Network access control method, firewall and user terminal

Abstract

The present application discloses a network access control method, a firewall, and a user terminal. The method comprises: receiving a knocking request message sent by a user terminal located in a first network, wherein the knocking request message comprises: a first user identifier and first access target information, the first user identifier being obtained by one-way mapping a first timestamp and an original user identifier using a collision-resistant one-way mapping algorithm; obtaining a key corresponding to the target user identifier when it is determined that the target user identifier exists in the user database, and using the key to decrypt the first access target information in the knocking request message to obtain the original access target information; and opening a network channel between the source address corresponding to the user terminal and the destination address corresponding to the original access target information located in a second network. The present application solves the technical problems of insufficient refinement and flexibility in access control to the network, and insufficient security and privacy protection.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network access control method, a firewall, and a user terminal. Background Art

[0002] Currently, the basic measure to deal with network snooping and attacks is to use various firewalls, which protect network applications by filtering the source IP (Internet Protocol) addresses of network requests.

[0003] In related technologies, intelligent firewalls can be "open on demand" for authorized users. These solutions proactively isolate network services through default firewall policies, protecting them from network snooping or attacks. However, for authorized users, the service instructs the firewall to release access when specific conditions are triggered, becoming visible to them and only them. This approach is like keeping a door closed by default, only opening it to let the knocker in when a pre-agreed "knock signal" is heard.

[0004] However, the intelligent firewalls in related technologies have technical problems such as insufficient precision and flexibility in controlling access to and from the network, and insufficient security and privacy protection.

[0005] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0006] The embodiments of the present application provide a network access control method, a firewall, and a user terminal to at least solve the technical problems that the control of inbound and outbound network access is not sophisticated and flexible enough, and the security and privacy protection levels are insufficient.

[0007] According to one aspect of an embodiment of the present application, a network access control method is provided, comprising: receiving a knocking request message sent by a user terminal located in a first network, wherein the knocking request message includes: a first user identifier and first access target information, the first user identifier is obtained by one-way mapping a first timestamp and an original user identifier using an anti-collision one-way mapping algorithm, and the first access target information is obtained by encrypting the original access target information using a key corresponding to the original user identifier; judging whether a target user identifier exists in a user database, wherein the target user identifier is a specific candidate user identifier in the user database, and the specific candidate timestamp and the specific candidate user identifier are input into the one-way The mapping result obtained after the mapping algorithm is the same as the first user identifier. The user database contains at least one user registration information, and the user registration information includes: a candidate user identifier, and a key corresponding to the candidate user identifier; when it is determined that the target user identifier exists in the user database, the key corresponding to the target user identifier is obtained, and the key is used to decrypt the first access target information in the knock request message to obtain the original access target information; a network channel is opened between the source address corresponding to the user terminal and the destination address corresponding to the original access target information in the second network, so that the user terminal can access the access target located in the second network, wherein the first network and the second network are two networks isolated by a firewall.

[0008] Optionally, determining whether the target user identifier exists in the user database includes: determining the local timestamp when the knock request message is received as the second timestamp, and determining the candidate timestamp interval based on the second timestamp and a preset allowable error; obtaining a candidate timestamp located in the candidate timestamp interval according to a preset time granularity; inputting the candidate timestamp and the candidate user identifier into a one-way mapping algorithm to obtain a mapping result, wherein the one-way mapping algorithm includes: a first mapping parameter and a second mapping parameter, the first mapping parameter traverses each candidate timestamp in the candidate timestamp interval, and the second mapping parameter traverses each candidate user identifier in the user database; when the mapping result is consistent with the first user identifier, the value of the first mapping parameter when the mapping result is obtained is determined as the first timestamp in the user terminal, and the value of the second mapping parameter when the mapping result is obtained is determined as the target user identifier.

[0009] Optionally, the knocking request message also includes: a first timestamp; determining whether the target user identifier exists in the user database also includes: determining the local timestamp when the knocking request message is received as the second timestamp, and determining the candidate timestamp interval based on the second timestamp and a preset allowable error; when the first timestamp in the knocking request message is within the candidate timestamp interval, inputting the first timestamp and the candidate user identifier into a one-way mapping algorithm to obtain a mapping result, wherein the one-way mapping algorithm includes: a first mapping parameter and a second mapping parameter, the first mapping parameter takes the first timestamp, and the second mapping parameter traverses each candidate user identifier in the user database; when the mapping result is consistent with the first user identifier, the value taken by the second mapping parameter when the mapping result is obtained is determined as the target user identifier.

[0010] Optionally, the first access target information is obtained by encrypting a specific mixing result using a key, and the specific mixing result is determined by the verification information and the original access target information; using the key to decrypt the first access target information in the knock request message includes: obtaining the key corresponding to the target user identifier stored in the user database, and using the key to decrypt the first user identifier to obtain a decrypted result, wherein the decrypted result includes: a verification part and an access target part; when the verification part in the decryption result is consistent with the verification information used when mixing the original access target information, the access target part in the decryption result is determined to be the original access target information corresponding to the first access target information.

[0011] Optionally, the method also includes: generating an original user identifier and a key corresponding to the original user identifier in response to a registration request message; storing the original user identifier and the key as candidate user identifiers and their corresponding keys in a user database of the firewall, and storing the original user identifier and the key in a secure storage medium so that the user can obtain the original user identifier and the key by collecting the secure storage medium.

[0012] According to another aspect of an embodiment of the present application, another network access control method is provided, including: using a collision-resistant one-way mapping algorithm to perform one-way mapping on a first timestamp and an original user identifier to obtain a first user identifier; using a key corresponding to the original user identifier to encrypt the original access target information to obtain first access target information; generating a knocking request message based on the first user identifier and the first access target information, and sending the knocking request message to a firewall; when the firewall opens a network channel in accordance with the knocking request, accessing the access target located in the second network, wherein the network channel is a channel between a source address located in the first network corresponding to a user terminal opened by the firewall in response to the knocking request message to a destination address located in the second network corresponding to the original access target information, and the first network and the second network are two networks isolated by the firewall.

[0013] Optionally, the original access target information includes: a uniform resource identifier in the form of a string; before encrypting the original access target information, it also includes: when the original access target information is in the form of a string, generating a target random number within a preset numerical range, wherein the target random number is a positive integer; adding preset characters of the target random number at the beginning or end of the original access target information to obtain new original access target information.

[0014] Optionally, the original access target information also includes: a destination Internet Protocol address and a destination protocol port number in binary form; encrypting the original access target information includes: mixing the verification information with the original access target information to obtain a specific mixed result; using a key to encrypt the specific mixed result to obtain the first access target information.

[0015] According to another aspect of the embodiment of the present application, a firewall is provided, including: a memory and a processor, the processor being configured to run a program stored in the memory, wherein the network access control method is executed when the program is run.

[0016] According to another aspect of the embodiments of the present application, a user terminal is provided, including: a memory and a processor, the processor being configured to run a program stored in the memory, wherein the network access control method is executed when the program is run.

[0017] In the embodiments of the present application, the aforementioned approach, through the use of a one-way mapping algorithm and an encryption algorithm, effectively enhances network access security, avoiding the risk of leakage of user identifiers and access target information during network transmission. Through firewall control, dynamic opening and closing of access channels is achieved, effectively performing identity authentication during the door-knocking process and effectively preventing unauthorized access. This addresses the technical issues of insufficiently refined and flexible access control for inbound and outbound networks, as well as insufficient security and privacy protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 This is a schematic diagram of a method flow for network access control provided according to an embodiment of the present application;

[0020] Figure 2 This is a schematic diagram of a method flow for network access control supporting two-way knocking provided in accordance with an embodiment of the present application;

[0021] Figure 3 This is a schematic diagram of another method flow for network access control provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that such expressions can be interchangeable where appropriate so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] To facilitate those skilled in the art to better understand the embodiments of the present application, some technical terms or nouns involved in the embodiments of the present application are explained as follows:

[0025] Firewall: A network security device deployed at the network control perimeter to implement access control. It analyzes network traffic at a specific level and, based on administrator-configured security rules, determines whether to allow network packets to pass. Firewalls are generally considered the first line of defense in network security and play a key role in network security protection.

[0026] In related technologies, traditional static firewalls usually adopt a defense strategy of default drop or default pass. However, no matter which approach is adopted (default drop / default pass), enabling the firewall is only a passive defense measure: since it is impossible to predict whether each source IP is legitimate or malicious, firewall administrators can usually only configure the firewall accordingly during or after network spying and attacks occur, and the protection effect is relatively delayed and limited.

[0027] To overcome the shortcomings of static firewalls, the related technology has evolved from traditional static firewalls to intelligent firewalls that can be opened on demand for authorized users. For those authorized users, the service will instruct the firewall to allow them to pass when specific conditions are triggered.

[0028] Taking the Linux and FreeBSD operating systems as an example, knockd is such a special daemon process that listens to the TCP / UDP protocol packets received by the host from the network. When these packets match the pre-configured rules in the form of a specific sequence of events, knockd will call the firewall command accordingly to open the firewall, which is always closed by default, to and only to the source IP that sent the correct knock signal.

[0029] However, current knockd technologies share a common limitation: they focus solely on situations where the knocker is outside the door ("knock in"), completely ignoring situations where the knocker is inside ("knock out"). It's important to note that knockd itself doesn't perform identity authentication, meaning it operates anonymously. In the "knock in" scenario, access can be granted first and then identity authentication performed, meaning the identity can be verified after the person enters the door.

[0030] However, if we switch our perspective from individuals to network service providers (such as operators), problems arise. Imagine a scenario where a network in a certain region can only access a limited number of targets on a whitelist when accessing the external network, and targets not on the whitelist are closed by default. Then, when an authorized user needs to temporarily access a specific target that is not on the whitelist (such as https: / / example.com), it is obvious that the knockd technology in related technologies cannot be applied, because "knock in" usually accesses the default target, while the target to be accessed by "knock out" cannot be determined in advance; different users will request different targets around the world, and the actual situation can only be known at the time of use.

[0031] Moreover, in the "knock on the door to get out" scenario, if the knockd solution in the related technology is still used, although the user can also "knock open" the firewall and temporarily access a default and fixed target, the defect of the solution is that the external network target usually will not and is not obliged to authenticate the user like the internal network SSH service or web mailbox, and it is even less likely to feedback relevant records to our operator. Therefore, in this scenario, the external network target will not and cannot help the internal network do any security work (for example, security audits).

[0032] To solve this reverse knocking problem, one technical approach is to modify knockd so that it authenticates users like the SSH service, for example, using username / password or digital signature technology. However, this would complicate the solution, reduce its confidentiality, and create new problems, as follows: Identity authentication schemes usually involve user identification, which makes two (or more) knocking signals from the same user correlated, and thus easily combined with other information to leak the user's identity. For example, an intranet observer might associate multiple knocking requests from a user through identification, and then infer the user's original identity or even the reverse knocking intention through social engineering. Therefore, how to make these knocking requests appear independent and unrelated, that is, how to make it impossible for observers to determine whether they come from the same user, is a problem that needs to be solved.

[0033] In summary, the transition from "knock in" to "knock out" not only faces the problem of unpredictable destinations, i.e., the user's access objectives, but also presents a new contradiction: ISPs must both authenticate the user's identity (to fundamentally prevent the knock signal from being misused by unauthorized parties) and protect the user's identity privacy (to prevent intranet observers from correlating and tracking the knock behavior). This shows that the requirements and security requirements for "knock out" solutions are significantly higher than those for "knock in" solutions; what works for "knock out" can inevitably work for "knock in," but the reverse is often not true.

[0034] In order to solve the above problems, relevant solutions are provided in the embodiments of the present application, which are described in detail below.

[0035] According to an embodiment of the present application, a method embodiment of network access control is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed by a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0036] The present invention provides a method for controlling network access. Figure 1is a schematic diagram of a method flow for network access control provided according to an embodiment of the present application, such as Figure 1 As shown, the method is applied to the firewall side and includes the following steps:

[0037] Step S102: Receive a knock request message sent by a user terminal located in the first network, wherein the knock request message includes: a first user identifier and first access target information, wherein the first user identifier is obtained by performing a one-way mapping between a first timestamp and an original user identifier using a collision-resistant one-way mapping algorithm, and the first access target information is obtained by encrypting the original access target information using a key corresponding to the original user identifier, wherein the original user identifier is a user identifier in plain text, and the original access target information is access target information in plain text;

[0038] Step S104: Determine whether a target user identifier exists in a user database, where the target user identifier is a specific candidate user identifier in the user database, and a mapping result obtained by inputting the specific candidate timestamp and the specific candidate user identifier into a one-way mapping algorithm is the same as the first user identifier. The user database contains at least one piece of user registration information, and the user registration information includes: the candidate user identifier and a key corresponding to the candidate user identifier.

[0039] Step S106: If it is determined that the target user identifier exists in the user database, a key corresponding to the target user identifier is obtained, and the key is used to decrypt the first access target information in the knock request message to obtain the original access target information;

[0040] Step S108, opening a network channel between the source address corresponding to the user terminal and the destination address located in the second network corresponding to the original access target information, so that the user terminal can access the access target located in the second network, wherein the first network and the second network are two networks isolated by a firewall.

[0041] Through the above steps, the use of a one-way mapping algorithm and encryption algorithms effectively enhances network access security, preventing the risk of leakage of user identifiers and access target information during network transmission. Through firewall control, dynamic opening and closing of access channels is achieved, effectively performing identity authentication during the door-knocking process and effectively preventing unauthorized access. This addresses the technical issues of insufficiently granular and flexible access control, as well as insufficient security and privacy protection.

[0042] The following further introduces the network access control method in steps S102 to S108 of the embodiment of the present application. It should be noted that the solution of the present application can be applied to the scenario of "knocking on the door to go out" (access from the intranet to the extranet) as well as the scenario of "knocking on the door to come in" (access from the extranet to the intranet). Through the above analysis, it can be seen that the solution used for "knocking on the door to go out" has significantly higher needs and security requirements than the solution used for "knocking on the door to come in". What can be used for "knocking on the door to go out" can definitely be used for "knocking on the door to come in". Therefore, in the subsequent introduction, the scenario of "knocking on the door to go out" (access from the intranet to the extranet) is mainly used as an example to illustrate this solution, and the application in the scenario of "knocking on the door to come in" (access from the extranet to the intranet) will not be repeated.

[0043] In the embodiment of the present application, it mainly includes an offline stage (user registration) and an online stage (mainly for knocking on the door to go out, but also applicable to the scenario of knocking on the door to come in), involving at least two participants: the authorized user (user terminal side) and the firewall (including its management party).

[0044] In the offline phase, the user side submits a registration request to the firewall side, as follows.

[0045] In some embodiments of the present application, the method also includes the following steps: generating an original user identifier and a key corresponding to the original user identifier in response to a registration request message; storing the original user identifier and the key as candidate user identifiers and their corresponding keys in a user database of the firewall, and storing the original user identifier and the key in a secure storage medium so that the user can obtain the original user identifier and the key by collecting the secure storage medium.

[0046] Specifically, the user submits a registration request message to the firewall manager (i.e., the network service provider). After passing the review, the firewall will assign the original user identifier u and the key k known only to the user and the firewall to the user.

[0047] In this embodiment, u and k are both sufficiently strong random numbers (e.g., 128-bit random numbers) and must be properly stored. On the one hand, they are stored in the firewall's user database. On the other hand, the firewall administrator can store their values ​​(along with the relevant client software) on a secure storage medium such as the online banking UShield and issue it to the user. The user then inserts this secure storage medium into their network terminal (e.g., a laptop) to execute the knock-on process. If a user needs to be revoked for any reason (commonly expiration or loss of the secure medium), simply disable the corresponding u and k in the user database.

[0048] After completing the offline registration process, the online door-knocking strategy can be implemented. The main steps of the online process are as follows: Figure 2As shown, in these steps, the firewall often needs to check the knock request. If any check fails, the firewall immediately terminates the process without having to respond to the knock request. The details are described below.

[0049] First, the user-side network terminal (i.e., the user terminal) reads the local timestamp t (i.e., the first timestamp), as well as the original user identifier u and key k stored on a secure storage medium; then, using a one-way mapping algorithm, the first timestamp t and the original user identifier u are one-way mapped to obtain a first user identifier (also called a pseudonym) p, i.e., p = h(t,u), where h is a pre-agreed collision-resistant one-way mapping algorithm (it is easy to calculate the output from the input, but it is not feasible to reversely infer the input from the output); and, using the key k, the access target d (i.e., the original access target information) requested by the user to be activated is encrypted into the first access target information c = E(k, t||d), where || represents bit string concatenation. For example, the concatenation result of integers x=0xfa and y=0xce is x||y=0xface, where the integers starting with 0x are represented in hexadecimal. E(k,*) is an encryption algorithm with k as the key and can use authenticatable encryption.

[0050] It should be noted that, in this embodiment, the first access target information c is obtained by encrypting the result t||d of the first timestamp t (that is, the first timestamp is selected as the verification information in this embodiment) and the original access target information d, but the embodiment of the present application does not limit the selection of verification information and the mixing method of the verification information and the original access target information d. Specifically, the verification information here can be determined by the first timestamp and / or the original user identifier, and any other information that can be verified; the mixing method here is not limited to splicing, and the two can be mixed in any mixing method. The terminal further encrypts the specific mixing result to obtain the first access target information c.

[0051] Afterwards, the user terminal can send a knock request message to the firewall, where the request message contains at least a pseudonym (ie, the first user identifier) ​​p, an encrypted access target (ie, the first access target information) c, and an optional local first timestamp t.

[0052] After receiving the knock request message sent by the user terminal, the firewall needs to first determine whether the knock request message contains the first timestamp t. If it contains t, the corresponding verification strategy is as follows.

[0053] In some embodiments of the present application, the knocking request message also includes: a first timestamp; determining whether the target user identifier exists in the user database also includes: determining the local timestamp when the knocking request message is received as a second timestamp, and determining a candidate timestamp interval based on the second timestamp and a preset allowable error; when the first timestamp in the knocking request message is located in the candidate timestamp interval, the first timestamp and the candidate user identifier are input into a one-way mapping algorithm to obtain a mapping result, wherein the one-way mapping algorithm includes: a first mapping parameter and a second mapping parameter, the first mapping parameter takes the first timestamp, and the second mapping parameter traverses each candidate user identifier in the user database; when the mapping result is consistent with the first user identifier, the value taken by the second mapping parameter when the mapping result is obtained is determined as the target user identifier.

[0054] Specifically, the firewall first determines the local timestamp (i.e., the second timestamp) T of the received knock request message, then determines whether the first timestamp is within the candidate timestamp interval (i.e., whether Te≤t≤T+e is satisfied), and determines whether a non-disabled u' can be found in the user database such that h(t,u') = p (i.e., determines whether the target user identifier u' exists); if both conditions are met, the knock request is deemed fresh and valid, the user-side first timestamp is t, and the original user identifier is u=u'; otherwise, the check fails. Wherein, e is the preset allowable error, which is an acceptable time error. For intranets, e is usually very small. For example, when t and T are measured in milliseconds, e can be 2000 milliseconds.

[0055] If the knock request received by the firewall does not contain the first timestamp t, the firewall executes the following verification strategy, which is as follows.

[0056] In some embodiments of the present application, determining whether a target user identifier exists in a user database includes: determining the local timestamp when the knock request message is received as a second timestamp, and determining a candidate timestamp interval based on the second timestamp and a preset allowable error; obtaining a candidate timestamp located in the candidate timestamp interval according to a preset time granularity; inputting the candidate timestamp and the candidate user identifier into a one-way mapping algorithm to obtain a mapping result, wherein the one-way mapping algorithm includes: a first mapping parameter and a second mapping parameter, the first mapping parameter traverses each candidate timestamp in the candidate timestamp interval, and the second mapping parameter traverses each candidate user identifier in the user database; when the mapping result is consistent with the first user identifier, the value of the first mapping parameter when the mapping result is obtained is determined as the first timestamp in the user terminal, and the value of the second mapping parameter when the mapping result is obtained is determined as the target user identifier.

[0057] Specifically, if the knock request received by the firewall does not contain t, the firewall attempts every possible candidate timestamp t' from the candidate timestamp interval (i.e., Te to T+e) at a preset time granularity, and attempts every non-disabled candidate user identifier u' from the database. If a combination t' and u' is found that satisfies h(t',u') = p, the knock request is considered fresh and valid, with the user-side timestamp t=t' and the user identifier u=u'. Otherwise, the check fails. The meaning of e remains unchanged here. For example, if t and T are measured in seconds, e can be 2 seconds.

[0058] The knocking request message in the embodiment of the present application does not contain any plaintext information without transmitting the first timestamp t. The first user identifier is the result of a one-way calculation, and the first access target information c is the result of encryption. In this case, the intranet observer cannot obtain any clues from the knocking request, and it is even difficult to distinguish port scanning from this knocking behavior.

[0059] In addition, it should be noted that the embodiment of the present application does not limit the transport layer protocol used to send the knock request message itself, and transport layer protocols such as TCP and UDP can be used.

[0060] After the firewall determines the original user identifier u=u' corresponding to the pseudonym p (first user identifier), it can find the key k corresponding to the original user identifier from the user database and use the key k to decrypt the first access target information c in the knock request message to obtain the original access target information d. The specific steps are as follows.

[0061] In some embodiments of the present application, the first access target information is obtained by encrypting a specific mixing result using a key, and the specific mixing result is determined by the verification information and the original access target information; using the key to decrypt the first access target information in the knock request message includes: obtaining the key corresponding to the target user identifier stored in the user database, and using the key to decrypt the first user identifier to obtain a decrypted result, wherein the decrypted result includes: a verification part and an access target part; when the verification part in the decryption result is consistent with the verification information used when mixing the original access target information, the access target part in the decryption result is determined to be the original access target information corresponding to the first access target information.

[0062] Specifically, in this embodiment, the first timestamp is selected as the verification information, and the first timestamp is directly concatenated with the original access target information in a mixed manner. In this case, the decryption algorithm D associated with the encryption algorithm E can be used to obtain t||d = D(k,c), where the decryption result includes the verification part and the access target part. If the decryption error occurs, the check fails. If the t of the verification part obtained by decryption is inconsistent with the verification information (i.e., the first timestamp) identified above, the check also fails.

[0063] It should be noted that in many encryption modes, even if the ciphertext has been tampered with, it can still be successfully decrypted (but the decrypted content is the tampered content). Only by using authenticatable encryption can errors be detected during the decryption process, thereby ensuring that the original access target information d obtained by decryption is credible.

[0064] Furthermore, the firewall can check whether the original access target information d is a correctly formatted access target. If not, the check fails. For example, the format of the original access target information d can be a binary destination IP address and destination protocol port number, or a string formatted uniform resource identifier (only the domain name is required, not the path, such as https: / / example.com).

[0065] The embodiments of this application do not restrict the specific format of the original access target information in actual applications. However, when d is represented as a string, symmetric encryption may leak the length of d, which may lead to the possibility of knocking requests being associated. Therefore, before performing the encryption operation c = E(k, t||d), the user needs to perform random padding at the beginning or end of d. For example, padding with a random number of English spaces within a certain range prevents intranet observers from inferring the specific length of d based on the length of the encrypted first access target information c. The details are as follows.

[0066] In some embodiments of the present application, the original access target information includes: a uniform resource identifier in the form of a string; before encrypting the original access target information, it also includes: when the original access target information is in the form of a string, generating a target random number within a preset numerical range, wherein the target random number is a positive integer; adding a preset character (for example, an English space symbol) of the target random number at the beginning or end of the original access target information to obtain new original access target information.

[0067] For example, Figure 2 As shown, Figure 2The original access target information d in the string is represented by a uniform resource identifier, and before each encryption operation E(k,*) is performed, the end of d needs to be filled with a random number of English spaces within a certain range [min,max]. Figure 2 The padded string (enclosed in double quotes) is underlined to emphasize the padding. This prevents the firewall from extracting the target d requested by the user, while also effectively preventing internal observers from inferring (and correlating) knock requests based on the length of c if d remains constant (i.e., when the user consistently requests the same external target). Accordingly, after decrypting c, the firewall also removes the trailing spaces from d.

[0068] It's easy to understand that when d is the destination IP address and destination protocol port number encoded in binary form, because IPv4 addresses are always 4 bytes long and IPv6 addresses are always 16 bytes long, an intranet observer cannot effectively associate the knock request based on the length of c. In this case, no additional padding is required. The first timestamp can be directly mixed with the original access target information to obtain a specific mixed result. The specific mixed result can be encrypted using a key to obtain the first access target information. Users can also disable the IPv4 address and only use the IPv6 address (or disable the IPv6 address and only use the IPv4 address), thereby achieving the effect that the intranet observer cannot obtain any intelligence about d.

[0069] After the firewall determines that the format of the original access target information is correct, it can extract the user's source IP and then open the corresponding network channel for the address. The specific steps are as follows.

[0070] In some embodiments of the present application, opening a network channel between the source address corresponding to the user terminal and the destination address corresponding to the original access target information includes the following steps: determining the source address corresponding to the knock request message, and the destination address corresponding to the original access target information; controlling the firewall to open the network channel between the source address and the destination address, and using the network channel to communicate between the source address and the destination address; automatically closing the network channel between the source address and the destination address when the idle duration of the network channel exceeds a preset time threshold or a channel closing request sent by the user terminal is received.

[0071] Specifically, the firewall extracts the user's source IP address from the knock request packet and temporarily enables an outbound pass policy for that address to the access destination d (similar to inbound). When d is a string-like URI whose domain name can be resolved to multiple destination IP addresses, the firewall may need to uniformly temporarily enable a policy for the user's source IP address to reach these destination IP addresses. The destination protocol port involved is determined by the URI in d (for example, https: / / example.com corresponds to TCP destination port 443, while https: / / example.com:8080 corresponds to TCP destination port 8080).

[0072] After the authorized user sends a knock request, they can wait a short while before initiating access to the external network destination d. The firewall can also monitor the network data from the authorized user to the destination d they requested access to. If the idle duration exceeds a preset threshold, the user's access is deemed complete and the previously temporarily enabled release policy is automatically disabled. Alternatively, similar to the previous steps, the user can initiate a request to disable the firewall, which the firewall will execute. This will not be elaborated here.

[0073] In addition, the firewall can also record the opening and closing information of temporary policies in the log. The specific steps are as follows.

[0074] In some embodiments of the present application, the method further includes the following steps: recording log information of the network channel.

[0075] Specifically, the firewall can record the activation and deactivation information of the temporary policy (including the firewall side timestamp T, user source IP, user identifier u, destination d, etc.) in the log for future auditing purposes.

[0076] The above-mentioned process steps in the embodiments of the present application can be mainly applied to the "reverse knocking" or "knock-out" scenario in network access control. For example, when a regional network accesses the external network, it can only access targets in a specific whitelist due to policies and other reasons, and targets not in the whitelist are closed by default; if an authorized user needs to temporarily access an external network target that is not in the whitelist, the method implemented in the present application can be used to send a knocking request in a covert form to the intelligent firewall deployed at the network boundary, so that the firewall can activate a temporary release policy for the authorized user.

[0077] The following further illustrates the method steps in the embodiments of the present application with reference to specific cases.

[0078] Suppose the metropolitan area network of a certain science and technology city cannot access the external network by default. When there are special requirements, authorized users are allowed to temporarily access external network targets. The solution in the embodiments of this application can be applied as a lightweight and sufficiently concealed solution to meet this requirement. Specifically, in this case, d is selected in the form of a string, t and T are selected as UNIX timestamps in milliseconds and saved in 8-byte long integers, e is taken as 2000 milliseconds, both u and k of the user are 128-bit secure random numbers, h is selected as the US national standard SHA-256 and the input parameters (t and u) are concatenated in the form of bit strings, and E is selected as the US national standard AES-128-GCM.

[0079] Suppose a user identifier is u = 0x13ed016a577f16c569f88ce208d3f26b. Its client software selects a fresh (i.e., different each time) random number 14 in the interval [10, 30], and accordingly adds 14 spaces to the uniform resource identifier https: / / example.com that it wants to temporarily access to transform it into d with a total length of 33 bytes. Thus, t||d is a total of 8 + 33 = 41 bytes, and then it is encrypted into c and sent at 10:44:32.791 seconds on March 2, 2025, Beijing time, that is, t = 0x19554bdb197. Its pseudonym p = h(t, u) = h(t||u) = h(0x0000019554bdb19713ed016a577f16c569f88ce208d3f26b) = 0x6053fd1a094002683d63204eda9cf013d49d66b6b424ba15fcb47854cb437ed4. The knocking request sent by this user contains: 8-byte t, 32-byte p, and 69-byte c; thus, the total net payload length of the knocking request is only 8 + 32 + 69 = 109 bytes, and t, p, and c can be completely placed in a UDP packet (or TCP packet) in the agreed order for transmission.

[0080] After the firewall receives the above knocking request, it extracts t and compares it with the local timestamp T. Intuitively, t < T should hold. However, since both t and T may have a certain error from the standard clock, as long as the difference between t and T is within e = 2000 milliseconds, the firewall can accept it. In actual situations, it is possible that t is slightly faster than the standard clock while T is slightly slower than the standard clock, resulting in the sending timestamp t even being greater than the receiving timestamp T. In this case, the firewall receives the knocking request at 10:四十三:32.185 seconds in its local time. Since T - 2000 ≤ t ≤ T + 2000, the firewall determines that the request is fresh and valid. Next, the firewall needs to traverse all non-disabled u in the database to find p = h(t||u), where the values of t and p are as above.

[0081] Compared with the anonymous knockd technology in the related art, the knock request in the present application scheme uses cryptographic technology. The firewall can check the user's identity and then implement effective network access control, especially temporary access control (including auditing). Unauthorized persons cannot abuse the knock signal to deceive the firewall by monitoring, replaying, altering, etc. The knock request uses a pseudonym to protect the user's original identity from being leaked. The firewall can quickly find the user identifier through exhaustive enumeration (or identify that the user does not have a legal identity), but the attacker cannot reveal the user's identity or associate multiple knock requests sent by the same user, thereby ensuring the legitimacy of the user's identity and effectively protecting the user's privacy. The scheme is user-friendly. The user only needs to carry a secure medium and can flexibly specify the target of his temporary request to open access. The knock request of this scheme only contains a stateless knock signal. The process is simple and can be implemented based on domestic and international standard cryptographic algorithms, reducing the implementation complexity.

[0082] The present application also provides another network access control method. Figure 3 FIG. 1 is a schematic diagram of another method flow for network access control provided in accordance with an embodiment of the present application. Figure 3 As shown, the method is applied to the user terminal side and includes the following steps:

[0083] Step S302: Using a collision-resistant one-way mapping algorithm, perform one-way mapping on the first timestamp and the original user identifier to obtain a first user identifier;

[0084] Step S304: encrypt the original access target information using the key corresponding to the original user identifier to obtain first access target information, wherein the original access target information is access target information in plain text;

[0085] Step S306: Generate a knock request message based on the first user identifier and the first access target information, and send the knock request message to the firewall;

[0086] Step S308, when the firewall opens a network channel in accordance with the knocking request, access is performed on the access target located in the second network, wherein the network channel is a channel between the source address located in the first network corresponding to the user terminal opened by the firewall in response to the knocking request message to the destination address located in the second network corresponding to the original access target information, and the first network and the second network are two networks isolated by the firewall.

[0087] Optionally, the original access target information includes: a uniform resource identifier in the form of a string; before encrypting the original access target information, it also includes: when the original access target information is in the form of a string, generating a target random number within a preset numerical range, wherein the target random number is a positive integer; adding preset characters of the target random number at the beginning or end of the original access target information to obtain new original access target information.

[0088] Optionally, the original access target information also includes: a destination Internet Protocol address and a destination protocol port number in binary form; encrypting the original access target information includes: mixing the verification information with the original access target information to obtain a specific mixed result; using a key to encrypt the specific mixed result to obtain the first access target information.

[0089] It should be noted that the network access control device provided in this embodiment is Figure 1 The network access control method shown corresponds to a method embodiment on the user terminal side. Therefore, the relevant explanations and descriptions of the above-mentioned network access control method are also applicable to the embodiments of the present application and will not be repeated here.

[0090] The embodiment of the present application also provides a firewall, comprising: a memory and a processor, the processor being configured to run a program stored in the memory, wherein a network access control method is executed when the program is running: receiving a knocking request message sent by a user terminal located in a first network, wherein the knocking request message comprises: a first user identifier and first access target information, wherein the first user identifier is obtained by performing a one-way mapping on a first timestamp and an original user identifier using an anti-collision one-way mapping algorithm, and the first access target information is obtained by encrypting the original access target information using a key corresponding to the original user identifier; determining whether a target user identifier exists in a user database, wherein the target user identifier is a specific candidate user identifier in the user database, and the specific candidate timestamp is The mapping result obtained after a specific candidate user identifier is input into a one-way mapping algorithm is the same as the first user identifier. The user database contains at least one user registration information, and the user registration information includes: a candidate user identifier, and a key corresponding to the candidate user identifier; when it is determined that the target user identifier exists in the user database, the key corresponding to the target user identifier is obtained, and the key is used to decrypt the first access target information in the knock request message to obtain the original access target information; a network channel is opened between the source address corresponding to the user terminal and the destination address corresponding to the original access target information in the second network, so that the user terminal can access the access target located in the second network, wherein the first network and the second network are two networks isolated by a firewall.

[0091] An embodiment of the present application also provides a user terminal, including: using a collision-resistant one-way mapping algorithm to perform one-way mapping on a first timestamp and an original user identifier to obtain a first user identifier; using a key corresponding to the original user identifier to encrypt the original access target information to obtain first access target information; generating a knocking request message based on the first user identifier and the first access target information, and sending the knocking request message to a firewall; when the firewall opens a network channel according to the knocking request, accessing the access target located in the second network, wherein the network channel is a channel between the source address located in the first network corresponding to the user terminal opened by the firewall in response to the knocking request message to the destination address located in the second network corresponding to the original access target information, and the first network and the second network are two networks isolated by the firewall.

[0092] The embodiment of the present application also provides a non-volatile storage medium, the non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the following network access control method by running the computer program: receiving a knocking request message sent by a user terminal located in a first network, wherein the knocking request message includes: a first user identifier and first access target information, the first user identifier is obtained by one-way mapping the first timestamp and the original user identifier using an anti-collision one-way mapping algorithm, and the first access target information is obtained by encrypting the original access target information using a key corresponding to the original user identifier; judging whether a target user identifier exists in a user database, wherein the target user identifier is a specific candidate user identifier in the user database, A mapping result obtained by inputting a specified candidate timestamp and a specific candidate user identifier into a one-way mapping algorithm is the same as the first user identifier, and the user database contains at least one user registration information, and the user registration information includes: a candidate user identifier, and a key corresponding to the candidate user identifier; when it is determined that the target user identifier exists in the user database, the key corresponding to the target user identifier is obtained, and the key is used to decrypt the first access target information in the knock request message to obtain the original access target information; a network channel is opened between the source address corresponding to the user terminal and the destination address corresponding to the original access target information in the second network, so that the user terminal can access the access target located in the second network, wherein the first network and the second network are two networks isolated by a firewall.

[0093] Alternatively, a collision-resistant one-way mapping algorithm is used to perform one-way mapping on the first timestamp and the original user identifier to obtain the first user identifier; the original access target information is encrypted using the key corresponding to the original user identifier to obtain the first access target information; a knocking request message is generated based on the first user identifier and the first access target information, and the knocking request message is sent to the firewall; when the firewall opens a network channel in accordance with the knocking request, the access target located in the second network is accessed, wherein the network channel is a channel between the source address located in the first network corresponding to the user terminal opened by the firewall in response to the knocking request message to the destination address located in the second network corresponding to the original access target information, and the first network and the second network are two networks isolated by the firewall.

[0094] The embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the network access control method described in each embodiment of the present application: receiving a knocking request message sent by a user terminal located in a first network, wherein the knocking request message includes: a first user identifier and first access target information, the first user identifier is obtained by one-way mapping the first timestamp and the original user identifier using an anti-collision one-way mapping algorithm, and the first access target information is obtained by encrypting the original access target information using a key corresponding to the original user identifier; judging whether a target user identifier exists in a user database, wherein the target user identifier is a specific candidate user identifier in the user database, and the specific candidate time is a specific candidate user identifier in the user database. The mapping result obtained after the stamp and the specific candidate user identifier are input into the one-way mapping algorithm is the same as the first user identifier. The user database contains at least one user registration information, and the user registration information includes: a candidate user identifier, and a key corresponding to the candidate user identifier; when it is determined that the target user identifier exists in the user database, the key corresponding to the target user identifier is obtained, and the key is used to decrypt the first access target information in the knock request message to obtain the original access target information; a network channel is opened between the source address corresponding to the user terminal and the destination address corresponding to the original access target information in the second network, so that the user terminal can access the access target located in the second network, wherein the first network and the second network are two networks isolated by a firewall.

[0095] Alternatively, a collision-resistant one-way mapping algorithm is used to perform one-way mapping on the first timestamp and the original user identifier to obtain the first user identifier; the original access target information is encrypted using the key corresponding to the original user identifier to obtain the first access target information; a knocking request message is generated based on the first user identifier and the first access target information, and the knocking request message is sent to the firewall; when the firewall opens a network channel in accordance with the knocking request, the access target located in the second network is accessed, wherein the network channel is a channel between the source address located in the first network corresponding to the user terminal opened by the firewall in response to the knocking request message to the destination address located in the second network corresponding to the original access target information, and the first network and the second network are two networks isolated by the firewall.

[0096] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0097] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0098] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0099] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0100] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0101] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0102] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A network access control method, characterized in that: include: Receiving a knock request message sent by a user terminal located in a first network, wherein the knock request message includes: a first user identifier and first access target information, wherein the first user identifier is obtained by performing a one-way mapping between a first timestamp and an original user identifier using a collision-resistant one-way mapping algorithm, and the first access target information is obtained by encrypting the original access target information using a key corresponding to the original user identifier; determining whether a target user identifier exists in a user database, wherein the target user identifier is a specific candidate user identifier in the user database, a mapping result obtained by inputting a specific candidate timestamp and the specific candidate user identifier into the one-way mapping algorithm is the same as the first user identifier, and the user database contains at least one piece of user registration information, the user registration information including: the candidate user identifier and the key corresponding to the candidate user identifier; If it is determined that the target user identifier exists in the user database, obtaining the key corresponding to the target user identifier, and using the key to decrypt the first access target information in the knock request message to obtain the original access target information; Opening a network channel between a source address corresponding to the user terminal and a destination address located in a second network corresponding to the original access target information, so that the user terminal can access the access target located in the second network, wherein the first network and the second network are two networks separated by a firewall; The method further includes: generating the original user identifier and the key corresponding to the original user identifier in response to the registration request message; storing the original user identifier and the key as candidate user identifiers and their corresponding keys in the user database of the firewall, and storing the original user identifier and the key in a secure storage medium so that the user can obtain the original user identifier and the key by collecting the secure storage medium.

2. The network access control method according to claim 1, wherein: Determining whether the target user identifier exists in the user database includes: Determine the local timestamp when the knock request message is received as a second timestamp, and determine a candidate timestamp interval based on the second timestamp and a preset allowable error; Obtaining candidate timestamps within the candidate timestamp interval according to a preset time granularity; Inputting the candidate timestamp and the candidate user identifier into the one-way mapping algorithm to obtain a mapping result, wherein the one-way mapping algorithm includes: a first mapping parameter and a second mapping parameter, the first mapping parameter traversing each candidate timestamp in the candidate timestamp interval, and the second mapping parameter traversing each candidate user identifier in the user database; When the mapping result is consistent with the first user identifier, the value of the first mapping parameter when obtaining the mapping result is determined as the first timestamp in the user terminal, and the value of the second mapping parameter when obtaining the mapping result is determined as the target user identifier.

3. The network access control method according to claim 1, wherein: The knock request message further includes: the first timestamp; Determining whether the target user identifier exists in the user database further includes: Determine the local timestamp when the knock request message is received as a second timestamp, and determine a candidate timestamp interval based on the second timestamp and a preset allowable error; When the first timestamp in the knock request message is within the candidate timestamp interval, inputting the first timestamp and the candidate user identifier into the one-way mapping algorithm to obtain a mapping result, wherein the one-way mapping algorithm includes: a first mapping parameter and a second mapping parameter, the first mapping parameter taking the first timestamp, and the second mapping parameter traversing each candidate user identifier in the user database; When the mapping result is consistent with the first user identifier, the value of the second mapping parameter when the mapping result is obtained is determined as the target user identifier.

4. The network access control method according to claim 1, wherein: The first access target information is obtained by encrypting a specific mixing result using the key, and the specific mixing result is determined by verification information and the original access target information; Decrypting the first access target information in the knock request message using the key includes: Obtaining the key corresponding to the target user identifier stored in the user database, and decrypting the first user identifier using the key to obtain a decryption result, wherein the decryption result includes: a verification part and an access target part; When the verification part in the decryption result is consistent with the verification information used when mixing the original access target information, the access target part in the decryption result is determined to be the original access target information corresponding to the first access target information.

5. A network access control method, characterized in that: include: Using a collision-resistant one-way mapping algorithm, one-way mapping is performed on the first timestamp and the original user identifier to obtain a first user identifier; Encrypting the original access target information using the key corresponding to the original user identifier to obtain first access target information; generating a knock request message according to the first user identifier and the first access target information, and sending the knock request message to the firewall; accessing an access target located on a second network when the firewall opens a network channel in accordance with the knock request, wherein the network channel is a channel between a source address located on the first network corresponding to the user terminal and a destination address located on the second network corresponding to the original access target information, the first network and the second network being two networks isolated by the firewall; The original user identifier and the key corresponding to the original user identifier are generated by the firewall device in response to a registration request message. The firewall device is also used to store the original user identifier and the key as candidate user identifiers and their corresponding keys in the user database of the firewall, and to store the original user identifier and the key in a secure storage medium so that the user can obtain the original user identifier and the key by collecting the secure storage medium.

6. The network access control method according to claim 5, characterized in that: The original access target information includes: a uniform resource identifier in the form of a character string; before encrypting the original access target information, it also includes: When the original access target information is in the form of a character string, a target random number is generated within a preset numerical range, wherein the target random number is a positive integer; Add the preset character of the target random number to the beginning or end of the original access target information to obtain the new original access target information.

7. The network access control method according to claim 6, characterized in that: The original access target information also includes: a destination Internet Protocol address and a destination protocol port number in binary form; encrypting the original access target information includes: Mixing the verification information with the original access target information to obtain a specific mixed result; The specific mixing result is encrypted using the key to obtain the first access target information.

8. A firewall device, characterized in that: include: A memory and a processor, wherein the processor is configured to run a program stored in the memory, wherein the network access control method according to any one of claims 1 to 4 is executed when the program is run.

9. A user terminal, characterized in that: include: A memory and a processor, wherein the processor is configured to run a program stored in the memory, wherein the network access control method according to any one of claims 5 to 7 is executed when the program is run.

Images