Firewall system access permission control method, device and equipment and storage medium

Abstract

The application relates to the technical field of financial science and technology, in particular to a firewall system access permission control method and device, equipment and a storage medium, wherein the method comprises the following steps: obtaining application access information, the application access information comprising an application information encrypted package and a user request ID; determining a target public key based on the user request ID and a preset matching table, decrypting the application information encrypted package based on the target public key to obtain plaintext information; judging whether the plaintext information exists in a preset parameter table; if it is judged that the plaintext information exists in the parameter table, opening the access permission of a superior firewall system to a subordinate object corresponding to the plaintext information. The application facilitates improving the access efficiency of a subordinate bank system to a superior bank system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of financial technology, and particularly relates to a firewall system access permission control method and device, equipment and a storage medium. BACKGROUND

[0002] In order to protect the data information security of users, different levels of bank systems are provided with corresponding firewalls to prevent external attacks; a superior bank system is provided with a superior firewall, and a subordinate bank system of the superior bank system is provided with a subordinate firewall, and the setting of the superior firewall limits the access of the subordinate bank system to each business system in the superior bank system.

[0003] If the subordinate bank system needs to access the superior bank system, the subordinate bank system needs to further apply for access permission to the superior bank system on the premise that the subordinate bank system has access qualification, and after obtaining the access permission, the subordinate bank system can have the permission to access each business system in the superior bank system.

[0004] However, at present, the approval process of the superior bank system for the access permission application of the subordinate bank system is complex, and the approval time is relatively long, which greatly affects the access efficiency of the subordinate bank system to the superior bank system. SUMMARY

[0005] In order to facilitate the improvement of the access efficiency of the subordinate bank system to the superior bank system, the present application provides a firewall system access permission control method, device, equipment and storage medium.

[0006] In a first aspect, the present application provides a firewall system access permission control method, comprising:

[0007] Obtaining application access information, the application access information comprising an application information encrypted package and a user request ID;

[0008] Determining a target public key based on the user request ID and a preset matching table, and decrypting the application information encrypted package based on the target public key to obtain plaintext information;

[0009] Judging whether the plaintext information exists in a preset parameter table;

[0010] If it is judged that the plaintext information exists in the parameter table, the access permission of the superior firewall system is opened to the subordinate object corresponding to the plaintext information.

[0011] In the implementation of the method, the superior firewall system, after receiving the application access information sent by the subordinate firewall system, can decrypt the application access information according to the preset public key, and then directly determine whether the subordinate object corresponding to the application access information has the access permission of the superior firewall system according to the decrypted plaintext information, so that the superior firewall system can quickly confirm whether the subordinate object has the access permission of the superior firewall system, thereby improving the access efficiency of the subordinate bank system to the superior bank system.

[0012] Preferably, after determining whether the plaintext information exists in the preset parameter table, the method further comprises:

[0013] If it is determined that the plaintext information does not exist in the parameter table, an access application is sent to the subordinate firewall system, so that the subordinate firewall system determines whether to continue accessing the superior firewall system based on the access application.

[0014] In the implementation of the method, the redundancy of the subordinate object accessing the business system in the superior firewall system can be improved, so as to further improve the success rate and security of the subordinate object accessing the superior firewall system.

[0015] Preferably, the method of enabling the subordinate firewall system to determine whether to continue accessing the superior firewall system based on the access application comprises:

[0016] The subordinate firewall system determines whether the uniform authentication ID in the access application exists in a preset personnel ID table; if yes, it is determined whether the plaintext information exists in a preset access control list; if no, the business system corresponding to the plaintext information is restricted.

[0017] In the implementation of the method, the success rate and security of the subordinate object accessing the superior firewall system can be improved.

[0018] Preferably, the method of enabling the subordinate firewall system to determine whether to continue accessing the superior firewall system based on the access application comprises:

[0019] It is determined whether the subordinate object corresponding to the plaintext information is a subordinate object adjacent to the superior firewall system.

[0020] If yes, the access permission of the superior firewall system is opened to the subordinate object.

[0021] In the implementation of the method, the data of the user can be interacted and managed, and the security of the data can be improved.

[0022] In a second aspect, the application also provides a firewall system access permission control method, comprising:

[0023] A request packet is generated based on an application access IP address, a system domain name and a user ID.

[0024] encrypt the request package based on a preset private key to obtain an encrypted package;

[0025] generate application access information based on the encrypted package and a user request ID;

[0026] send the application access information to a superior firewall system, so that the superior firewall system: acquires application access information including an application information encrypted package and a user request ID; determines a target public key based on the user request ID and a preset matching table, and decrypts the application information encrypted package based on the target public key to obtain plaintext information; judges whether the plaintext information exists in a preset parameter table; and if it is judged that the plaintext information exists in the parameter table, opens access permission of the superior firewall system to a subordinate object corresponding to the plaintext information.

[0027] In the implementation of the above method, when the superior firewall system receives the application access information sent by the subordinate firewall system, the application access information can be decrypted according to a preset public key, and then whether the subordinate object corresponding to the application access information has access permission of the superior firewall system is directly judged according to the decrypted plaintext information, so that the superior firewall system can quickly confirm whether the subordinate object has access permission of the superior firewall system, thereby improving the access efficiency of the subordinate bank system to the superior bank system.

[0028] In a third aspect, the application further provides a firewall system access permission control method, comprising:

[0029] acquire subordinate application access information sent by a subordinate firewall system, the subordinate application access information including a subordinate application information encrypted package and a subordinate user request ID;

[0030] decrypt the subordinate application information encrypted package in the subordinate application access information based on a subordinate public key corresponding to the subordinate user request ID to obtain subordinate plaintext information;

[0031] encrypt the subordinate plaintext information based on a preset intermediate private key to obtain an intermediate application information encrypted package, and generate intermediate application access information based on the intermediate application information encrypted package and a preset intermediate user request ID;

[0032] send the intermediate application access information to a superior firewall system, so that the superior firewall system decrypts the intermediate application information encrypted package in the intermediate application access information based on an intermediate public key corresponding to the intermediate user request ID to obtain the subordinate plaintext information, and judges whether the subordinate firewall system has access permission of the superior firewall system based on the subordinate plaintext information.

[0033] The implementation of the method, if the lower firewall system wants to access the upper firewall system across levels, needs to pass through the middle firewall system to perform the decryption and re-encryption process, so as to facilitate the security of the access process while meeting the demand of the lower firewall system to access the upper firewall system across levels.

[0034] In a fourth aspect, the present application provides a firewall system access permission control device, comprising:

[0035] An information obtaining module is configured to obtain application access information, wherein the application access information comprises an application information encrypted package and a user request ID;

[0036] A public key decryption module is configured to determine a target public key based on the user request ID and a preset matching table, and decrypt the application information encrypted package based on the target public key to obtain plaintext information;

[0037] A plaintext judgment module is configured to judge whether the plaintext information exists in a preset parameter table;

[0038] An access control module is configured to open the access permission of the upper firewall system to a lower object corresponding to the plaintext information if it is judged that the plaintext information exists in the parameter table.

[0039] In a fifth aspect, the present application provides a computer device, which comprises a memory and a processor, the memory stores a computer program, and the processor implements the steps in the above method when executing the computer program.

[0040] In a sixth aspect, the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps in the above method.

[0041] In a seventh aspect, the present application further provides a computer program product. The computer program product comprises a computer program, and the computer program is executed by a processor to implement the steps in any of the above method embodiments.

[0042] The firewall system access permission control method, device, equipment and storage medium described above, by obtaining the application access information, the application access information includes application information encrypted package and user request ID; determining the target public key based on the user request ID and the preset matching table, decrypting the application information encrypted package based on the target public key to obtain plaintext information; judging whether the plaintext information exists in the preset parameter table; if it is judged that the plaintext information exists in the parameter table, the access permission of the upper level firewall system is opened to the subordinate object corresponding to the plaintext information. Through the above implementation, when the upper level firewall system receives the application access information sent by the subordinate firewall system, the application access information can be decrypted according to the preset public key, and then whether the subordinate object corresponding to the application access information has the access permission of the upper level firewall system is directly judged according to the decrypted plaintext information, so that the upper level firewall system can quickly confirm whether the subordinate object has the access permission of the upper level firewall system, thereby improving the access efficiency of the subordinate bank system to the upper level bank system.

[0043] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the application, nor is it used to limit the scope of the application. Other features of the application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some of the embodiments of the application, and therefore should not be regarded as limiting the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0045] Figure 1 A firewall system access permission control method flow chart provided in the embodiments of the application;

[0046] Figure 2 Another firewall system access permission control method flow chart provided in the embodiments of the application;

[0047] Figure 3 Another firewall system access permission control method flow chart provided in the embodiments of the application;

[0048] Figure 4 The structure diagram of a firewall system access permission control device provided in the embodiments of the application;

[0049] Figure 5 The composition diagram of a multi-level firewall system provided in the embodiments of the application;

[0050] Figure 6 Fig. 1 is a structural schematic diagram of a computer device provided in an embodiment of the present application;

[0051] Figure 7 Fig. 4 is an internal structural diagram of a computer readable storage medium provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the objects, technical solutions and advantages of the present disclosure clearer, the present disclosure will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present disclosure and not intended to limit the present disclosure.

[0053] It should be noted that the terms "first", "second" and the like in the description, claims and above drawings of the present disclosure are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present disclosure described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, device, product or apparatus that includes a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or apparatus.

[0054] In this paper, the term "and / or" is only a description of the association relationship between the associated objects, which means that there can be three relationships. For example, A and / or B can represent three cases: A exists alone, A and B exist together, and B exists alone. In addition, the character " / " in this paper generally represents an "or" relationship between the front and rear associated objects.

[0055] Embodiment one

[0056] Figure 1 Fig. 2 is a flowchart of a firewall system access permission control method provided in the first embodiment of the present application, referring to Figure 1 The method can be executed by a device for executing the method, which can be realized by software and / or hardware. The method comprises the following steps:

[0057] S110, obtaining application access information, the application access information comprising an application information encryption package and a user request ID.

[0058] It should be noted that the execution subject of the present embodiment is a superior firewall system.

[0059] The bank is divided into banks of different levels according to functions, for example, the head bank is the upper-level bank, and the bank under the head bank is the lower-level bank; each level of bank sets a firewall in the bank system of itself to protect the security of user data; the bank system of the upper-level bank (hereinafter referred to as the upper-level bank system) contains various business systems, each business system can be accessed by the lower-level bank to realize specific business operations, and the firewall set by the upper-level bank system is referred to as the upper-level firewall in this embodiment; the bank system of the lower-level bank (hereinafter referred to as the lower-level bank system) also contains various business systems suitable for the lower-level bank, and the firewall set by the lower-level bank system is referred to as the lower-level firewall in this embodiment; and the upper-level bank system with the upper-level firewall is referred to as the upper-level firewall system, and the lower-level bank system with the lower-level firewall is referred to as the lower-level bank system; when the lower-level firewall system needs to access the business system in the upper-level firewall system, an application information needs to be sent to the upper-level firewall system, and the application information is used to represent the application subject (the specific object of sending the application information) and the business system information to be accessed; for example, the application information in this embodiment includes a user ID, an application access IP address and a system domain name, wherein the user ID is used to represent the application subject, the application access IP address is the IP address of the business system, and the system domain name is the domain name of the business system, and the application access IP address and the system domain name are used to represent the business system information to be accessed; in other embodiments, the content included in the application information is not limited.

[0060] The application information encryption package is a data package obtained by encrypting the application information by a certain encryption algorithm; in this embodiment, the encryption algorithm is the SM2 algorithm (a national encryption asymmetric encryption algorithm), which belongs to the elliptic curve cryptography (ECC) and is an algorithm based on the discrete mathematical problem of the elliptic curve. The widely used SM2 256-bit encryption algorithm is quite secure, equivalent to the security of RSA 2048-bit and above. The SM2 algorithm has public and private keys, and the private key can be calculated from the public key; it is quite difficult to calculate the private key from the public key; in other embodiments, RSA algorithm and Diffie-Hellman key exchange algorithm can also be used, and the specific implementation is not limited.

[0061] The user request ID specifically refers to the ID of the institution sending the application information or the special ID of the person sending the application information.

[0062] Specifically, the lower firewall system encrypts the application information by using a preset encryption algorithm before sending the application information, so as to obtain an application information encryption package; then the application information encryption package and the user request ID are combined to form application access information, and the application access information is sent to the upper firewall system; the upper firewall system acquires the application access information, so as to further acquire the required information from the application access information.

[0063] S120, determining a target public key based on the user request ID and a preset matching table, and decrypting the application information encryption package based on the target public key to obtain plaintext information.

[0064] In the embodiment, the SM2 algorithm used for the application information has a corresponding public key and a private key, the private key is used to encrypt the application information to obtain the application information encryption package, the public key corresponding to the private key is stored in the upper firewall system of the lower firewall system, the matching table is preset in the upper firewall system, the matching table includes the stored public keys and the user request IDs corresponding to each public key, the target public key is the public key corresponding to the same user request ID in the application access information in the matching table, the public key is used to decrypt the application information encryption package encrypted by the corresponding private key, the plaintext information is the decryption result obtained by decrypting the application information encryption package by the public key, and in the embodiment, the plaintext information is the user ID, the application access IP address and the system domain name used to form the application information.

[0065] Specifically, the same user request ID as that in the application access information is matched from the preset matching table, the public key corresponding to the user request ID is determined from the matching table, and the public key is recorded as the target public key; further, the application information encryption package in the application access information is decrypted by using the public key, so as to obtain the plaintext information.

[0066] S130, judging whether the plaintext information exists in the preset parameter table.

[0067] The parameter table includes the following fields: business system name, application access IP address, system domain name, user ID, organization name, and organization ID / interior organization number. The business system name is the name of the business system in the upper firewall system, the application access IP address is the IP address of the business system in the upper firewall system accessible by the lower firewall system, the system domain name is the domain name of the business system in the upper firewall system, the user ID is the application subject sending the application information by the lower firewall system, and the organization name is the name of the organization where the application subject is located. It can be seen that the parameter table also includes the types of contents included in the plaintext information: the application access IP address, the system domain name, and the user ID. It should be noted that by judging whether the plaintext information exists in the preset parameter table, it can be determined whether the application subject corresponding to the user ID in the plaintext information has access rights to access the business system in the upper firewall system corresponding to the application access IP address.

[0068] Specifically, the upper firewall system determines whether the decrypted plaintext information exists in the preset parameter table.

[0069] S140, if it is determined that the plaintext information exists in the parameter table, the access rights of the upper firewall system are opened to the lower object corresponding to the plaintext information.

[0070] The lower object corresponding to the plaintext information is the application subject corresponding to the user ID in the plaintext information.

[0071] Specifically, if it is determined that the plaintext information exists in the parameter table, the access rights of the business system in the upper firewall system corresponding to the application access IP address are opened to the lower object corresponding to the plaintext information.

[0072] It should be noted that the present embodiment obtains application access information, the application access information includes application information encryption package and user request ID; determines a target public key based on the user request ID and a preset matching table, decrypts the application information encryption package based on the target public key to obtain plaintext information; determines whether the plaintext information exists in a preset parameter table; if it is determined that the plaintext information exists in the parameter table, the access rights of the upper firewall system are opened to the lower object corresponding to the plaintext information. Through the above implementation, when the upper firewall system receives the application access information sent by the lower firewall system, the application access information can be decrypted according to the preset public key, and then it is directly determined whether the lower object corresponding to the application access information has access rights to access the upper firewall system according to the decrypted plaintext information. In this way, the upper firewall system can quickly confirm whether the lower object has access rights to access the upper firewall system, thereby improving the access efficiency of the lower bank system to the upper bank system.

[0073] Embodiment two

[0074] The firewall system access permission control method provided in Embodiment Two of the present application supplements the steps after "judging whether the plaintext information exists in the preset parameter table" in Embodiment One; it should be noted that the parts not described in detail in this embodiment can be referred to the descriptions of other embodiments. The method comprises the following steps:

[0075] S210, obtaining application access information, wherein the application access information comprises an application information encrypted package and a user request ID.

[0076] S220, determining a target public key based on the user request ID and a preset matching table, and decrypting the application information encrypted package based on the target public key to obtain plaintext information.

[0077] S230, judging whether the plaintext information exists in a preset parameter table.

[0078] S240, if it is judged that the plaintext information exists in the parameter table, opening the access permission of the upper-level firewall system to the lower-level object corresponding to the plaintext information.

[0079] S250, if it is judged that the plaintext information does not exist in the parameter table, sending an access application to the lower-level firewall system, so that the lower-level firewall system judges whether to continue accessing the upper-level firewall system based on the access application.

[0080] In the case where the upper-level firewall system judges that the plaintext information corresponding to the lower-level firewall system does not exist in the parameter table, it is preliminarily judged that the lower-level firewall system does not have the qualification to access the upper-level firewall system at this time. The access application is the access application information sent by the upper-level firewall system to the lower-level firewall system, which can be used to inform the lower-level firewall system that it cannot access the upper-level firewall system at this time. The lower-level firewall system can judge whether to continue accessing the upper-level firewall system according to the access application after receiving the access application.

[0081] It should be noted that the implementation of the above steps of this embodiment facilitates to improve the security of the lower-level object accessing the business system in the upper-level firewall system.

[0082] Embodiment three

[0083] The firewall system access permission control method provided in Embodiment Three of the present application optimizes "so that the lower-level firewall system judges whether to continue accessing the upper-level firewall system based on the access application" in Embodiment Two; it should be noted that the parts not described in detail in this embodiment can be referred to the descriptions of other embodiments. The method comprises the following steps:

[0084] S310, obtaining application access information, the application access information including an application information encrypted package and a user request ID.

[0085] S320, determining a target public key based on the user request ID and a preset matching table, and decrypting the application information encrypted package based on the target public key to obtain plaintext information.

[0086] S330, judging whether the plaintext information exists in a preset parameter table.

[0087] S340, if it is judged that the plaintext information exists in the parameter table, opening an access permission of a superior firewall system to a subordinate object corresponding to the plaintext information.

[0088] S350, if it is judged that the plaintext information does not exist in the parameter table, issuing an access application to a subordinate firewall system, and judging whether a uniform authentication ID in the access application exists in a preset personnel ID table; if yes, judging whether the plaintext information exists in a preset access control list; if no, limiting an access to a business system corresponding to the plaintext information.

[0089] It should be noted that, in a case where the plaintext information corresponding to the subordinate firewall system does not exist in the parameter table corresponding to the superior firewall system, it is indicated that the subordinate firewall system cannot access the superior firewall system at this time, but the access control list is preset in the subordinate firewall system, and the access control list is a black list or a white list; if the above plaintext information also does not exist in the access control list, it is finally indicated that a subordinate access object in the subordinate firewall system has no permission to access the business system corresponding to the plaintext information and the superior firewall system.

[0090] It should be noted that, in a case where the plaintext information corresponding to the subordinate firewall system does not exist in the parameter table corresponding to the superior firewall system, it is indicated that the subordinate firewall system cannot access the superior firewall system at this time, but the access control list is preset in the subordinate firewall system, and the access control list is a black list or a white list; if the above plaintext information also does not exist in the access control list, it is finally indicated that a subordinate access object in the subordinate firewall system has no permission to access the business system corresponding to the plaintext information and the superior firewall system.

[0091] Embodiment Four

[0092] The firewall system access permission control method provided in Embodiment Four optimizes the "opening an access permission of a superior firewall system to a subordinate object corresponding to the plaintext information" in Embodiment One; it should be noted that, in the part not described in this embodiment, reference can be made to the description of other embodiments, and the method comprises:

[0093] S410, obtain application access information, the application access information comprising an application information encrypted package and a user request ID.

[0094] S420, determine a target public key based on the user request ID and a preset matching table, and decrypt the application information encrypted package based on the target public key to obtain plaintext information.

[0095] S430, judge whether the plaintext information exists in a preset parameter table.

[0096] S441, if it is judged that the plaintext information exists in the parameter table, judge whether the lower-level object corresponding to the plaintext information is a lower-level object adjacent to the upper-level firewall system.

[0097] It should be noted that the upper-level bank has a corresponding lower-level bank, and the lower-level bank can also have its corresponding lower-level bank, i.e., the lower-level bank of the upper-level bank, and so on, wherein the lower-level bank is the upper-level bank of the lower-level bank, and the lower-level bank is the lower-level bank of the lower-level bank; the lower-level bank is the lower-level bank adjacent to the corresponding upper-level bank; correspondingly, the lower-level firewall system is the lower-level firewall system adjacent to the corresponding upper-level firewall system; the lower-level object issuing the application information of the lower-level firewall system is the lower-level object adjacent to the upper-level firewall system; by judging whether the lower-level object corresponding to the plaintext information is the lower-level object adjacent to the upper-level firewall system, it can be judged whether the lower-level object has the access right to the business system; in this embodiment, in order to interact and manage the data of the user and improve the security of the data, the upper-level firewall system is set to be open only to the adjacent lower-level firewall system, i.e., only the lower-level object in the adjacent lower-level firewall system can access the upper-level firewall system; however, due to the post change of the staff and other situations, the parameter table in the upper-level firewall system can store the application information of the non-adjacent lower-level object; in order to prevent the non-adjacent lower-level object from having the access right to the upper-level firewall system, it is further necessary to judge whether the lower-level object corresponding to the plaintext information is the lower-level object adjacent to the upper-level firewall system.

[0098] Specifically, the upper-level firewall system further judges whether the lower-level object corresponding to the plaintext information is the lower-level object adjacent to the upper-level firewall system in the case that the plaintext information exists in the parameter table.

[0099] S442, if yes, open the access right of the upper-level firewall system to the lower-level object.

[0100] Specifically, if the upper-level firewall system judges that the lower-level object corresponding to the plaintext information is the lower-level object adjacent to the upper-level firewall system, the upper-level firewall system opens the access right of the upper-level firewall system to the lower-level object, so as to enable the lower-level object to access the business system corresponding to the plaintext information in the upper-level firewall system.

[0101] Embodiment Five

[0102] Figure 2 A flow chart of a firewall system access permission control method is provided for Embodiment Five of the present application, referring to Figure 2 The method can be executed by a device for executing the method, which can be realized by software and / or hardware. It should be noted that the parts not described in the present embodiment can be referred to the descriptions of other embodiments. The method comprises the following steps:

[0103] S510, generating a request packet based on the application access IP address, system domain name and user ID.

[0104] It should be noted that the execution subject of the present embodiment is a subordinate firewall system.

[0105] When the subordinate firewall system needs to access a service system in a superior firewall system, the subordinate firewall system needs to send application information to the superior firewall system. The application information is used to represent the application subject (the specific object of sending the application information) and the service system information to be accessed. In an example, the application information in the present embodiment comprises a user ID, an application access IP address and a system domain name. The user ID is used to represent the application subject. The application access IP address is the IP address of the service system. The system domain name is the domain name of the service system. The application access IP address and the system domain name are used to represent the service system information to be accessed. In other embodiments, the content included in the application information is not limited. The request packet is the data packet obtained by combining the application access IP address, the system domain name and the user ID.

[0106] Specifically, the subordinate firewall system combines the application access IP address, the system domain name and the user ID to generate the request packet.

[0107] S520, encrypting the request packet based on a preset private key to obtain an encrypted packet.

[0108] In order to improve the security of data transmission between the lower firewall system and the upper firewall system, in the embodiment, the request packet is encrypted by using a preset encryption algorithm, which has a public key and a private key. The private key is used to encrypt the request packet in the lower firewall system to obtain an encrypted packet. The public key is sent to the upper firewall system adjacent to the lower firewall system, so that the upper firewall system subsequently presets a matching table based on the key. In the example, the encryption algorithm specifically adopts the SM2 algorithm (national secret asymmetric encryption algorithm). The SM2 algorithm belongs to the elliptic curve cryptography (ECC) and is an algorithm based on the discrete mathematical problem of elliptic curve. The widely used SM2 256-bit encryption algorithm is quite safe, equivalent to the security of RSA 2048-bit and above. The SM2 algorithm has a public key and a private key. The public key can be calculated from the private key. It is quite difficult to calculate the private key from the public key. In other embodiments, RSA algorithm and Diffie-Hellman key exchange algorithm can also be used, and the specific implementation is not limited.

[0109] Specifically, the lower firewall system encrypts the request packet by using the private key provided by the preset encryption algorithm, thereby obtaining an encrypted packet.

[0110] S530, generating application access information based on the encrypted packet and the user request ID.

[0111] The user request ID specifically refers to the institution ID that sends the application information or the special ID of the personnel that specifically sends the application information. The application access information is information obtained by combining the encrypted packet and the user request ID.

[0112] Specifically, the lower firewall system combines the encrypted packet and the user request ID to obtain the application access information.

[0113] S540, sending the application access information to the upper firewall system, so that the upper firewall system: obtains the application access information, which includes the application information encrypted packet and the user request ID; determines the target public key based on the user request ID and the preset matching table, and decrypts the application information encrypted packet based on the target public key to obtain plaintext information; judges whether the plaintext information exists in the preset parameter table; if it is judged that the plaintext information exists in the parameter table, the access permission of the upper firewall system is opened to the lower object corresponding to the plaintext information.

[0114] It should be noted that the embodiment obtains the encrypted package by encrypting the request package, so as to facilitate improving the security of data transmission between the lower-level firewall system and the upper-level firewall system; in addition, the application access information is sent to the upper-level firewall system to enable the upper-level firewall system to obtain the application access information, the application access information includes the application information encrypted package and the user request ID; the target public key is determined based on the user request ID and the preset matching table, and the application information encrypted package is decrypted based on the target public key to obtain the plaintext information; it is judged whether the plaintext information exists in the preset parameter table; if it is judged that the plaintext information exists in the parameter table, the access permission of the upper-level firewall system is opened to the lower-level object corresponding to the plaintext information. Through the above implementation, when the upper-level firewall system receives the application access information sent by the lower-level firewall system, the application access information can be decrypted according to the preset public key, and then whether the lower-level object corresponding to the application access information has the access permission of the upper-level firewall system is directly judged according to the decrypted plaintext information, so that the upper-level firewall system can quickly confirm whether the lower-level object has the access permission of the upper-level firewall system, thereby improving the access efficiency of the lower-level bank system to the upper-level bank system.

[0115] Embodiment six

[0116] Figure 3 A firewall system access permission control method flow chart is provided for the embodiment five of the application, referring to Figure 3 The method can be executed by a device executing the method, which can be realized by software and / or hardware. It should be noted that the parts not described in the embodiment can be referred to the description of other embodiments. The method comprises the following steps:

[0117] S610, obtaining the lower-level application access information sent by the lower-level firewall system, the lower-level application access information including the lower-level application information encrypted package and the lower-level user request ID.

[0118] Wherein, when the lower-level firewall system needs to perform cross-level access, such as Figure 4 the case that the lower-level firewall system needs to access the upper-level firewall system through the middle-level firewall system; the lower-level firewall system needs to send the lower-level application access information to the middle-level firewall system, the lower-level application access information being the application access information sent by the lower-level firewall system to the middle-level firewall system; the lower-level application information encrypted package being the application information encrypted package generated by the lower-level firewall system, and the lower-level user request ID being the user request ID generated by the lower-level firewall system.

[0119] Specifically, the middle-level firewall system receives the lower-level application access information sent by the lower-level firewall system.

[0120] S620, decrypt the lower-level application information encryption package in the lower-level application access information based on the lower-level public key corresponding to the lower-level user request ID to obtain lower-level plaintext information.

[0121] The lower-level public key corresponding to each lower-level user request ID is preset in the middle-level firewall system. After the middle-level firewall system receives the lower-level application access information, the corresponding lower-level public key can be determined according to the lower-level user request ID in the lower-level application access information, and then the lower-level application information encryption package in the lower-level application access information is decrypted by using the lower-level public key, so that the corresponding lower-level plaintext information is obtained. The lower-level plaintext information is the plaintext information corresponding to the lower-level firewall system.

[0122] S630, encrypt the lower-level plaintext information based on the preset middle-level private key to obtain a middle-level application information encryption package, and generate a middle-level application access information based on the middle-level application information encryption package and a preset middle-level user request ID.

[0123] In order to improve the security of the application access information transmission, the lower-level plaintext information needs to be encrypted again before being sent to the upper-level firewall system by the middle-level firewall system. A middle-level private key for encrypting the plaintext information is preset in the middle-level firewall system. The middle-level private key is the private key corresponding to the middle-level firewall system. The middle-level private key can encrypt the lower-level plaintext information into a middle-level application information encryption package. The middle-level user request ID is the user request ID corresponding to the middle-level firewall system. The middle-level application information encryption package and the middle-level user request ID can be combined into a middle-level application access information by the middle-level firewall system.

[0124] S640, send the middle-level application access information to the upper-level firewall system, so that the upper-level firewall system decrypts the middle-level application information encryption package in the middle-level application access information based on the middle-level public key corresponding to the middle-level user request ID to obtain the lower-level plaintext information, and judges whether the lower-level firewall system has the qualification to access the upper-level firewall system based on the lower-level plaintext information.

[0125] The middle-level firewall system can further send the middle-level application access information to the upper-level firewall system after generating the middle-level application access information. A middle-level public key corresponding to the middle-level private key is arranged in the upper-level firewall system. The middle-level public key is used to decrypt the middle-level application information encryption package in the middle-level application access information to obtain the corresponding lower-level plaintext information. The upper-level firewall system can judge whether the lower-level firewall system has the qualification to access the upper-level firewall system according to the lower-level plaintext information. The steps of judging whether the lower-level firewall system has the qualification to access the upper-level firewall system according to the lower-level plaintext information by the upper-level firewall system can be referred to the steps of S330-S350.

[0126] It should be understood that although the steps in the flowcharts involved in the above-described embodiments are shown in sequence according to the arrows, the steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, the execution of the steps is not strictly limited in sequence, and the steps can be executed in other sequences. Moreover, at least some of the steps in the flowcharts involved in the above-described embodiments can include multiple steps or multiple stages, which are not necessarily executed at the same time but can be executed at different times, and the execution of the steps or stages is not necessarily sequential but can be executed alternately or alternately with at least some of the other steps or steps or stages in other steps.

[0127] Embodiment Seven

[0128] Based on the same inventive concept, the present embodiment also provides a firewall system access permission control device for implementing the firewall system access permission control method of the above-described embodiment one. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more firewall system access permission control device embodiments provided below can refer to the limitations of the firewall system access permission control method in the above text, which will not be repeated here.

[0129] In the present embodiment, as shown in Figure 5 , a firewall system access permission control device is provided, comprising:

[0130] an information acquisition module, configured to acquire application access information, the application access information comprising an application information encrypted package and a user request ID;

[0131] a public key decryption module, configured to determine a target public key based on the user request ID and a preset matching table, and decrypt the application information encrypted package based on the target public key to obtain plaintext information;

[0132] a plaintext judgment module, configured to judge whether the plaintext information exists in a preset parameter table;

[0133] an access control module, configured to open the access permission of the upper-level firewall system to the lower-level object corresponding to the plaintext information if it is judged that the plaintext information exists in the parameter table.

[0134] In one embodiment, the firewall system access permission control device further comprises:

[0135] a list judgment module, configured to judge whether the plaintext information is queried in a preset access control list if it is judged that the plaintext information does not exist in the parameter table;

[0136] The access limiting module is configured to limit access to the service system corresponding to the plaintext information if the answer is no.

[0137] In one embodiment, the access control module is configured to:

[0138] determine whether the subordinate object corresponding to the plaintext information is a subordinate object adjacent to the superior firewall system;

[0139] If the answer is yes, the access control module is configured to open the access permission of the superior firewall system to the subordinate object.

[0140] Embodiment eight

[0141] In this embodiment, a computer device is provided, which can be a server, and an internal structure diagram of the computer device can be as shown in Figure 6 The computer device includes a processor, a memory, and a network interface connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The database of the computer device is configured to store data. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement a firewall system access permission control method.

[0142] Those skilled in the art can understand that Figure 6 the structure shown in the figure is only a block diagram of part of the structure related to the present disclosure, and does not constitute a limitation on the computer device to which the present disclosure is applied. A specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0143] Embodiment nine

[0144] In this embodiment, a computer readable storage medium is provided, as shown in Figure 7 which stores a computer program. The computer program is executed by the processor to implement the steps in each of the method embodiments described above.

[0145] Embodiment ten

[0146] In this embodiment, a computer program product is provided, which includes a computer program. The computer program is executed by the processor to implement the steps in each of the method embodiments described above.

[0147] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present disclosure are all information and data authorized by the user or authorized by all parties.

[0148] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiments. Any reference to memory, database or other medium used in the embodiments provided by the present disclosure can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided by the present disclosure can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided by the present disclosure can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0149] The technical features of the above embodiments can be combined in any way. To make the description concise, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not exist contradictions, they should be considered as the scope of the present disclosure.

[0150] The above-described embodiments are merely illustrative of several embodiments of the present disclosure, which are described in a relatively specific and detailed manner, but should not be construed as limiting the scope of the patent of the present disclosure. It should be noted that, for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present disclosure, which are all within the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the appended claims.

Claims

1. A firewall system access authority control method characterized by, The application comprises the following steps: obtaining application access information, wherein the application access information comprises an application information encryption package and a user request ID; determining a target public key based on the user request ID and a preset matching table, and decrypting the application information encryption package based on the target public key to obtain plaintext information; judging whether the plaintext information exists in a preset parameter table; if it is judged that the plaintext information exists in the parameter table, opening the access permission of the upper firewall system to the lower object corresponding to the plaintext information.

2. The method of claim 1, wherein, After judging whether the plaintext information exists in the preset parameter table, the method further comprises the following steps: if it is judged that the plaintext information does not exist in the parameter table, sending an access application to the lower firewall system, so that the lower firewall system judges whether to continue accessing the upper firewall system based on the access application.

3. The method of claim 2, wherein, The step of making the lower firewall system judge whether to continue accessing the upper firewall system based on the access application comprises the following steps: making the lower firewall system judge whether a unified authentication ID in the access application exists in a preset personnel ID table; if yes, judging whether the plaintext information exists in a preset access control list; if no, limiting the access to the business system corresponding to the plaintext information.

4. The method of claim 1, wherein, The step of opening the access permission of the upper firewall system to the lower object corresponding to the plaintext information comprises the following steps: judging whether the lower object corresponding to the plaintext information is an adjacent lower object of the upper firewall system; if yes, opening the access permission of the upper firewall system to the lower object.

5. A firewall system access authority control method characterized by, The application comprises the following steps: generating a request package based on an application access IP address, a system domain name and a user ID; encrypting the request package based on a preset private key to obtain an encryption package; generating application access information based on the encryption package and a user request ID; sending the application access information to the upper firewall system, so that the upper firewall system: obtains application access information, wherein the application access information comprises an application information encryption package and a user request ID; determines a target public key based on the user request ID and a preset matching table, and decrypts the application information encryption package based on the target public key to obtain plaintext information; judges whether the plaintext information exists in a preset parameter table; if it is judged that the plaintext information exists in the parameter table, opening the access permission of the upper firewall system to the lower object corresponding to the plaintext information.

6. A firewall system access authority control method characterized by comprising: The application comprises the following steps: obtaining lower application access information sent by the lower firewall system, wherein the lower application access information comprises a lower application information encryption package and a lower user request ID; decrypting the lower application information encryption package in the lower application access information based on a lower public key corresponding to the lower user request ID to obtain lower plaintext information; encrypting the lower plaintext information based on a preset intermediate private key to obtain an intermediate application information encryption package, and generating an intermediate application access information based on the intermediate application information encryption package and a preset intermediate user request ID; The intermediate application access information is sent to a superior firewall system, so that the superior firewall system decrypts the intermediate application information encryption package in the intermediate application access information based on an intermediate public key corresponding to the intermediate user request ID to obtain the lower level plaintext information, and determines whether the lower level firewall system has the qualification to access the superior firewall system based on the lower level plaintext information.

7. A firewall system access right control device characterized by comprising: The apparatus comprises: An information obtaining module is configured to obtain application access information, wherein the application access information comprises an application information encryption package and a user request ID. A public key decryption module is configured to determine a target public key based on the user request ID and a preset matching table, and decrypt the application information encryption package based on the target public key to obtain plaintext information. A plaintext determination module is configured to determine whether the plaintext information exists in a preset parameter table. An access control module is configured to open the access right of a superior firewall system to a lower level object corresponding to the plaintext information if it is determined that the plaintext information exists in the parameter table.

8. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the steps of the method in any one of claims 1 to 6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 6.

Images