Network communication method and system based on service access verification

Abstract

The embodiment of the invention provides a network communication method and system based on service access verification. The method comprises: an ingress gateway performs first service access verification and second service access verification on a first message sent by a terminal, and forwards the first message passing the first service access verification and the second service access verification to an egress gateway, the first service access verification being identity authenticity verification, and the second service access verification being identity authenticity verification; the second service access verification is legality verification; and the exit gateway carries out third service access verification on the received first message and forwards the first message passing the third service access verification to the application server, and the third service access verification is legality verification. According to the embodiment of the invention, the problem that in the existing communication method based on service access verification in the related technology, the service access verification certificate is generated by the server side and is verified at the near destination side, so that the network attack can not be defended in time is solved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communications, and in particular, to a network communication method and system based on service access verification. Background Art

[0002] Service access authentication credentials, such as verification codes and access tokens, can prevent the server from being subjected to DoS (Denial of Service) network attacks caused by any client accessing the server, and protect the server's resources from unauthorized access. However, the service access authentication credentials in the related art are generated by the server and verified at the near-destination end. As a result, the network protection pressure at the near-destination end is relatively high, and it is easy to fail to resist network attacks in a timely manner. Summary of the invention

[0003] The embodiments of the present invention provide a network communication method and system based on service access verification, so as to at least solve the problem that the existing communication method based on service access verification in the related technology is prone to the problem of not being able to resist network attacks in a timely manner because the service access verification credentials are generated by the server side and verified near the destination side.

[0004] According to one embodiment of the present invention, a network communication method based on service access verification is provided, including: an ingress gateway performs a first service access verification and a second service access verification on a first message sent by a terminal, and forwards the first message that passes the first service access verification and the second service access verification to an egress gateway, wherein the first service access verification is an identity authenticity verification, and the second service access verification is a legality verification; the egress gateway performs a third service access verification on the received first message, and forwards the first message that passes the third service access verification to the application server, wherein the third service access verification is a legality verification.

[0005] According to another embodiment of the present invention, there is provided a network communication system based on service access verification, comprising: an ingress gateway, configured to perform a first service access verification and a second service access verification on a first message sent by a terminal, and forward the first message that passes the first service access verification and the second service access verification to an egress gateway, wherein the first service access verification is an identity authenticity verification, and the second service access verification is a legality verification;

[0006] The egress gateway is configured to perform a third service access verification on the received first message, and forward the first message that passes the third service access verification to the application server.

[0007] According to yet another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any one of the above method embodiments when run.

[0008] According to yet another embodiment of the present invention, there is provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0009] Through the embodiments of the present invention, since the service access verification is performed on the message at the inlet gateway and the outlet gateway, the network protection pressure near the destination can be dispersed, and at the same time, the reaction time to the network attack is increased, and the network attack can be resisted in time. Therefore, the existing communication method based on service access verification in the related art can be solved. Because the service access verification credential is generated by the server and verified near the destination, it is easy to resist the network attack in time, thereby achieving the effect of improving the efficiency of resisting the network attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 It is a hardware structure block diagram of a network device running a network communication method based on service access authentication according to an embodiment of the present invention;

[0011] Figure 2 is a structural block diagram of a network communication system based on service access authentication according to an embodiment of the present invention;

[0012] Figure 3 is a flow chart of a network communication method based on service access authentication according to an embodiment of the present invention;

[0013] Figure 4 is a flow chart of performing service access verification on a first message according to an embodiment of the present invention;

[0014] Figure 5 is a flow chart of performing service access verification on a second message according to an embodiment of the present invention;

[0015] Figure 6 is a flow chart of performing service access verification on a third message according to an embodiment of the present invention;

[0016] Figure 7 is a flow chart of a network communication method based on service access authentication according to an embodiment of the present invention;

[0017] Figure 8 is a flow chart of a network communication method based on service access verification according to a first embodiment of the present invention;

[0018] Fig. 9 is a flow chart of a network communication method based on service access verification according to a second scenario embodiment of the present invention;

[0019] Fig.10 It is a flow chart of a network communication method based on service access authentication according to the third scenario embodiment of the present invention. DETAILED DESCRIPTION

[0020] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings and in combination with the embodiments.

[0021] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0022] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a network device, a computer terminal or a similar computing device. Taking running on a network device as an example, Figure 1 1 is a hardware structure diagram of a network device for executing a network communication method for service access authentication according to an embodiment of the present invention. Figure 1 As shown, the network device may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the above network device may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above network device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0023] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the network communication method for service access verification in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the network device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0024] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the network device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0025] The present application embodiment can be run on Figure 2 In the network architecture shown in Figure 2 As shown, the network architecture includes: a terminal device 10 , an authentication server 20 , a network controller 30 , an ingress gateway 40 , an egress gateway 50 , an application server 60 and a DHCP server 70 .

[0026] The authentication server 20 is used to perform identity authentication on the terminal device.

[0027] The DHCP server 70 is used to allocate legal IP addresses to terminal devices.

[0028] The network controller 30 is used to subscribe to services, issue service policies and network data forwarding policies, and can globally manage the ingress gateway and egress gateway, including: a computing network system, a network control center management unit, an SDN (software defined networking) master controller, etc.

[0029] The ingress gateway 40 has the functions of network routing and deploying network security policies, including: ingress gateway, border gateway, access switch and router, etc.

[0030] The egress gateway 50 has the functions of network routing and deploying network security policies, including: egress gateway, border gateway, etc.

[0031] Two data network forwarding modes, service identification routing and service IP address routing, are supported between the inlet gateway 40 and the outlet gateway 50. In the embodiment of the present invention, service access verification is performed at the inlet gateway 40 and the outlet gateway 50 to filter the passing data packets, thereby ensuring that the data of the legitimate terminal can access the application server 60, preventing network attacks, and ensuring that the data of the application server 60 will not be accessed by illegal terminals without authorization.

[0032] The service access verification methods include: verification code, service access control list; wherein the verification code is generated by a hash algorithm and based on a key, and the generation factors of the verification code include the service identifier SID, the terminal identity ID, the terminal address IPc, the service address IPs, the key, etc. The generation factors of the service access control list include the service identifier SID, the terminal identity ID, the terminal address IPc, the service address IPs, the terminal MAC address, etc.

[0033] In this embodiment of the invention, a network communication method for service access verification running on the above network device or network architecture is provided. Figure 3 is a flow chart of a network communication method based on service access authentication according to an embodiment of the present invention. Figure 3 As shown, the method includes: a subscription message process, a first packet query service identification process and a subsequent business access process, wherein the subscription message process requires a first service access verification and a second service access verification to be performed on the encapsulated third message; the first packet query service identification process requires a first service access verification, a second service access verification and a third service access verification to be performed on the encapsulated second message; the subsequent business access process requires a first service access verification, a second service access verification and a third service access verification to be performed on the first message.

[0034] Figure 4 is a flow chart of performing service access verification on a first message according to an embodiment of the present invention, such as Figure 4 As shown, the process includes the following steps:

[0035] In step S402, the ingress gateway performs a first service access verification and a second service access verification on a first message sent by the terminal, and forwards the first message that passes the first service access verification and the second service access verification to the egress gateway, wherein the first service access verification is an identity authenticity verification, and the second service access verification is a legality verification; wherein the terminal is functionally equivalent to the above-mentioned terminal device 10.

[0036] Before step S402 of this embodiment, the method further includes performing a first service access verification, a second service access verification, and a third service access verification on the second message sent by the terminal. Figure 5 is a flow chart of performing service access verification on a second message according to an embodiment of the present invention, such as Figure 5 As shown, the process includes the following steps:

[0037] Step S502: the ingress gateway performs the first service access verification and the second service access verification on the second message sent by the terminal, and forwards the second message that passes the first service access verification and the second service access verification to the egress gateway;

[0038] In step S504, the export gateway performs a third service access verification on the received second message, and forwards the second message that passes the third service access verification to the application server, so that the application server responds to the terminal's query destination address request based on the second message, and sends a response message carrying the destination address to the terminal.

[0039] In one embodiment, before the ingress gateway performs the first service access verification and the second service access verification on the second message sent by the terminal, the method further includes performing the first service access verification and the second service access verification on the third message sent by the terminal, Figure 6 is a flow chart of performing service access verification on a third message according to an embodiment of the present invention, such as Figure 6 As shown, the process includes the following steps:

[0040] Step S602: the ingress gateway performs the first service access verification and the second service access verification on the third message sent by the terminal;

[0041] In step S604, the entry gateway forwards the third message that passes the first service access verification and the second service access verification to the network controller, so that the network controller responds to the terminal's request for the service identifier of the application server based on the third message, and sends a response message carrying the service identifier of the application server to the terminal.

[0042] In one embodiment, the first message, the second message or the third message includes at least one of the following fields: a source address, an identity identifier of the terminal, a service identifier of the application server, a service identifier of a network controller, and a preset root key.

[0043] In one embodiment, the source address is generated by a dynamic host configuration protocol server in response to a request from the terminal for a terminal IP address; the terminal's identity identifier is used by the terminal to make an access authentication request to an authentication server.

[0044] In one embodiment, the first service access verification includes: verifying the following information of the first message, the second message or the third message through a service access control table: source address, media access control address and identity identifier, so as to verify the address authenticity of the first message, the second message or the third message.

[0045] In an embodiment of the present invention, the service access verification method can be achieved by binding the user identity identifier with the source address of the terminal as a generation factor of the subscription legitimacy credential and the service access legitimacy credential, and a key generating a verification code or a service access control list to perform identity authenticity, address authenticity and access legitimacy verification on the border network device (for example: egress gateway, ingress gateway).

[0046] In one embodiment, the second service access verification includes one of the following:

[0047] Generate a first verification code according to the identity identifier, the service identifier of the network controller and the root key carried in the third message, and compare the first verification code with the second verification code carried in the third message to verify the legitimacy of service access to the third message, wherein the second verification code is generated by the authentication server according to the identity identifier, the service identifier of the network controller and the root key after the terminal passes the identity authentication; the preset root key is generated by the authentication server and sent by the network controller to the ingress gateway and the egress gateway;

[0048] Generate a third verification code according to the service identifier of the application server and the identity identifier carried by the second message, and compare the third verification code with a fourth verification code carried by the second message to verify the legitimacy of service access of the second message; wherein the fourth verification code is generated by the network controller according to the identity identifier and the service identifier of the application server carried by the third message;

[0049] A fifth verification code is generated according to the source address, the destination address and the root key, and the fifth verification code is compared with the sixth verification code carried in the first message to verify the legitimacy of service access of the first message; wherein the sixth verification code is: when the second message passes the third service access verification, the export gateway generates it based on the source address, the destination address and the root key carried by the second message.

[0050] In one embodiment, the second service access verification includes one of the following:

[0051] Generate an eighth verification code according to a preset public key of the authentication server and the identity identifier and the service identifier of the network controller carried in the third message, and compare the eighth verification code with a ninth verification code carried in the third message to verify the legitimacy of service access to the third message, wherein the ninth verification code is generated by the authentication server according to the identity identifier, the service identifier of the network controller and the private key of the authentication server after the terminal passes the identity authentication;

[0052] The tenth verification code carried in the second message is signed by the public key of the network controller to verify the legitimacy of the service access of the second message; wherein the tenth verification code is generated by the network controller based on the identity carried by the third message, the service identifier of the network controller, and the identity, and the private key of the network controller; wherein the public key of the network controller is generated by itself, or generated by other devices and sent to the network controller.

[0053] A first certificate is generated according to the source address, the destination address and the symmetric key of the ingress gateway carried by the first message, and the first certificate is compared with the second certificate carried in the first message to verify the legitimacy of service access of the first message; wherein the second certificate is generated based on the destination address and a first pre-certificate when the second message passes the second service access verification, the first pre-certificate is generated according to the source address carried by the second message and the symmetric key of the ingress gateway, and the destination address is obtained by the egress gateway through table lookup based on the application server identifier carried by the second message.

[0054] In one embodiment, the ingress gateway performs the first service access verification and the second service access verification on the first message, the second message, or the third message through a service access control table, including one of the following:

[0055] The ingress gateway verifies the source address, the identity identifier, and the service identifier of the network controller carried by the third message through the first service access control table to verify the identity authenticity and subscription legitimacy of the first message;

[0056] The ingress gateway verifies the source address, the identity identifier, and the service identifier of the application server carried by the second message through a second service access control table to verify the identity authenticity and subscription legitimacy of the second message;

[0057] The ingress gateway verifies the source address, the identity identifier, and the destination address carried by the first message through the third service access control table to verify the identity authenticity and subscription legitimacy of the first message.

[0058] Step S404: the egress gateway performs a third service access verification on the received first message, and forwards the first message that passes the third service access verification to the application server, wherein the third service access verification is a legitimacy verification.

[0059] In one embodiment, the third service access verification includes one of the following:

[0060] The export gateway generates a seventh verification code according to the source address, the destination address and the root key, and compares the seventh verification code with the sixth verification code carried in the first message to verify the legitimacy of service access of the first message; forwards the first message that passes the legitimacy verification of service access to the application server; the export gateway generates a third verification code according to the service identifier of the application server carried in the second message and the identity identifier, and compares the third verification code with the fourth verification code carried in the second message to verify the legitimacy of service access of the second message.

[0061] In one embodiment, the third service access verification includes one of the following: generating a third certificate based on the source address, the destination address and the symmetric key of the entry gateway carried by the first message, and comparing the third certificate with the fourth certificate carried in the first message to verify the legitimacy of service access of the first message; wherein the fourth certificate is: generated based on the destination address, the source address carried by the second message and the symmetric key of the entry gateway when the second message passes the third service access verification; forwarding the first message that passes the service access legitimacy verification to the application server; the egress gateway verifies the tenth verification code carried in the second message by using the public key of the network controller to verify the legitimacy of service access of the second message.

[0062] In one embodiment, the device for generating the first certificate, the second certificate, the third certificate, or the fourth certificate includes one of the following: the egress gateway, the ingress gateway, the core switch, and the core router, wherein the core switch and the core router are key devices arranged in the middle of the network.

[0063] In one embodiment, the third service access verification includes at least one of the following: the export gateway verifies the identity identifier carried by the second message and the service identifier of the application server through the fourth service access control list; the export gateway verifies the identity identifier and the destination address carried by the first message through the fifth service access control list.

[0064] Through the above steps, since the service access verification of the message is performed at the inlet gateway and the outlet gateway, the network protection pressure near the destination can be dispersed, and at the same time, the reaction time to the network attack is increased, and the network attack can be resisted in time. Therefore, it can solve the problem of the existing communication method based on service access verification in the related technology, because the service access verification credentials are generated by the server and verified near the destination, which is prone to the problem of not resisting the network attack in time. The effect of improving the efficiency of resisting network attacks is achieved.

[0065] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0066] In this embodiment, a system for network communication based on service access authentication is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0067] like Figure 2 A network communication system based on service access authentication is shown, the system comprises: a terminal device 10, an authentication server 20, a network controller 30, an ingress gateway 40, the egress gateway 50 and an application server 60. Among them,

[0068] The ingress gateway 40 is configured to perform a first service access verification and a second service access verification on a first message sent by a terminal, and forward the first message that passes the first service access verification and the second service access verification to an egress gateway, wherein the first service access verification is an identity authenticity verification, and the second service access verification is a legality verification;

[0069] The egress gateway 50 is configured to perform a third service access verification on the received first message, and forward the first message that passes the third service access verification to the application server.

[0070] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0071] To facilitate the understanding of the technical solution provided by the present invention, a detailed description will be given below in conjunction with embodiments of specific scenarios.

[0072] The embodiment of the present invention provides a network communication method based on service access verification. Figure 7 is a flow chart of a network communication method based on service access authentication according to an embodiment of the present invention. Figure 7 As shown, the method mainly includes the following steps:

[0073] Step S702: key pre-setting management.

[0074] Specifically, key pre-setting management includes multiple methods, such as:

[0075] Use symmetric key method;

[0076] Use a mixture of asymmetric and symmetric keys;

[0077] Table lookup method, wherein no key is required in the table lookup method.

[0078] For the same-domain network topology, a symmetric key method is used to generate the verification code. The generation factors of the verification code include the root key MSK, user identity ID, service identifier SID, source address IPc, and destination address IPs.

[0079] For cross-domain network topology, asymmetric keys are used to generate verification codes, and symmetric keys are used to generate certificates. The factors for generating certificates include key K, source address IPc, and destination address IPs. Certificates can be generated not only at the border gateway, but also at key devices in the middle of the network, to achieve on-the-road verification of subsequent business messages and prevent man-in-the-middle attacks.

[0080] When the computing power of the network equipment of the border gateway is limited, an access control table can be deployed at the border gateway to implement service access verification by table lookup.

[0081] Step S704: user access authentication.

[0082] For example: Figure 2 The terminal device 10 performs user ID authentication to the authentication server 20. After the authentication server 20 verifies the user ID, it generates a subscription legitimacy certificate and applies to the DHCP server 70 for the terminal address IPc (ie, source address).

[0083] The subscription legitimacy certificate is a verification code or access control list generated based on a symmetric key or an asymmetric key, which includes at least one of the following generation factors: the service identifier SID0 of the network controller, the terminal identity ID, the key, and the terminal address IPc. The generation algorithm is a general hash algorithm. The DHCP server returns the network controller service identifier SID0, the terminal address IPc, and the subscription legitimacy certificate to the terminal.

[0084] Step S606: User subscribes to the service.

[0085] For example: Figure 2 The terminal device 10 in the embodiment encapsulates the message, which is functionally equivalent to the third message in the above embodiment, and carries the network controller service identifier SID0 and the verification code, and is also used to apply to the network controller for the service identifier SID1 of the application server, wherein the verification code can be carried or not carried according to the specific implementation scenario, and the data packet passes through the inlet gateway 40, and the verification code cryptographic verification or table lookup verification is performed. If the verification passes, the data packet is forwarded; if the verification fails, the data packet is discarded. Among them, the table lookup verification functionally includes the function of the first service access verification and the function of the second service access verification, and the verification code cryptographic verification is functionally equivalent to the second service access verification in the above embodiment. The network controller 30 uses the service identifier SID1 to update the service access legitimacy certificate, and sends the security policy to the inlet gateway 40 and the outlet gateway 50. Finally, the service identifier SID1 and the service access legitimacy certificate are returned to the terminal device 10.

[0086] In one embodiment, the network controller 30 returns only the service identifier SID1 to the terminal device 10 .

[0087] Step S708, the first packet queries the service identifier.

[0088] For example: Figure 2The terminal device 10 in the embodiment encapsulates a message, which is equivalent to the second message in the above embodiment, and carries the service identifier SID1 and the verification code to query the application server 60 for its service IP address (IPs, i.e., the destination address), wherein the verification code can be carried or not carried according to the specific implementation scenario. The data packet passes through the inlet gateway 40 and the outlet gateway 50, and the verification code key verification and table lookup verification are performed. If the verification passes, the data packet is forwarded; if the verification fails, the data packet is discarded. Among them, the table lookup verification is functionally equivalent to the first service access verification in the above embodiment, and the verification code key verification is functionally equivalent to the second service access verification in the above embodiment; the inlet gateway 40 generates a pre-authorization certificate, and the outlet gateway 50 uses the service IP address IPs to update the service access legitimacy certificate, and sends the security policy to the inlet gateway 40; wherein, when updating the service location legitimacy certificate, the outlet gateway also performs a third service access verification on the received message (second message), and if the third service access verification passes, the service access legitimacy certificate is updated. Finally, the service IP address IPs and the service access legitimacy certificate are returned to the terminal.

[0089] In one embodiment, the ingress gateway 40 does not generate a pre-ticket.

[0090] In one embodiment, the application server 60 only returns the service IP address IPs to the terminal device 10 .

[0091] Step S710: subsequent service message access.

[0092] For example: Figure 2 The terminal device 10 in the embodiment encapsulates the message, which is functionally equivalent to the first message in the above embodiment. The message carries a verification code or a certificate to access the service message to the application server 60. The data packet passes through the inlet gateway 40, and performs verification code cryptographic verification and table lookup verification. If the verification passes, the data packet is forwarded to the egress gateway; if the verification fails, the data packet is discarded. Among them, the table lookup verification is functionally equivalent to the first service access verification in the above embodiment, and the verification code key verification is functionally equivalent to the second service access verification in the above embodiment. The egress gateway 50 performs verification code cryptographic verification on the received message, and the verification code cryptographic verification is equivalent to the third service access verification in the above embodiment. If the verification codes are consistent, the message continues to be forwarded; if they are inconsistent, the message is discarded.

[0093] Scenario Example 1

[0094] Figure 8 is a flow chart of a network communication method based on service access authentication according to a first embodiment of the present invention. In this scenario, key pre-setting management uses a symmetric key method, such as Figure 8As shown, the method comprises the following steps:

[0095] Step S800: The authentication server generates a root key MSK, the network controller presets the root key MSK distributed by the authentication server, and sends the root key MSK to the ingress gateway and the egress gateway.

[0096] Step S801: User access authentication.

[0097] This step specifically includes the following steps:

[0098] Step S801a: The terminal device needs to provide a user identity (ID) to perform identity authentication with the authentication server.

[0099] Step S801b, subscription legitimacy certificate generation.

[0100] The authentication server generates a subscription verification code code0=F(MSK, ID, SID0) according to the user identity ID, the network controller service identifier SID0, and the root key MSK, and applies for the terminal IP address from the DHCP server. The network controller service identifier is known information to the authentication server.

[0101] Step S801c, the DHCP server returns the terminal address IPc and records the access control table (IPc-ID-MAC) at the ingress gateway. The access control table is generated and set by the ingress gateway. When the DHCP server feeds back a data packet to the terminal, the data packet will pass through the ingress gateway, and the ingress gateway will record IPc-ID-MAC according to the data packet.

[0102] Step S802: User subscribes to service.

[0103] This step specifically includes the following steps:

[0104] Step S802a, encapsulate the ID in the terminal source address IPc, carry the network controller service identifier SID0 and the subscription verification code code0 in the message, and apply to the network controller for the application server service identifier SID1. The application server service identifier SID1 is known information to the network controller.

[0105] Step S802b: identity authenticity verification and subscription legitimacy verification.

[0106] Specifically, the message passes through the ingress gateway and is first filtered by the access control table (IPc-ID-MAC), and the IPc, ID and MAC are verified. Only the data packets that meet the verification conditions can pass. Then, based on the user identity ID, service identifier SID0 and preset root key MSK carried in the message, code0'=F(MSK, ID, SID0) is generated, and the subscription verification code code0 carried in the message and the generated code0' are compared. If the verification codes are consistent, the message will continue to be forwarded to the network controller; if they are inconsistent, the message will be discarded.

[0107] The identity authenticity verification at the entry gateway is functionally equivalent to the first service access verification in the above embodiment, and the subscription legitimacy verification is functionally equivalent to the second service access verification in the above embodiment. Step S802c: Generate a service access legitimacy certificate.

[0108] The network controller generates a verification code code1=F(MSK, ID, SID1) according to the user identity ID and the service identifier SID1, and returns the service identifier SID1 and the verification code code1 to the terminal.

[0109] Step S802d: The network controller sends the service identifier SID1 requirement and service policy to the ingress gateway and the egress gateway, wherein the SID1 requirement refers to the information associated with the user identity identifier and SID1.

[0110] The messages involved in the above steps S802-S802d are functionally equivalent to the third message in the above embodiment.

[0111] Step S803, query the service identifier of the first packet.

[0112] This step specifically includes the following steps:

[0113] Step S803a: The terminal sends the first packet carrying the service identifier SID1 and the verification code code1, and queries the application server for the service IP address IPs.

[0114] Step S803b: identity authenticity verification and service access legitimacy verification.

[0115] Specifically, the first packet passes through the ingress gateway and is first filtered by the access control table (IPc-ID-MAC). The IPc, ID, and MAC are verified. Only packets that meet the verification conditions can pass. Then, the verification code code1, SID1, and ID are parsed from the message. The verification code code1' is generated based on the service identifier SID1 of the application server and according to the algorithm. Code1 is compared with code1'. If the verification codes are consistent, the message will continue to be forwarded. If they are inconsistent, the message will be discarded.

[0116] Among them, the identity authenticity verification at the entry gateway is functionally equivalent to the first service access verification in the above embodiment, and the service access legitimacy verification is functionally equivalent to the second service access verification in the above embodiment.

[0117] Step S803c serves data forwarding and routing.

[0118] Specifically, the ingress gateway identifies the service identifier SID1 of the application server in the destination address field, and queries the egress gateway based on the service identifier to perform routing through SID1, determines the service node and network path that meet the service requirements, performs message forwarding, and forwards the message to the egress gateway.

[0119] Step S803d, service access legitimacy certificate update. The egress gateway first performs service access legitimacy verification, the steps are the same as S803b. If the verification is successful, it will regenerate the verification code code2 = F (MSK, IPc, IPs), carry code2 in the message, and forward the message to the application server. The application server responds with a message carrying the service IP address IPs and the verification code code2.

[0120] The messages involved in the above steps S803-S803d are functionally equivalent to the second message in the above embodiment. The service access legitimacy verification performed at the egress gateway is functionally equivalent to the third service access verification in the above embodiment.

[0121] Step S804: subsequent service message access.

[0122] This step specifically includes the following steps:

[0123] Step S804a, the terminal encapsulates the subsequent message and carries the verification code code2, and performs business message access to the service IP address IPs.

[0124] Step S804b: address authenticity verification and service access legitimacy verification.

[0125] Specifically, when a message passes through the ingress gateway, it is first filtered by the access control table (IPc-ID-MAC), and the IPc, ID, and MAC are verified (address authenticity verification). Only packets that meet the verification conditions can pass. Then, based on the source address IPc, destination address IPs, and preset root key MSK carried in the message, code2'=F(MSK, IPc, IPs) is generated, and the verification code code2 carried in the message is compared with the generated code2' (service access legitimacy verification). If the verification codes are consistent, the message will continue to be forwarded; if they are inconsistent, the message will be discarded. When the message passes through the egress gateway, the verification code code2 is verified (service access legitimacy verification). If the verification codes are consistent, the message will continue to be forwarded; if they are inconsistent, the message will be discarded.

[0126] The messages involved in the above steps S804-S804b are functionally equivalent to the first message in the above embodiment. The address authenticity verification at the ingress gateway is functionally equivalent to the first service access verification in the above embodiment, and the service access legitimacy verification is functionally equivalent to the second service access verification in the above embodiment; the service access legitimacy verification at the egress gateway is functionally equivalent to the third service access verification in the above embodiment.

[0127] In this embodiment, the verification code is generated by using a symmetric key method, which is suitable for centralized management of keys in the same domain. The verification node only needs to perform a hash operation once. This method has the advantages of stateless checking, convenient key use, and high verification efficiency.

[0128] Scenario Example 2

[0129] Fig. 9 : is a flow chart of a network communication method based on service access authentication according to a second embodiment of the present invention. In this scenario, the key pre-setting management method is to use a mixed method of asymmetric keys and symmetric keys, such as Fig. 9 As shown, the method comprises the following steps:

[0130] Step S900: key pre-setting management.

[0131] Specifically, the authentication server sends its own public key PK_0 to the ingress gateway, and its own private key SK_0 is stored locally for management; the network controller sends the public key PK to the ingress gateway and the egress gateway, and its own private key SK is stored locally for management. The ingress gateway and the egress gateway each manage their own key K.

[0132] Step S901: User access authentication.

[0133] This step specifically includes the following steps:

[0134] Step S901a: The terminal needs to provide a user ID and perform identity authentication to an authentication server.

[0135] Step S901b, subscription legitimacy certificate generation.

[0136] The authentication server generates a subscription verification code code0=F(SK_0, ID, SID0) based on the user identity ID, the network controller service identifier SID0, and its own private key SK_0, and applies for a terminal IP address from the DHCP server.

[0137] Step S901c: The DHCP server returns the terminal address IPc and records the access control table (IPc-ID-MAC) at the egress gateway.

[0138] Step S902: User subscribes to service.

[0139] This step specifically includes the following steps:

[0140] Step S902a: The terminal source address IPc encapsulates the ID, carries the service identifier SID0 and the subscription verification code code0 in the message, and applies for the service identifier SID1 from the network controller.

[0141] Step S902b: Identity authenticity verification and subscription legitimacy verification.

[0142] When the message passes through the ingress gateway, it is first filtered by the access control table (IPc-ID-MAC) and the IPc, ID and MAC are verified. Only the data packets that meet the verification conditions can pass. Then, based on the user identity ID, service identifier SID0 and preset authentication server public key PK_0 carried in the message, code0'=F(PK_0,ID,SID0) is generated, and the subscription verification code code0 carried in the message is compared with the generated code0'. If the verification codes are consistent, the message will continue to be forwarded to the network controller; if they are inconsistent, the message will be discarded.

[0143] Among them, the identity authenticity verification at the entry gateway is functionally equivalent to the first service access verification in the above embodiment, and the subscription legitimacy verification is functionally equivalent to the second service access verification in the above embodiment.

[0144] Step S902c, service access legitimacy certificate generation.

[0145] The network controller generates a verification code code1=F(SK, ID, SID1) according to the user identity ID, the service identifier SID1 and its own private key SK, and returns the service identifier SID1 and the verification code code1 to the terminal.

[0146] Step S902d: The network controller sends the service identifier SID1 requirement and service policy to the ingress gateway and the egress gateway.

[0147] The messages involved in the above steps S900 - S902d are functionally equivalent to the third message in the above embodiment.

[0148] Step S903, query the service identifier of the first packet.

[0149] This step specifically includes the following steps:

[0150] Step S903a: The terminal sends the first packet carrying the service identifier SID1 and the verification code code1, and queries the application server for the service IP address IPs.

[0151] Step S903b: identity authenticity verification and service access legitimacy verification.

[0152] The first packet passes through the ingress gateway and is first filtered by the access control list (IPc-ID-MAC). The IPc, ID and MAC are verified. Only packets that meet the verification conditions can pass. The verification code code1, SID1 and ID are then parsed from the message. The network controller public key PK is used to verify the signature of code1. If the verification is successful, a pre-authentication certificate is generated; if the verification fails, the message is discarded.

[0153] Among them, the identity authenticity verification at the entry gateway is functionally equivalent to the first service access verification in the above embodiment, and the service access legitimacy verification is functionally equivalent to the second service access verification in the above embodiment.

[0154] Step S903c, pre-warrant generation.

[0155] The ingress gateway generates a pre-certificate PCAP1=F(K1, IPc) based on its own key K1, and carries the pre-certificate information in the message.

[0156] Step S903d, service data forwarding and routing.

[0157] The ingress gateway node identifies the service identifier of the destination address field, and determines the service node and network path that meet the service requirements based on the service identifier query and computing power routing table, and performs message forwarding.

[0158] Step S903e, service access legitimacy certificate update.

[0159] The egress gateway first verifies the legitimacy of service access, and the steps are the same as in S903b. It uses the network controller public key PK to verify the signature. If the verification is successful, it generates a pre-certificate PCAP2=F(K2, IPc) based on its own key K2, and then uses the service IP address IPs to regenerate the certificate CAP=F(PCAP, IPs), including CAP1 and CAP2. It carries the certificates CAP1 and CAP2 in the message and forwards the message to the application server. The application server responds with a message that carries the service IP address IPs and the certificates CAP1 and CAP2.

[0160] In one embodiment, CAP2 can be directly generated by the egress gateway according to K2, IPc and IPs, or a pre-certificate PCAP2=F(K2, IPc) can be generated first, and then CAP2 is generated according to PCAP2=F(K2, IPc) and IPs.

[0161] The messages involved in the above steps S903-S903e are functionally equivalent to the second message in the above embodiment. The service access legitimacy verification performed at the egress gateway is functionally equivalent to the third service access verification in the above embodiment.

[0162] Step S904: subsequent service message access.

[0163] This step specifically includes the following steps:

[0164] Step S904a: The terminal encapsulates subsequent messages and carries the certificates CAP1 and CAP2 to access the service messages to the service IP address IPs.

[0165] Step S904b: address authenticity verification and service access legitimacy verification.

[0166] When the message passes through the ingress gateway, it is first filtered by the access control table (IPc-ID-MAC) (address authenticity verification). Only the data packets that meet the conditions can pass. Then, based on the source address IPc, destination address IPs and its own key K1 carried in the message, it generates a pre-certificate PCAP1'=F(K1,IPc), and then generates a certificate CAP1'=F(PCAP1',IPs). Compare the certificate CAP1 carried in the message with the generated CAP1' (service access legitimacy verification). If the values ​​are consistent, the message will continue to be forwarded; if they are inconsistent, the message will be discarded. When the message passes through the egress gateway, the certificate CAP2 is verified (service access legitimacy verification). If the values ​​are consistent, the message will continue to be forwarded; if they are inconsistent, the message will be discarded.

[0167] The messages involved in the above steps S904-S904b are functionally equivalent to the first message in the above embodiment. The address authenticity verification at the ingress gateway is functionally equivalent to the first service access verification in the above embodiment, and the service access legitimacy verification is functionally equivalent to the second service access verification in the above embodiment; the service access legitimacy verification at the egress gateway is functionally equivalent to the third service access verification in the above embodiment.

[0168] In this embodiment, an asymmetric key method is used to generate a verification code, and a symmetric key method is used to generate a certificate. This is suitable for cross-domain key decentralized management. Network devices each manage their own keys to reduce the risk of key leakage. This method has the advantage of on-the-fly verification. At the same time, key nodes in the middle of the network can also participate in the verification.

[0169] Scenario Example 3

[0170] Fig.10 is a flow chart of a network communication method based on service access authentication according to a third embodiment of the present invention, wherein the key presetting management method is a table lookup method, such as Fig.10 As shown, the method comprises the following steps:

[0171] Step S1001: user access authentication.

[0172] This step specifically includes the following steps:

[0173] Step S1001a: The terminal needs to provide a user ID and perform identity authentication with the authentication server. After the authentication server verifies the user ID, it returns the network controller service identifier SID0 to the terminal and applies for the terminal IP address from the DHCP server.

[0174] Step S1001b, the DHCP server returns the terminal IP address IPc and records the access control table (IPc-ID-MAC) at the ingress gateway.

[0175] Step S1001c: Subscription validity certificate generation: The authentication server synchronizes the service access control table T (IPc-ID-MAC-SID0) with the network controller and sends it to the ingress gateway.

[0176] Step S1002, user subscribes to service.

[0177] This step specifically includes the following steps:

[0178] Step S1002a, the user subscribes to the service, the terminal source address IPc encapsulates the ID, the message carries the service identifier SID0 and the subscription verification code code0, and applies for the service identifier SID1 from the network controller.

[0179] Step S1002b: identity authenticity verification and subscription legitimacy verification.

[0180] The message passes through the ingress gateway and is filtered by the service access control list (IPc-ID-MAC-SID0), that is, the message is authenticated for identity and subscription legitimacy. If a match is found, the message is forwarded; otherwise, the message is discarded and a subscription failure is returned.

[0181] The identity authenticity verification at the entry gateway is functionally equivalent to the first service access verification in the above embodiment, and the subscription legitimacy verification is functionally equivalent to the second service access verification in the above embodiment. In this embodiment, the first service access verification and the second service access verification are performed based on the service access control table (IPc-ID-MAC-SID0). Step S1002c: Generate service access legitimacy certificate.

[0182] The network controller updates the service access control table T (IPc-ID-SID1) and sends it to the ingress gateway and the egress gateway, and at the same time returns the service identifier SID1 to the terminal.

[0183] Step S1002d: The network controller sends the service identifier SID1 requirement and service policy to the ingress gateway and the egress gateway.

[0184] The messages involved in the above steps S1002-S1002d are functionally equivalent to the third message in the above embodiment.

[0185] Step S1003, query the service identifier of the first packet.

[0186] This step specifically includes the following steps:

[0187] Step S1003a: the terminal sends the first packet carrying the service identifier SID1, and queries the application server for the service IP address IPs.

[0188] Step S1003b: identity authenticity verification and service access legitimacy verification.

[0189] The first packet passes through the ingress gateway and is filtered by the service access control table T1 (IPc-ID-MAC-SID1), that is, the message is authenticated for identity and subscription legitimacy. If a match is found, the message is forwarded; otherwise, the message is discarded and a subscription failure is returned.

[0190] The identity authenticity verification at the ingress gateway is functionally equivalent to the first service access verification in the above embodiment, and the subscription legitimacy verification is functionally equivalent to the second service access verification in the above embodiment. In this embodiment, the first service access verification and the second service access verification are performed based on the service access control table (IPc-ID-MAC-SID0). Step S1003c, service data forwarding and routing.

[0191] The ingress gateway identifies the service identifier in the destination address field, and determines the service node and network path that meet the service requirements based on the service identifier query and computing power routing table, and performs message forwarding.

[0192] Step S1003d, the service access control list is updated.

[0193] The egress gateway first performs service access control table T2 (ID-SID1) filtering, that is, service access legitimacy verification. If a match is found, the message is forwarded; otherwise, the message is discarded. The application server responds with a message carrying the service IP address IPs, and updates the service access control table T2 (ID-IPs) at the egress gateway, and updates the service access control table T1 (IPc-ID-IPs) at the egress gateway.

[0194] The message involved in the above steps S1003-S1003d is functionally equivalent to the second message in the above embodiment.

[0195] The service access legitimacy verification performed at the egress gateway is functionally equivalent to the third service access verification in the above embodiment.

[0196] Step S1004: subsequent service message access.

[0197] This step specifically includes the following steps:

[0198] Step S1004a: The terminal encapsulates subsequent messages and performs business message access to the service IP address IPs.

[0199] Step S1004b: address authenticity verification and service access legitimacy verification.

[0200] When a message passes through the ingress gateway, it is first filtered by the service access control table T1 (IPc-ID-IPs) (address authenticity verification and service access legitimacy verification). Only packets that meet the conditions can pass. Then, the egress gateway filters the service access control table T2 (ID-IPs), that is, service access legitimacy verification. If a match is found, the message is forwarded; otherwise, the message is discarded.

[0201] Among them, the messages involved in the above steps S1004-S1004b are functionally equivalent to the first message in the above embodiment. The address authenticity verification at the ingress gateway is functionally equivalent to the first service access verification in the above embodiment, and the service access legitimacy verification is functionally equivalent to the second service access verification in the above embodiment. In this embodiment, both verifications are completed based on the service access control table T1 (IPc-ID-IPs); the service access legitimacy verification at the egress gateway is functionally equivalent to the third service access verification in the above embodiment.

[0202] In this embodiment, service access verification is performed by using an access control list, which does not require the participation of a key and has a higher efficiency by status check verification.

[0203] In the above-mentioned embodiment of the present invention, by deploying service access verification strategies on demand at the border network devices such as the ingress gateway and the egress gateway or the key devices in the middle of the network, the trusted communication of the legitimate terminal to the application server is realized. The application server is protected from DoS (Denial of Service) network attacks and the application server resources are not accessed without authorization. At the same time, in this embodiment, the service access verification is advanced to the network controller and the border gateway, which can defend against network attacks and illegal access more timely than the service access verification in the related art which is usually authorized at the server end.

[0204] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0205] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0206] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0207] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0208] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0209] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0210] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A network communication method based on service access verification, characterized in that: include: The ingress gateway performs a first service access verification and a second service access verification on a first message sent by the terminal, and forwards the first message that passes the first service access verification and the second service access verification to the egress gateway, wherein the first service access verification is an identity authenticity verification, and the second service access verification is a legality verification; The egress gateway performs a third service access verification on the received first message, and forwards the first message that passes the third service access verification to the application server, wherein the third service access verification is a legality verification.

2. The method according to claim 1, characterized in that Before the ingress gateway performs the first service access verification and the second service access verification on the first message sent by the terminal, the method further includes: The ingress gateway performs the first service access verification and the second service access verification on the second message sent by the terminal, and forwards the second message that passes the first service access verification and the second service access verification to the egress gateway; The export gateway performs the third service access verification on the received second message, and forwards the second message that passes the third service access verification to the application server, so that the application server responds to the terminal's query destination address request based on the second message, and sends a response message carrying the destination address to the terminal.

3. The method according to claim 2, characterized in that: Before the ingress gateway performs the first service access verification and the second service access verification on the second message sent by the terminal, the method further includes: The ingress gateway performs the first service access verification and the second service access verification on the third message sent by the terminal; The entry gateway forwards the third message that passes the first service access verification and the second service access verification to the network controller, so that the network controller responds to the terminal's request for the service identifier of the application server based on the third message, and sends a response message carrying the service identifier of the application server to the terminal.

4. The method according to claim 3, characterized in that in, The first message, the second message or the third message includes at least one of the following fields: the source address of the terminal, the identity identifier of the terminal, the service identifier of the application server, the service identifier of the network controller, and a preset root key.

5. The method according to claim 4, characterized in that in, The source address is generated by a dynamic host configuration protocol server in response to a request from the terminal for a terminal IP address; the terminal identity is used by the terminal to make an access authentication request to an authentication server.

6. The method according to claim 4, characterized in that in, The first service access verification includes: verifying the following information of the first message, the second message or the third message through a service access control table: source address, media access control address and identity identifier, so as to verify the address authenticity of the first message, the second message or the third message.

7. The method according to claim 4, characterized in that in, The second service access verification includes one of the following: Generate a first verification code according to the identity identifier, the service identifier of the network controller and the root key carried in the third message, and compare the first verification code with the second verification code carried in the third message to verify the legitimacy of service access to the third message, wherein the second verification code is generated by the authentication server according to the identity identifier, the service identifier of the network controller and the root key after the terminal passes the identity authentication; the preset root key is generated by the authentication server and sent by the network controller to the ingress gateway and the egress gateway; Generate a third verification code according to the service identifier of the application server and the identity identifier carried by the second message, and compare the third verification code with a fourth verification code carried by the second message to verify the legitimacy of service access of the second message; wherein the fourth verification code is generated by the network controller according to the identity identifier and the service identifier of the application server carried by the third message; A fifth verification code is generated according to the source address, the destination address and the root key, and the fifth verification code is compared with the sixth verification code carried in the first message to verify the legitimacy of service access of the first message; wherein the sixth verification code is: when the second message passes the third service access verification, the export gateway generates it based on the source address, the destination address and the root key carried by the second message.

8. The method according to claim 7, characterized in that The third service access verification includes one of the following: The egress gateway generates a seventh verification code according to the source address, the destination address, and the root key, and compares the seventh verification code with the sixth verification code carried in the first message to verify the legitimacy of service access to the first message; The egress gateway generates a third verification code according to the service identifier of the application server and the identity identifier carried in the second message, and compares the third verification code with a fourth verification code carried in the second message to verify the legitimacy of service access of the second message.

9. The method according to claim 4, characterized in that in, The second service access verification includes one of the following: Generate an eighth verification code according to a preset public key of the authentication server and the identity identifier and the service identifier of the network controller carried in the third message, and compare the eighth verification code with a ninth verification code carried in the third message to verify the legitimacy of service access to the third message, wherein the ninth verification code is generated by the authentication server according to the identity identifier, the service identifier of the network controller and the private key of the authentication server after the terminal passes the identity authentication; The tenth verification code carried in the second message is signed by the public key of the network controller to verify the legitimacy of service access to the second message; wherein the tenth verification code is generated by the network controller according to the identity carried by the third message, the service identifier of the network controller, the identity, and the private key of the network controller; A first certificate is generated according to the source address, the destination address and the symmetric key of the ingress gateway carried by the first message, and the first certificate is compared with the second certificate carried in the first message to verify the legitimacy of service access of the first message; wherein the second certificate is generated based on the destination address and a first pre-certificate when the second message passes the second service access verification, the first pre-certificate is generated according to the source address carried by the second message and the symmetric key of the ingress gateway, and the destination address is obtained by the egress gateway through table lookup based on the application server identifier carried by the second message.

10. The method according to claim 9, characterized in that The third service access verification includes one of the following, including: The egress gateway generates a third certificate according to the source address, the destination address and the symmetric key of the ingress gateway carried by the first message, and compares the third certificate with the fourth certificate carried in the first message to verify the legitimacy of service access of the first message; wherein the fourth certificate is generated based on the destination address, the source address carried by the second message and the symmetric key of the ingress gateway when the second message passes the third service access verification; The egress gateway verifies the signature of the tenth verification code carried in the second message through the public key of the network controller to verify the legitimacy of service access to the second message.

11. The method according to claim 9 or 10, characterized in that: in, The device for generating the first ticket, the second ticket, the third ticket, or the fourth ticket includes one of the following: the egress gateway, the ingress gateway, the core switch, and the core router.

12. The method according to claim 4, characterized in that in, The ingress gateway performs the first service access verification and the second service access verification on the first message, the second message, or the third message through a service access control table, including one of the following: The ingress gateway verifies the source address, the identity identifier, and the service identifier of the network controller carried by the third message through the first service access control table to verify the identity authenticity and subscription legitimacy of the first message; The ingress gateway verifies the source address, the identity identifier, and the service identifier of the application server carried by the second message through a second service access control table to verify the identity authenticity and subscription legitimacy of the second message; The ingress gateway verifies the source address, the identity identifier, and the destination address carried by the first message through the third service access control table to verify the identity authenticity and subscription legitimacy of the first message.

13. The method according to claim 12, characterized in that The third service access verification includes at least one of the following: The egress gateway verifies the identity carried by the second message and the service identifier of the application server through a fourth service access control table; The egress gateway verifies the identity identifier and the destination address carried in the first message through a fifth service access control table.

14. A network communication system based on service access authentication, characterized in that: include: an ingress gateway, configured to perform a first service access verification and a second service access verification on a first message sent by a terminal, and forward the first message that passes the first service access verification and the second service access verification to an egress gateway, wherein the first service access verification is an identity authenticity verification, and the second service access verification is a legality verification; The egress gateway is configured to perform a third service access verification on the received first message, and forward the first message that passes the third service access verification to the application server.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 13 when executed by a processor.

16. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method described in any one of claims 1 to 13 are implemented.

Images