Information publishing system and method based on SDP

Abstract

The invention discloses an information issuing system based on an SDP. The information issuing system comprises an SDP client, an SDP controller, an SDP gateway, a server, a network, a player and a display device. The operation station (namely the SDP client) sends an SPA data packet to the SDP controller; the SDP controller receives and verifies authentication information in the SPA data packet, notifies the SDP gateways to accept a connection request of an operation station after verification is passed, and sends an SDP gateway list to the operation station, the operation station sends the SPA data packet to the SDP gateways in the list, and two-way encryption connection is established after verification is passed; and the operation station sends multimedia information to the server through the SDP gateway and by using the bidirectional encrypted data channel, and the server receives and stores the multimedia information sent by the operation station. And the player receives the multimedia information sent by the server, combines the multimedia information and sends the combined multimedia information to the display equipment. According to the invention, access control is carried out on the server by using the SDP technology, a security boundary can be dynamically created as required, and network resources are isolated from an unsecure network.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security, and in particular relates to an information publishing system and method based on SDP. Background Art

[0002] The information publishing system is mainly composed of servers, networks, players, and display devices. The server information is sent to the player through the network, and the player then combines audio, video, pictures, text and other information (including playback position and playback content, etc.) and transmits it to LCD TVs and other display devices that can accept audio and video input to form audio and video file playback.

[0003] In recent years, display devices in many public places (such as restaurants, shopping malls, and schools) have frequently been attacked by cyber attacks, playing inappropriate content, and even worse, during live conferences, live broadcast websites were attacked by Trojan viruses, causing the live broadcast websites to be out of control. The security issues in information publishing systems are becoming increasingly serious, and security incidents are occurring frequently.

[0004] At present, the commonly used methods to resist network attacks are offline display methods and manual content review and monitoring methods. Offline display means that the information publishing device is not connected to the network. Since the information publishing device is not connected to the network, it avoids network attacks. However, when uploading or changing the display content, the offline display method requires manual upload or modification of the display device one by one. The offline display method has problems such as difficult information management and heavy workload, and the manual content review and monitoring method requires a lot of time and manpower. Summary of the invention

[0005] In order to overcome the shortcomings of the above-mentioned prior art, the present invention proposes an information publishing system and method based on SDP to solve the problem that the information publishing system is easily attacked by the network, and avoids the inefficiency of offline display methods and manual content review and monitoring methods.

[0006] To achieve the above purpose, the present invention adopts the following technical means:

[0007] A first aspect of the present invention provides an information publishing system based on SDP, including an SDP client, an SDP controller, an SDP gateway, a server, a network, a player, and a display device;

[0008] The SDP client is deployed on an operation station, and the SDP client sends a SPA data packet to the SDP controller;

[0009] The SDP controller receives and verifies the authentication information in the SPA data packet. After the verification is successful, it notifies the SDP gateway to accept the connection request of the operation station and sends the SDP gateway list to the operation station. The operation station sends the SPA data packet to the SDP gateway in the list. After the verification is successful, a two-way encrypted connection is established.

[0010] The operation station sends multimedia information to the server through the SDP gateway and using a bidirectional encrypted data channel. The server receives and stores the multimedia information sent by the operation station. The player receives the multimedia information sent by the server and sends it to the display device in combination. The display device is used to display the multimedia information sent by the player.

[0011] A second aspect of the present invention further provides an information publishing method using the SDP-based information publishing system of the first aspect, comprising:

[0012] Deploy the SDP client on the operation station, and the SDP client sends SPA data packets to the SDP controller;

[0013] The SDP controller receives and verifies the authentication information in the SPA data packet. After the verification is successful, it notifies the SDP gateway to accept the connection request of the operation station and sends the SDP gateway list to the operation station. The operation station sends the SPA data packet to the SDP gateway in the list. After the verification is successful, a two-way encrypted connection is established.

[0014] The SDP client sends multimedia information to the server through the SDP gateway and using a bidirectional encrypted data channel. The server receives and stores the multimedia information. The player receives the multimedia information sent by the server and combines and sends it to the display device; the display device displays the multimedia information sent by the player.

[0015] Compared with the prior art, the present invention uses SDP (Software Defined Perimeter) technology to control access to the server, which can dynamically create a security boundary on demand, isolate network resources from unsafe networks, and prevent network resources and devices from being directly exposed to the Internet, thus avoiding external security threats and alleviating network attacks. In addition, the information publishing system based on SDP can publish or change information in real time, avoiding the problems of difficult information management and heavy workload of offline display methods.

[0016] Furthermore, the operation station of the present invention is also used for playback control functions such as user management, resource management, display device management, player management, and playback settings, and can edit, review, and publish playback content, and uniformly manage and control the player.

[0017] Furthermore, the implementation method of the present invention for establishing a two-way encrypted connection is as follows: the operation station first sends a SPA data packet to the SDP controller, and the SPA data packet includes authentication information. After receiving the SPA data packet, the SDP controller verifies the authentication information in the SPA data packet. After the operation station is verified, the SDP controller determines the list of SDP gateways to which the operation station can connect. In addition, the SDP controller notifies the SDP gateway to accept communications from the operation station and sends the SDP gateway list to the operation station. The operation station sends a SPA data packet to the authorized SDP gateway, i.e., the SDP gateway in the SDP gateway list. The SDP gateway also verifies the SPA data packet. When the verification is successful, the operation station, i.e., the SDP client, and these verified SDP gateways create a two-way encrypted connection. Through the two verifications of the SDP controller and the SDP gateway, it is possible to ensure that network resources are isolated from unsafe networks to avoid network attacks.

[0018] Furthermore, the SDP controller of the present invention determines a list of SDP gateways to which the operation station can connect, and the implementation method is as follows: the SDP controller groups users and resources according to the configuration, and configures different policies for different user groups, that is, the SDP controller determines the resources that the user can access based on the user's role or user group, and can adjust the user's resource access rights in real time according to the analysis results given by the risk assessment, generate a secure tunnel policy, and send it to the SDP client and SDP gateway.

[0019] Furthermore, the present invention sets a timeout retransmission mechanism at the operation station, and the SDP security framework uses a single-packet authorization and authentication technology. The operation station starts its timer after sending a SPA data packet to the SDP controller. When the value of the timer is equal to the time threshold, and the operation station has not received the SDP gateway list sent by the SDP controller, the operation station resends the SPA data packet to the SDP controller until it is sent successfully.

[0020] Furthermore, the information publishing system based on SDP of the present invention can push or modify the information on the terminal display device in real time, and the implementation method is as follows:

[0021] The multimedia information stored in the server is sent to the player through the network. The player combines the multimedia information (such as pictures, sounds, and text) and then transmits the combined information to a display device that can accept audio and video input to form an audio and video file for playback.

[0022] Furthermore, the SDP gateway of the server of the present invention is configured to discard all data packets, and unauthorized operating stations cannot scan the server port.

[0023] Furthermore, before the client of the present invention passes identity authentication and authorization, the SDP controller and the SDP gateway do not respond to any connection request. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the present application or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0025] Figure 1 It is a schematic diagram of the information publishing system framework based on SDP of the present invention.

[0026] Figure 2 It is a work flow chart of the information publishing system based on SDP of the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0028] refer to Figure 1 As shown, the information publishing system based on SDP of the present invention includes an SDP client, an SDP controller, an SDP gateway, a server, a network, a player and a display device.

[0029] In the information publishing system, the operation station is used for major functions such as user management, resource management, display device management, player management, and playback settings. It also edits, reviews, and publishes playback content, thereby uniformly managing and controlling the player. Specific means include adding, modifying, deleting, and searching.

[0030] refer to Figure 2As shown, the SDP client of the present invention is deployed on the operation station. The system uses SDP (Software Defined Perimeter) technology to perform access control on the server. The operation station sends a SPA data packet to the SDP controller. After the SDP controller receives the SPA data packet, the SDP controller verifies the authentication information in the received SPA data packet. After the verification is passed, the SDP controller determines the list of SDP gateways that the operation station can connect to based on the user identity. The SDP controller notifies the SDP gateway to accept the connection request of the operation station and sends the SDP gateway list to the operation station. The operation station sends a SPA data packet to the SDP gateway in the list. The SDP gateway also verifies the authentication information in the received SPA data packet, and only after the verification is passed, a two-way encrypted connection is established with the operation station.

[0031] In the present invention, the SPA data packets sent by the operation station to the SDP controller and the SDP gateway are all data packets used to request a connection, and are used by the SDP controller and the SDP gateway to authenticate the SDP client. The content of the SPA data packet mainly includes information such as user name, password, and target service identifier. Before the operation station (SDP client) of the present invention passes the identity authentication authorization, the SDP controller and the SDP gateway will not respond to any connection request. The sending of the two SPA data packets has a sequential relationship, that is, the SPA data packet is sent to the SDP controller first. After the SDP controller passes the verification, the SDP gateway list is sent to the operation station, and the operation station can send the SPA data packet to the SDP gateway. In this way, access control and data channels can be separated, which is conducive to hiding and protecting data servers and infrastructure, thereby preventing potential network attacks.

[0032] Next, the operation station sends multimedia information to the server through the SDP gateway using a two-way encrypted data channel. The server receives and stores the multimedia information sent by the operation station. The player receives the multimedia information sent by the server and combines and sends it to the display device; the display device is used to display the multimedia information sent by the player.

[0033] Since the SDP controller has a policy management function, it can group users and resources according to the configuration, and adjust the user's resource access rights in real time according to the analysis results given by the risk assessment. The policy management function of the SDP controller supports the configuration of different policies for different user groups, including roles, user groups, accessible resources, etc. At the same time, the SDP controller conducts risk assessment on the operation station (SDP client) through the risk information provided by the environmental perception system, and dynamically adjusts the policy according to the assessment results to generate a fine-grained access control policy. The SDP controller generates user access rights based on user permissions and policy specifications, generates a secure tunnel policy, and sends it to the operation station and SDP gateway.

[0034] In some embodiments of the present invention, a timeout retransmission mechanism can be set at the operation station. Specifically, a timer and a time threshold are set at the operation station, and the SDP security framework uses a single-packet authorization authentication technology. The operation station starts its timer after sending a SPA data packet to the SDP controller. When the value of the timer is equal to the time threshold, and the operation station has not received the SDP gateway list sent by the SDP controller, the operation station resends the SPA data packet to the SDP controller and resets the timer until the transmission is successful. In network communications, data packets may be lost or delayed due to network congestion, equipment failure, and other reasons. Therefore, the present invention sets a timeout retransmission mechanism at the operation station (SDP client) to improve the reliability of data transmission. The efficiency and reliability of network transmission can be improved by reasonably configuring the timeout time.

[0035] In some embodiments of the present invention, the information publishing system can push or modify the information on the terminal display device in real time, and the implementation method is as follows:

[0036] The multimedia information (text, pictures, audio, video, etc.) stored in the server is sent to the player through the network. The player combines various media information and then transmits the combined information to the display device that can accept audio and video input to form an audio and video file for playback. This method facilitates information management, reduces workload, and improves work efficiency. In addition, when a security incident occurs in the display device, the security incident can be handled in a timely manner.

[0037] One of the most critical and core components in the SDP architecture is the mandatory implementation of the "authentication before connection" security model. In the present invention, before the operation station (SDP client) passes the identity authentication authorization, the SDP controller and SDP gateway will not respond to any connection request, which can reduce the visibility of the server to unauthorized entities, minimize the attack surface, and thus reduce security risks.

[0038] In some embodiments of the present invention, the SDP gateway of the server is configured to discard all data packets, so that unauthorized operating stations cannot scan the server ports.

Claims

1. The information publishing system based on SDP is characterized by: Including SDP client, SDP controller, SDP gateway, server, network, player and display device; The SDP client is deployed on an operation station and sends a SPA data packet to the SDP controller; The SDP controller receives and verifies the authentication information in the SPA data packet. After the verification is successful, it notifies the SDP gateway to accept the connection request of the operation station and sends the SDP gateway list to the operation station. The operation station sends the SPA data packet to the SDP gateway in the list. After the verification is successful, a two-way encrypted connection is established. The operation station sends multimedia information to the server through the SDP gateway and using a bidirectional encrypted data channel. The server receives and stores the multimedia information sent by the operation station. The player receives the multimedia information sent by the server and combines and sends it to the display device; the display device is used to display the multimedia information sent by the player.

2. The information publishing system based on SDP according to claim 1, characterized in that: Use SDP technology to control access to the server.

3. The information publishing system based on SDP according to claim 1, characterized in that: The operation station is used for user management, resource management, display device management, player management and playback settings, and edits, reviews and publishes playback content, and uniformly manages and controls the players.

4. The information publishing system based on SDP according to claim 1, characterized in that: The operation station first sends a SPA data packet to the SDP controller, and the SPA data packet includes authentication information. After receiving the SPA data packet, the SDP controller verifies the authentication information in the data packet. After the operation station is verified, the SDP controller determines the list of SDP gateways to which the operation station can connect; The SDP controller notifies the SDP gateway to accept communications from the operation station. The SDP controller sends the SDP gateway list to the operation station. The operation station sends an SPA data packet to the authorized SDP gateway. The SDP gateway verifies the SPA data packet. After the verification is passed, the SDP client and these SDP gateways create a two-way encrypted connection.

5. The information publishing system based on SDP according to claim 4 is characterized in that: The SDP controller determines a list of SDP gateways to which the operator station can connect, and the implementation method is as follows: The SDP controller groups users and resources according to the configuration and configures different policies for different user groups. That is, the SDP controller determines the resources that users can access based on their roles or user groups, and adjusts the user's resource access rights in real time based on the analysis results given by the risk assessment, generates a secure tunnel policy, and sends it to the SDP client and SDP gateway.

6. The information publishing system based on SDP according to claim 1, characterized in that: A timeout retransmission mechanism is set at the operation station. The SDP system uses single-packet authorization and authentication technology. After the operation station sends a SPA data packet to the SDP controller, its timer is started. When the timer value is equal to the time threshold, and the operation station has not received the SDP gateway list sent by the SDP controller, the operation station resends the SPA data packet to the SDP controller until it is sent successfully.

7. The information publishing system based on SDP according to claim 1, characterized in that: The system can push or modify the information on the terminal display device in real time. The implementation method is as follows: The multimedia information stored in the server is sent to the player through the network. The player combines various media information and then transmits the combined information to a display device that can accept audio and video input to form an audio and video file for playback.

8. The information publishing system based on SDP according to claim 1, characterized in that: The SDP gateway of the server is set to discard all data packets, and unauthorized operating stations cannot scan the server port.

9. The information publishing system based on SDP according to claim 1, characterized in that: The SDP controller and SDP gateway do not respond to any connection requests before the client passes authentication and authorization.

10. The information publishing method using the SDP-based information publishing system of claim 1, characterized in that: include: Deploy the SDP client on the operation station, and the SDP client sends SPA data packets to the SDP controller; The SDP controller receives and verifies the authentication information in the SPA data packet. After the verification is successful, it notifies the SDP gateway to accept the connection request of the operation station and sends the SDP gateway list to the operation station. The operation station sends the SPA data packet to the SDP gateway in the list. After the verification is successful, a two-way encrypted connection is established. The operation station sends multimedia information to the server through the SDP gateway and using a bidirectional encrypted data channel, the server receives and stores the multimedia information, and the player receives the multimedia information sent by the server and sends it to the display device in combination; The display device displays the multimedia information sent by the player.

Images