification is passed, establish a network connection channel with the security gateway device, so that the external network device connected to the security gateway device can access the internal network resources via the network connection channel.

9. An electronic device, comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to the gateway access method according to any one of claims 1 to 7.

10. A computer storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the gateway access method according to any one of claims 1 to 7 is implemented.

Images