Network service access control method and system

Abstract

The invention discloses a network service access control method and system, the method is applied to a network service provider, an auxiliary server, a target server and a firewall are deployed on the network service provider, a target service runs on the target server, and the method comprises the following steps: the auxiliary server receives a request of a user; the request is adapted to a predetermined message format of the auxiliary server, the content comprises combined information and a check code, and the combined information comprises an access identifier and a firewall setting command; the auxiliary server searches an associated target server according to the access identifier, and forwards the combined information and the check code to the target server; the target server verifies the combined information and the check code; and if the verification result is successful, the target server notifies the firewall to adjust the firewall setting related to the access of the user to the target service based on the setting command. According to the method, the security and universality of network service can be improved, and the access experience of a user is improved. The method can be widely applied to the technical field of network services.

Description

Technical Field

[0001] The present application relates to the technical field of network services, and in particular to an access control method and system for network services. Background Art

[0002] On the Internet, almost all network service providers have suffered from network spying (such as port scanning) and network attacks (such as denial of service, especially distributed denial of service) and have suffered greatly from them. The basic measure to deal with network spying and attacks is to use various firewalls, which protect network applications by filtering the source IP addresses of network requests. Enabling a firewall is only a passive defense measure: since it is impossible to predict whether each source IP address is legitimate or malicious, firewall administrators can usually only configure the firewall accordingly during or after network spying and attacks occur, so the effect is relatively delayed and limited. Another strategy is to limit the flow of services indiscriminately in advance. In this way, even if it is impossible to predict where malicious users come from, there will be an upper limit to the damage they can cause by launching attacks; however, normal users will also be affected, such as network speed reduction and congestion.

[0003] In the related field, some technical solutions "actively" hide network services (called target services) from the servers (called target servers) where they are located through the default firewall policy. Obviously, when such network services disappear from the Internet and cannot be reached, they are naturally immune to network spying or attacks. For those authorized users, the target server will instruct the firewall to release them separately when specific conditions are triggered, and become visible to them and only to them. For example, users can send messages to the target server in a specific form (i.e., knock codes). When these messages match the pre-configured rules of the network service provider, the firewall that is always closed by default is opened to the user. However, this implementation method is vulnerable to replay attacks, and the security of network services is affected; if the knock codes are changed frequently, it will cause inconvenience to users, and as time goes by, the knock codes will become more and more complicated and may even be exhausted. Summary of the invention

[0004] The purpose of this application is to solve one of the technical problems existing in the relevant field to at least a certain extent.

[0005] To this end, an object of an embodiment of the present application is to provide a method and system for access control of network services.

[0006] In order to achieve the above technical objectives, the technical solutions adopted by the embodiments of the present application include:

[0007] On the one hand, an embodiment of the present application provides an access control method for a network service, which is applied to a network service provider, wherein the network service provider is deployed with an auxiliary server, a target server, and a firewall, and a target service is running on the target server, and the method includes:

[0008] The auxiliary server receives a request from a user; wherein the request is adapted to a predetermined message format of the auxiliary server, the content of the request includes combination information and a check code generated according to the combination information, the combination information includes an access identifier and a setting command of the firewall regarding the user's access to the target service, and the setting command is an opening command or a closing command;

[0009] The auxiliary server searches for the associated target server according to the access identifier, and forwards the combination information and the verification code to the target server;

[0010] The target server verifies the combination information and the verification code;

[0011] If the verification result is passed, the target server notifies the firewall to adjust the firewall settings regarding the user's access to the target service based on the setting command.

[0012] In addition, the access control method for a network service according to the above embodiment of the present application may also have the following additional technical features:

[0013] Further, in one embodiment of the present application, the network service provider receives a registration request from the user for a target service under a first server, determines an authentication credential used by the user to access the target service, and allocates an access identifier for an access relationship between the user and the target service; wherein the first server is any of the target servers;

[0014] The network service provider registers and maintains an association relationship between the access identifier and the user, the target service, and the authentication credential used by the user to access the target service.

[0015] Furthermore, in one embodiment of the present application, the verification code is generated by the following steps:

[0016] The user obtains a current first timestamp;

[0017] The user calculates the verification code through a predetermined verification algorithm, with the authentication credential as a first input and the access identifier, the first timestamp and the setting command as a second input.

[0018] Furthermore, in one embodiment of the present application, the target server verifies the combination information and the verification code, including:

[0019] The target server obtains a current second timestamp;

[0020] The target server infers, based on the second timestamp, a sending timestamp used by at least one of the users when generating the verification code within a preset time difference;

[0021] The target server obtains the authentication credential corresponding to the user according to the access identifier;

[0022] Through a predetermined verification algorithm, the target server performs verification based on the authentication credential, the combined information, the sending timestamp and the verification code to obtain a verification result.

[0023] Further, in an embodiment of the present application, the first timing granularity of the first timestamp is different from the second timing granularity of the second timestamp; the target server infers, based on the second timestamp, within a preset error range, a sending timestamp used by at least one of the users when generating the verification code, including:

[0024] The target server converts the second timestamp according to the first timing granularity of the first timestamp to obtain a third timestamp; wherein the timing granularity of the third timestamp is the same as the first timing granularity;

[0025] The target server uses the third timestamp as the sending timestamp, or uses N timestamps of the first timing granularity adjacent to the third timestamp as the sending timestamp; wherein N is a positive integer.

[0026] Further, in one embodiment of the present application, the target server performs verification based on the authentication credential, the combined information, the sending timestamp and the verification code through a predetermined verification algorithm to obtain a verification result, including:

[0027] The target server performs verification based on the authentication credential, the combined information, each of the sending timestamps and the verification code through a predetermined verification algorithm to obtain a sub-verification result corresponding to each of the sending timestamps;

[0028] If any of the sub-verification results corresponding to the sending timestamp is passed, the target server determines that the verification result is passed;

[0029] If all sub-verification results corresponding to the sending timestamps are failed, the target server determines that the verification result is failed.

[0030] Furthermore, in an embodiment of the present application, the combination information further includes a first timestamp; and the target server verifies the combination information and the verification code, including:

[0031] The target server obtains a current second timestamp;

[0032] The target server calculates a time difference between the second timestamp and the first timestamp;

[0033] If the absolute value of the time difference is greater than the preset time difference, the target server determines that the verification result is failed.

[0034] Furthermore, in one embodiment of the present application, the target server verifies the combination information and the verification code, further comprising:

[0035] If the absolute value of the time difference is less than or equal to the preset time difference, the target server obtains the authentication credential corresponding to the user according to the access identifier;

[0036] Through a predetermined verification algorithm, the target server performs verification based on the authentication credential, the combined information and the verification code to obtain a verification result.

[0037] On the other hand, an embodiment of the present application provides another access control method for network services, which is applied to a network service provider, wherein the network service provider is deployed with an auxiliary server, a target server and a firewall, and a target service is running on the target server, and the method includes:

[0038] The auxiliary server receives a request from a user; wherein the request is adapted to a predetermined message format of the auxiliary server, the content of the request includes combination information and a check code generated according to the combination information, the combination information includes an access identifier and a setting command of the firewall regarding the user's access to the target service, and the setting command is an opening command or a closing command;

[0039] The auxiliary server searches for an associated target server according to the access identifier;

[0040] If the associated target server is found, the auxiliary server verifies the combination information and the verification code;

[0041] If the verification result is passed, the auxiliary server notifies the firewall to adjust the firewall settings for the user to access the target service based on the setting command.

[0042] On the other hand, an embodiment of the present application provides an access control system for a network service, including: an auxiliary server and a target server;

[0043] The auxiliary server is used to receive a request from a user; wherein the request is adapted to a predetermined message format of the auxiliary server, the content of the request includes combination information and a check code generated according to the combination information, the combination information includes an access identifier and a setting command of the firewall regarding the user's access to the target service, and the setting command is an opening command or a closing command;

[0044] The auxiliary server is used to search for the associated target server according to the access identifier;

[0045] The auxiliary server is further used to forward the combination information and the verification code to the target server or verify the combination information and the verification code, and when the verification result is passed, notify the firewall to adjust the firewall settings for the user to access the target service based on the setting command;

[0046] The target server is used to verify the combination information and the verification code, and when the verification result is passed, based on the setting command, notify the firewall to adjust the firewall settings regarding the user's access to the target service.

[0047] The advantages and benefits of the present application will be partially given in the following description, and partially become apparent from the following description, or be understood through the practice of the present application:

[0048] The embodiment of the present application discloses a method and system for controlling access to a network service, which is applied to a network service provider, wherein the network service provider is deployed with an auxiliary server, a target server and a firewall, and a target service is running on the target server, wherein the method comprises: the auxiliary server receives a user's request; wherein the request is adapted to a predetermined message format of the auxiliary server, and the content of the request comprises combination information and a check code generated according to the combination information, wherein the combination information comprises an access identifier and a setting command of the firewall regarding the user's access to the target service, wherein the setting command is an opening command or a closing command; the auxiliary server searches for an associated target server according to the access identifier, and forwards the combination information and the check code to the target server; the target server verifies the combination information and the check code; if the verification result is passed, the target server, based on the setting command, notifies the firewall to adjust the firewall settings regarding the user's access to the target service. The method can improve the security and versatility of network services and improve the user's access experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following introduction is made to the drawings of the embodiments of the present application or the related technical solutions in the prior art. It should be understood that the drawings introduced below are only for the convenience of clearly describing some embodiments of the technical solutions of the present application. For technical personnel in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0050] Figure 1 A schematic diagram of setting a firewall in the related field;

[0051] Figure 2 A flowchart of a method for controlling access to a network service provided in an embodiment of the present application;

[0052] Figure 3 A schematic diagram of an implementation scenario of a method for controlling access to a network service provided in an embodiment of the present application;

[0053] Figure 4 A schematic diagram of a process for generating a verification code provided in an embodiment of the present application;

[0054] Figure 5 A schematic diagram of a process for verifying combination information and a check code by a target server provided in an embodiment of the present application;

[0055] Figure 6 A schematic diagram of a process for verifying a target server based on authentication credentials, combined information, a sending timestamp and a check code provided in an embodiment of the present application;

[0056] Figure 7 A schematic diagram of a flow chart of another target server verifying the combination information and the verification code provided in an embodiment of the present application;

[0057] Figure 8 A flowchart of another network service access control method provided in an embodiment of the present application;

[0058] Fig. 9 A schematic diagram of a specific implementation flow of a method for controlling access to a network service provided in an embodiment of the present application;

[0059] Fig.10 A schematic diagram of an access control system for a network service provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] The present application is further described below in conjunction with the accompanying drawings and specific embodiments. The described embodiments should not be regarded as limiting the present application, and all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0061] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0062] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0063] 1) Network service is an application (also called a daemon) in a computer network such as the Internet, which is used to meet users' various computing and communication needs such as data storage, information retrieval and browsing, and remote host login.

[0064] 2) Port, an integer greater than or equal to 1 and less than or equal to 65535, is a software identifier. A network server (identified by a network address such as IPv4 or IPv6) can provide multiple network services at the same time, which are distinguished by protocols (connection-oriented TCP and connectionless UDP) plus port numbers, that is, network services are "bound" to protocols and port numbers.

[0065] 3) Message authentication code (MAC), a type of cryptographic algorithm used by both senders and receivers to verify the integrity of data, such as those described in the national standard GB / T 15852. Before using the message authentication code mechanism, the data sender and receiver must determine a shared authentication credential, typically a key.

[0066] On the Internet, almost all network service providers have suffered from network spying (such as port scanning) and network attacks (such as denial of service, especially distributed denial of service). The basic measure to deal with network spying and attacks is to use various firewalls, which protect network applications by filtering the source IP address of the network request. The following are two typical firewall policies, which are combined in tandem to filter the traffic entering the network, which can protect TCP port x on server X so that it is only open to source IP address A and hidden from the rest of the Internet:

[0067] {Source IP address A, protocol TCP, destination IP address X, destination port x}=>Accept

[0068] {Source IP address is arbitrary, destination IP address is X}=>discard

[0069] For example, please refer to Figure 1 , Figure 1 A schematic diagram of a firewall setting in the related field is shown. Figure 1 In the example, the firewall has the effect that visitors other than A, such as B, will think that server X does not exist on the Internet; B cannot find X, so he cannot spy on or attack it. If you need to open services for authorized user C in addition to A, you need to add a separate release policy for C as well.

[0070] However, enabling a firewall is only a passive defense measure: since it is impossible to predict whether each source IP is legitimate or malicious, firewall administrators can usually only configure the firewall accordingly during or after network espionage and attacks occur, so the effect is relatively delayed and limited. Another strategy is to limit the flow of services indiscriminately in advance. In this way, even if it is impossible to predict where malicious users come from, there will be an upper limit to the damage they can cause by launching attacks; however, normal users will also be affected, such as network speed reduction and congestion.

[0071] In the related field, some technical solutions "actively" hide network services (called target services) from the servers (called target servers) where they are located through the default firewall policy. Obviously, when such network services disappear from the Internet and cannot be reached, they are naturally immune to network spying or attacks. For those authorized users, the target server will instruct the firewall to release them separately when specific conditions are triggered, and become visible to them and only to them. For example, users can send messages to the target server in a specific form (i.e., knock codes). When these messages match the pre-configured rules of the network service provider, the firewall that is always closed by default is opened to the user.

[0072] For example, taking Linux and FreeBSD operating systems as examples, knockd is such a special daemon process, which listens to the TCP / UDP protocol messages received by the host from the network. When these messages match the rules pre-configured by the network service operator in the form of a specific event sequence, that is, a knock code (for example, three messages sequentially access the TCP ports 7000, 8000, and 9000 of the target server, even if these ports are not bound to network services), knockd will call the firewall command accordingly to open the default firewall that is always closed to and only to the source IP address that sent the correct knock code (here, accessing the predefined port in a predefined order). In other words, knockd will dynamically enable the "open hole release" policy on the firewall for the source IP address that "matches the code"; for the remaining source IP addresses, the firewall remains closed, that is, the target service remains invisible. In addition, knockd can also automatically close the release policy through time limits and other mechanisms.

[0073] However, there are some problems in the application of the above implementation method. For example, a network attacker may discover the knock code sent by the authorized user to the target server through monitoring, and then replay it. For example, for the above-mentioned embodiment of accessing the predefined port in a predefined order as the knock signal, after the network attacker monitors the request of the authorized user, he also sends messages to the TCP ports 7000, 8000, and 9000 of the target server in sequence. Then he will also be regarded as an authorized user by knockd, which may lead to account explosion, denial of service and other attack behaviors. In this regard, the relevant mitigation measure is that the network service provider preconfigures a long list of knock codes for knockd, each knock code is used only once, and it will be immediately invalidated after use and replaced by the next code (such as the access sequence of the predefined port is changed to 7070, 8080, 9090), and then replaced by the next code (such as the access sequence of the predefined port is changed to 7777, 8888, 9999), and so on. The disadvantages of this measure are also obvious: authorized users have to change their passwords every time, which is very inconvenient, and the long list of pre-configured passwords will eventually run out; when the website serves two or more authorized users at the same time, there will be conflicts between users, and no one knows which password others have already used, so no one is sure which password they should use next time, resulting in an embarrassing situation where they cannot log in. In addition, for security control and other reasons, some corporate networks or small ISPs have strict restrictions on outbound (uplink) traffic, allowing only access to the most commonly used ports such as 22, 53, 80, 123, and 443, and not allowing access to non-standard ports such as 7000, 7070, and 7777.

[0074] From the above, it can be seen that the existing technology has drawbacks in the security and versatility of network services, and the user experience is affected.

[0075] In view of this, an access control method for network services is provided in an embodiment of the present application, which is applied to a network service provider, wherein the network service provider is deployed with an auxiliary server, a target server and a firewall, and a target service is running on the target server, and the method comprises: the auxiliary server receives a user's request; wherein the request is adapted to a predetermined message format of the auxiliary server, and the content of the request comprises combination information and a check code generated according to the combination information, and the combination information comprises an access identifier and a setting command of the firewall regarding the user's access to the target service, and the setting command is an opening command or a closing command; the auxiliary server searches for the associated target server according to the access identifier, and forwards the combination information and the check code to the target server; the target server verifies the combination information and the check code; if the verification result is passed, the target server notifies the firewall to adjust the firewall settings regarding the user's access to the target service based on the setting command. This method can improve the security and versatility of network services and improve the user's access experience.

[0076] Please refer to Figure 2 , Figure 2 A flowchart of a network service access control method provided in an embodiment of the present application is shown. The network service access control method provided in an embodiment of the present application is applied to a network service provider, and the network service provider is deployed with an auxiliary server, a target server and a firewall, and the method comprises at least the following steps:

[0077] Step 210: The auxiliary server receives a request from the user; wherein the request is adapted to a predetermined message format of the auxiliary server, and the content of the request includes combination information and a verification code generated according to the combination information, and the combination information includes an access identifier and a setting command of the firewall regarding the user's access to the target service, and the setting command is an opening command or a closing command;

[0078] Step 220: the auxiliary server searches for the associated target server according to the access identifier, and forwards the combination information and the verification code to the target server;

[0079] Step 230: the target server verifies the combination information and the verification code;

[0080] Step 240: If the verification result is passed, the target server notifies the firewall to adjust the firewall settings regarding the user's access to the target service based on the setting command.

[0081] In the embodiment of the present application, the network service provider may deploy an auxiliary server, a target server and a firewall, wherein a target service is run on the target server, and the target service may be a network service that is only for a few special users (such as VIP users). The number of target services running on the target server may be one or more, and the present application does not limit the number. Similarly, an auxiliary service is run on the auxiliary server, and the auxiliary service is a service that can be accessed by potential users (no matter where they are on the Internet, even in a strictly controlled corporate network or a small ISP), which can use a commonly used port number, and the number of auxiliary services running on the auxiliary server may also be one or more. It should be noted that in the embodiment of the present application, the auxiliary service may be a fictitious service, that is, it does not actually provide a real service, and does not even respond to any request (that is, it is silent and invisible). In the embodiment of the present application, the firewall deployed by the network service provider is used to protect the target server, and the firewall can allow or deny user access to the target service through corresponding settings. Of course, in some embodiments, the firewall can also be used to protect the auxiliary server, and the present application does not limit this.

[0082] In some embodiments, the target service and the auxiliary service may run on the same server, that is, the auxiliary server and the target server may be the same server. In other embodiments, the auxiliary server and the target server may also be different servers, and the number of the auxiliary server and the target server may be one or more.

[0083] For example, please refer to Figure 3 , Figure 3 A schematic diagram of an implementation scenario of a network service access control method provided in an embodiment of the present application is shown. Figure 3 In the example, the network service provider can build two auxiliary servers, namely DNS1.example.com and DNS2.example.com. The firewall of the target server (i.e. SSH.example.com) (which may or may not be located on the target server) closes the access from the outside to the target service by default, and the auxiliary server does not access the target service. However, the auxiliary server maintains communication with the target server through a secure channel (such as VPN) to forward the knock code. The auxiliary server and the target server can be physical machines or virtual machines. The auxiliary server and the target server are both located in the autonomous domain (example.com) of the network service provider, and the secure channel between them is maintained by the network service provider. If the user comes from the Internet outside the autonomous domain and a firewall is deployed between the user and the target server, a firewall may or may not be deployed between the user and the auxiliary server.

[0084] For authorized users of the target server, they can send a request to the network service provider to adjust the firewall settings for accessing the target service on the target server. Specifically, the user can send a request to the auxiliary server, and the message format of the request is adapted to the predetermined message format of the auxiliary server. For example, for example, an auxiliary service adapted to the DNS service can be run on the auxiliary server, and the request received by the auxiliary server can default to the message format of the DNS request, for example, it can include a domain name in the format of "knock code.example.com". Of course, it can be understood that the predetermined message format of the actual auxiliary server can be determined according to the specific situation, and this application does not limit this.

[0085] In the request initiated by the user, there may be combined information and a check code generated according to the combined information, and the combined information may include an access identifier and a setting command specified by the user. Among them, the access identifier is an identifier assigned by the network service provider for the access relationship between the authorized user and the target service. The access identifier is used to register the access relationship of "user-target service", and its specific data content may include numbers or characters, etc., which is not limited in this application. The setting command in the combined information can be used to adjust the firewall settings for the user to access the target service, and the target service is the target service associated with the access identifier. For example, if the current authorized user wants the firewall to open the target service for himself, the setting command can be a command to open the target service, and vice versa, the setting command can also be a command to close the target service. In the embodiment of the present application, there is no limitation on the specific content form of the setting command and the meaning of opening or closing it represents. Exemplarily, for example, in some embodiments, the setting command can use 1 bit of data, such as 1 for opening and 0 for closing.

[0086] In the embodiment of the present application, the check code can be generated according to the combined information, for example, the check code can be generated by related cryptographic calculations. For example, in an asymmetric cryptographic system, a digital signature can be used to generate the check code; in a symmetric cryptographic system, a message authentication code can be used to generate the check code.

[0087] The auxiliary service may be virtual, that is, the service may not actually be provided. After receiving the user's request, the auxiliary server may directly extract the combination information and the check code in the request without responding to the request. After obtaining the combination information and the check code, the auxiliary server may search for the associated target server according to the access identifier in the combination information. It can be understood that the access identifier registers the access relationship of "user-target service", and the location of the target server where the target service is located is clear. Therefore, the association relationship between the access identifier and the target server can be clearly determined based on the relationship between the access identifier-target service-target server. If the associated target server is found, the auxiliary server may forward the combination information and the check code to the target server. After receiving the combination information and the check code, the target server may verify them and obtain the corresponding verification result. There are two types of verification results, namely, pass and fail. When the verification result is pass, it can be determined that the user is an authorized user, so that the user can adjust the firewall settings for accessing the target service according to the setting command. In contrast, if the verification result is fail, the setting command may not be responded to, that is, the request is discarded.

[0088] It is understandable that in the embodiment of the present application, if the auxiliary server cannot find the target server associated with the access identifier after the user initiates a request, the request can be discarded without subsequent processing.

[0089] In some embodiments, the method in the embodiment of the present application may also include a preparation stage, during which the user may register for authorization with the network service provider to determine the authorized users corresponding to each target service. In this stage, the user may send a registration request to the network service provider, which may be used to register the user's legal access rights to a target service. In the embodiment of the present application, the target server where the target service for which the user requires to register legal access rights is located is recorded as the first server, the first server may be any target server, and the target service for which the user requires to register legal access rights may be any target service on the first server.

[0090] After the network service provider receives the user's registration request for the target service under the first server, it can determine the authentication credential used by the user to access the target service and assign an access identifier to the access relationship between the user and the target service. Among them, the authentication credential can be used to verify the user's access rights to the target service later. This application does not limit the specific source of the authentication credential. For example, in some embodiments, it can be provided by the network service provider to the user. In some embodiments, it can also be selected by the user. This application does not limit this. The access identifier is used to identify the access relationship between a group of users and the target service. Different access relationships correspond to different access identifiers. For example, for the same user, the access identifiers corresponding to the access relationships between him and different target services are different; for the same target service, the access identifiers corresponding to the access relationships between different users and the target service are also different.

[0091] In the embodiment of the present application, the network service provider can also register and maintain the association between the access identifier and the user, the target service, and the authentication credential used by the user to access the target service, so as to facilitate the subsequent determination of the target service or authentication credential corresponding to the request based on the access identifier. The user can modify or reset the authentication credential used by himself according to actual needs, and after the adjustment, the network service provider can update the association between the access identifier and the authentication credential.

[0092] Exemplarily, when registering the above-mentioned association relationship, the network service provider can use the access identifier as the key, and the user, the target service, and the authentication credential used by the user to access the target service as the value to establish a key-value pair to store their association relationship. For example, in some embodiments, the user, the target service, and the authentication credential used by the user to access the target service can be used as a whole as the value to register the above-mentioned association relationship, and the corresponding key-value pair is expressed as (access identifier, (user, target service, authentication credential)). In some embodiments, the user, the target service, and the authentication credential used by the user to access the target service can also be used as a value to register the above-mentioned association relationship, and the corresponding number of key-value pairs is multiple, expressed as (access identifier, user), (access identifier, target service) and (access identifier, authentication credential). In particular, in an embodiment of the present application, in order to facilitate quick verification of whether the user has registered the relevant access relationship during registration, in an embodiment of the present application, the user and the target service as a whole can be taken as one value, and the access identifier can be used as the key to construct a key-value pair, and the authentication credential used by the user to access the target service can be used as another value, and the access identifier can be used as the key to construct another key-value pair. The resulting key-value pair is expressed as (access identifier, (user, target service)), (access identifier, authentication credential).

[0093] It should be pointed out that in the embodiment of the present application, the association relationship registered and maintained by the network service provider can be stored by the network service provider on a dedicated registration server for query by the auxiliary server or the target server, or can be directly stored locally on the auxiliary server or the target server as needed. This application does not impose any restrictions on this.

[0094] Specifically, in some embodiments, referring to Figure 4 , Figure 4 A schematic diagram of a flow chart for generating a verification code provided in an embodiment of the present application is shown. In an embodiment of the present application, when generating a verification code in a request, a user can obtain a current timestamp and record the timestamp here as a first timestamp. Then, the user can calculate the corresponding verification code through a predetermined verification algorithm, with the authentication credential as one input, recorded as the first input, and the access identifier, the first timestamp and the setting command as another input, recorded as the second input. The present application does not limit the type of verification algorithm used in the process. For example, a message authentication code can be used as a predetermined verification algorithm.

[0095] for Figure 4 The verification code generation process shown is shown in Figure 5 , Figure 5 A schematic diagram of a process for verifying combination information and a check code by a target server provided in an embodiment of the present application is shown. In this embodiment, the combination information does not include content related to the timestamp. When verifying the combination information and the check code, the target server can estimate the timestamp used by the user when generating the check code by inference. It is easy to understand that after the user generates the check code, the request is sent to the target server. The whole process is relatively short. Therefore, the target server can infer the timestamp used by the user when generating the check code based on the timestamp when the request is received. In the embodiment of the present application, the timestamp when the target server receives the request is recorded as the second timestamp. When the target server receives the request, it can determine the second timestamp by querying the current timestamp; in addition, the timestamp used by the target server when the user generates the check code is recorded as the sending timestamp.

[0096] In an embodiment of the present application, when the target server infers the sending timestamp, it can estimate the sending timestamp within the preset time difference based on the second timestamp. The preset time difference here is used to limit a desirable time range, that is, the absolute value of the time difference between the selected sending timestamp and the second timestamp needs to be less than or equal to the preset time difference. For example, several timestamps before (or after) the second timestamp can be selected as the sending timestamp, that is, the number of candidates for the sending timestamp can be multiple. Of course, in some embodiments, a sending timestamp can also be inferred, and this application does not limit this.

[0097] It is easy to understand that, assuming that the clocks of the target server and the user side are synchronized, the timestamp (i.e., the first timestamp) used by the user when actually generating the verification code will be slightly earlier than the second timestamp. Therefore, the timestamp before the second timestamp can be selected as the estimated sending timestamp. In other cases, the clocks of the target server and the user side may not be synchronized, which will cause the first timestamp and the second timestamp to be misaligned. For example, the first timestamp recorded on the user side is later than the second timestamp recorded on the target server side. In order to take these situations into account as much as possible, in the embodiments of the present application, the timestamp after the second timestamp can also be selected as the estimated sending timestamp. This application does not limit the specific number of estimated sending timestamps.

[0098] As described above, the network service provider can register the association between the access identifier and the authentication credential in advance, so the target server can obtain the corresponding authentication credential based on the access identifier. Then, the target server can perform verification based on the authentication credential, the combined information, the sending timestamp and the check code to obtain the corresponding verification result.

[0099] Reference Figure 6 , Figure 6 A flow chart of a target server provided in an embodiment of the present application for verification based on authentication credentials, combined information, a sending timestamp and a check code is shown. In an embodiment of the present application, the number of inferred sending timestamps can be multiple, so when the target server performs verification, each sending timestamp can be used for verification one by one through a predetermined verification algorithm. That is, verification is performed based on the authentication credentials, combined information, each sending timestamp and a check code to obtain a verification result corresponding to each sending timestamp, which can be recorded as a sub-verification result in an embodiment of the present application. If there is a sub-verification result corresponding to any sending timestamp that is passed, it means that the inferred sending timestamp is the same as the first timestamp, and the request is legal, and the target server can determine that the verification result is passed. If the sub-verification results corresponding to all the sending timestamps are not passed, it is highly likely that the request is illegal, and the target server can determine that the verification result is not passed.

[0100] Of course, it is understandable that in the embodiment of the present application, when the target server actually performs verification, it can determine that the verification result is passed and end the verification process when it determines that a certain sub-verification result is passed, without having to determine other sub-verification results. Moreover, in the embodiment of the present application, verifying the request based on the timestamp can effectively resist replay attacks.

[0101] It should be noted that, in some embodiments, the timing granularity of the timestamp used by the user side may be different from the timing granularity used by the target server side, and the first timing granularity of the obtained first timestamp is different from the second timing granularity of the second timestamp. For example, the timing granularity of the timestamp used by the user side is seconds, and the timing granularity used by the target server side is milliseconds. In this case, when the target server infers the sending timestamp, it can first convert the timing granularity of the second timestamp and convert it into timestamp data with the same timing granularity as that used by the first timestamp.

[0102] In an embodiment of the present application, the timing granularity of the timestamp used by the user side (that is, the timing granularity of the first timestamp) is recorded as the first timing granularity, and the timing granularity of the timestamp used by the target server (that is, the timing granularity of the second timestamp) is recorded as the second timing granularity. When inferring the sending timestamp, the second timestamp can be converted according to the first timing granularity to obtain a third timestamp, so that the timing granularity of the obtained third timestamp is the same as the first timing granularity. Then, the target server can determine the sending timestamp under the first timing granularity based on the third timestamp. For example, in some embodiments, the third timestamp can be directly used as the sending timestamp; in some embodiments, the timestamps of the N first timing granularities adjacent to the third timestamp can be used as the sending timestamp, where N is a positive integer, and its size can be flexibly adjusted according to actual needs, and the present application does not impose any restrictions on this.

[0103] In the embodiment of the present application, in the aforementioned example, the combined information received by the target server does not include the first timestamp, and the request can be verified by inferring the sending timestamp. In other embodiments, the combined information sent by the user may also include the first timestamp, and in this case, the check code can be generated based on the combined information including the first timestamp. For this implementation, when verifying the request, the target server can directly use the first timestamp without inferring the sending timestamp.

[0104] Please refer to Figure 7 , Figure 7 Another flow chart of verification of combination information and check code by a target server provided in an embodiment of the present application is shown. In the embodiment of the present application, when verifying the combination information and check code, the target server can also obtain the current timestamp, i.e., the second timestamp. Then, the target server can calculate the time difference between the second timestamp and the first timestamp. For the time difference, the preset time difference described in the previous embodiment can be used for comparison. If the absolute value of the time difference is greater than the preset time difference, it means that the first timestamp used in the request is earlier, and may have expired or is a malicious request of a replay attack. Therefore, in this case, the target server can directly determine that the verification result is not passed.

[0105] In contrast, if the absolute value of the time difference is less than or equal to the preset time difference, it means that the request is fresh, and the target server can further obtain the authentication credentials corresponding to the user based on the access identifier, and then verify based on the authentication credentials, combined information and verification code through a predetermined verification algorithm to obtain a verification result. Similarly, the verification result obtained here is pass or fail. If the verification result is pass, it can be determined that the user is an authorized user, so that the firewall settings for the user to access the target service can be adjusted according to the setting command. If the verification result is fail, the setting command can be ignored, that is, the request is discarded.

[0106] Reference Figure 8 In an embodiment of the present application, another access control method for network services is also provided, the method comprising:

[0107] The auxiliary server receives a request from a user; wherein the request is adapted to a predetermined message format of the auxiliary server, the content of the request includes combination information and a check code generated according to the combination information, the combination information includes an access identifier and a setting command of the firewall regarding the user's access to the target service, and the setting command is an opening command or a closing command;

[0108] The auxiliary server searches for an associated target server according to the access identifier;

[0109] If the associated target server is found, the auxiliary server verifies the combination information and the verification code;

[0110] If the verification result is passed, the auxiliary server notifies the firewall to adjust the firewall settings for the user to access the target service based on the setting command.

[0111] The method in the embodiments of the present application, and Figure 2 The methods shown in the figure have the same application scenarios. The difference is that Figure 2 In the method shown, the process of verifying and notifying the firewall is mainly executed by the target server, while in the embodiment of the present application, the process of verifying and notifying the firewall may not be completed by the target server but transferred to the auxiliary server, so that in addition to verifying the access identifier, it can also undertake more auxiliary tasks, thereby reducing the load of the target server as much as possible, which is conducive to improving the fluency and stability of the services provided by the target server.

[0112] It can be understood that the contents of the above method embodiments are all applicable to this embodiment, and the functions specifically implemented in this embodiment are the same as those in the above method embodiments, which will not be elaborated here.

[0113] In the following, in conjunction with a specific application scenario, an access control method for a network service provided in an embodiment of the present application is introduced and explained.

[0114] Embodiment 1:

[0115] A cloud computing company provides host services to the outside world. Some tenants purchase VIP security protection because they do not want the host to be detected by the outside world (including various network worms and crawlers, as well as robots that conduct automated attacks such as account blasting) and only be accessed by tenants privately. The cloud computing company supports 32,768 VIP tenants (this is because 15-bit access identifiers are used to register the access relationship between users and target services, and these access identifiers can be recycled). Different tenants request the cloud computing company to deploy their own target services. Each target service uses a set of firewalls and a group of auxiliary servers deployed by the cloud computing company. The auxiliary service running on the auxiliary server is the DNS service.

[0116] In the preparation stage, user A applies to the cloud computing company for VIP security protection, and for this he needs to register his target service, such as TCP port 22 of 66.55.44.33. Assume that the access ID assigned to the access relationship between user A and the target service is 100, and the key he registers is 0x000102030405060708090A0B0C0D0E0F (the number starting with 0x is a hexadecimal unsigned integer, the same below). This is the symmetric key shared with the cloud computing company, and serves as the authentication credential used by user A to access the target service. For the following data processing process, please refer to Fig. 9 .

[0117] During the use phase, user A initiates a request to "open a hole" in the firewall at 10:00 a.m. on January 1, 2025 to access his target service. For this purpose, user A's client sets {combined information} = {0x80646774A1A0}, with the format of {1-bit opening / closing indication||15-bit access id||32-bit UNIX timestamp}, where || represents the concatenation of binary data (it is easy to verify the correctness of this combined information, for example, 0x0064 is the access id, and the highest bit becomes 0x8064 because it is an opening indication, and 0x6774A1A0 = 1735696800 is the UNIX timestamp). The HMAC-MD5 calculated based on the symmetric key key and the combined information is {check code} = {0x8f03143705f625bb1d99708b23132286}.

[0118] User A initiates a request, and the client encodes {combined information, check code} according to the predetermined message format of the auxiliary server. In the embodiment of the present application, the virtual auxiliary service on the auxiliary server is a DNS service, so the message format of the encoding result is a domain name, such as 80646774A1A08f03143705f625bb1d99708b23132286.example.com, and its total length is only 56 characters, which is far less than the upper limit of the full domain name in the Internet specification (usually 253 characters). The client sends this domain name as a knock signal to one of the auxiliary servers. The auxiliary server receives it at 10:00:01. It finds that the UNIX timestamp 0x6774A1A0 extracted from the knock signal is 1 second ago, so it is fresh enough. The extracted access id is 0x64, which is a valid id. The corresponding authentication certificate can prove that the received {combined information, checksum} is legal. Therefore, it searches for the target server and port (that is, the target service) corresponding to the access id, and calls the firewall interface to open the access policy for the target service for user A. After that, the target service is available to user A, but remains invisible to the rest of the Internet. After the visit, user A can explicitly close this policy (or wait for it to be automatically deleted by the firewall after a timeout). Assuming that user A initiates the request at 10:59:59 am on January 1, 2025, {combination information} = {0x00646774AFAF}, {check code} = {0x15e160a4cbbb55bb4c3a2987d72836d6}.

[0119] like Fig. 9 As shown, in the embodiment of the present application, user A is the sender, and the cloud computing company, as the network service provider, is the receiver. The actual process of verifying the request and notifying the firewall to execute the relevant policy can be executed on the auxiliary server or on the target server, and the present application does not limit this.

[0120] Embodiment 2:

[0121] Company Z tries to avoid opening its exposure to the Internet for security reasons and compliance pressure. Company Z has its own office automation website https: / / OA.example.com, which is closed to the external network by default, and employees can access it from the company's intranet. When employees are at home or on a business trip, they can use this application to open access to the target service, that is, the OA network. Since all employees of Company Z have only one target service, https: / / OA.example.com, the access id can be degenerated into the employee id. Company Z has a stable staff of dozens of people, and each employee will receive a USB memory when he joins the company. It stores the client software installation program for accessing the target service from the external network, as well as the symmetric key associated with the employee id. For example, employee V with id 99 was assigned a symmetric key with a value of 0xF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF during the preparation stage of this application, which can be used as an authentication credential.

[0122] In the use phase, the embodiment of the present application adopts the timestamp in minutes instead of seconds, that is, the UNIX timestamp is divided by 60 and the possible remainder is discarded. The purpose of this is to implicitly transmit the timestamp. The overall request process is as follows:

[0123] Step 1: Employee V's client initiates a knock code at 14:59:59 on December 31, 2030. It sets {combined information} = {0xE301E98903}, with the format of {1-bit on / off indication||7-bit access ID||32-bit timestamp}, where the UNIX timestamp of the initiation time is 1924930799, divided by 60 to get 32082179, which is 0x01E98903. The HMAC-MD5 corresponding to this complete combined information is 0x32d03626fe041079a6db6505bd51ca47. However, when the client encodes {combined information, checksum}, it discards the timestamp 0x01E98903 instead of explicitly passing it, so E332d03626fe041079a6db6505bd51ca47.example.com becomes the encoded domain name, and the length is reduced to only 46 characters. The client randomly selects DNS3.example.com from the auxiliary server and sends the domain name to it, just like a normal DNS resolution request.

[0124] In step 2, the auxiliary server extracts the employee ID 99 from the domain name, and finds that this is the currently valid ID, so it forwards the knock code and the IP address of employee V to the target server where the target service registered with this ID is located.

[0125] Step 3: The target server receives the knock code at 15:00:01 on December 31, 2030. As mentioned above, the knock code E332d03626fe041079a6db6505bd51ca47 does not contain a timestamp. However, the local timestamp of the target server is 1924930801 / 60=32082180=0x01E98904. Based on this, the target server knows that the client's timestamp should be one of 0x01E98904 and 0x01E98903, and the complete combination information is one of {0xE301E98904} and {0xE301E98903}. The target server extracts the key with id 0x63, verifies {combination information, check code}, and only considers the knock code illegal if both candidates of the combination information fail to be verified. As a result, the combination of information {0xE301E98903} passed the verification, so the target server called the firewall management interface to "open a hole and let it pass" for V.

[0126] Step 4: Employee V accesses the OA network normally. Employee V can explicitly close the release policy after the access is completed. During this process, the timestamp is still not explicitly transmitted but implicitly transmitted to shorten the length of the domain name after the knock code is encoded. Employee V can also wait for the firewall to automatically delete the release policy opened for him after the access is completed.

[0127] It can be understood that the technical solution in the embodiments of the present application has at least the following advantages:

[0128] 1) A knock code based on timestamp and checksum is introduced to replace port knocking, which effectively solves the problem that the knock code is vulnerable to replay attack / the knock code will be exhausted.

[0129] 2) The verification code mechanism only requires the user to save a fixed key that can be revoked when necessary (rather than a long string of one-time codes), which solves the user usability problem.

[0130] 3) An auxiliary server is introduced, and the knock code is packaged as a request for an auxiliary service, which overcomes the problem that port knocking cannot be used in some corporate networks or ISPs. The fictitious auxiliary service also makes the knock code more concealed. The protected target service is not visible to the outside world, and the security is better.

[0131] 4) A user management mechanism was introduced, based on which user isolation of verification codes was implemented, allowing multiple users to access the target service at the same time, solving the problem of multiple users being coupled and affecting each other.

[0132] Reference Fig.10 , In an embodiment of the present application, there is also provided an access control system for a network service, which includes an auxiliary server 1020 and a target server 1010;

[0133] The auxiliary server is used to receive a request from a user; wherein the request is adapted to a predetermined message format of the auxiliary server, the content of the request includes combination information and a check code generated according to the combination information, the combination information includes an access identifier and a setting command of the firewall regarding the user's access to the target service, and the setting command is an opening command or a closing command;

[0134] The auxiliary server is used to search for the associated target server according to the access identifier;

[0135] The auxiliary server is further used to forward the combination information and the verification code to the target server or verify the combination information and the verification code, and when the verification result is passed, notify the firewall to adjust the firewall settings for the user to access the target service based on the setting command;

[0136] The target server is used to verify the combination information and the verification code, and when the verification result is passed, based on the setting command, notify the firewall to adjust the firewall settings regarding the user's access to the target service.

[0137] It can be understood that the contents of the above method embodiments are all applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0138] The method in the embodiment of the present application can be set in a computer-readable storage medium, and the computer-readable storage medium can be used in an auxiliary server and a target server to execute relevant program codes, thereby realizing the above-mentioned application of the present application.

[0139] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the application is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part described as a larger operation is performed independently.

[0140] In addition, although the present application is described in the context of functional modules, it should be understood that, unless otherwise specified, one or more of the functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present application. More specifically, in view of the properties, functions, and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional techniques of the engineer. Therefore, those skilled in the art can implement the present application set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present application, which is determined by the full scope of the attached claims and their equivalents.

[0141] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

[0142] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0143] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0144] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0145] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0146] Although the embodiments of the present application have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present application, and that the scope of the present application is defined by the claims and their equivalents.

[0147] The above is a specific description of the preferred implementation of the present application, but the present application is not limited to the embodiments. Technical personnel familiar with the field can make various equivalent modifications or substitutions without violating the spirit of the present application. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present application.

Claims

1. A method for controlling access to a network service, characterized in that: Applied to a network service provider, the network service provider is deployed with an auxiliary server, a target server and a firewall, and a target service is running on the target server. The method includes: The auxiliary server receives a request from a user; wherein the request is adapted to a predetermined message format of the auxiliary server, the content of the request includes combination information and a check code generated according to the combination information, the combination information includes an access identifier and a setting command of the firewall regarding the user's access to the target service, and the setting command is an opening command or a closing command; The auxiliary server searches for the associated target server according to the access identifier, and forwards the combination information and the verification code to the target server; The target server verifies the combination information and the verification code; If the verification result is passed, the target server notifies the firewall to adjust the firewall settings regarding the user's access to the target service based on the setting command.

2. A method for controlling access to network services according to claim 1, characterized in that: The method further comprises: The network service provider receives a registration request from the user for a target service under a first server, determines an authentication credential used by the user to access the target service, and allocates an access identifier for an access relationship between the user and the target service; wherein the first server is any of the target servers; The network service provider registers and maintains an association relationship between the access identifier and the user, the target service, and the authentication credential used by the user to access the target service.

3. A method for controlling access to network services according to claim 2, characterized in that: The verification code is generated by the following steps: The user obtains a current first timestamp; The user calculates the verification code through a predetermined verification algorithm, with the authentication credential as a first input and the access identifier, the first timestamp and the setting command as a second input.

4. A method for controlling access to network services according to claim 3, characterized in that: The target server verifies the combination information and the verification code, including: The target server obtains a current second timestamp; The target server infers, based on the second timestamp, a sending timestamp used by at least one of the users when generating the verification code within a preset time difference; The target server obtains the authentication credential corresponding to the user according to the access identifier; Through a predetermined verification algorithm, the target server performs verification based on the authentication credential, the combined information, the sending timestamp and the verification code to obtain a verification result.

5. A method for controlling access to network services according to claim 4, characterized in that: A first timing granularity of the first timestamp is different from a second timing granularity of the second timestamp; The target server infers, based on the second timestamp, within a preset error range, a sending timestamp used by at least one of the users when generating the verification code, including: The target server converts the second timestamp according to the first timing granularity of the first timestamp to obtain a third timestamp; wherein the timing granularity of the third timestamp is the same as the first timing granularity; The target server uses the third timestamp as the sending timestamp, or uses N timestamps of the first timing granularity adjacent to the third timestamp as the sending timestamp; wherein N is a positive integer.

6. A method for controlling access to network services according to claim 4, characterized in that: The target server performs verification based on the authentication credential, the combination information, the sending timestamp and the verification code through a predetermined verification algorithm to obtain a verification result, including: The target server performs verification based on the authentication credential, the combined information, each of the sending timestamps and the verification code through a predetermined verification algorithm to obtain a sub-verification result corresponding to each of the sending timestamps; If any of the sub-verification results corresponding to the sending timestamp is passed, the target server determines that the verification result is passed; If all sub-verification results corresponding to the sending timestamps are failed, the target server determines that the verification result is failed.

7. A method for controlling access to network services according to claim 1, characterized in that: The combined information further includes a first timestamp; the target server verifies the combined information and the verification code, including: The target server obtains a current second timestamp; The target server calculates a time difference between the second timestamp and the first timestamp; If the absolute value of the time difference is greater than the preset time difference, the target server determines that the verification result is failed.

8. A method for controlling access to network services according to claim 7, characterized in that: The target server verifies the combination information and the verification code, further comprising: If the absolute value of the time difference is less than or equal to the preset time difference, the target server obtains the authentication credential corresponding to the user according to the access identifier; Through a predetermined verification algorithm, the target server performs verification based on the authentication credential, the combined information and the verification code to obtain a verification result.

9. A method for controlling access to a network service, characterized in that: Applied to a network service provider, the network service provider is deployed with an auxiliary server, a target server and a firewall, and a target service is running on the target server. The method includes: The auxiliary server receives a request from a user; wherein the request is adapted to a predetermined message format of the auxiliary server, the content of the request includes combination information and a check code generated according to the combination information, the combination information includes an access identifier and a setting command of the firewall regarding the user's access to the target service, and the setting command is an opening command or a closing command; The auxiliary server searches for an associated target server according to the access identifier; If the associated target server is found, the auxiliary server verifies the combination information and the verification code; If the verification result is passed, the auxiliary server notifies the firewall to adjust the firewall settings for the user to access the target service based on the setting command.

10. An access control system for network services, characterized in that: include: Auxiliary servers and target servers; The auxiliary server is used to receive a request from a user; wherein the request is adapted to a predetermined message format of the auxiliary server, the content of the request includes combination information and a check code generated according to the combination information, the combination information includes an access identifier and a setting command of the firewall regarding the user's access to the target service, and the setting command is an opening command or a closing command; The auxiliary server is used to search for the associated target server according to the access identifier; The auxiliary server is further used to forward the combination information and the verification code to the target server or verify the combination information and the verification code, and when the verification result is passed, notify the firewall to adjust the firewall settings for the user to access the target service based on the setting command; The target server is used to verify the combination information and the verification code, and when the verification result is passed, based on the setting command, notify the firewall to adjust the firewall settings regarding the user's access to the target service.

Images