A method for overlay network access control and password isolation based on user identity

Abstract

The present application discloses a method for overlay network access control and password isolation based on user identity identification, comprising: deploying an asymmetric cryptographic system based on identification passwords on CPE devices, and using the identification passwords to design CPE device network identifications, device public and private keys, and user identifications; binding user identifications with access control policies and transmission encryption policies, and utilizing identity authentication services and policy services provided by infrastructure; applying user identifications to service access processes, and implementing two-level permission checks on CPEc devices and CPEs devices at the edge of the overlay network to achieve fine-grained access control for different user services; setting a zero-interaction service key generation mechanism based on the algorithmic characteristics of identification and public keys, and cooperating with the Encapsulating Security Payload Protocol to protect the confidentiality, integrity, and forward security of user service data, thereby achieving strong password-based security isolation of different user service data on the overlay network.

Description

Technical Field

[0001] The present application belongs to the field of communication technology, and in particular relates to an overlay network access control and password isolation method based on user identity identification. Background Art

[0002] With the rapid growth of internet data center services, cloud-network convergence has become an inevitable trend in future communications network development. In this context, leveraging SD-WAN technology to flexibly and on-demand schedule network resources on the bearer network to build an overlay network, enabling various users to access cloud services and data through the overlay network, has become a new network solution. To ensure secure and convenient access to various services through the overlay network, an efficient and secure access management and data isolation approach is required to implement fine-grained access control and data protection for different users and services.

[0003] Traditional enterprises often use Internet encryption or dedicated lines to synchronize and securely share data between headquarters and branches. Data protection is primarily achieved through technologies such as IPSec and TLS. IPSec is a network-layer VPN technology that uses authentication (AH) and Encapsulating Security Payload (ESP) to provide security services. It is application-independent and securely protects various types of business data by establishing IPSec tunnels. TLS, the security foundation of HTTPS, negotiates security policies and exchanges keys with the server through a handshake to establish secure communication connections. It is widely used in areas such as web browsing, email, instant messaging, and payment. Deploying traditional encryption technologies such as IPSec and TLS on overlay networks faces the following shortcomings: First, traditional security and confidentiality policies are typically tightly coupled to IP addresses, making them difficult to adapt to the dynamic changes in IP addresses brought about by user access and cloud-based services. Second, IPSec lacks support for network virtualization, making it difficult to implement fine-grained control and protection of user business data. TLS negotiates security policies through a three-way handshake. However, in scenarios with multiple concurrent users, service key generation is inefficient, making it difficult to provide isolated security and confidentiality services for multiple users simultaneously.

[0004] When it comes to fine-grained protection of cloud resources, research institutions at home and abroad have mainly focused on attribute-based encryption (ABE). However, ABE lacks forward security and can only be used for secure sharing of cloud resources, making it unsuitable for protecting business processes. Summary of the Invention

[0005] The purpose of this application is to overcome the problems of the existing technology and disclose a method for overlay network access control and password isolation based on user identity identification. This application cooperates with identity authentication and policy service infrastructure to achieve user's on-the-go secure access, service access control, and strong password-based service security isolation, providing fine-grained, dynamic, and secure access control and data protection for various users accessing cloud services or data through the overlay network.

[0006] The purpose of this application is achieved through the following technical solutions:

[0007] A method for overlay network access control and password isolation based on user identity identification. The overlay network is constructed between a CPEc device and a CPEs device. The CPEc device is deployed at the user's local area network egress, and the CPEs device is deployed at the data center entrance. The overlay network is connected to an identity authentication infrastructure and a policy service infrastructure.

[0008] The overlay network access control and password isolation method includes:

[0009] Deploy an asymmetric cryptographic system based on identification passwords on CPE devices. Use identification passwords to design CPE device network identifiers, device public and private keys, and user identities. By binding user identities to access control policies and transmission encryption policies, and leveraging the identity authentication and policy services provided by the infrastructure, secure access is achieved for all types of users on different LANs and computing terminals.

[0010] At the same time, by applying user identity identification to the service access process, two-level permission checks are implemented on the CPEc devices and CPEs devices at the edge of the overlay network to achieve fine-grained access control for different user services.

[0011] According to a preferred embodiment, the overlay network access control and password isolation method further includes:

[0012] Based on the algorithmic characteristics of identification and public keys, a zero-interaction business key generation mechanism is set up, and the Encapsulating Security Payload Protocol is used to protect the confidentiality, integrity, and forward security of user business data, so that different user business data can be strongly isolated based on passwords on the overlay network.

[0013] According to a preferred embodiment, a user information collection device is deployed on the computing terminal within the user local area network, which uses user information to initiate a network access authentication request to the CPEc device, and initiates identity authentication to the identity authentication infrastructure; the identity authentication process includes: the user initiates network access authentication through the computing terminal, if the authentication fails, the user has no right to use the terminal, if the authentication succeeds, the computing terminal obtains the user identity token, and the CPEc device at the LAN boundary adds a corresponding security table item.

[0014] According to a preferred embodiment, an extended IP protocol is run on the computing terminal, and the option field of the IP header is extended with user identification, service identification, authentication timestamp and signature information.

[0015] According to a preferred embodiment, the user identity is a unique identifier of the user in the network, including an identifier type, an identifier ID, and an identifier validity period;

[0016] The service identifier includes the service application identifier and network performance requirement information, which is used to enable the CPEc device to perceive the application and requirements, thereby providing users with refined network services and accurate network operation and maintenance;

[0017] The authentication timestamp includes the time information when the user successfully obtains the identity token through authentication, which is used to control the user's access time, initiate re-authentication, and participate in the calculation as the time factor parameter of the business key;

[0018] The signature is a signature of the user identity, service identity, and authentication timestamp fields by the computing terminal using the user's private key.

[0019] According to a preferred embodiment, the CPEc device is configured to support SD-WAN and SR, and can select CPEs devices to access the data center based on overlay network planning, bearer network link status, and service quality requirements;

[0020] The CPEc device is configured to perform primary access control based on the user identity to confirm whether the user has the authority to use the overlay network;

[0021] The CPEc device is configured to generate service keys with zero interaction with the CPEs device, and encrypt / decrypt, decrypt / encapsulate user service messages based on the Encapsulating Security Payload Protocol, implementing strong security isolation based on passwords.

[0022] According to a preferred embodiment, the CPEs device is configured to support SD-WAN and SR, and is capable of selecting a path to communicate with the CPEc device based on overlay network planning, bearer network link status, and service quality requirements;

[0023] The CPEs device is configured to perform secondary access control based on user identity and service identity to confirm whether the user has access rights to the relevant service / application;

[0024] The CPEs device is configured to generate service keys with zero interaction with the CPEc device, and encrypt / decrypt, decrypt / encapsulate user service messages based on the Encapsulating Security Payload Protocol, implementing strong security isolation based on passwords.

[0025] According to a preferred embodiment, the CPEc device and the CPEs device protect confidentiality, integrity and forward security of user service data through the Encapsulating Security Payload Protocol, and at the same time extend the logical service domain identifier in the IP header option field for security checking.

[0026] According to a preferred embodiment, the logical service domain identifier is a unique identifier of the overlay network constructed on demand on the bearer network.

[0027] According to a preferred embodiment, the CPE device is configured to: after the authentication timestamp changes, when the service request message is received for the first time, the service key generation process is started. The service key generation is jointly participated by the public and private key pair of the CPEc device, the public and private key pair of the CPEs device, the user identity, and the authentication timestamp information, and the user factor and time factor elements are added, so as to achieve strong password-based security isolation between the service data of different users.

[0028] The aforementioned main solution of this application and its further options can be freely combined to form multiple solutions, all of which can be adopted and protected by this application. After understanding the solution of this application, those skilled in the art will understand that there are many combinations based on existing technology and common knowledge, all of which are technical solutions to be protected by this application, and these are not exhaustive here.

[0029] Beneficial effects of this application:

[0030] 1) Improved the adaptability of security and confidentiality strategies to cloud computing

[0031] By binding user identity identification with security and confidentiality policies, and combining the services provided by identity authentication and policy service infrastructure, not only can all types of users achieve secure access on different local area networks and different computing terminals, but network usage permissions and business permissions can also be checked based on user identification and business needs, thus achieving fine-grained access control for different user businesses.

[0032] 2) Strong password-based security isolation of different users is achieved on the overlay network

[0033] User identity identification is applied to the business access process. The algorithmic characteristics of the identity being the public key are utilized to generate business keys through a zero-interaction mechanism. User and time factors are added to the calculation process of the business keys to achieve strong password-based security isolation of different user services on the overlay network. The Encapsulating Security Payload Protocol is used to protect the confidentiality, integrity, and forward security of user business data. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is a schematic diagram of the network application scenario of this application;

[0035] Figure 2 This is a diagram of the IP option field expansion;

[0036] Figure 3 This is a diagram of the domain identifier extension field and ESP encapsulation;

[0037] Figure 4 This is a diagram of the identity authentication process;

[0038] Figure 5 This is a diagram of the business access process;

[0039] Figure 6 This is a diagram of the re-authentication process. DETAILED DESCRIPTION

[0040] The following describes the embodiments of the present application through specific examples. Those skilled in the art can easily understand the other advantages and effects of the present application from the content disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments. The details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other unless they conflict.

[0041] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. In addition, the terms "first," "second," "third," etc. are used only to distinguish the descriptions and are not to be understood as indicating or implying relative importance.

[0042] It should also be noted that, in the description of this application, unless otherwise expressly specified or limited, the terms "disposed," "installed," "connected," and "connected" should be understood in a broad sense. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium; and they can refer to internal connections between two components. Those skilled in the art will understand the specific meanings of the above terms in this application based on the specific circumstances.

[0043] In addition, the present application would like to point out that, in the present application, unless the specific structures, connection relationships, positional relationships, power source relationships, etc. are specifically written out, the structures, connection relationships, positional relationships, power source relationships, etc. involved in the present application are all known to those skilled in the art based on the existing technology without creative work.

[0044] refer to Figure 1 As shown, the present application discloses an overlay network access control and password isolation method based on user identity identification, wherein the overlay network is constructed between a CPEc device and a CPEs device, wherein the CPEc device is deployed at the user LAN exit, and the CPEs device is deployed at the data center entrance, and the overlay network is connected to an identity authentication service infrastructure and a policy service infrastructure.

[0045] Specifically, the overlay network access control and password isolation method includes:

[0046] An asymmetric cryptographic system based on identification passwords is deployed on CPE devices. Identification passwords are used to design CPE device network identifiers, device public and private keys, and user identities. By binding user identities with access control policies and transmission encryption policies, and leveraging the identity authentication and policy services provided by the infrastructure, secure access is achieved for all types of users on different LANs and computing terminals. Furthermore, by applying user identities to service access processes, two-level permission checks are implemented on CPEc and CPEs devices at the edge of the overlay network to achieve fine-grained access control for different user services.

[0047] Furthermore, the overlay network access control and password isolation method further includes:

[0048] Based on the algorithmic characteristics of identification and public keys, a zero-interaction business key generation mechanism is set up, and the Encapsulating Security Payload Protocol is used to protect the confidentiality, integrity, and forward security of user business data, so that different user business data can be strongly isolated based on passwords on the overlay network.

[0049] Preferably, a user information collection device is deployed on a computing terminal within the user local area network, and uses the user information to initiate a network access authentication request to the CPEc device, and initiates identity authentication to the identity authentication infrastructure.

[0050] Furthermore, the identity authentication process includes: the user initiates network access authentication through the computing terminal. If the authentication fails, the user has no right to use the terminal. If the authentication succeeds, the computing terminal obtains the user identity token, and the CPEc device at the LAN boundary adds a corresponding security entry.

[0051] Preferably, reference Figure 2 As shown, the computing terminal runs an extended IP protocol, and the option field of the IP header is extended with user identity identification, service identification, authentication timestamp and signature information.

[0052] Furthermore, the user identity is a unique identifier of the user in the network, including the identifier type, identifier ID and identifier validity period; it can be bound to the security and confidentiality policy to adapt to the IP address changes caused by the user's random access.

[0053] The service identifier includes a service application identifier and network performance requirement information, which is used to enable the CPEc device to perceive the application and requirements, thereby providing users with refined network services and accurate network operation and maintenance.

[0054] The authentication timestamp includes the time information when the user successfully obtains the identity token through authentication, which is used to control the user's access time, initiate re-authentication, and participate in the calculation as the time factor parameter of the business key;

[0055] The signature is a signature of the user identity, service identity, and authentication timestamp fields by the computing terminal using the user's private key. Figure 3 In the signature (4), the first 4 bytes of the signature result are represented.

[0056] Preferably, the CPEc device is configured to support SD-WAN and SR, and can select CPEs devices to access the data center based on overlay network planning, bearer network link status, and service quality requirements; and the CPEc device is configured to perform first-level access control based on user identity to confirm whether the user has the authority to use the overlay network; the CPEc device is configured to generate business keys with zero interaction with the CPEs device, and encrypt / decrypt, decompress / encapsulate user business messages based on the Encapsulating Security Payload Protocol, and implement strong security isolation based on passwords.

[0057] Preferably, the CPEs device is configured to support SD-WAN and SR, and can select a path to communicate with the CPEc device based on the overlay network planning, bearer network link status, and service quality requirements; the CPEs device is configured to perform secondary access control based on user identity and service identity to confirm whether the user has access rights to related services / applications; the CPEs device is configured to generate service keys with zero interaction with the CPEc device, and encrypt / decrypt and decrypt / encapsulate user service messages based on the Encapsulating Security Payload Protocol to implement strong password-based security isolation.

[0058] Furthermore, the CPEc device and the CPEs device use the Encapsulating Security Payload protocol to protect the confidentiality, integrity and forward security of user service data, and at the same time extend the logical service domain identifier in the IP header option field for security checking. Figure 3 The logical service domain identifier is a unique identifier of the overlay network constructed on demand on the bearer network.

[0059] Preferably, the CPE device initiates the service key generation process when it first receives a service request message after the authentication timestamp changes. This key generation process utilizes the public-private key pair of the CPEc device, the public-private key pair of the CPEs device, the user identity, the authentication timestamp, and other information. By incorporating user and time factors, strong cryptographic security isolation is ensured between different users' service data. Table 1 shows the symbols involved in the service key calculation.

[0060] Table 1

[0061]

[0062] This section uses the CPEc device as an example to describe the service key calculation process.

[0063] CPE C The device database already contains CPE C Device public-private key pair TPK C / TSK C , the network identification of all CPE devices in the network, and configure the public key generation algorithm GenTPK() and the hash algorithm Hmac with parameters K ().

[0064] Step 1: CPE C The device receives the user request message and confirms that the data has not been tampered with, and can obtain the ID U , TimeS and other information, after the data center access point is determined, the CPE S Network ID of the device S ;

[0065] Step 2: CPE C The device uses the user identity to generate the user public key TPK U , recorded as: TPK U =GenTPK(ID U ) and take TPK U The first 32 bits of TPK are used as the hash parameter K, which is recorded as: K = TPK U ∣ 32 ;

[0066] Step 3: CPE C Device uses network identification ID S Generate CPE S Device public key, denoted as: TPK S =GenTPK(IDs);

[0067] Step 4: CPE C The device uses the local private key and CPE S Device public key, calculate key information mask MASK = TSK C ☉TPK S ;

[0068] Step 5: CPE C The device calculates the 32-bit business key Key = MASK | 32 ⊕Hmac K (TimeS).

[0069] Example 1

[0070] refer to Figure 4 As shown, this embodiment discloses an identity authentication process. The user initiates network access authentication through the computing terminal. If the authentication fails, the user is not authorized to use the terminal. If the authentication succeeds, the computing terminal obtains the user identity token, and the CPEc device at the LAN boundary adds the corresponding security entry. Specifically, it includes:

[0071] Step 1: The computing terminal collects user identity information, such as fingerprints and irises, through a supporting device and initiates a network access authentication request to the CPEc device at the LAN boundary. The authentication information carries the user identity information.

[0072] Step 2: The CPEc device at the LAN edge extracts the user identity information and initiates an authentication request to the authentication infrastructure.

[0073] Step 3: The authentication infrastructure extracts the user's identity information and matches it against the local database. If a match is found, a user token is generated, which contains the user's identity and user permissions. The token is then sent to the CPEc device via an authentication response message.

[0074] Step 4: The CPEc receives the authentication response message and extracts the user token.

[0075] Step 5: The CPEc device uses the user identity in the user token to request the user's control policy from the policy service infrastructure, including the access control policy and transmission encryption policy.

[0076] Step 6: The policy service infrastructure queries the local database for the user's control policy based on the user's identity and sends the query result to the CPEc device via a user control policy response message.

[0077] Step 7: The CPEc device generates a security entry based on the computing terminal IP address, user identity, access control policy, transmission encryption policy, and other information and adds it to the local security database.

[0078] Step 8: The CPEc sends the authentication result and user token to the computing terminal via an authentication response message.

[0079] Step 9: If the authentication is successful, the computing terminal obtains the user token and records the timestamp of the authentication success for use in the service access phase.

[0080] Example 2

[0081] refer to Figure 5 As shown, this embodiment discloses a service access process, which requires two steps to be completed before service access, including: first, building an overlay network between the CPEc device and the CPEs device according to user needs; second, the user completes network access authentication on a computing terminal in the local area network and obtains user tokens (including user identity, user public and private key pairs), authentication timestamp and other information.

[0082] The business access process specifically includes:

[0083] Step 1: The user initiates a service access request on the computing terminal. The computing terminal fills in the option field of the IP header with information such as user identity, service identity, and authentication timestamp based on actual needs.

[0084] Step 2: The computing terminal uses the user's private key to sign the user identity, service identity, authentication timestamp and other fields, and fills the first 4 bytes of the signature result into the extended signature field;

[0085] Step 3: The CPEc receives the service access request message, generates a user public key using the user ID, and verifies the signature of the user ID, service ID, and authentication timestamp fields. If the signature verification fails, the message is discarded. If the signature verification succeeds, the message continues to be executed.

[0086] Step 4: The CPEc device matches the local security entry against the user ID. If a match fails, the entry is discarded and the process terminates. If a match succeeds, the process continues.

[0087] Step 5: The CPEc device checks the user's service permissions based on the security entry to determine whether the user and the service are authorized to use the overlay network.

[0088] Step 6: After the permission check passes, the CPEc device checks the authentication timestamp in the message. If the authentication timestamp matches the security entry, the process goes directly to step 10; otherwise, the process continues.

[0089] Step 7: The CPEc device selects an appropriate CPEs device to access the data center based on the overlay network routing plan, the destination address of the service access, and the service quality requirements.

[0090] Step 8: The CPEc device uses the network ID of the CPEs device to generate a device public key, and then generates a service key based on the local private key, the CPEs device public key, the user ID, and the authentication timestamp.

[0091] Step 9: The CPEc device saves the service key, authentication timestamp, and other information in the corresponding security entry in the local database.

[0092] Step 10: The CPEc device adds the logical service domain identifier to the IP header option field, encrypts and encapsulates the user service request message based on the ESP protocol, and sends it to the corresponding CPEs device.

[0093] Step 11: After receiving the service request, the CPE device uses the user ID to generate the user public key and verifies the signature of the user ID, service ID, authentication timestamp and other fields. If the signature verification fails, the request is discarded directly. If the signature verification succeeds, the request continues.

[0094] Step 12: The CPE uses the user identity to match the local security table entry. If a match is successful, it proceeds directly to step 14. If a match fails, it uses the user identity to initiate a user control policy request to the policy service infrastructure.

[0095] Step 13: The policy service infrastructure uses the user identity to match the local database. If a match is found, the policy service infrastructure notifies the CPE of the authentication result, security policy, validity period, and other information through a user control policy response.

[0096] Step 14: If the user control policy request is successful, the CPE device generates a security entry based on the user identity, access control policy, transmission encryption policy, and other information and adds it to the local security database;

[0097] Step 15: The CPE checks the user's service permissions based on the security entry to determine whether the user has permission to access the data center service or application.

[0098] Step 16: After the permission check passes, the CPE checks the authentication timestamp in the message. If the authentication timestamp matches the security entry, the process goes directly to step 19; otherwise, the process continues.

[0099] Step 17: The CPEs device obtains the network ID of the CPEc device based on the routing information and generates a device public key. It then generates a service key using the local private key, the CPEc device public key, the user ID, and the authentication timestamp.

[0100] Step 18: The CPE device saves the service key and authentication timestamp in the corresponding security entry in the local database;

[0101] Step 19: The CPEs device decrypts and decapsulates the user service data using the service key, removes the logical service domain identifier field in the IP header option, and sends the service request data to the corresponding service server.

[0102] Step 20: The service server processes the service request and returns a service response message. The option field in the IP header of the response message is filled with the user identity, service identity, authentication timestamp, and signature information.

[0103] Step 21: The CPE receives the service response message, extracts the user identity, and matches it with the local security entry. If the match fails, the CPE discards the message; if the match succeeds, the CPE continues.

[0104] Step 22: The CPEs device fills the logical service domain identifier in the option field of the IP header of the message, encrypts and encapsulates the service response message using the ESP protocol, and forwards it to the network.

[0105] Step 23: The CPEc receives the service response message, extracts the user identity, and matches it with the local security entry. If the match fails, the CPEc discards the message; if the match succeeds, the CPEc continues.

[0106] Step 24: The CPEc device decrypts and decapsulates the service data message using the service key, removes the logical service domain identifier field in the IP header options, and sends the service response message to the corresponding computing terminal.

[0107] Step 25: After receiving the service response data, the computing terminal continues the process until the service ends and the user goes offline. The computing terminal notifies the CPEc device of the user offline message.

[0108] Step 26: The CPEc receives the user offline notification, deletes the corresponding security entry based on the user's identity, and notifies the CPEs that the service has been completed.

[0109] Step 27: The CPEs device receives the service completion notification and deletes the corresponding security entry based on the user identity, and the service access process ends.

[0110] Example 3

[0111] refer to Figure 6 As shown, this embodiment discloses a re-authentication process. According to system requirements, the CPEc device regularly detects the authentication duration of the user / computing terminal. If the authentication time has timed out or is about to time out, the CPEc device notifies the computing terminal to initiate re-authentication. Specifically, it includes:

[0112] Step 1: The computing terminal receives a reauthentication request from the CPEc device and first checks the user's usage. If the user has not operated for a long time or has gone offline, the computing terminal notifies the CPEc device of the user's offline status, and the process ends. If the user is still using the terminal normally, the process proceeds to step 3.

[0113] Step 2: The CPEc receives the user offline notification, deletes the corresponding security entry based on the user's identity, and notifies the corresponding CPEs that the user has gone offline. The CPEs then deletes the corresponding security entry, and the process ends.

[0114] Step 3: The computing terminal uses the user identity to initiate a network re-authentication request to the CPEc device at the network edge;

[0115] Step 4: The CPEc device extracts the user identity and initiates an identity re-authentication request to the authentication infrastructure.

[0116] Step 5: The authentication infrastructure extracts the user ID and matches it against the local database. If a match is successful, it generates a new user token containing the user ID and the latest user permissions. This token is then sent to the CPEc device via an authentication response message.

[0117] Step 6: The CPEc device uses the user identity in the user token to request the latest control policy for the user from the policy service infrastructure.

[0118] Step 7: The policy service infrastructure queries the local database for the latest control policy for the relevant user based on the user identity and sends the query result to the CPEc device via a user control policy response message.

[0119] Step 8: The CPEc processes the latest control policies, including access control policies and transmission encryption policies. If there are any changes, it updates the security entries in the local database.

[0120] Step 9: The CPEc sends the authentication result and user token to the computing terminal via an authentication response message.

[0121] Step 10: If the authentication is successful, the computing terminal obtains the user token and records the timestamp of the authentication success.

[0122] Compared with the traditional overlay network security isolation method, this application improves the adaptability of security and confidentiality policies to cloud computing. By binding user identity identification with security and confidentiality policies and combining the services provided by identity authentication and policy service infrastructure, it not only enables various users to access securely on different local area networks and different computing terminals; but also performs network usage permission and business permission checks based on user identification and business needs, thus achieving fine-grained access control for different user businesses.

[0123] At the same time, strong cryptographic isolation is achieved between different user service data on the overlay network. By applying user identity to the service access process, leveraging the algorithmic properties of the identity as a public key, and generating service keys through a zero-interaction mechanism, the calculation of the service keys incorporates user and time factors. This achieves strong cryptographic isolation between different user service data on the overlay network. The Encapsulating Security Payload Protocol also protects the confidentiality, integrity, and forward security of user service data.

[0124] This application proposes a user identity-based overlay network access control and password isolation method, which can be coordinated with identity authentication and policy service infrastructure to achieve secure and trusted user access, service access control, and strong password-based user service security isolation. It provides fine-grained, dynamic, and secure access control and isolation protection for various users to access data center services and data through the overlay network, and has good application prospects.

[0125] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for overlay network access control and password isolation based on user identity identification, characterized in that: The overlay network is constructed between CPEc devices and CPEs devices. The CPEc devices are deployed at the user LAN egress and the CPEs devices are deployed at the data center inlet. The overlay network is connected to the identity authentication infrastructure and the policy service infrastructure. The overlay network access control and password isolation method based on user identity identification includes: Deploy an asymmetric cryptographic system based on identification passwords on CPE devices. Use identification passwords to design CPE device network identifiers, device public and private keys, and user identities. By binding user identities to access control policies and transmission encryption policies, and leveraging the identity authentication and policy services provided by the infrastructure, secure access is achieved for all types of users on different LANs and computing terminals. At the same time, by applying user identity identification to the service access process, two-level permission checks are implemented on the CPEc and CPEs devices at the edge of the overlay network to achieve fine-grained access control for different user services. The CPEc device is configured to support SD-WAN and SR, and can select CPEs devices to access the data center based on overlay network planning, bearer network link status, and service quality requirements; The CPEc device is configured to perform primary access control based on the user identity to confirm whether the user has the authority to use the overlay network; The CPEc device is configured to generate service keys with zero interaction with the CPEs device, and encrypt / decrypt, decrypt / encapsulate user service messages based on the Encapsulating Security Payload protocol, implementing strong security isolation based on cryptography; The CPEs device is configured to support SD-WAN and SR, and can select a path to communicate with the CPEc device based on overlay network planning, bearer network link status, and service quality requirements; The CPEs device is configured to perform secondary access control based on user identity and service identity to confirm whether the user has access rights to the relevant service / application; The CPEs device is configured to generate service keys with zero interaction with the CPEc device, and encrypt / decrypt, decrypt / encapsulate user service messages based on the Encapsulating Security Payload Protocol, implementing strong security isolation based on passwords.

2. The overlay network access control and password isolation method based on user identity identification according to claim 1 is characterized in that: The overlay network access control and password isolation method further includes: Based on the algorithmic characteristics of identification and public keys, a zero-interaction business key generation mechanism is set up, and the Encapsulating Security Payload Protocol is used to protect the confidentiality, integrity, and forward security of user business data, so that different user business data can be strongly isolated based on passwords on the overlay network.

3. The overlay network access control and password isolation method based on user identity identification according to claim 1 is characterized in that: A user information collection device is deployed on the computing terminal in the user LAN, which uses the user information to initiate a network access authentication request to the CPEc device and initiate identity authentication to the identity authentication infrastructure; The identity authentication process includes: the user initiates network access authentication through the computing terminal. If the authentication fails, the user is not authorized to use the terminal. If the authentication succeeds, the computing terminal obtains the user identity token, and the CPEc device at the LAN boundary adds the corresponding security table entry.

4. The overlay network access control and password isolation method based on user identity identification according to claim 3 is characterized in that: The computing terminal runs an extended IP protocol, and the option field of the IP header is extended with user identification, service identification, authentication timestamp and signature information.

5. The overlay network access control and password isolation method based on user identity identification according to claim 4 is characterized in that: The user identity is the unique identifier of the user in the network, including the identifier type, identifier ID and identifier validity period; The service identifier includes the service application identifier and network performance requirement information, which is used to enable the CPEc device to perceive the application and requirements, thereby providing refined network services and accurate network operation and maintenance for the CPEc device; The authentication timestamp includes the time information when the user successfully obtains the identity token through authentication, which is used to control the user's access time, initiate re-authentication, and participate in the calculation as the time factor parameter of the business key; The signature is a signature of the user identity, service identity, and authentication timestamp fields by the computing terminal using the user's private key.

6. The method for overlay network access control and password isolation based on user identity identification according to claim 1, characterized in that: The CPEc device and the CPEs device protect the confidentiality, integrity and forward security of user service data through the Encapsulating Security Payload Protocol, and at the same time extend the logical service domain identifier in the IP header option field for security checking.

7. The overlay network access control and password isolation method based on user identity identification according to claim 6 is characterized in that: The logical service domain identifier is a unique identifier of the overlay network constructed on demand on the bearer network.

8. The overlay network access control and password isolation method based on user identity identification according to claim 1 or 3, characterized in that: The CPE device is configured to start the service key generation process when it receives the first service request message after the authentication timestamp changes. The service key generation process is jointly participated by the CPEc device public and private key pair, the CPEs device public and private key pair, the user identity, and the authentication timestamp information, and the user factor and time factor are added to achieve strong password-based security isolation between different users' service data.

Images