Software-defined security access gateway with single packet authentication function and authentication method

Abstract

The invention discloses a software-defined security access gateway with a single-packet authentication function and an authentication method, which are characterized in that an unauthenticated client side gateway is denied to access a network environment of a service server through a single-packet authentication and cryptographic algorithm signature verification strategy mode, so that the security and stability of access platform service are ensured. According to the invention, on the basis of encrypted transmission data, the service server can be protected from virus invasion, the performance stability of the client side gateway can be ensured, and the user is prevented from being interfered when accessing the service. The authenticated client-side gateway maintains the open life cycle of the network environment by continuously sending the single-packet authentication message, so that an intrusion device can be effectively prevented from attacking through an open network environment strategy.

Description

Technical Field

[0001] The present invention relates to the technical field of software-defined secure access gateways, and in particular to a software-defined secure access gateway with a single-packet authentication function and an authentication method. Background Art

[0002] The software-defined secure access gateway is a pre-security device / gateway that accesses various network identity authentication services through application servers. It can also be considered as the "gatekeeper" of the network identity authentication platform. Its purpose is to prevent illegal use by applications and users who do not have access rights, while ensuring the normal use of legal applications and users. The network identity authentication secure access gateway is a gateway-type device with functions such as secure encryption and decryption, signature verification, and zero-trust authentication.

[0003] At present, when third-party services access the network identity authentication service platform, they usually adopt existing technical solutions, including soft authentication access and SSL VPN gateway access. Soft authentication access uses authentication methods such as username and password, digital certificate, AK / SK, and HTTPS (international algorithm) encrypted transmission to ensure trusted access to third-party services. SSL VPN gateway access is implemented in an SSL end-to-end manner, and completes the authentication and encrypted transmission of third-party access services by integrating single-packet authentication and SSL protocol to ensure network-level access to third-party services.

[0004] The soft authentication access method is mainly implemented through Ukey simple verification and international algorithms, such as a dual authentication security access system based on UKey authentication disclosed in Chinese patent application CN109347831A. This identity authentication method has many risks such as easy to crack, easy to lose, easy to impersonate, and poor performance. The international algorithm SSL does not meet the relevant domestic security requirements.

[0005] The SSL VPN gateway access method mainly uses the SSL protocol to authenticate the access service. For example, the access methods described in Chinese patent applications CN117834218A, CN116248405, and CN113852681A have a relatively simple authentication method, which only targets simple attacks such as traditional interception, man-in-the-middle attacks, and password guessing. It relies on the back-end platform's trust in the SSL VPN gateway for network-level transmission, cannot perform fine-grained authentication on specific services, and does not support specific business models of network identity authentication platforms. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention aims to provide a software-defined secure access gateway and an authentication method with a single-packet authentication function.

[0007] In order to achieve the above object, the present invention adopts the following technical solution:

[0008] The authentication method of a software-defined secure access gateway with a single-packet authentication function comprises the following steps:

[0009] S1. The client-side gateway sends an application for a gateway device certificate and a single-packet authentication key to the central-side gateway;

[0010] S2. The center-side gateway reviews the application information sent by the client-side gateway;

[0011] S3. After the central gateway passes the review, it returns the gateway device certificate and single-package authentication key to the client gateway;

[0012] S4. After receiving the gateway device certificate and the single-package authentication key, the client-side gateway assembles the basic device information and signs it with the single-package authentication key to generate a single-package authentication message;

[0013] S5. The client-side gateway sends the single-packet authentication message to the center-side gateway for knock authentication;

[0014] S6. After the center-side gateway is successfully authenticated, the corresponding client-side gateway is added to the dynamic whitelist;

[0015] S7. The client-side gateway uses the gateway device certificate as the SSL handshake certificate, establishes an SSL channel with the center-side gateway, and applies for a business password signature certificate.

[0016] S8. After receiving the application in step S7, the center-side gateway verifies whether the client-side gateway that sent the application is in the dynamic whitelist;

[0017] S9. After the center-side gateway passes the verification, it sends the business password signature certificate to the client-side gateway;

[0018] S10. When the client needs to send business data to the business system, the client-side gateway signs the business data using the business cryptographic signature certificate;

[0019] S11. The client-side gateway uses the gateway device certificate as the SSL handshake certificate to perform an SSL handshake with the center-side gateway and sends the signed business data.

[0020] S12: The center-side gateway verifies whether the client-side gateway that sends the service data is in the dynamic whitelist. After the verification is passed, the service data is signed;

[0021] S13. After the central gateway verifies the signature, it sends the business data to the corresponding business server.

[0022] Furthermore, in steps S7 and S11, when establishing an SSL connection, the client-side gateway will first verify the certificate validity period and certificate source of the gateway device certificate, and then establish an SSL channel with the center-side gateway after the verification is passed; and in steps S8 and S12, the center-side gateway will correspondingly verify the certificate validity period and certificate source of the SSL handshake certificate.

[0023] Furthermore, in step S8 and step S12, the center-side gateway will also verify whether the SSL communication protocol of the client-side gateway is national encryption.

[0024] Furthermore, in step S4, the basic device information includes a device management serial number, device version information and a timestamp, and the single-package authentication message also includes an HMAC value calculated for the basic device information.

[0025] The present invention also provides a software-defined secure access gateway with a single-packet authentication function, including a center-side gateway and a client-side gateway, wherein a client accesses the client-side gateway, and servers of one or more business systems access the center-side gateway;

[0026] The client-side gateway is used to operate according to steps S1, S4, S5, S7, S10, and S11 of the above method;

[0027] The center-side gateway is used to operate according to steps S2, S3, S6, S8, S9, S12, and S13 of the above method.

[0028] The beneficial effects of the present invention are as follows: the present invention can be used to more securely protect the business server. Through the single-packet authentication and cryptographic algorithm signature verification policy mode, the unauthenticated client-side gateway will be denied access to the network environment of the business server, thereby ensuring the security and stability of the access platform business. On the basis of encrypted transmission data, the present invention can protect the business server from virus intrusion, while also ensuring the performance stability of the client-side gateway to avoid interference when users access the business. The authenticated client-side gateway maintains the open life cycle of the network environment by continuously sending single-packet authentication messages, which can effectively prevent intrusion devices from attacking through the open network environment policy. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 is an overall timing diagram of the method of the embodiment of the present invention;

[0030] Figure 2 A schematic diagram of the interaction between the center-side gateway and the client-side gateway in the method of the embodiment of the present invention;

[0031] Figure 3 It is a schematic diagram of the security status of existing access gateways;

[0032] Figure 4 The figure is a schematic diagram of the security situation of the software-defined secure access gateway in an embodiment of the present invention. DETAILED DESCRIPTION

[0033] The present invention will be further described below in conjunction with the accompanying drawings. It should be noted that this embodiment is based on the technical solution and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to this embodiment.

[0034] This embodiment provides an authentication method for a software-defined secure access gateway with a single-packet authentication function, wherein the software-defined secure access gateway includes a central-side gateway and a client-side gateway, wherein a client accesses the client-side gateway, and servers of one or more business systems access the central-side gateway; Figure 1 As shown, the authentication method includes the following steps:

[0035] S1. The client-side gateway sends an application for a gateway device certificate and a single-package authentication key to the central-side gateway. The application information may include the name of the access organization, person in charge, contact number, contact email, credit platform, gateway device manufacturer, gateway device model, gateway device management serial number, device validity period, country, province, city information, etc.

[0036] S2. The center-side gateway reviews the application information sent by the client-side gateway.

[0037] S3. After the central gateway passes the review, it returns the gateway device certificate and single-package authentication key to the client-side gateway.

[0038] S4. After receiving the gateway device certificate and the single-package authentication key, the client-side gateway assembles the basic information of the device and signs it with the single-package authentication key to generate a single-package authentication message; the basic information of the device includes the device management serial number, device version information, timestamp and other information, and the single-package authentication message also includes the HMAC value calculated for the basic information of the device.

[0039] S5. The client-side gateway sends a single-packet authentication message to the center-side gateway for knock authentication.

[0040] S6. After the central gateway successfully authenticates, the corresponding client gateway is added to the dynamic whitelist. Specifically, the central gateway authenticates the timestamp in the single-packet authentication message to ensure the credibility of the single-packet authentication message, and authenticates the HMAC value to ensure that the message has not been tampered with. More specifically, the central gateway recalculates the HMAC value and then compares it with the HMAC value in the sent message to determine whether the message has not been tampered with.

[0041] S7. The client-side gateway uses the gateway device certificate as the SSL handshake certificate, establishes an SSL channel with the center-side gateway, and applies for a business password signature certificate.

[0042] S8. After receiving the application in step S7, the center-side gateway verifies whether the client-side gateway that sent the application is in the dynamic whitelist.

[0043] S9. After the center-side gateway passes the verification, it sends the business password signature certificate to the client-side gateway.

[0044] S10. When the client needs to send business data to the business system, the client-side gateway signs the business data using the business cryptographic signature certificate.

[0045] S11. The client-side gateway uses the gateway device certificate as the SSL handshake certificate to perform an SSL handshake with the center-side gateway and sends the signed business data.

[0046] S12. The center-side gateway verifies whether the client-side gateway that sends the business data is in the dynamic whitelist. After the verification is passed, the business data is signed.

[0047] S13. After the central gateway verifies the signature, it sends the business data to the corresponding business server.

[0048] In this embodiment, in step S7 and step S11, when establishing an SSL connection, the client-side gateway will first verify the certificate validity period and certificate source of the gateway device certificate, and then establish an SSL channel with the central-side gateway after the verification is passed; and in step S8 and step S12, the central-side gateway will correspondingly verify the certificate validity period and certificate source of the SSL handshake certificate.

[0049] Furthermore, in this embodiment, in step S8 and step S12, the center-side gateway will also verify whether the SSL communication protocol of the client-side gateway is national encryption.

[0050] Furthermore, in this embodiment, in step S10, the client-side gateway can perform secure encapsulation of business data based on privacy computing or cryptographic protocols. The specific encapsulation functions and algorithms are defined by the software payload, and can provide SM2 algorithm digital envelope and digital signature, single-round / multi-round OT protocol, zero-knowledge proof, customized binary repeated query and other encapsulation functions and algorithms.

[0051] like Figure 2As shown, in the above method, the client later joins the client-side gateway, and the central-side gateway authenticates the client-side gateway through the single-packet authentication method (SPA), opens the business network environment, and maintains the life cycle of the open network environment by continuously sending single-packet authentication messages. After receiving the SPA knocking authentication from the client-side gateway, the central-side gateway uses the key to authenticate the SPA knocking information. After the verification passes, the SPA knocking authorization is completed and the corresponding business port is opened to the client-side gateway. After that, the client-side gateway and the central-side gateway will establish an SSL connection. During the establishment process, the central-side gateway will perform security verification. Only after the verification passes can the connection channel be established. When the client-side gateway accesses the back-end business, it is necessary to use a cryptographic algorithm to sign the business data, and the central-side gateway verifies the signature data. After the signature verification passes, the business data is forwarded to the server of the corresponding business system.

[0052] Specifically, in this embodiment, the single-packet authentication message of the client-side gateway uses cryptographic technology to protect the integrity and source authenticity of the content of the single-packet authentication message, thereby preventing attackers from illegally accessing the infrastructure by forging, tampering with or replaying SPA messages.

[0053] It should be noted that traditional access devices cannot provide effective protection when clients access the network, which can easily lead to the following problems: Figure 3 Compared with the existing access gateway, the software-defined secure access gateway of this embodiment can protect the business server more securely. Through the single-packet authentication and cryptographic algorithm signature verification policy mode, the unauthenticated client-side gateway will be denied access to the network environment of the business server, thereby ensuring the security and stability of the access platform business. Figure 4 shown.

[0054] On the basis of encrypting the transmitted data, the service server is protected from virus intrusion, and the performance stability of the client-side gateway is also guaranteed to avoid interference when users access the service. After authentication, the client-side gateway maintains the open life cycle of the network environment by continuously sending single-packet authentication messages, which can effectively prevent intrusion devices from attacking through the open network environment strategy.

[0055] For those skilled in the art, various corresponding changes and modifications can be made according to the above technical solutions and concepts, and all of these changes and modifications should be included in the protection scope of the claims of the present invention.

Claims

1. An authentication method for a software-defined secure access gateway with a single-packet authentication function, characterized in that: The steps include: S1. The client-side gateway sends an application for a gateway device certificate and a single-packet authentication key to the central-side gateway; S2. The center-side gateway reviews the application information sent by the client-side gateway; S3. After the central gateway passes the review, it returns the gateway device certificate and single-package authentication key to the client gateway; S4. After receiving the gateway device certificate and the single-package authentication key, the client-side gateway assembles the basic device information and signs it with the single-package authentication key to generate a single-package authentication message; S5. The client-side gateway sends the single-packet authentication message to the center-side gateway for knock authentication; S6. After the center-side gateway is successfully authenticated, the corresponding client-side gateway is added to the dynamic whitelist; S7. The client-side gateway uses the gateway device certificate as the SSL handshake certificate, establishes an SSL channel with the center-side gateway, and applies for a business password signature certificate. S8. After receiving the application in step S7, the center-side gateway verifies whether the client-side gateway that sent the application is in the dynamic whitelist; S9. After the center-side gateway passes the verification, it sends the business password signature certificate to the client-side gateway; S10. When the client needs to send business data to the business system, the client-side gateway signs the business data using the business cryptographic signature certificate; S11. The client-side gateway uses the gateway device certificate as the SSL handshake certificate to perform an SSL handshake with the center-side gateway and sends the signed business data. S12: The center-side gateway verifies whether the client-side gateway that sends the service data is in the dynamic whitelist. After the verification is passed, the service data is signed; S13. After the central gateway verifies the signature, it sends the business data to the corresponding business server.

2. The method according to claim 1, characterized in that In step S7 and step S11, when establishing an SSL connection, the client-side gateway will first verify the certificate validity period and certificate source of the gateway device certificate, and then establish an SSL channel with the central-side gateway after the verification is passed; and in step S8 and step S12, the central-side gateway will correspondingly verify the certificate validity period and certificate source of the SSL handshake certificate.

3. The method according to claim 1, characterized in that In step S8 and step S12, the central-side gateway will also verify whether the SSL communication protocol of the client-side gateway is national encryption.

4. The method according to claim 1, characterized in that: In step S4, the basic device information includes a device management serial number, device version information and a timestamp, and the single-package authentication message also includes an HMAC value calculated for the basic device information.

5. A software-defined secure access gateway with single-packet authentication function, characterized in that: It includes a center-side gateway and a client-side gateway, the client accesses the client-side gateway, and the server of one or more business systems accesses the center-side gateway; The client-side gateway is used to operate according to steps S1, S4, S5, S7, S10, and S11 of any method described in claims 1-4; The central side gateway is used to operate according to steps S2, S3, S6, S8, S9, S12, and S13 of any method described in claims 1-4.

Images