Software-defined security access gateway with single packet authentication function and authentication method

Abstract

The application discloses a software-defined security access gateway with single packet authentication function and an authentication method, wherein through single packet authentication and a password algorithm signature verification strategy mode, an unauthenticated customer side gateway will be denied to access a network environment of a service server, so that the security and stability of an access platform service are ensured. On the basis of encrypted transmission data, the application can protect the service server from virus invasion, and meanwhile, the performance stability of the customer side gateway is ensured, and user access to the service is prevented from being interfered. The customer side gateway after authentication can maintain the open life cycle of the network environment by continuously sending single packet authentication messages, so that the attack of an invasion device through an opened network environment strategy can be effectively prevented.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software-defined security access gateway, in particular to a software-defined security access gateway with single package authentication function and an authentication method. BACKGROUND

[0002] The software-defined security access gateway is a front-end security device / gateway for accessing various network identity authentication services through an application server, and can also be regarded as a "gatekeeper" of the network identity authentication platform. Its purpose is to prevent illegal use of applications and users without access permission, while ensuring normal use of key devices for legitimate applications and users. The network identity authentication security access gateway is a gateway-type device with functions such as security encryption and decryption, signature verification, and zero-trust authentication.

[0003] Currently, when a third-party service accesses a network identity authentication service platform, existing technical solutions are usually adopted, including soft authentication access and SSL VPN gateway access. Soft authentication access uses username and password, digital certificate, AK / SK authentication means combined with HTTPS (international algorithm) encryption transmission to ensure trusted access of third-party services. SSL VPN gateway access is implemented in an SSL end-to-end manner, and single package authentication and SSL protocol are combined to complete authentication and encrypted transmission of third-party access services to ensure network-level access of third-party services.

[0004] Soft authentication access is mainly implemented through Ukey simple verification and international algorithm, such as the dual authentication security access system based on UKey authentication disclosed in Chinese patent application CN109347831A. This identity authentication method has many risks such as easy cracking, easy loss, easy impersonation, poor performance, and does not comply with domestic security requirements.

[0005] SSL VPN gateway access is mainly implemented through SSL protocol for identity authentication of access services, such as the access methods described in Chinese patent applications CN117834218A, CN116248405, and CN113852681A. The authentication method is relatively single, only targeting simple attacks such as traditional interception, man-in-the-middle attacks, and password guessing, relying on the trust of the back-end platform for SSL VPN gateway network-level transmission, and cannot perform fine-grained authentication on specific services, nor support specific business modes of the network identity authentication platform. SUMMARY

[0006] In view of the deficiencies of the prior art, the present application aims to provide a software-defined security access gateway with single package authentication function and an authentication method.

[0007] To achieve the above-mentioned purposes, the present application adopts the following technical solutions:

[0008] The authentication method of the software-defined security access gateway with single packet authentication function comprises the following steps:

[0009] S1, the customer-side gateway sends a gateway device certificate and an application for a single packet authentication key to the center-side gateway;

[0010] S2, the center-side gateway audits the application information sent by the customer-side gateway;

[0011] S3, after the center-side gateway audits and passes, the center-side gateway returns the gateway device certificate and the single packet authentication key to the customer-side gateway;

[0012] S4, after the customer-side gateway receives the gateway device certificate and the single packet authentication key, the customer-side gateway assembles device basic information and signs using the single packet authentication key to generate a single packet authentication message;

[0013] S5, the customer-side gateway sends the single packet authentication message to the center-side gateway for knocking authentication;

[0014] S6, after the center-side gateway authenticates successfully, the corresponding customer-side gateway is added to the dynamic white list;

[0015] S7, the customer-side gateway uses the gateway device certificate as the SSL handshake certificate to establish an SSL channel with the center-side gateway and applies for a business password signature certificate;

[0016] S8, after the center-side gateway receives the application of step S7, the center-side gateway verifies whether the customer-side gateway sending the application is in the dynamic white list;

[0017] S9, after the center-side gateway verifies and passes, the center-side gateway issues the business password signature certificate to the customer-side gateway;

[0018] S10, when the client needs to send business data to the business system, the customer-side gateway signs the business data using the business password signature certificate;

[0019] S11, the customer-side gateway uses the gateway device certificate as the SSL handshake certificate to perform SSL handshake with the center-side gateway and sends the signed business data;

[0020] S12, the center-side gateway verifies whether the customer-side gateway sending the business data is in the dynamic white list, and after verification, the center-side gateway verifies the signature of the business data;

[0021] S13, after the center-side gateway verifies and passes, the center-side gateway sends the business data to the corresponding business server.

[0022] Further, in steps S7 and S11, when establishing the SSL connection, the client-side gateway first verifies the certificate validity period and the certificate source of the gateway device certificate, and then establishes the SSL channel with the center-side gateway after verification; and in steps S8 and S12, the center-side gateway correspondingly verifies the certificate validity period and the certificate source of the SSL handshake certificate.

[0023] Further, in steps S8 and S12, the center-side gateway further verifies whether the SSL communication protocol of the client-side gateway is a national secret.

[0024] Further, in step S4, the device basic information includes device management serial number, device version information and timestamp, and the single packet authentication message further includes the HMAC value calculated for the device basic information.

[0025] The application further provides a software-defined security access gateway with a single packet authentication function, comprising a center-side gateway and a client-side gateway, wherein the client accesses the client-side gateway, and one or more servers of a service system access the center-side gateway.

[0026] The client-side gateway is used to operate according to steps S1, S4, S5, S7, S10, S11 of the above method.

[0027] The center-side gateway is used to operate according to steps S2, S3, S6, S8, S9, S12, S13 of the above method.

[0028] The application has the advantages that: the application can more safely protect the service server, and through the single packet authentication and the password algorithm signature verification policy mode, the unauthenticated client-side gateway will be refused to access the network environment of the service server, so as to ensure the safety and stability of the access platform service. On the basis of encrypted transmission data, the application can protect the service server from virus invasion, and can also ensure the performance stability of the client-side gateway, and avoid interference when the user accesses the service. The authenticated client-side gateway maintains the network environment opening life cycle by continuously sending the single packet authentication message, and can effectively prevent the intrusion device from attacking through the opened network environment policy. BRIEF DESCRIPTION OF DRAWINGS

[0029] Figure 1 It is the overall timing diagram of the embodiment method of the application.

[0030] Figure 2 It is the interaction schematic diagram of the center-side gateway and the client-side gateway in the embodiment method of the application.

[0031] Figure 3 It is the security situation schematic diagram of the existing access gateway.

[0032] Figure 4 The figure is a schematic diagram of the security situation of the software-defined secure access gateway in an embodiment of the present invention. DETAILED DESCRIPTION

[0033] The present invention will be further described below in conjunction with the accompanying drawings. It should be noted that this embodiment is based on the technical solution and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to this embodiment.

[0034] This embodiment provides an authentication method for a software-defined secure access gateway with a single-packet authentication function, wherein the software-defined secure access gateway includes a central-side gateway and a client-side gateway, wherein the client accesses the client-side gateway, and the servers of one or more business systems access the central-side gateway; Figure 1 As shown, the authentication method includes the following steps:

[0035] S1. The client-side gateway sends an application for a gateway device certificate and a single-package authentication key to the central-side gateway. The application information may include the name of the access organization, person in charge, contact number, contact email, credit platform, gateway device manufacturer, gateway device model, gateway device management serial number, device validity period, country, province, city information, etc.

[0036] S2. The central gateway reviews the application information sent by the client gateway.

[0037] S3. After the central gateway passes the review, it returns the gateway device certificate and single-package authentication key to the client gateway.

[0038] S4. After receiving the gateway device certificate and the single-package authentication key, the client-side gateway assembles the basic device information and signs it with the single-package authentication key to generate a single-package authentication message; the basic device information includes the device management serial number, device version information, timestamp and other information, and the single-package authentication message also includes the HMAC value calculated for the basic device information.

[0039] S5. The client-side gateway sends the single-packet authentication message to the central-side gateway for knock authentication.

[0040] S6. After successful authentication, the central gateway adds the corresponding client gateway to the dynamic whitelist. Specifically, the central gateway verifies the timestamp in the single-packet authentication message to ensure its authenticity and the HMAC value to ensure the message has not been tampered with. More specifically, the central gateway recalculates the HMAC value and compares it with the HMAC value in the sent message to determine whether the message has been tampered with.

[0041] S7, the client-side gateway uses the gateway device certificate as an SSL handshake certificate to establish an SSL channel with the center-side gateway and apply for a business password signature certificate.

[0042] S8, after the center-side gateway receives the application in step S7, it verifies whether the client-side gateway sending the application is in the dynamic white list.

[0043] S9, after the center-side gateway verifies, it issues a business password signature certificate to the client-side gateway.

[0044] S10, when the client needs to send business data to the business system, the client-side gateway signs the business data using the business password signature certificate.

[0045] S11, the client-side gateway uses the gateway device certificate as an SSL handshake certificate to perform SSL handshake with the center-side gateway and sends the signed business data.

[0046] S12, the center-side gateway verifies whether the client-side gateway sending the business data is in the dynamic white list, and after verification, it verifies the signature of the business data.

[0047] S13, after the center-side gateway verifies the signature, it sends the business data to the corresponding business server.

[0048] In this embodiment, in steps S7 and S11, when establishing an SSL connection, the client-side gateway first verifies the certificate validity period and certificate source of the gateway device certificate, and after verification, it establishes an SSL channel with the center-side gateway; and in steps S8 and S12, the center-side gateway correspondingly verifies the certificate validity period and certificate source of the SSL handshake certificate.

[0049] Further, in this embodiment, in steps S8 and S12, the center-side gateway also verifies whether the SSL communication protocol of the client-side gateway is a national secret.

[0050] Further, in this embodiment, in step S10, the client-side gateway can perform secure encapsulation based on privacy computing or cryptographic protocols, and the specific encapsulation functions and algorithms are defined by the software payload, which can provide SM2 algorithm digital envelope and digital signature, single / multi-round OT protocol, zero-knowledge proof, customized dichotomy repeated query and other encapsulation functions and algorithms.

[0051] As Figure 2As shown in the above method, the client side gateway joins the client side network, and the center side gateway authenticates the client side gateway through single packet authentication (SPA) to open the service network environment, and maintains the life cycle of the open network environment by continuously sending single packet authentication messages. After receiving the SPA knock authentication of the client side gateway, the center side gateway uses a key to authenticate and verify the SPA knock information, and completes the SPA knock authorization after the verification is passed, and opens the corresponding service port to the client side gateway. Then the client side gateway and the center side gateway will establish an SSL connection, and during the establishment process, the center side gateway will perform security verification, and only after the verification is passed, the connection channel can be established. When the client side gateway accesses the back-end service, a cryptographic algorithm needs to be used to sign the service data, and the center side gateway verifies the signature data, and after the verification is passed, the service data is forwarded to the server of the corresponding service system.

[0052] Specifically, in the embodiment, the single packet authentication message of the client side gateway uses a cryptographic technique to protect the integrity and authenticity of the single packet authentication message content, and prevents attackers from illegally accessing the infrastructure by forging, tampering or replaying the SPA message.

[0053] It should be noted that the traditional access device cannot provide effective protection when the client accesses, which will easily cause security risks such as Figure 3 Compared with the existing access gateway, the software-defined security access gateway of the embodiment can more securely protect the service server, and through the single packet authentication and the cryptographic algorithm signature verification strategy mode, the unauthenticated client side gateway will be refused to access the network environment of the service server, thereby ensuring the security and stability of the access platform service, as shown in Figure 4 .

[0054] On the basis of encrypted transmission data, the service server is protected from virus invasion, and the performance stability of the client side gateway is also ensured, avoiding interference when users access services. The client side gateway after authentication maintains the network environment open life cycle by continuously sending single packet authentication messages, which can effectively prevent intrusion devices from attacking through the open network environment strategy.

[0055] For those skilled in the art, various corresponding changes and modifications can be given according to the above technical solutions and concepts, and all these changes and modifications should be included in the protection scope of the claims of the present application.

Claims

1. An authentication method for a software-defined secure access gateway with a single-packet authentication function, characterized in that: The steps include: S1. The client-side gateway sends a request for a gateway device certificate and a single-packet authentication key to the central-side gateway. S2. The center-side gateway reviews the application information sent by the client-side gateway; S3. After the central gateway passes the review, it returns the gateway device certificate and single-package authentication key to the client gateway; S4. After receiving the gateway device certificate and the single-package authentication key, the client-side gateway assembles the basic device information and signs it with the single-package authentication key to generate a single-package authentication message. S5. The client-side gateway sends the single-packet authentication message to the central-side gateway for knock authentication. S6. After the center-side gateway is successfully authenticated, the corresponding client-side gateway is added to the dynamic whitelist; S7. The client-side gateway uses the gateway device certificate as the SSL handshake certificate, establishes an SSL channel with the center-side gateway, and applies for a business password signature certificate. S8. After receiving the application in step S7, the center-side gateway verifies whether the client-side gateway that sent the application is in the dynamic whitelist; S9. After the central gateway passes the verification, it sends the business password signature certificate to the client gateway; S10. When the client needs to send business data to the business system, the client-side gateway uses the business cryptographic signature certificate to sign the business data; S11. The client-side gateway uses the gateway device certificate as the SSL handshake certificate to perform an SSL handshake with the central-side gateway and sends the signed business data. S12: The center-side gateway verifies whether the client-side gateway that sends the service data is in the dynamic whitelist. If the verification is successful, the center-side gateway verifies the signature of the service data. S13. After the central gateway verifies the signature, it sends the business data to the corresponding business server.

2. The method according to claim 1, characterized in that In steps S7 and S11, when establishing an SSL connection, the client-side gateway will first verify the certificate validity period and certificate source of the gateway device certificate, and then establish an SSL channel with the central-side gateway after the verification is passed; and in steps S8 and S12, the central-side gateway will correspondingly verify the certificate validity period and certificate source of the SSL handshake certificate.

3. The method according to claim 1, characterized in that In step S8 and step S12, the central side gateway will also verify whether the SSL communication protocol of the client side gateway is national secret.

4. The method according to claim 1, wherein In step S4, the basic device information includes a device management serial number, device version information, and a timestamp, and the single-packet authentication message also includes an HMAC value calculated for the basic device information.

5. A software-defined secure access gateway with single-packet authentication function, characterized in that: It includes a center-side gateway and a client-side gateway. The client accesses the client-side gateway, and the servers of one or more business systems access the center-side gateway. The client-side gateway is configured to operate according to steps S1, S4, S5, S7, S10, and S11 of the method according to any one of claims 1 to 4; The central side gateway is used to operate according to steps S2, S3, S6, S8, S9, S12, and S13 of the method according to any one of claims 1 to 4.

Images