Firewall system access authority control method and device, equipment and storage medium

Abstract

The invention relates to the technical field of financial science and technology, in particular to a firewall system access authority control method, device and equipment and a storage medium, and the method comprises the steps: obtaining application access information which comprises an application information encryption packet and a user request ID; determining a target public key based on the user request ID and a preset matching table, and decrypting the application information encryption packet based on the target public key to obtain plaintext information; judging whether the plaintext information exists in a preset parameter table or not; and if it is judged that the plaintext information exists in the parameter table, opening the access authority of a superior firewall system to a subordinate object corresponding to the plaintext information. The method is convenient for improving the access efficiency of the lower-level bank system to access the upper-level bank system.

Description

Technical Field

[0001] The present application relates to the field of financial technology, and in particular to a firewall system access permission control method, device, equipment and storage medium. Background Art

[0002] In order to protect the data and information security of users, banking systems at different levels are equipped with corresponding firewalls to defend against external attacks; the superior banking system is equipped with an superior firewall, and the subordinate banking system of the superior banking system is equipped with a subordinate firewall. The setting of the superior firewall will limit the subordinate banking system's access to the various business systems in the superior banking system.

[0003] If a subordinate banking system needs to access a superior banking system, it needs to apply for access rights from the superior banking system on the premise that the subordinate banking system has access qualifications. Only after obtaining access rights can the subordinate banking system have the authority to access various business systems in the superior banking system.

[0004] However, at present, the approval process for the superior bank system to apply for access rights to the subordinate bank system is complicated and the approval time is long, which greatly affects the access efficiency of the subordinate bank system to the superior bank system. Summary of the invention

[0005] In order to improve the access efficiency of a lower-level banking system to a higher-level banking system, the present application provides a firewall system access rights control method, apparatus, device and storage medium.

[0006] In a first aspect, the present application provides a firewall system access rights control method, comprising:

[0007] Obtaining application access information, wherein the application access information includes an encrypted application information package and a user request ID;

[0008] Determine a target public key based on the user request ID and a preset matching table, and decrypt the application information encrypted package based on the target public key to obtain plain text information;

[0009] Determine whether the plaintext information exists in a preset parameter table;

[0010] If it is determined that the plain text information exists in the parameter table, the access permission of the upper-level firewall system is opened to the lower-level object corresponding to the plain text information.

[0011] In the implementation of the above method, when the upper-level firewall system receives the application access information sent by the lower-level firewall system, it can decrypt the application access information according to the preset public key, and then directly determine whether the lower-level object corresponding to the application access information has the access right to access the upper-level firewall system based on the decrypted plaintext information. In this way, the upper-level firewall system can quickly confirm whether the lower-level object has the access right to access the upper-level firewall system, thereby improving the access efficiency of the lower-level banking system to the upper-level banking system.

[0012] Preferably, after determining whether the plain text information exists in a preset parameter table, the method further includes:

[0013] If it is determined that the plain text information does not exist in the parameter table, an access request is sent to the subordinate firewall system, so that the subordinate firewall system determines whether to continue accessing the superior firewall system based on the access request.

[0014] The implementation of the above method can improve the redundancy of the business system in the upper-level firewall system when the lower-level object accesses the upper-level firewall system, so as to further improve the success rate and security of the lower-level object accessing the upper-level firewall system.

[0015] Preferably, the step of enabling the lower-level firewall system to determine whether to continue accessing the upper-level firewall system based on the access application includes:

[0016] The lower-level firewall system determines whether the unified authentication ID in the access application exists in the preset personnel ID table; if so, determines whether the plaintext information exists in the preset access control list; if not, restricts access to the business system corresponding to the plaintext information.

[0017] The implementation of the above method facilitates improving the success rate and security of lower-level objects accessing the upper-level firewall system.

[0018] Preferably, the step of opening the access rights of the upper-level firewall system to the lower-level object corresponding to the plaintext information includes:

[0019] Determining whether the subordinate object corresponding to the plaintext information is a subordinate object adjacent to the superior firewall system;

[0020] If so, the access rights of the upper-level firewall system are opened to the lower-level object.

[0021] The implementation of the above method can facilitate the interaction and management of user data and improve the security of data.

[0022] In a second aspect, the present application also provides a firewall system access rights control method, comprising:

[0023] Generate a request packet based on the requested access IP address, system domain name, and user ID;

[0024] Encrypting the request packet based on a preset private key to obtain an encrypted packet;

[0025] Generate application access information based on the encrypted package and the user request ID;

[0026] The application access information is sent to the upper-level firewall system so that the upper-level firewall system: obtains the application access information, the application access information includes an application information encryption package and a user request ID; determines a target public key based on the user request ID and a preset matching table, and decrypts the application information encryption package based on the target public key to obtain plain text information; determines whether the plain text information exists in a preset parameter table; if it is determined that the plain text information exists in the parameter table, then opens the access rights of the upper-level firewall system to the lower-level object corresponding to the plain text information.

[0027] In the implementation of the above method, when the upper-level firewall system receives the application access information sent by the lower-level firewall system, it can decrypt the application access information according to the preset public key, and then directly determine whether the lower-level object corresponding to the application access information has the access right to access the upper-level firewall system based on the decrypted plaintext information. In this way, the upper-level firewall system can quickly confirm whether the lower-level object has the access right to access the upper-level firewall system, thereby improving the access efficiency of the lower-level banking system to the upper-level banking system.

[0028] In a third aspect, the present application further provides a firewall system access rights control method, comprising:

[0029] Obtaining subordinate application access information sent by the subordinate firewall system, wherein the subordinate application access information includes a subordinate application information encrypted package and a subordinate user request ID;

[0030] Decrypting the subordinate application information encrypted package in the subordinate application access information based on the subordinate public key corresponding to the subordinate user request ID to obtain subordinate plaintext information;

[0031] Encrypting the subordinate plaintext information based on a preset intermediate private key to obtain an intermediate application information encryption package, and generating intermediate application access information based on the intermediate application information encryption package and a preset intermediate user request ID;

[0032] The intermediate application access information is sent to the upper-level firewall system, so that the upper-level firewall system decrypts the intermediate application information encrypted package in the intermediate application access information based on the intermediate public key corresponding to the intermediate user request ID to obtain the lower-level plaintext information, and determines whether the lower-level firewall system is qualified to access the upper-level firewall system based on the lower-level plaintext information.

[0033] When the above method is implemented, if the lower-level firewall system wants to access the upper-level firewall system across levels, it needs to go through the process of decryption and re-encryption by the intermediate firewall system. This makes it easy to ensure the security of the access process while meeting the needs of the lower-level firewall system to access the upper-level firewall system across levels.

[0034] In a fourth aspect, the present application provides a firewall system access rights control device, comprising:

[0035] An information acquisition module, used to acquire application access information, wherein the application access information includes an application information encryption package and a user request ID;

[0036] A public key decryption module, used to determine a target public key based on the user request ID and a preset matching table, and decrypt the application information encrypted package based on the target public key to obtain plain text information;

[0037] A plain text determination module, used to determine whether the plain text information exists in a preset parameter table;

[0038] The access control module is used to open the access rights of the upper-level firewall system to the lower-level object corresponding to the plaintext information if it is determined that the plaintext information exists in the parameter table.

[0039] In a fifth aspect, the present application provides a computer device, the computer device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the steps in the above method when executing the computer program.

[0040] In a sixth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the steps in the above method when executed by a processor.

[0041] In a seventh aspect, the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0042] The above-mentioned firewall system access right control method, device, equipment and storage medium obtain application access information, wherein the application access information includes an application information encryption package and a user request ID; determine the target public key based on the user request ID and a preset matching table, decrypt the application information encryption package based on the target public key to obtain plain text information; determine whether the plain text information exists in a preset parameter table; if it is determined that the plain text information exists in the parameter table, then open the access right of the upper-level firewall system to the lower-level object corresponding to the plain text information. Through the above implementation, the upper-level firewall system can decrypt the application access information according to the preset public key after receiving the application access information sent by the lower-level firewall system, and then directly determine whether the lower-level object corresponding to the application access information has the access right to access the upper-level firewall system according to the decrypted plain text information. In this way, the upper-level firewall system can quickly confirm whether the lower-level object has the access right to access the upper-level firewall system, thereby improving the access efficiency of the lower-level bank system to the upper-level bank system.

[0043] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0045] Figure 1 A flowchart of a method for controlling access rights of a firewall system provided in an embodiment of the present application;

[0046] Figure 2 A flowchart of another method for controlling access rights of a firewall system provided in an embodiment of the present application;

[0047] Figure 3 A flowchart of another method for controlling access rights of a firewall system provided in an embodiment of the present application;

[0048] Figure 4 A schematic diagram of the structure of a firewall system access rights control device provided in an embodiment of the present application;

[0049] Figure 5 A schematic diagram of the composition of a multi-level firewall system provided in an embodiment of the present application;

[0050] Figure 6 A schematic diagram of the structure of a computer device provided in an embodiment of the present application;

[0051] Figure 7 This is a diagram of the internal structure of a computer-readable storage medium provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present disclosure more clear, the present disclosure is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present disclosure and are not used to limit the present disclosure.

[0053] It should be noted that the terms "first", "second", etc. in the specification and claims of this article and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of this article described here can be implemented in an order other than those illustrated or described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0054] In this article, the term "and / or" is only a description of the association relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the related objects before and after are in an "or" relationship.

[0055] Embodiment 1

[0056] Figure 1 A flowchart of a firewall system access rights control method provided in Example 1 of the present application, refer to Figure 1 The method may be performed by a device for performing the method, and the device may be implemented by software and / or hardware. The method includes:

[0057] S110: Obtain application access information, where the application access information includes an encrypted application information package and a user request ID.

[0058] It should be noted that the execution subject of this embodiment is the upper-level firewall system.

[0059] Among them, banks are divided into different levels of banks according to their functions. For example, the headquarters bank is the superior superior bank, and the banks under the headquarters bank are subordinate banks. In order to protect the security of user data, banks of various levels set up firewalls in their own banking systems. The banking system of the superior bank (hereinafter referred to as the superior banking system) includes various business systems, and each business system can be accessed by the subordinate bank to implement specific business operations. The firewall set up by the superior banking system is recorded as the superior firewall in this embodiment. The banking system of the subordinate bank (hereinafter referred to as the subordinate banking system) also includes a variety of business systems applicable to the subordinate bank. The firewall set up by the subordinate banking system is recorded as the subordinate firewall in this embodiment; and the superior banking system with the superior firewall is recorded as The upper-level firewall system also records the lower-level bank system with the lower-level firewall as the lower-level bank system; when the lower-level firewall system needs to access the business system in the upper-level firewall system, it needs to send application information to the upper-level firewall system, and the application information is used to characterize the application subject (the specific object of sending the application information) and the business system information requested for access; illustratively, the application information in this embodiment includes a user ID, an IP address for application access, and a system domain name, wherein the user ID is used to characterize the application subject, the IP address for application access is the IP address of the business system, the system domain name is the domain name of the business system, and the IP address for application access and the system domain name are used to characterize the business system information requested for access; in other embodiments, the content included in the application information is not specifically limited.

[0060] Among them, the application information encryption package is a data package obtained by encrypting the application information through a certain encryption algorithm; the encryption algorithm in this embodiment specifically adopts the SM2 algorithm (national secret asymmetric encryption algorithm), and the SM2 algorithm belongs to the elliptic curve cryptography system (ECC), which is an algorithm based on the discrete mathematical problem of the elliptic curve. The currently widely used SM2256bit encryption algorithm is quite safe, equivalent to the security of RSA 2048bit and above. The SM2 algorithm is divided into public and private keys, and the public key can be calculated from the private key; it is quite difficult to calculate the private key from the public key; in other embodiments, the RSA algorithm and the Diffie-Hellman key exchange algorithm can also be used, and there is no specific limitation.

[0061] The user request ID specifically refers to the ID of the organization that issues the application information or the special ID of the person who specifically issues the application information.

[0062] Specifically, before sending out the application information, the lower-level firewall system first uses a preset encryption algorithm to encrypt the application information to obtain an application information encryption package; then the application information encryption package is combined with the user request ID to form application access information, and then the application access information is sent to the upper-level firewall system. The upper-level firewall system obtains the application access information so as to further obtain the required information from the application access information in the future.

[0063] S120: Determine a target public key based on the user request ID and a preset matching table, and decrypt the application information encrypted package based on the target public key to obtain plain text information.

[0064] Among them, the SM2 algorithm adopted by this embodiment for the application information has a corresponding public key and private key, wherein the private key is used to encrypt the application information to obtain an application information encrypted package; the public key corresponding to the private key is stored in the upper-level firewall system of the lower-level firewall system; a matching table is preset in the upper-level firewall system, and the matching table contains the stored public keys and the user request ID corresponding to each public key one by one; the target public key is the public key corresponding to the user request ID in the matching table that is the same as the application access information; the public key is used to decrypt the application information encrypted package encrypted using the corresponding private key; the plaintext information is the decryption result obtained after decrypting the application information encrypted package by the public key; in this embodiment, the plaintext information is also the user ID, application access IP address and system domain name used to constitute the application information.

[0065] Specifically, a user request ID identical to the user request ID in the access application information is matched from a preset matching table, and then a public key corresponding to the user request ID is determined from the matching table, and the public key is recorded as the target public key; further, the public key is used to decrypt the application information encrypted package in the access application information, thereby obtaining the plaintext information.

[0066] S130: Determine whether the plain text information exists in a preset parameter table.

[0067] Among them, the upper-level firewall system also presets a parameter table, and the fields included in the parameter table are: business system name, application access IP address, system domain name, user ID, organization name, organization ID / internal organization number; among them, the business system name is the name of the business system in the upper-level firewall system, the application access IP address is the IP address of the business system in the upper-level firewall system that can be accessed by the lower-level firewall system, the system domain name is the domain name of the business system in the upper-level firewall system, the user ID is the applicant who sends the application information in the lower-level firewall system, and the organization name is the name of the organization where the applicant is located; it can be seen that the parameter table also contains the types of content included in the plain text information: application access IP address, system domain name and user ID. It should be noted that by judging whether the plain text information exists in the preset parameter table, it can be judged whether the applicant corresponding to the user ID in the plain text information has the access right to access the business system in the upper-level firewall system corresponding to the application access IP address.

[0068] Specifically, the upper-level firewall system determines whether the decrypted plaintext information exists in a preset parameter table.

[0069] S140: If it is determined that the plain text information exists in the parameter table, the access rights of the upper-level firewall system are opened to the lower-level object corresponding to the plain text information.

[0070] Among them, the subordinate object corresponding to the plain text information is the applicant corresponding to the user ID in the plain text information.

[0071] Specifically, if it is determined that the plain text information exists in the above parameter table, the access permission of the business system corresponding to the IP address requested for access in the upper-level firewall system is opened to the lower-level object corresponding to the plain text information.

[0072] It should be noted that, in this embodiment, the application access information is obtained, and the application access information includes an application information encryption package and a user request ID; the target public key is determined based on the user request ID and a preset matching table, and the application information encryption package is decrypted based on the target public key to obtain plain text information; it is determined whether the plain text information exists in the preset parameter table; if it is determined that the plain text information exists in the parameter table, the access rights of the upper-level firewall system are opened to the lower-level object corresponding to the plain text information. Through the above implementation, the upper-level firewall system can decrypt the application access information according to the preset public key after receiving the application access information sent by the lower-level firewall system, and then directly determine whether the lower-level object corresponding to the application access information has the access right to access the upper-level firewall system according to the decrypted plain text information, so that the upper-level firewall system can quickly confirm whether the lower-level object has the access right to access the upper-level firewall system, thereby improving the access efficiency of the lower-level bank system to the upper-level bank system.

[0073] Embodiment 2

[0074] A firewall system access rights control method provided in the second embodiment of the present application supplements the step after "determining whether the plaintext information exists in a preset parameter table" in the first embodiment; it should be noted that for the part not described in detail in this embodiment, reference may be made to the description of other embodiments, and the method includes:

[0075] S210: Obtain application access information, where the application access information includes an encrypted application information package and a user request ID.

[0076] S220: Determine a target public key based on the user request ID and a preset matching table, and decrypt the application information encrypted package based on the target public key to obtain plain text information.

[0077] S230: Determine whether the plain text information exists in a preset parameter table.

[0078] S240: If it is determined that the plain text information exists in the parameter table, the access rights of the upper-level firewall system are opened to the lower-level object corresponding to the plain text information.

[0079] S250: If it is determined that the plain text information does not exist in the parameter table, an access request is sent to the subordinate firewall system, so that the subordinate firewall system determines whether to continue accessing the superior firewall system based on the access request.

[0080] Among them, when the upper-level firewall system determines that the plaintext information corresponding to the lower-level firewall system does not exist in the parameter table, it preliminarily determines that the lower-level firewall system does not have the qualifications to access the upper-level firewall system at this time; the access application is the access application information sent by the upper-level firewall system to the lower-level firewall system, and the access application can be used to inform the lower-level firewall system that it cannot access the upper-level firewall system at this time; after receiving the access application, the lower-level firewall system can determine whether to continue to access the upper-level firewall system based on the access application.

[0081] It should be noted that the implementation of the above steps in this embodiment facilitates improving the security of the lower-level objects accessing the business system in the upper-level firewall system.

[0082] Embodiment 3

[0083] A firewall system access control method is provided in a third embodiment of the present application. The method optimizes the method of "enabling the lower-level firewall system to determine whether to continue accessing the upper-level firewall system based on the access application" in the second embodiment. It should be noted that for the parts not described in detail in the present embodiment, reference can be made to the descriptions of other embodiments. The method includes:

[0084] S310: Obtain application access information, where the application access information includes an encrypted application information package and a user request ID.

[0085] S320: Determine a target public key based on the user request ID and a preset matching table, and decrypt the application information encrypted package based on the target public key to obtain plain text information.

[0086] S330: Determine whether the plain text information exists in a preset parameter table.

[0087] S340: If it is determined that the plain text information exists in the parameter table, the access rights of the upper-level firewall system are opened to the lower-level object corresponding to the plain text information.

[0088] S350. If it is determined that the plain text information does not exist in the parameter table, an access request is sent to the subordinate firewall system, so that the subordinate firewall system determines whether the unified authentication ID in the access request exists in the preset personnel ID table; if so, it is determined whether the plain text information exists in the preset access control list; if not, access to the business system corresponding to the plain text information is restricted.

[0089] Among them, in order to facilitate the strict control of the access of the superior object in the superior firewall system to the business system in the subordinate firewall system, a personnel ID table is preset in the subordinate firewall system, and the personnel ID table is used to store the unified authentication ID of the superior object that has the authority to access the internal of the subordinate firewall system; it should be noted that a unified authentication ID corresponding to the superior object is set in the access application; if the unified authentication ID of the superior object exists in the personnel ID table, it indicates that the superior object has the authority to access the internal of the subordinate firewall system.

[0090] It should be noted that, when the plaintext information corresponding to the lower-level firewall system does not exist in the parameter table corresponding to the upper-level firewall system, it means that the lower-level firewall system cannot access the upper-level firewall system at this time, but at this time, the lower-level firewall system has an access control list preset, and the access control list is a blacklist or a whitelist; if the above-mentioned plaintext information does not exist in the access control list, it ultimately means that the lower-level access object in the lower-level firewall system does not have the authority to access the business system of the upper-level firewall system corresponding to the plaintext information.

[0091] Embodiment 4

[0092] A firewall system access permission control method is provided in a fourth embodiment of the present application. The method optimizes the "opening the access permission of the upper-level firewall system to the lower-level object corresponding to the plaintext information" in the first embodiment. It should be noted that for the parts not described in detail in this embodiment, reference can be made to the descriptions of other embodiments. The method includes:

[0093] S410: Obtain application access information, where the application access information includes an encrypted application information package and a user request ID.

[0094] S420: Determine a target public key based on the user request ID and a preset matching table, and decrypt the application information encrypted package based on the target public key to obtain plain text information.

[0095] S430: Determine whether the plain text information exists in a preset parameter table.

[0096] S441. If it is determined that the plain text information exists in the parameter table, determine whether the subordinate object corresponding to the plain text information is a subordinate object adjacent to the upper-level firewall system.

[0097] It should be noted that a superior bank has a corresponding subordinate bank, and the subordinate bank may also have its corresponding subordinate bank, that is, the subordinate bank of the superior bank, and so on, wherein the subordinate bank is the superior bank of the subordinate bank, and the subordinate bank is the subordinate bank of the subordinate bank; the subordinate bank is the subordinate bank adjacent to the corresponding superior bank; correspondingly, the subordinate firewall system is the subordinate firewall system adjacent to the corresponding superior firewall system; the subordinate object to which the subordinate firewall system sends the application information is also the subordinate object adjacent to the superior firewall system; by judging whether the subordinate object corresponding to the plaintext information is the subordinate object adjacent to the superior firewall system, it can be Determine whether the subordinate object has the authority to access the business system; in this embodiment, in order to interact and manage user data and improve data security, the upper-level firewall system is set to be open only to adjacent lower-level firewall systems, that is, only subordinate objects in adjacent lower-level firewall systems can access the upper-level firewall system; however, due to the position changes of staff members, the parameter table in the upper-level firewall system may store application information of non-adjacent subordinate objects; in order to prevent non-adjacent subordinate objects from having the authority to access the upper-level firewall system, it is also necessary to determine whether the subordinate object corresponding to the plaintext information is an adjacent subordinate object of the upper-level firewall system.

[0098] Specifically, when the upper-level firewall system determines that the plain text information exists in the parameter table, it further determines whether the lower-level object corresponding to the plain text information is an adjacent lower-level object of the upper-level firewall system.

[0099] S442: If yes, then open the access rights of the upper-level firewall system to the lower-level object.

[0100] Specifically, if the upper-level firewall system determines that the subordinate object corresponding to the plaintext information is a subordinate object adjacent to the upper-level firewall system, the upper-level firewall system opens the access rights of the upper-level firewall system to the subordinate object, so that the subordinate object can access the business system corresponding to the plaintext information in the upper-level firewall system.

[0101] Embodiment 5

[0102] Figure 2 A flowchart of a firewall system access rights control method provided in Example 5 of the present application, refer to Figure 2 The method may be executed by a device for executing the method, and the device may be implemented by software and / or hardware. It should be noted that for the parts not described in detail in this embodiment, reference may be made to the descriptions of other embodiments. The method includes:

[0103] S510: Generate a request packet based on the requested access IP address, system domain name, and user ID.

[0104] It should be noted that the execution subject of this embodiment is the lower-level firewall system.

[0105] Among them, when the lower-level firewall system needs to access the business system in the upper-level firewall system, it needs to send application information to the upper-level firewall system, and the application information is used to characterize the applicant (the specific object of sending the application information) and the business system information requested for access; illustratively, the application information in this embodiment includes a user ID, an application access IP address and a system domain name, wherein the user ID is used to characterize the applicant, the application access IP address is the IP address of the business system, the system domain name is the domain name of the business system, and the application access IP address and the system domain name are used to characterize the business system information requested for access; in other embodiments, the content included in the application information is not specifically limited; the request packet is a data packet obtained by combining the application access IP address, the system domain name and the user ID.

[0106] Specifically, the lower-level firewall system combines the access request IP address, system domain name, and user ID to generate a request packet.

[0107] S520: Encrypt the request packet based on a preset private key to obtain an encrypted packet.

[0108] Among them, in order to improve the security of data transmission between the lower-level firewall system and the upper-level firewall system, in this embodiment, a preset encryption algorithm is used to encrypt the request packet, and the encryption algorithm has a public key and a private key, wherein the private key is used to encrypt the request packet in the lower-level firewall system to obtain an encrypted packet; the public key is used to send to the upper-level firewall system adjacent to the lower-level firewall system, so that the upper-level firewall system can subsequently preset a matching table based on the key. Exemplarily, in this example, the encryption algorithm specifically adopts the SM2 algorithm (national secret asymmetric encryption algorithm), which belongs to the elliptic curve cryptography system (ECC) and is an algorithm based on the discrete mathematical problem of the elliptic curve. The currently widely used SM2256bit encryption algorithm is quite safe, equivalent to the security of RSA 2048bit and above. The SM2 algorithm is divided into public and private keys, and the public key can be calculated by the private key; it is quite difficult to calculate the private key by the public key; in other embodiments, the RSA algorithm and the Diffie-Hellman key exchange algorithm can also be used, and there is no specific limitation.

[0109] Specifically, the lower-level firewall system uses a private key provided by a preset encryption algorithm to encrypt the request packet, thereby obtaining an encrypted packet.

[0110] S530: Generate access application information based on the encrypted package and the user request ID.

[0111] The user request ID specifically refers to the ID of the organization that issues the application information or the special ID of the person who specifically issues the application information; the application access information is the information obtained by combining the encrypted package with the user request ID.

[0112] Specifically, the lower-level firewall system combines the encrypted package with the user request ID to obtain the application access information.

[0113] S540, sending the application access information to the upper-level firewall system, so that the upper-level firewall system: obtains the application access information, the application access information includes an application information encryption package and a user request ID; determines the target public key based on the user request ID and a preset matching table, and decrypts the application information encryption package based on the target public key to obtain plain text information; determines whether the plain text information exists in a preset parameter table; if it is determined that the plain text information exists in the parameter table, then opens the access rights of the upper-level firewall system to the lower-level object corresponding to the plain text information.

[0114] It should be noted that, in this embodiment, the request packet is encrypted to obtain an encrypted packet, so as to improve the security of data transmission between the lower-level firewall system and the upper-level firewall system; in addition, the application access information is sent to the upper-level firewall system so that the upper-level firewall system obtains the application access information, and the application access information includes the application information encrypted packet and the user request ID; the target public key is determined based on the user request ID and the preset matching table, and the application information encrypted packet is decrypted based on the target public key to obtain the plain text information; it is determined whether the plain text information exists in the preset parameter table; if it is determined that the plain text information exists in the parameter table, the access right of the upper-level firewall system is opened to the lower-level object corresponding to the plain text information. Through the above implementation, the upper-level firewall system can decrypt the application access information according to the preset public key after receiving the application access information sent by the lower-level firewall system, and then directly determine whether the lower-level object corresponding to the application access information has the access right to access the upper-level firewall system according to the decrypted plain text information, so that the upper-level firewall system can quickly confirm whether the lower-level object has the access right to access the upper-level firewall system, thereby improving the access efficiency of the lower-level bank system to the upper-level bank system.

[0115] Embodiment 6

[0116] Figure 3 A flowchart of a firewall system access rights control method provided in Example 5 of the present application, refer to Figure 3 The method may be executed by a device for executing the method, and the device may be implemented by software and / or hardware. It should be noted that for the parts not described in detail in this embodiment, reference may be made to the descriptions of other embodiments. The method includes:

[0117] S610, obtaining subordinate application access information sent by the subordinate firewall system, wherein the subordinate application access information includes a subordinate application information encrypted package and a subordinate user request ID.

[0118] Among them, when the lower-level firewall system needs to perform cross-level access, such as Figure 4 The situation shown is that the lower-level firewall system needs to access the upper-level firewall system across the intermediate firewall system; the lower-level firewall system needs to first send lower-level application access information to the intermediate firewall system, and the lower-level application access information is the application access information sent by the lower-level firewall system to the intermediate firewall system; the lower-level application information encrypted package is the application information encrypted package generated by the lower-level firewall system, and the lower-level user request ID is the user request ID generated by the lower-level firewall system.

[0119] Specifically, the intermediate firewall system receives the lower-level access application information sent by the lower-level firewall system.

[0120] S620. Decrypt the subordinate application information encrypted package in the subordinate application access information based on the subordinate public key corresponding to the subordinate user request ID to obtain subordinate plaintext information.

[0121] Among them, the intermediate firewall system is preset with subordinate public keys corresponding to each subordinate user request ID. After the intermediate firewall system receives the subordinate application access information, it can determine the corresponding subordinate public key according to the subordinate user request ID in the subordinate application access information, and then use the subordinate public key to decrypt the subordinate application information encrypted package in the subordinate application access information, so as to obtain the corresponding subordinate plaintext information; the subordinate plaintext information is also the plaintext information corresponding to the subordinate firewall system.

[0122] S630: Encrypt the subordinate plaintext information based on a preset intermediate private key to obtain an intermediate application information encryption package, and generate intermediate application access information based on the intermediate application information encryption package and a preset intermediate user request ID.

[0123] Among them, in order to improve the security of application access information transmission, the intermediate firewall system needs to encrypt the subordinate plaintext information before sending it to the upper-level firewall system; the intermediate firewall system is preset with an intermediate private key for encrypting plaintext information, and the intermediate private key is also the private key corresponding to the intermediate firewall system; the intermediate private key can encrypt the subordinate plaintext information into an intermediate application information encrypted package; the intermediate user request ID is the user request ID corresponding to the intermediate firewall system, and the intermediate firewall system can combine the intermediate application information encrypted package with the intermediate user request ID into intermediate application access information.

[0124] S640. Send the intermediate application access information to the upper-level firewall system, so that the upper-level firewall system decrypts the intermediate application information encrypted package in the intermediate application access information based on the intermediate public key corresponding to the intermediate user request ID to obtain the lower-level plaintext information, and determines whether the lower-level firewall system is qualified to access the upper-level firewall system based on the lower-level plaintext information.

[0125] Among them, after generating the intermediate application access information, the intermediate firewall system can further send the intermediate application access information to the upper-level firewall system; the upper-level firewall system is provided with an intermediate public key corresponding to the intermediate private key, and the intermediate public key is used to decrypt the intermediate application information encrypted package in the intermediate application access information to obtain the corresponding lower-level plaintext information. The upper-level firewall system can determine whether the lower-level firewall system is qualified to access the upper-level firewall system based on the lower-level plaintext information. The step of the upper-level firewall system determining whether the lower-level firewall system is qualified to access the upper-level firewall system based on the lower-level plaintext information can be referred to steps S330-S350.

[0126] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0127] Embodiment 7

[0128] Based on the same inventive concept, this embodiment also provides a firewall system access control device for implementing the firewall system access control method involved in the above embodiment 1. The implementation solution provided by the device is similar to the implementation solution recorded in the above method, so the specific limitations in one or more firewall system access control device embodiments provided below can refer to the limitations of the firewall system access control method above, and will not be repeated here.

[0129] In this embodiment, Figure 5 As shown, a firewall system access authority control device is provided, comprising:

[0130] An information acquisition module, used to acquire application access information, wherein the application access information includes an application information encryption package and a user request ID;

[0131] A public key decryption module, used to determine a target public key based on the user request ID and a preset matching table, and decrypt the application information encrypted package based on the target public key to obtain plain text information;

[0132] A plain text determination module, used to determine whether the plain text information exists in a preset parameter table;

[0133] The access control module is used to open the access rights of the upper-level firewall system to the lower-level object corresponding to the plaintext information if it is determined that the plaintext information exists in the parameter table.

[0134] In one embodiment, the firewall system access permission control device further includes:

[0135] A list determination module, for determining whether the plain text information is found in a preset access control list if it is determined that the plain text information does not exist in the parameter table;

[0136] The access restriction module is used to restrict access to the business system corresponding to the plaintext information if no.

[0137] In one embodiment, in terms of opening the access rights of the upper-level firewall system to the lower-level object corresponding to the plaintext information, the access control module is specifically used to:

[0138] Determining whether the subordinate object corresponding to the plaintext information is a subordinate object adjacent to the superior firewall system;

[0139] If so, the access rights of the upper-level firewall system are opened to the lower-level object.

[0140] Embodiment 8

[0141] In this embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a firewall system access right control method is implemented.

[0142] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the scheme of the present disclosure, and does not constitute a limitation on the computer device to which the scheme of the present disclosure is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0143] Embodiment 9

[0144] In this embodiment, a computer readable storage medium is provided. Figure 7 As shown, a computer program is stored thereon, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0145] Embodiment 10

[0146] In this embodiment, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0147] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0148] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided by the present disclosure can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided by the present disclosure may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited thereto. The processor involved in each embodiment provided by the present disclosure may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited thereto.

[0149] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0150] The above-described embodiments only express several implementation methods of the present disclosure, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present disclosure, and these all belong to the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure shall be subject to the attached claims.

Claims

1. A method for controlling access rights of a firewall system, characterized in that: include: Obtaining application access information, wherein the application access information includes an encrypted application information package and a user request ID; Determine a target public key based on the user request ID and a preset matching table, and decrypt the application information encrypted package based on the target public key to obtain plain text information; Determine whether the plaintext information exists in a preset parameter table; If it is determined that the plain text information exists in the parameter table, the access permission of the upper-level firewall system is opened to the lower-level object corresponding to the plain text information.

2. The method according to claim 1, characterized in that After determining whether the plain text information exists in the preset parameter table, the method further includes: If it is determined that the plain text information does not exist in the parameter table, an access request is sent to the subordinate firewall system, so that the subordinate firewall system determines whether to continue accessing the superior firewall system based on the access request.

3. The method according to claim 2, characterized in that The method of enabling the lower-level firewall system to determine whether to continue accessing the upper-level firewall system based on the access application includes: The lower-level firewall system determines whether the unified authentication ID in the access application exists in the preset personnel ID table; if so, determines whether the plaintext information exists in the preset access control list; if not, restricts access to the business system corresponding to the plaintext information.

4. The method according to claim 1, characterized in that The step of opening the access rights of the upper-level firewall system to the lower-level object corresponding to the plaintext information includes: Determining whether the subordinate object corresponding to the plaintext information is a subordinate object adjacent to the superior firewall system; If so, the access rights of the upper-level firewall system are opened to the lower-level object.

5. A method for controlling access rights of a firewall system, characterized in that: include: Generate a request packet based on the requested access IP address, system domain name, and user ID; Encrypting the request packet based on a preset private key to obtain an encrypted packet; Generate application access information based on the encrypted package and the user request ID; The application access information is sent to the upper-level firewall system, so that the upper-level firewall system: obtains the application access information, the application access information includes an application information encryption package and a user request ID; determines a target public key based on the user request ID and a preset matching table, and decrypts the application information encryption package based on the target public key to obtain plain text information; Determine whether the plaintext information exists in a preset parameter table; If it is determined that the plain text information exists in the parameter table, the access permission of the upper-level firewall system is opened to the lower-level object corresponding to the plain text information.

6. A method for controlling access rights of a firewall system, characterized in that: include: Obtaining subordinate application access information sent by the subordinate firewall system, wherein the subordinate application access information includes a subordinate application information encrypted package and a subordinate user request ID; Decrypting the subordinate application information encrypted package in the subordinate application access information based on the subordinate public key corresponding to the subordinate user request ID to obtain subordinate plaintext information; Encrypting the subordinate plaintext information based on a preset intermediate private key to obtain an intermediate application information encryption package, and generating intermediate application access information based on the intermediate application information encryption package and a preset intermediate user request ID; The intermediate application access information is sent to the upper-level firewall system, so that the upper-level firewall system decrypts the intermediate application information encrypted package in the intermediate application access information based on the intermediate public key corresponding to the intermediate user request ID to obtain the lower-level plaintext information, and determines whether the lower-level firewall system is qualified to access the upper-level firewall system based on the lower-level plaintext information.

7. A firewall system access rights control device, characterized in that: The device comprises: An information acquisition module, used to acquire application access information, wherein the application access information includes an application information encryption package and a user request ID; A public key decryption module, used to determine a target public key based on the user request ID and a preset matching table, and decrypt the application information encrypted package based on the target public key to obtain plain text information; A plain text determination module, used to determine whether the plain text information exists in a preset parameter table; The access control module is used to open the access rights of the upper-level firewall system to the lower-level object corresponding to the plaintext information if it is determined that the plaintext information exists in the parameter table.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images