Internet access method

Abstract

The invention discloses an internet access method and system, and the method comprises the following steps: 1, receiving a request domain name, and collecting the login information and identity information of a user; step 2, obtaining an obtained request domain name, analyzing and judging the authenticity of a request address or the domain name, obtaining user login information and identity information, and analyzing and judging whether a login user has the right to access the domain name; 3, acquiring an access request of a user, analyzing the access request of the user to generate an access identifier, and detecting the access authority according to the access identifier and the identity feature; 4, generating a pass token according to a detection result to access the data, submitting a temporary access permission application, and generating a temporary pass token; and 5, receiving an access result fed back by the service system, and feeding back an access request failure reason. The system has the advantages of being high in safety and convenient to manage.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet access, and in particular to an Internet access method. Background Art

[0002] With the continuous improvement of science and technology, the operation mode of enterprises is increasingly tending towards digital transformation. The business systems of enterprises are more dependent on the Internet. Not only do internal employees want to access the company's various business data, but also customers and partners have the need to access corporate data. The large access group cannot effectively control access rights, and customers and partners basically access from the outside, including the network environment of public places such as shopping malls and restaurants. The environment in which these external accesses are located is complex, which may threaten the security of the enterprise's business system. Therefore, it is necessary to design an Internet access method and system with high security and easy management. Summary of the invention

[0003] The object of the present invention is to provide an Internet access method and system to solve the problems raised in the above background technology.

[0004] In order to solve the above technical problems, the present invention provides the following technical solutions: an Internet access method, comprising the following steps:

[0005] Step 1: Receive the requested domain name and collect the user's login information and identity information;

[0006] Step 2: Obtain the requested domain name, analyze and determine the authenticity of the request address or domain name, obtain the user login information and identity information, and analyze and determine whether the logged-in user has the right to access the domain name;

[0007] Step 3: Obtain the user's access request, analyze the user's access request to generate an access identifier, and detect access rights based on the access identifier and identity features;

[0008] Step 4: Generate a pass token to access the data based on the test results, submit an application for temporary access rights, and generate a temporary pass token;

[0009] Step 5: Receive the access result from the business system and provide feedback on the reason for the access request failure.

[0010] According to the above technical solution, the steps of analyzing and determining the authenticity of the request address or domain name and analyzing and determining whether the logged-in user has the right to access the domain name include:

[0011] Obtain the domain name information input by the user, analyze and verify the domain name information, compare the obtained domain name address with the domain name address preset in the system database. When the comparison similarity reaches the preset maximum threshold, start the judgment unit to compare the user-input domain name with the preset domain name in the database. When the comparison result is exactly the same, the user logs in to the website and enters the identity information. When there is a difference in the comparison result, the system pops up a window to prompt that the domain name is incorrect and please re-enter;

[0012] Obtain the identity data input by the user during login, analyze the user identity data, judge the user's identity, and detect whether the user login information exists in the enterprise business system database. If it is detected that it exists in the system database, the information input by the logged-in user is true and access to the website is allowed. If it does not exist in the system database, the system pops up a window to prompt that the user information is incorrect and please re-enter. After the user logs in successfully, the data displayed on the page are all publicly available data of the enterprise, and other data only display the data type module.

[0013] According to the above technical solution, the step of analyzing the user access request to generate an access identifier includes:

[0014] Obtain the access request submitted by the user, extract keywords from the access request, confirm the data type that the user wants to access according to the extracted keywords, divide the permission security level according to the data type, and analyze the permission security level of the data to be accessed by the access request. When the permission security level is higher than the maximum threshold set by the system, the system will initiate dual authentication and send an application to the system administrator to request their assistance in completing the secondary verification.

[0015] According to the above technical solution, the step of detecting the access permission according to the access identifier and identity characteristics includes:

[0016] After the system receives the access application, it will verify the access permission. When the content accessed by the user needs to be verified, the system pops up a window to collect and identify the user's fingerprint or face using the access device, perform identity verification and check the permission. The system receives the fingerprint and face data for processing. The system will not immediately feedback the verification result. Through a program preset in the system, the preset permission detection result feedback time interval in the system is T. After T time, the system will feedback the detection result. If an access request is continuously sent to a group of data types within a certain period of time, the system will adjust the access permission detection result feedback duration. The feedback duration of the detection result is calculated by the formula y = a * x 2 + T, where the coefficient 0 < a < 1 and T is a constant. It is not difficult to obtain from the formula that the more access times within a short period, the longer the waiting duration.

[0017] According to the above technical solution, the steps of generating a pass token to access data according to the detection result, submitting an application for temporary access rights, and generating a temporary pass token include:

[0018] Get the access permission check result, and determine whether the user has the permission to access the data based on the analysis result. When the detection result shows that the access request has the access permission, the user decides whether to generate a pass token, and uses the pass token to carry the user access request to access the enterprise business system to obtain the data the user wants to access. When the access request made by an ordinary user is not within the user's permission range, the user submits an application for temporary access to the data to the system administrator through the temporary permission application unit. The system will collect all user behaviors before the user applies for temporary access, analyze the user behavior data, analyze the user behavior to obtain the user's access preference, and further analyze whether the user behavior is at risk of enterprise data being stolen based on the user's access data type and permission security level. When the user behavior has been staying in the content related to the enterprise's key technologies, If the system determines that the user's behavior does not contain risky behavior and the security level of the access content of its access permission application is below the set threshold, all of them will be approved. When internal employees submit temporary permission applications, the employees upload relevant work requirements in a timely manner, otherwise the application will not be approved. For approved temporary permission applications, the system will generate their own temporary pass tokens based on the application content. The temporary pass token has a valid period, which can be changed and set by the system administrator. The maximum valid period cannot exceed the threshold preset in the system. When the maximum valid period exceeds the preset threshold, the system will pop up a window to remind you and clear the set valid period. Click OK to continue to set the compliance of the temporary pass token valid period.

[0019] According to the above technical solution, the step of receiving the access result fed back by the business system and feeding back the reason for the failure of the access request includes:

[0020] The access token and temporary access token are used as carriers to carry the access data and feedback to the web page. After the edge server obtains the access data, it sends an instruction to the data feedback unit, and uses the data feedback unit to call the verification unit for identity authentication. The verification unit collects user fingerprint and face recognition information data, obtains the user permission data collected by the access permission detection unit, and compares the data collected by the verification unit with the data of the access permission detection unit. When the comparison results are completely consistent, the data feedback unit obtains the data from the edge server and feeds it back to the page. When there is a difference in the comparison results, the verification unit sends a signal to the edge server, and the edge server shreds the temporarily stored data after receiving the signal.

[0021] According to the above technical solution, the system includes:

[0022] Domain name detection module, used to detect the authenticity of domain names and verify user identities;

[0023] An access rights management module, used for managing access rights;

[0024] The feedback module is used to feed back the accessed data to the web page.

[0025] According to the above technical solution, the domain name detection module includes:

[0026] A receiving unit, used for receiving a domain name and user identity information input by a user;

[0027] A judgment unit, used to judge the authenticity of the domain name and verify the identity of the user;

[0028] The sending unit is used to send the user authority to the edge server, and the edge server obtains data according to the authority.

[0029] According to the above technical solution, the access permission management module includes:

[0030] A user access request acquisition unit, used to acquire user access request data;

[0031] An access permission detection unit, used to detect whether a user has access permission;

[0032] A pass token generation unit, used to generate a pass token to carry user access request acquisition data;

[0033] The temporary permission application unit is used to apply for temporary access permission.

[0034] According to the above technical solution, the feedback module includes:

[0035] A data feedback unit, used to receive access request data obtained by the edge server;

[0036] A verification unit, used to verify the user's identity again;

[0037] The request failure feedback unit is used to feedback the reason for the request failure.

[0038] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: the present invention, by providing a domain name detection module to analyze the accuracy of the domain name, judge the authenticity of the domain name, prevent phishing websites from obtaining corporate data and user identity information, and improve the security of the system; an access permission detection unit and a temporary permission application unit are also provided; the access permission detection unit detects whether the access request proposed by the user is within the access permission; if the user does not have the permission to view the access request proposed by the user, the user applies for access through the temporary permission application unit; the system analyzes the result to determine whether the user's temporary permission application can be approved, thereby facilitating the administrator's management of the system and making the system usage experience more convenient and quick. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0040] Figure 1 This is a flowchart of a method for accessing the Internet provided in Embodiment 1 of the present invention;

[0041] Figure 2 This is a schematic diagram of the module composition of an Internet access system provided in Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] Embodiment 1: Figure 1 This is a flowchart of an Internet access method and system provided in Embodiment 1 of the present invention. This embodiment can be applied to the scenario of enterprise system control access. This method can be executed by an Internet access method and system provided in this embodiment. Figure 1 As shown, the method specifically comprises the following steps:

[0044] Step 1: Receive the requested domain name and collect the user's login information and identity information;

[0045] Step 2: Obtain the requested domain name, analyze and determine the authenticity of the request address or domain name, obtain the user login information and identity information, and analyze and determine whether the logged-in user has the right to access the domain name;

[0046] In an embodiment of the present invention, in the process of accessing enterprise data through a unique domain name, the receiving unit obtains data including a domain name address and identity information, and transmits the obtained data to a judgment unit. The judgment unit verifies the authenticity of the domain name address. The domain names corresponding to the business systems of the enterprise are all specific, and only the correct domain names can access the business systems of the enterprise. After accessing the website according to the correct domain name, the user is guided to log in to collect user identity information. The judgment unit obtains the user identity information for analysis, determines whether the user login information is correct, and uses the sending unit to send a signal to the edge server, and the edge server obtains the enterprise data.

[0047] Exemplarily, the main methods for the judgment unit to analyze the collected data include: analysis of the acquired domain name information and analysis of the identity information. The specific method for analyzing the domain name information is: obtaining the domain name information input by the user, analyzing and verifying the domain name information, comparing the acquired domain name address with the domain name address preset in the system database, and when the comparison similarity reaches the preset maximum threshold, the judgment unit is started to compare the domain name input by the user with the preset domain name in the database. When the comparison result is exactly the same, the user logs in to the website and enters the identity information. When the comparison result is different, the system feedback pop-up window prompts that the domain name is wrong and please re-enter it, so as to prevent criminals from using websites with similar domain names to disguise as corporate websites to steal information or other behaviors that harm corporate interests, thereby avoiding phishing websites from harming corporate interests. The specific method for analyzing identity data is: obtaining the identity data entered by the user when logging in, analyzing the user's identity data, determining the user's identity, and detecting whether the user's login information exists in the enterprise business system database. If it is detected that it exists in the system database, the information entered by the logged-in user is true and the user is allowed to access the website. If it does not exist in the system database, a pop-up window will pop up to prompt the user that the information is incorrect and the user should re-enter the information. After the user successfully logs in, the data displayed on the page are all publicly available data of the enterprise, and other data only display the data type module. There will be no consequences such as data theft due to account theft. Therefore, the security performance of this access method and system is guaranteed.

[0048] Step 3: Obtain the user's access request, analyze the user's access request to generate an access identifier, and detect access rights based on the access identifier and identity features;

[0049] In an embodiment of the present invention, during the process of a user accessing a website, access request data of the user is obtained, the access request is analyzed, an access content identifier in the user access request is analyzed and obtained, identity data is obtained, and the identity data is analyzed to obtain an identity identifier. The obtained identity identifier and access content identifier are bound to the user request, and the access request carrying the access content identifier and identity identifier is subjected to access permission detection. Whether to generate a pass token is judged according to the detection result, and the pass token carrying the user access request is sent to the edge server. The edge server retrieves data from the system and temporarily stores it in the edge server.

[0050] Exemplarily, the specific method for access permission query includes the analysis of the user access request and the analysis of the user access permission. Among them, the specific method for analyzing the user access request is as follows: obtain the access request submitted by the user, extract keywords for the access request, confirm the data type that the user wants to access according to the extracted keywords, divide the permission security level according to the data type, and analyze the permission security level of the data to be accessed by the access request. When the permission security level is higher than the maximum threshold set by the system, the system will initiate dual authentication and send an application to the system administrator, asking for their help to complete the auxiliary verification and help itself complete the access permission verification, so as to achieve the purpose of protecting enterprise data with a high permission security level and further ensure the security of the business system; the specific method for analyzing the user access permission is as follows: after the system receives the access application, it will verify the access permission. When the content accessed by the user needs to be verified, the system pops up a window to collect and identify the user's fingerprint or face using the access device, perform identity verification and permission inspection. The system processes the received fingerprint and face data and will not immediately feedback the verification result. Through a program preset in the system, the preset feedback time interval of the permission detection result in the system is T. After a duration of T, the system will feedback the detection result. If access requests are continuously sent to a set of data types within a certain period of time, the system will adjust the feedback duration of the access permission detection result. The feedback duration of the detection result is calculated by the formula y = a * x 2 + T, where the coefficient 0 < a < 1 and T is a constant. It is not difficult to obtain from the formula that the more accesses are made in a short period of time, the longer the waiting duration will be. Therefore, it can effectively prevent scripts from using a fixed life cycle to test the permission defense line of the system, significantly enhancing the security of the system.

[0051] Step 4: Generate a pass token according to the detection result to access the data, submit a temporary access permission application, and generate a temporary pass token;

[0052] In an embodiment of the present invention, the access permission check result is obtained, and it is determined whether the user has the permission to access the data based on the analysis result. When the detection result shows that the access request has the access permission, the user decides whether to generate a pass token, and uses the pass token to carry the user access request to access the enterprise business system to obtain the data that the user wants to access. When the access request made by an ordinary user is not within the user's permission range, the user submits an application for temporary access to the data to the system administrator through a temporary permission application unit. The system will collect all user behaviors before the user applies for temporary access, analyze the user behavior data, and analyze the user behavior to obtain the user's access preference. According to the type of user access data and the permission security level, it is further analyzed whether the user behavior has the risk of enterprise data being stolen. When the user behavior has been staying on the content related to the enterprise's key technology, it is determined that the user behavior has a security risk, and the temporary permission application submitted by the user will not be approved. If the system determines that the user behavior does not have risky behavior and the access content security level of its access permission application is within the scope of the user's permission, the system will not approve the user behavior. If all are below the set threshold, they will all be passed. When internal employees submit temporary permission applications, they must upload relevant work requirement certificates in a timely manner, otherwise the application will not be passed. For approved temporary permission applications, the system will generate their own temporary pass tokens based on the application content. Temporary pass tokens have a valid period, which can be changed and set by the system administrator. The maximum valid period cannot exceed the threshold preset in the system. When the maximum valid period exceeds the preset threshold, the system will pop up a window to remind you and clear the set valid period. Click OK to continue to set the temporary pass token validity period in compliance. Temporary pass tokens are different from pass tokens. Pass tokens carry user access requests to obtain access data. Temporary pass tokens are generated based on the target access data of the access application after review by the system administrator. That is, temporary pass tokens are attached to access requests, so there will be no confusion or abuse of pass tokens. Therefore, administrators are no longer busy with the differentiated management of pass tokens, making system operation more convenient and quick.

[0053] Step 5: Receive the access result from the business system and provide feedback on the reason for the access request failure.

[0054] In an embodiment of the present invention, during the data access process, the pass token and the temporary pass token are used as carriers to carry the access data and feedback to the web page. After the edge server obtains the access data, it sends an instruction to the data feedback unit, and uses the data feedback unit to call the verification unit for identity authentication. The verification unit collects user fingerprint and face recognition information data, obtains user authority data collected by the access authority detection unit, and compares the data collected by the verification unit with the data of the access authority detection unit. When the comparison result is completely consistent, the data feedback unit obtains the data from the edge server and feeds it back to the page. When there is a difference in the comparison result, the verification unit sends a signal to the edge server. After receiving the signal, the edge server shreds the temporarily stored data. The secondary verification of the identity information ensures the security of the data and increases the security of the system. The shredding of the data also prevents the leakage of enterprise data. When the access request fails, the request failure feedback unit analyzes the failure step to obtain the failure reason, such as identity authentication failure, unauthorized party, temporary authority application not approved or other reasons. On this basis, system problems can basically be solved in a targeted manner through the reasons fed back by the request failure feedback unit, making the system management more convenient and efficient.

[0055] Embodiment 2: Embodiment 2 of the present invention provides an Internet access method and system. Figure 2 A schematic diagram of the module composition of an Internet access system provided in Embodiment 2 of the present invention is shown in FIG. Figure 2 As shown, the system includes:

[0056] Domain name detection module, used to detect the authenticity of domain names and verify user identities;

[0057] An access rights management module, used for managing access rights;

[0058] The feedback module is used to feed back the accessed data to the web page.

[0059] In some embodiments of the present invention, the domain name detection module includes:

[0060] A receiving unit, used for receiving a domain name and user identity information input by a user;

[0061] A judgment unit, used to judge the authenticity of the domain name and verify the identity of the user;

[0062] The sending unit is used to send the user authority to the edge server, and the edge server obtains data according to the authority.

[0063] In some embodiments of the present invention, the access rights management module includes:

[0064] A user access request acquisition unit, used to acquire user access request data;

[0065] An access permission detection unit, used to detect whether a user has access permission;

[0066] A pass token generation unit, used to generate a pass token to carry user access request acquisition data;

[0067] The temporary permission application unit is used to apply for temporary access permission.

[0068] In some embodiments of the present invention, the feedback module includes:

[0069] A data feedback unit, used to receive access request data obtained by the edge server;

[0070] A verification unit, used to verify the user's identity again;

[0071] The request failure feedback unit is used to feedback the reason for the request failure.

[0072] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0073] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for accessing the Internet, characterized in that: The method comprises the following steps: Step 1: Receive the requested domain name and collect the user's login information and identity information; Step 2: Obtain the requested domain name, analyze and determine the authenticity of the request address or domain name, obtain the user login information and identity information, and analyze and determine whether the logged-in user has the right to access the domain name; Step 3: Obtain the user's access request, analyze the user's access request to generate an access identifier, and detect access rights based on the access identifier and identity characteristics; Step 4: Generate a pass token to access the data based on the test results, submit an application for temporary access rights, and generate a temporary pass token; Step 5: Receive the access result from the business system and provide feedback on the reason for the access request failure; The steps of analyzing and determining the authenticity of the request address or domain name and analyzing and determining whether the logged-in user has the right to access the domain name include: Obtain the domain name information input by the user, analyze and verify the domain name information, compare the obtained domain name address with the domain name address preset in the system database, and when the comparison similarity reaches the preset maximum threshold, start the judgment unit to compare the domain name input by the user with the preset domain name in the database. When the comparison result is exactly the same, the user logs in to the website and enters the identity information. When the comparison result is different, the system feedback pop-up window prompts that the domain name is wrong and please re-enter; Get the identity data entered by the user when logging in, analyze the user's identity data, determine the user's identity, and check whether the user's login information exists in the enterprise business system database. If it is detected in the system database, the information entered by the logged-in user is true and the user is allowed to access the website. If it does not exist in the system database, the system pops up a window to prompt the user that the information is wrong and asks the user to re-enter the information. After the user successfully logs in, the data displayed on the page are all public data of the enterprise, and other data only display the data type module; The steps of analyzing the user access request and generating an access token include: Obtain access requests submitted by users, extract keywords from access requests, confirm the type of data that users want to access based on the extracted keywords, divide the permission security level based on the data type, and analyze the permission security level of the data to be accessed by the access request. When the permission security level is higher than the maximum threshold set by the system, the system will start dual authentication and initiate an application to the system administrator to request their help in completing auxiliary verification; The steps of detecting access rights based on access identifiers and identity features include: After the system receives an access request, it will verify the access permission. When the content accessed by the user needs to be verified, the system pops up a window to collect and identify the user's fingerprint or face using the access device, perform identity verification and check the permission. The system processes the fingerprint and face data received. The system will not immediately feedback the verification result. Through a program preset in the system, the preset feedback time interval of the permission detection result in the system is T. After a duration of T, the system will feedback the detection result. If access requests are continuously sent for a group of data types within a certain period of time, the system will adjust the feedback duration of the access permission detection result. The feedback duration of the detection result is calculated through a formula, where the coefficient 0 < a < 1 and T is a constant. It is not difficult to obtain from the formula that the more access requests are made in a short period of time, the longer the waiting duration will be; The steps of generating a pass token according to the detection result to access the data, submitting a temporary access permission application, and generating a temporary pass token include: Obtain the access permission check result, and judge whether the user has the permission to access the data according to the analysis result. When the detection result shows that the access request has access permission, the user decides whether to generate a pass token, and uses the pass token to carry the user's access request to access the enterprise business system to obtain the data the user wants to access. When the access request made by an ordinary user is outside the user's permission scope, the user submits an application for temporary access rights to the data to the system administrator through the temporary permission application unit. The system will collect all user behaviors of the user before applying for temporary access rights, analyze the user behavior data, analyze the user behavior to obtain the user's access preference, and further analyze whether there is a risk of enterprise data being stolen according to the user's access data type and permission security level. When the user's behavior stays on the content related to the enterprise's key technologies all the time, it is judged that the user's behavior has a security risk, and the temporary permission application submitted by the user will not be approved. If the system judges that the user's behavior does not have a risk behavior and the security level of the access content of the access permission application is below the set threshold, all will be approved. When an internal employee submits a temporary permission application, the employee shall promptly upload relevant work requirement certificates, otherwise the application will not be approved either; for the approved temporary permission applications, the system will generate respective temporary pass tokens according to the application content. The temporary pass token has a validity period, and the system administrator can change and set the validity period. The maximum validity period cannot exceed the threshold preset in the system. When the maximum validity period exceeds the preset threshold, the system will pop up a reminder window and clear the set validity period. Click OK to continue setting the validity period of the temporary pass token in compliance.

Images