Overlay network access control and password isolation method based on user identity

Abstract

The invention discloses a user identity identification-based overlay network access control and password isolation method, which comprises the following steps of: deploying an asymmetric password system based on an identification password on CPE (Customer Premise Equipment), and designing a CPE network identifier, an equipment public and private key and a user identity identification by utilizing the identification password; a user identity identifier is bound with an access control strategy and a transmission encryption strategy, and an identity authentication service and a strategy service are provided by using an infrastructure; a user identity is applied to a service access process, and two-stage permission check is implemented on CPEc equipment and CPEs equipment at the edge of an overlay network, so that access control of different user service fine grit is realized; based on algorithm characteristics of an identifier and a public key, a zero-interaction service key generation mechanism is set, and confidentiality, integrity and forward security protection is performed on user service data in cooperation with a packaging security load protocol, so that password-based strong security isolation of different user service data on an overlay network is realized.

Description

Technical Field

[0001] The present application belongs to the field of communication technology, and in particular relates to an overlay network access control and password isolation method based on user identity identification. Background Art

[0002] With the rapid development of Internet data center services, cloud-network integration has become an inevitable trend in the development of future communication networks. In this context, using SD-WAN technology to flexibly schedule network resources on demand on the bearer network to build an overlay network, and for various users to access cloud services or data through the overlay network, has become a new network solution. In order to ensure that different users can safely and conveniently access various services through the overlay network, a set of efficient and secure access control and data isolation methods are needed to implement fine-grained access control and data protection for different users and different services.

[0003] Traditional enterprises mostly use Internet encryption or dedicated lines to achieve data synchronization and secure sharing between headquarters and branches, and data protection is mainly achieved by IPSec, TLS and other technologies. IPSec is a network layer VPN technology that uses identity authentication AH and encapsulation security payload ESP to provide security services. It is independent of the application and provides security protection for various types of business data by establishing IPSec tunnels; TLS protocol is the security foundation of HTTPS. It negotiates security policies with the server through handshakes, exchanges keys, and establishes secure communication connections. It is widely used in web browsing, email, instant messaging, transaction payment and other fields. When deploying traditional encryption technologies such as IPSec and TLS on overlay networks, the following shortcomings are faced: First, traditional security and confidentiality policies are generally closely coupled with IP addresses, making it difficult to adapt to the dynamic changes in IP addresses caused by users' random access and business cloud migration; second, IPSec lacks support for network virtualization and cannot implement fine-grained control and protection of user business data; TLS negotiates security policies through three-way handshakes. In multi-user concurrent scenarios, the efficiency of business key generation is low, making it difficult to provide multiple users with isolated security and confidentiality services at the same time.

[0004] In terms of fine-grained protection of cloud resources, research institutions at home and abroad mainly focus on attribute-based encryption. However, attribute-based encryption is insufficient in forward security and can only be used for secure sharing of cloud resources, and is not suitable for the protection of business processes. Summary of the invention

[0005] The purpose of this application is to overcome the problems of the prior art and disclose an overlay network access control and password isolation method based on user identity identification. This application cooperates with identity authentication and policy service infrastructure to achieve user's random secure access, service access control, and strong security isolation of services based on passwords, providing fine-grained, dynamic, and secure access control and data protection for various users to access cloud services or data through overlay networks.

[0006] The purpose of this application is achieved through the following technical solutions:

[0007] An overlay network access control and password isolation method based on user identity identification, wherein the overlay network is constructed between a CPEc device and a CPEs device, wherein the CPEc device is deployed at the user LAN exit, and the CPEs device is deployed at the data center entrance, and the overlay network is connected with an identity authentication infrastructure and a policy service infrastructure;

[0008] The overlay network access control and password isolation method includes:

[0009] Deploy an asymmetric cryptographic system based on identification passwords on CPE devices, and use identification passwords to design CPE device network identification and device public and private keys, as well as user identification. By binding user identification with access control policies and transmission encryption policies, and using the identity authentication services and policy services provided by the infrastructure, all types of users can achieve secure access to different LANs and computing terminals.

[0010] At the same time, by applying user identity to the service access process, a two-level permission check is implemented on the CPEc devices and CPEs devices at the edge of the overlay network to achieve fine-grained access control for different user services.

[0011] According to a preferred embodiment, the overlay network access control and password isolation method further includes:

[0012] Based on the algorithmic characteristics of identification and public keys, a zero-interaction business key generation mechanism is set up, and the confidentiality, integrity and forward security of user business data are protected in conjunction with the Encapsulating Security Payload Protocol, so that different user business data can be strongly isolated based on passwords on the overlay network.

[0013] According to a preferred embodiment, a user information collection device is deployed on the computing terminal within the user local area network, and a network access authentication request is initiated to the CPEc device using the user information, and identity authentication is initiated to the identity authentication infrastructure; the identity authentication process includes: the user initiates network access authentication through the computing terminal, and if the authentication fails, the user has no right to use the terminal; if the authentication succeeds, the computing terminal obtains the user identity token, and the CPEc device at the boundary of the local area network adds a corresponding security table item.

[0014] According to a preferred embodiment, an extended IP protocol is running on the computing terminal, and the option field in the IP header is extended with user identification, service identification, authentication timestamp and signature information.

[0015] According to a preferred embodiment, the user identity is a unique identifier of the user in the network, including an identifier type, an identifier ID, and an identifier validity period;

[0016] The service identifier includes a service application identifier and network performance requirement information, which is used to enable the CPEc device to perceive the application and requirements, thereby providing users with refined network services and accurate network operation and maintenance;

[0017] The authentication timestamp includes the time information when the user successfully authenticates and obtains the identity token, which is used to control the user's access duration, initiate re-authentication, and participate in the calculation as a time factor parameter of the business key;

[0018] The signature is a signature of the user identity, service identity, and authentication timestamp fields by the computing terminal using the user's private key.

[0019] According to a preferred embodiment, the CPEc device is configured to support SD-WAN and SR, and can select CPEs devices to access the data center based on overlay network planning, bearer network link status, and service quality requirements;

[0020] The CPEc device is configured to perform primary access control based on the user identity to confirm whether the user has the authority to use the overlay network;

[0021] The CPEc device is configured to generate service keys with zero interaction with the CPEs device, and encrypt / decrypt, decrypt / encapsulate user service messages based on the Encapsulating Security Payload Protocol, and implement strong security isolation based on passwords.

[0022] According to a preferred embodiment, the CPEs device is configured to support SD-WAN and SR, and can select a path to communicate with the CPEc device according to overlay network planning, bearer network link status, and service quality requirements;

[0023] The CPEs device is configured to perform secondary access control based on the user identity and service identity to confirm whether the user has access rights to the relevant service / application;

[0024] The CPEs device is configured to generate service keys with zero interaction with the CPEc device, and encrypt / decrypt, decrypt / encapsulate user service messages based on the Encapsulating Security Payload Protocol, and implement strong security isolation based on passwords.

[0025] According to a preferred embodiment, the CPEc device and the CPEs device perform confidentiality, integrity and forward security protection on user service data through the Encapsulated Security Payload Protocol, and at the same time extend the logical service domain identifier in the IP header option field for security checking.

[0026] According to a preferred implementation, the logical service domain identifier is a unique identifier of an overlay network constructed on demand on a bearer network.

[0027] According to a preferred embodiment, the CPE device is configured to: after the authentication timestamp changes, when the service request message is received for the first time, the service key generation process is started, and the service key generation is jointly participated by the public and private key pair of the CPEc device, the public and private key pair of the CPEs device, the user identity, and the authentication timestamp information, and the user factor and time factor elements are added, so as to achieve strong password-based security isolation between the service data of different users.

[0028] The aforementioned main scheme of the present application and its further options can be freely combined to form multiple schemes, all of which are schemes that can be adopted and claimed for protection in the present application. After understanding the scheme of the present application, those skilled in the art can understand that there are multiple combinations based on the prior art and common knowledge, all of which are technical schemes to be protected by the present application, and they are not exhaustively listed here.

[0029] Beneficial effects of this application:

[0030] 1) Improved the adaptability of security and confidentiality strategies to cloud computing

[0031] By binding user identity with security and confidentiality policies, and combining the services provided by identity authentication and policy service infrastructure, not only can all types of users achieve secure access to different LANs and computing terminals, but network usage permissions and business permissions can also be checked based on user identity and business needs, thus achieving fine-grained access control for different user businesses.

[0032] 2) Strong password-based security isolation of different users is implemented on the overlay network

[0033] The user identity is applied to the business access process, and the algorithm characteristics of the identity, that is, the public key, are used to generate the business key through a zero-interaction mechanism. The user factor and time factor are added to the calculation process of the business key to achieve strong password-based security isolation of different user services on the overlay network; and the Encapsulated Security Payload Protocol is used to protect the confidentiality, integrity and forward security of user business data. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a schematic diagram of the network application scenario of this application;

[0035] Figure 2 This is a schematic diagram of the IP option field expansion;

[0036] Figure 3 It is a diagram of the domain identifier extension field and ESP encapsulation;

[0037] Figure 4 It is a schematic diagram of the identity authentication process;

[0038] Figure 5 It is a business access process diagram;

[0039] Figure 6 This is a schematic diagram of the re-authentication process. DETAILED DESCRIPTION

[0040] The following describes the embodiments of the present application through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0041] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0042] In the description of this application, it should also be noted that, unless otherwise clearly specified and limited, the terms "set", "install", "connect", and "connect" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0043] In addition, the present application would like to point out that, in the present application, unless the specific structure, connection relationship, positional relationship, power source relationship, etc. are specifically written out, the structure, connection relationship, positional relationship, power source relationship, etc. involved in the present application are all known by those skilled in the art on the basis of the prior art without creative work.

[0044] refer to Figure 1 As shown, the present application discloses an overlay network access control and password isolation method based on user identity identification, wherein the overlay network is constructed between a CPEc device and a CPEs device, wherein the CPEc device is deployed at the user LAN exit, and the CPEs device is deployed at the data center entrance, and the overlay network is connected to an identity authentication service infrastructure and a policy service infrastructure.

[0045] Specifically, the overlay network access control and password isolation method includes:

[0046] An asymmetric cryptographic system based on identification passwords is deployed on CPE devices, and identification passwords are used to design CPE device network identifications, device public and private keys, and user identifications. By binding user identifications with access control policies and transmission encryption policies, and using the identity authentication services and policy services provided by the infrastructure, secure access for various types of users on different LANs and different computing terminals is achieved. At the same time, by applying user identifications to service access processes, two-level permission checks are implemented on CPEc devices and CPEs devices at the edge of the overlay network to achieve fine-grained access control for different user services.

[0047] Furthermore, the overlay network access control and password isolation method further includes:

[0048] Based on the algorithmic characteristics of identification and public keys, a zero-interaction business key generation mechanism is set up, and the confidentiality, integrity and forward security of user business data are protected in conjunction with the Encapsulating Security Payload Protocol, so that different user business data can be strongly isolated based on passwords on the overlay network.

[0049] Preferably, a user information collection device is deployed on a computing terminal in the user local area network, and a network access authentication request is initiated to the CPEc device using the user information, and identity authentication is initiated to the identity authentication infrastructure.

[0050] Furthermore, the identity authentication process includes: the user initiates network access authentication through the computing terminal. If the authentication fails, the user has no right to use the terminal. If the authentication succeeds, the computing terminal obtains the user identity token, and the CPEc device at the boundary of the local area network adds a corresponding security table item.

[0051] Preferably, reference Figure 2 As shown, the computing terminal runs an extended IP protocol, and the option field in the IP header is extended with user identity identification, service identification, authentication timestamp and signature information.

[0052] Furthermore, the user identity is a unique identifier of the user in the network, including the identifier type, identifier ID and identifier validity period; it can be bound to a security and confidentiality policy to adapt to the IP address changes caused by the user's random access.

[0053] The service identifier includes a service application identifier and network performance requirement information, which is used to enable the CPEc device to perceive applications and requirements, thereby providing users with refined network services and accurate network operation and maintenance.

[0054] The authentication timestamp includes the time information when the user successfully authenticates and obtains the identity token, which is used to control the user's access duration, initiate re-authentication, and participate in the calculation as a time factor parameter of the business key;

[0055] The signature is a signature of the user identity, service identity, and authentication timestamp fields by the computing terminal using the user's private key. Figure 3 In the example, signature (4) represents the first 4 bytes of the signature result.

[0056] Preferably, the CPEc device is configured to support SD-WAN, SR, and can select CPEs devices to access the data center based on overlay network planning, bearer network link status, and service quality requirements; and the CPEc device is configured to perform primary access control based on user identity to confirm whether the user has the authority to use the overlay network; the CPEc device is configured to generate business keys with zero interaction with the CPEs device, and encrypt / decrypt, decompress / encapsulate user business messages based on the Encapsulating Security Payload Protocol, and implement strong password-based security isolation.

[0057] Preferably, the CPEs device is configured to support SD-WAN, SR, and can select a path to communicate with the CPEc device according to the overlay network planning, bearer network link status, and service quality requirements; the CPEs device is configured to perform secondary access control based on user identity and service identity to confirm whether the user has access rights to related services / applications; the CPEs device is configured to generate service keys with zero interaction with the CPEc device, and encrypt / decrypt, decompress / encapsulate user service messages based on the Encapsulated Security Payload Protocol to implement strong password-based security isolation.

[0058] Furthermore, the CPEc device and the CPEs device use the Encapsulating Security Payload Protocol to protect the confidentiality, integrity and forward security of user service data, and at the same time extend the logical service domain identifier in the IP header option field for security check. Figure 3 The logical service domain identifier is a unique identifier of the overlay network constructed on demand on the bearer network.

[0059] Preferably, after the authentication timestamp changes, when the CPE device receives the service request message for the first time, it starts the service key generation process. The key generation is jointly participated by the public and private key pair of the CPEc device, the public and private key pair of the CPEs device, the user identity, the authentication timestamp and other information. Due to the addition of user factors, time factors and other factors, strong password-based security isolation between different user service data is ensured. The symbols involved in the service key calculation are shown in Table 1.

[0060] Table 1

[0061]

[0062] Taking CPEc as an example, the calculation process of the service key is introduced.

[0063] CPE C The device database already contains CPE C Device public and private key pair TPK C / TSK C , the network identification of all CPE devices in the network, and configure the public key generation algorithm GenTPK() and the hash algorithm Hmac with parameters K ().

[0064] Step 1: CPE C The device receives the user's request message and confirms that the data has not been tampered with, and can obtain the ID U , TimeS and other information. After the data center access point is determined, the CPE S The network ID of the device S ;

[0065] Step 2: CPE C The device uses the user identity to generate the user public key TPK U , recorded as: TPK U =GenTPK(ID U ) and take TPK U The first 32 bits of TPK are used as the hash parameter K, denoted as: K = TPK U ∣ 32 ;

[0066] Step 3: CPE C Device uses network identification ID S Generate CPE S Device public key, denoted as: TPK S =GenTPK(IDs);

[0067] Step 4: CPE C The device uses the local private key, CPE S Device public key, calculate key information mask MASK = TSK C ☉TPK S ;

[0068] Step 5: CPE C The device calculates the 32-bit business key Key = MASK | 32 ⊕Hmac K (TimeS).

[0069] Example 1

[0070] refer to Figure 4 As shown, this embodiment discloses an identity authentication process. The user initiates network access authentication through the computing terminal. If the authentication fails, the user has no right to use the terminal. If the authentication succeeds, the computing terminal obtains the user identity token, and the CPEc device at the edge of the local area network adds the corresponding security table item. Specifically, it includes:

[0071] Step 1: The computing terminal collects user identity information, such as fingerprints, irises and other biometric features, through supporting equipment, and initiates a network access authentication request to the CPEc device at the edge of the LAN. The authentication information carries the user identity information.

[0072] Step 2: The CPEc device at the edge of the LAN extracts the user identity information and initiates an authentication request to the authentication infrastructure;

[0073] Step 3: The authentication infrastructure extracts the user identity information and matches it in the local database. If the match is successful, a user token is generated, which contains the user identity, user rights, etc. The user token is sent to the CPEc device through the authentication response message.

[0074] Step 4: The CPEc device receives the identity authentication response message and extracts the user token;

[0075] Step 5: The CPEc device uses the user identity in the user token to request the policy service infrastructure for the user's control policy, including access control policy and transmission encryption policy.

[0076] Step 6: The policy service infrastructure queries the local database for the control policy of the relevant user based on the user identity, and sends the query result to the CPEc device through the user control policy response message;

[0077] Step 7: The CPEc device generates a security entry based on the computing terminal IP, user identity, access control policy, transmission encryption policy and other information and adds it to the local security database;

[0078] Step 8: The CPEc device sends the authentication result and user token to the computing terminal through the authentication response message;

[0079] Step 9: If the authentication is successful, the computing terminal obtains the user token and records the timestamp of the authentication success for use in the service access phase.

[0080] Example 2

[0081] refer to Figure 5 As shown, this embodiment discloses a service access process, and two steps are completed before service access, including: the first step is to build an overlay network between the CPEc device and the CPEs device according to user needs; the second step is that the user completes the network access authentication on a computing terminal in the local area network, and obtains the user token (including the user identity, the user public and private key pair), the authentication timestamp and other information.

[0082] The business access process specifically includes:

[0083] Step 1: The user initiates a service access request on the computing terminal. The computing terminal fills in the user identity, service identity, authentication timestamp and other information in the option field of the IP header according to actual needs;

[0084] Step 2: The computing terminal uses the user's private key to sign the user identity, service identity, authentication timestamp and other fields, and fills the first 4 bytes of the signature result into the extended signature field;

[0085] Step 3: The CPEc device receives the service access request message, generates a user public key using the user identity, and verifies the signature of the user identity, service identity, authentication timestamp and other fields. If the signature verification fails, the message is discarded directly. If the signature verification succeeds, the message continues to be executed.

[0086] Step 4: The CPEc device matches the local security entry according to the user identity. If the match fails, it is discarded and the process is terminated. If the match succeeds, the process continues.

[0087] Step 5: The CPEc device checks the user service rights based on the security entry to determine whether the user and the service have the right to use the overlay network.

[0088] Step 6: After the authority check is passed, the CPEc device checks the authentication timestamp information in the message. If the authentication timestamp is consistent with that in the security entry, it directly goes to step 10, otherwise it continues to execute;

[0089] Step 7: The CPEc device selects a suitable CPEs device to access the data center based on the overlay network routing plan, the destination address of the service access, the service quality requirements and other information;

[0090] Step 8: The CPEc device generates a device public key using the network identifier of the CPEs device, and generates a service key based on the local private key, the CPEs device public key, the user identifier, and the authentication timestamp;

[0091] Step 9: The CPEc device saves the service key, authentication timestamp and other information in the corresponding security entry in the local database;

[0092] Step 10: The CPEc device adds the logical service domain identifier to the IP header option field, encrypts and encapsulates the user service request message based on the ESP protocol, and sends it to the corresponding CPEs device;

[0093] Step 11: After receiving the service request, the CPEs device generates a user public key using the user identity, and verifies the signature of the user identity, service identity, authentication timestamp and other fields. If the signature verification fails, it is directly discarded. If the signature verification succeeds, it continues to execute;

[0094] Step 12: The CPEs device uses the user identity to match the local security table entry. If the match is successful, it goes directly to step 14. If the match fails, it uses the user identity to initiate a user control policy request to the policy service infrastructure;

[0095] Step 13: The policy service infrastructure uses the user identity to match the local database. If the match is successful, the authentication result, security and confidentiality policy, validity period and other information are notified to the CPEs device through the user control policy response;

[0096] Step 14: If the user control policy request is successful, the CPEs device generates a security entry based on the user identity, access control policy, transmission encryption policy and other information and adds it to the local security database;

[0097] Step 15: The CPEs device checks the user service authority based on the security entry to determine whether the user has the authority to access the service or application of the data center;

[0098] Step 16: After the permission check is passed, the CPEs device checks the authentication timestamp information in the message. If the authentication timestamp is consistent with the security entry, it directly goes to step 19, otherwise it continues to execute;

[0099] Step 17: The CPEs device obtains the network identifier of the CPEc device according to the routing information, generates a device public key, and generates a service key using the local private key, the CPEc device public key, the user identifier, and the authentication timestamp;

[0100] Step 18: The CPEs device saves the service key and authentication timestamp in the corresponding security entry in the local database;

[0101] Step 19: The CPEs device uses the service key to decrypt and decapsulate the user service data, removes the logical service domain identification field in the IP header option, and sends the service request data to the corresponding service server;

[0102] Step 20: The service server processes the service request and returns a service response message, filling in the user identity, service identity, authentication timestamp and signature information in the option field of the IP header of the response message;

[0103] Step 21: The CPEs device receives the service response message, extracts the user identity and matches it with the local security table entry. If the match fails, the message is discarded. If the match succeeds, the process continues.

[0104] Step 22: The CPEs device fills the logical service domain identifier in the option field of the IP header of the message, encrypts and encapsulates the service response message using the ESP protocol, and forwards it to the network;

[0105] Step 23: The CPEc device receives the service response message, extracts the user identity and matches it with the local security table entry. If the match fails, the message is discarded. If the match succeeds, the process continues.

[0106] Step 24: The CPEc device decrypts and decapsulates the service data message using the service key, removes the logical service domain identification field in the IP header option, and sends the service response message to the corresponding computing terminal;

[0107] Step 25: After receiving the service response data, the computing terminal continues the process until the service ends and the user goes offline, and the computing terminal notifies the CPEc device of the user offline message;

[0108] Step 26: The CPEc device receives the user offline notification, deletes the corresponding security entry according to the user identity, and notifies the CPEs device that the service is completed;

[0109] Step 27: The CPEs device receives the service processing completion notification and deletes the corresponding security entry according to the user identity, and the service access process ends.

[0110] Example 3

[0111] refer to Figure 6 As shown, this embodiment discloses a re-authentication process. According to system requirements, the CPEc device periodically detects the authentication time of the user / computing terminal. If the authentication time has timed out or is about to time out, the CPEc device notifies the computing terminal to initiate re-authentication. Specifically, it includes:

[0112] Step 1: The computing terminal receives the re-authentication request from the CPEc device and first checks the user's usage. If the user has not operated for a long time or has been offline, the CPEc device is notified of the user's offline message and the process ends. If the user is still using the terminal normally, go to step 3.

[0113] Step 2: The CPEc device receives the user offline notification, deletes the corresponding security entry according to the user identity, and notifies the corresponding CPEs device that the relevant user is offline. The CPEs device deletes the corresponding security entry, and the process ends.

[0114] Step 3: The computing terminal uses the user identity to initiate a network re-authentication request to the CPEc device at the network boundary;

[0115] Step 4: The CPEc device extracts the user identity and initiates an identity re-authentication request to the identity authentication infrastructure;

[0116] Step 5: The authentication infrastructure extracts the user identity and matches it in the local database. If the match is successful, it generates the latest user token, which contains the user identity, the latest user permissions, etc., and sends it to the CPEc device through the authentication response message;

[0117] Step 6: The CPEc device uses the user identity in the user token to request the latest control policy for the user from the policy service infrastructure;

[0118] Step 7: The policy service infrastructure queries the local database for the latest control policy of the relevant user based on the user identity, and sends the query result to the CPEc device through the user control policy response message;

[0119] Step 8: The CPEc device processes the latest control policy, including the access control policy and the transmission encryption policy. If there is a change, it updates the security table entry in the local database.

[0120] Step 9: The CPEc device sends the authentication result and user token to the computing terminal through the authentication response message;

[0121] Step 10: If the authentication is successful, the computing terminal obtains the user token and records the timestamp of the authentication success.

[0122] Compared with the traditional overlay network security isolation method, this application improves the adaptability of security and confidentiality policies to cloud computing. By binding user identity identification with security and confidentiality policies and combining the services provided by identity authentication and policy service infrastructure, it not only enables various types of users to access different local area networks and different computing terminals in a secure manner, but also performs network usage permission and business permission checks based on user identification and business needs, thereby achieving fine-grained access control for different user businesses.

[0123] At the same time, strong password-based security isolation between different user business data is achieved on the overlay network. The user identity is applied to the business access process, and the algorithm characteristics of the identity, that is, the public key, are used to generate the business key through a zero-interaction mechanism. The calculation process of the business key adds user factors and time factors to achieve strong password-based security isolation between different user business data on the overlay network; and the Encapsulated Security Payload Protocol is used to protect the confidentiality, integrity and forward security of user business data.

[0124] This application proposes an overlay network access control and password isolation method based on user identity identification, which can cooperate with identity authentication and policy service infrastructure to achieve user secure and trusted access, service access control, and strong security isolation of user services based on passwords, and provide fine-grained, dynamic, and secure access control and isolation protection for various users to access data center services and data through overlay networks, and has good application prospects.

[0125] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A method for overlay network access control and password isolation based on user identity, characterized in that: The overlay network is constructed between the CPEc device and the CPEs device. The CPEc device is deployed at the user LAN exit, and the CPEs device is deployed at the data center entrance. The overlay network is connected with an identity authentication infrastructure and a policy service infrastructure. The overlay network access control and password isolation method includes: Deploy an asymmetric cryptographic system based on identification passwords on CPE devices, and use identification passwords to design CPE device network identification and device public and private keys, as well as user identification. By binding user identification with access control policies and transmission encryption policies, and using the identity authentication services and policy services provided by the infrastructure, secure access for all types of users on different LANs and computing terminals can be achieved. At the same time, by applying user identity to the service access process, a two-level permission check is implemented on the CPEc devices and CPEs devices at the edge of the overlay network to achieve fine-grained access control for different user services.

2. The overlay network access control and password isolation method according to claim 1, characterized in that: The overlay network access control and password isolation method further includes: Based on the algorithmic characteristics of identification and public keys, a zero-interaction business key generation mechanism is set up, and the confidentiality, integrity and forward security of user business data are protected in conjunction with the Encapsulating Security Payload Protocol, so that different user business data can be strongly isolated based on passwords on the overlay network.

3. The overlay network access control and password isolation method according to claim 1, characterized in that: A user information collection device is deployed on the computing terminal in the user local area network, which uses the user information to initiate a network access authentication request to the CPEc device and initiates identity authentication to the identity authentication infrastructure; The identity authentication process includes: the user initiates network access authentication through the computing terminal. If the authentication fails, the user has no right to use the terminal. If the authentication succeeds, the computing terminal obtains the user identity token, and the CPEc device at the boundary of the local area network adds a corresponding security table item.

4. The overlay network access control and password isolation method as claimed in claim 3, characterized in that: The computing terminal runs an extended IP protocol, and the option field of the IP header is extended with user identity identification, service identification, authentication timestamp and signature information.

5. The overlay network access control and password isolation method as claimed in claim 4, characterized in that: The user identity is a unique identifier of the user in the network, including the identifier type, identifier ID and identifier validity period; The service identifier includes a service application identifier and network performance requirement information, which is used to enable the CPEc device to perceive the application and requirements, thereby providing refined network services and accurate network operation and maintenance for the CPEc device; The authentication timestamp includes the time information when the user successfully authenticates and obtains the identity token, which is used to control the user's access duration, initiate re-authentication, and participate in the calculation as a time factor parameter of the business key; The signature is a signature of the user identity, service identity, and authentication timestamp fields by the computing terminal using the user's private key.

6. The overlay network access control and password isolation method according to claim 1, characterized in that: The CPEc device is configured to support SD-WAN and SR, and can select CPEs devices to access the data center based on overlay network planning, bearer network link status, and service quality requirements; The CPEc device is configured to perform primary access control based on the user identity to confirm whether the user has the authority to use the overlay network; The CPEc device is configured to generate service keys with zero interaction with the CPEs device, and encrypt / decrypt, decrypt / encapsulate user service messages based on the Encapsulating Security Payload Protocol, and implement strong security isolation based on passwords.

7. The overlay network access control and password isolation method according to claim 6, characterized in that: The CPEs device is configured to support SD-WAN and SR, and can select a path to communicate with the CPEc device according to overlay network planning, bearer network link status, and service quality requirements; The CPEs device is configured to perform secondary access control based on the user identity and service identity to confirm whether the user has access rights to the relevant service / application; The CPEs device is configured to generate service keys with zero interaction with the CPEc device, and encrypt / decrypt, decrypt / encapsulate user service messages based on the Encapsulating Security Payload Protocol, and implement strong security isolation based on passwords.

8. The overlay network access control and password isolation method according to claim 7, characterized in that: The CPEc device and the CPEs device protect confidentiality, integrity and forward security of user service data through the Encapsulation Security Payload Protocol, and at the same time extend the logical service domain identifier in the IP header option field for security checking.

9. The overlay network access control and password isolation method as claimed in claim 8, characterized in that: The logical service domain identifier is a unique identifier of the overlay network constructed on demand on the bearer network.

10. The overlay network access control and password isolation method according to claim 1 or 3, characterized in that: The CPE device is configured to start the service key generation process when it receives the service request message for the first time after the authentication timestamp changes. The service key generation is jointly participated by the public and private key pair of the CPEc device, the public and private key pair of the CPEs device, the user identity, and the authentication timestamp information, and the user factor and time factor are added, so as to achieve strong password-based security isolation between the service data of different users.

Images