Application service access control method based on user equipment

Abstract

The invention discloses an application service access control method based on user equipment, and relates to the technical field of computers. The method comprises the following steps: identifying an application service type when a user terminal accesses the Internet through a data packet deep detection technology of a router, and recording an IP address of the user terminal; performing access interception on the unauthenticated user terminal, and redirecting to an authentication page provided by the portal server; forwarding authentication information submitted by the user terminal on the authentication page to an LDAP server for verification so as to obtain permission group information of the user terminal; comparing the authority group information with a plurality of different groups to generate a user token, and writing the user token into a client cookie of the user terminal; and dynamically authorizing the access authority of the user terminal during subsequent access to the Internet based on the binding relationship between the application service type and the IP address in the user token. According to the method, the user access authority can be finely controlled.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to an application service access control method based on user equipment. BACKGROUND

[0002] With the increasing competition pressure of home terminal equipment, it is urgent to improve the product competitiveness. The traditional gateway firewall mainly controls the access according to the Internet Protocol (IP) address, Uniform Resource Locator (URL), port, MAC address (Media Access Control Address, MAC Address) and the like.

[0003] The existing access control method cannot parse the application layer service type when forwarding the data packet. For example, when the application service port changes, the existing access control method cannot identify it, and the existing access control method keeps the access permission consistent for the application services of different users connected to the same home gateway.

[0004] Therefore, there is an urgent need for a method capable of fine control of user access permission. SUMMARY

[0005] Therefore, it is necessary to provide an application service access control method based on user equipment to solve the above technical problems. The method can fine control the user access permission.

[0006] The present application adopts the following technical solutions: The present application provides an application service access control method based on user equipment, comprising: The application service type when the user terminal accesses the Internet is identified through the data packet deep detection technology of the router, and the IP address of the user terminal is recorded; The access of the unauthenticated user terminal is intercepted, and redirected to the authentication page provided by the portal server; The authentication information submitted by the user terminal on the authentication page is forwarded to the LDAP server for verification to obtain the permission group information of the user terminal; The permission group information is compared with a plurality of different groups to generate a user token, and the user token is written into the client cookie of the user terminal; the user token includes the binding relationship between the application service type and the IP address; Based on the binding relationship between the application service type and the IP address in the user token, the access permission of the user terminal when accessing the Internet subsequently is dynamically authorized.

[0007] Preferably, the application service type when the user terminal accesses the Internet is identified through a packet deep detection technology of the router, and specifically includes: Monitoring the request packet sent when the user terminal accesses the Internet; Analyzing the content in the request packet, and matching the preset application service type feature library according to the analysis result; the application service type feature library includes a MIME type identifier of a video stream media, an extension name feature of file download, and a User-Agent rule of web browsing; When it is detected that the request packet includes encrypted traffic, the application service type to which the domain name belongs is identified through an SNI field and a TLS handshake protocol.

[0008] Preferably, the permission group information supports a multi-level nested structure, including an administrator group, a normal user group, and a temporary visitor group, and different groups correspond to different service type access white lists.

[0009] Preferably, based on the binding relationship between the application service type and the IP address in the user token, the access permission of the user terminal when subsequently accessing the Internet is dynamically authorized, and specifically includes: When the user terminal initiates a new Internet access request, the application service type and the IP address of the current Internet access request are extracted through the deep packet detection technology; The application service type and the IP in the new Internet access request are compared with the binding relationship stored in the user token, and when the application service type matches and the IP is consistent, the user terminal is granted the access permission of the new Internet access request.

[0010] Preferably, the method further includes: When it is detected that the application service type in the new Internet access request exceeds the authorized range of the application service type feature library or the IP is not matched, the user terminal is redirected to the authentication page provided by the portal server.

[0011] The application provides an application service access control device based on a user equipment, which includes: An identification module is configured to identify the application service type when the user terminal accesses the Internet through a packet deep detection technology of a router, and record the IP address of the user terminal; A redirection module is configured to intercept the access of an unauthenticated user terminal, and redirect the user terminal to an authentication page provided by a portal server; An acquisition module is configured to forward the authentication information submitted by the user terminal on the authentication page to an LDAP server for verification, so as to acquire the permission group information of the user terminal; The generating module is configured to compare the permission group information with a plurality of different groups, generate a user token, and write the user token into a client cookie of the user terminal; the user token comprises a binding relationship between an application service type and an IP address; The authorization module is configured to dynamically authorize the access permission of the user terminal when the user terminal accesses the Internet subsequently based on the binding relationship between the application service type and the IP address in the user token.

[0012] The application provides a computer readable storage medium, which stores a computer program; the computer program is executed by a processor to implement the application business access control method based on a user device.

[0013] The application provides a computer device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor; the processor implements the application business access control method based on a user device when executing the program.

[0014] The application achieves the following beneficial effects by adopting the above at least one technical solution: The application business type when the user terminal accesses the Internet is recognized, and the IP address of the user terminal is recorded; the recorded IP address and application business type can accurately distinguish the user terminal accessing the Internet; the unauthenticated user terminal is intercepted and redirected to the authentication page provided by the portal server; the authentication information submitted by the user terminal on the authentication page is forwarded to the LDAP server for verification to obtain the permission group information of the user terminal; the permission group information is compared with a plurality of different groups to generate a user token, and the user token is written into the client cookie of the user terminal; the IP address and the application business type in the user token can finely control the user access permission; the access permission of the user terminal when accessing the Internet subsequently is dynamically authorized based on the binding relationship between the application business type and the IP address in the user token. The application can finely control the user access permission. BRIEF DESCRIPTION OF DRAWINGS

[0015] The accompanying drawings, which are included to provide a further understanding of the application, constitute a part of this application, and illustrate the illustrative embodiments of the application and its description used to explain the application, and do not constitute an improper limitation on the application. In the drawings:

[0016] Figure 1 The application provides a flowchart of an application business access control method based on a user device; Figure 2 The application provides an application business access control flowchart; Figure 3A user equipment-based application service access control device provided by the application is shown in the figure; Figure 4 A computer device for implementing the user equipment-based application service access control method provided by the application is shown in the figure. DETAILED DESCRIPTION

[0017] In order to make the objectives, technical solutions and advantages of the application clearer, the technical solutions of the application will be described clearly and completely below in combination with specific embodiments of the application and corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the application, but not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the application.

[0018] or a device such as a desktop computer, a server, a notebook computer, etc. that can execute the solutions of the application. For the convenience of description, the following will be described taking a server as the execution subject.

[0019] The application detects the application service type of a user and the user login authentication technology by using the deep packet detection technology, formulates an access strategy, authorizes the access permission of the application service of different users, controls the access of the application service by using the minimum authorization strategy, and solves the problem of the division of the range of the access permission of the application service and the permission of different users.

[0020] The technical solutions provided by the embodiments of the application will be described in detail below in combination with the drawings.

[0021] Figure 1 A flowchart of a user equipment-based application service access control method provided by the application is shown in the figure, and specifically includes the following steps. S101: The application service type when a user terminal accesses the Internet is identified by using the deep packet detection technology of a router, and the IP address of the user terminal is recorded.

[0022] In an exemplary embodiment, the application service type when a user terminal accesses the Internet is identified by using the deep packet detection technology of a router, and specifically includes: listening to the request data packet sent when the user terminal accesses the Internet; analyzing the content in the request data packet, and matching the preset application service type feature library according to the analysis result; the application service type feature library includes the MIME type identifier of the video streaming media, the extension name feature of the file download, and the User-Agent rule of the web browsing; when it is detected that the request data packet includes encrypted traffic, the application service type of the domain name is identified by using the SNI field and the TLS handshake protocol.

[0023] Specifically, when a user accesses the external network, the router uses the deep packet detection technology to detect the application service type and record the IP address of the user.

[0024] S102: Intercept the access of the unauthenticated user terminal and redirect to the authentication page provided by the portal server.

[0025] The router requires user authentication and redirects to the portal server authentication page. 3. The user enters the username and password on the web page provided by the portal server to authenticate.

[0026] S103: Forward the authentication information submitted by the user terminal on the authentication page to the LDAP server for verification to obtain the permission group information of the user terminal.

[0027] In an exemplary embodiment, the permission group information supports a multi-level nested structure, including an administrator group, a general user group, and a temporary visitor group, and different groups correspond to different business type access white lists.

[0028] When the router receives the user authentication request, the policy control module queries the user information from the LDAP server, and the LDAP server receives the request and replies with the permission group information of the user terminal if the authentication is successful.

[0029] S104: Compare the permission group information with multiple different groups to generate a user token and write the user token to the client cookie of the user terminal; the user token includes the binding relationship between the application business type and the IP address.

[0030] Access permissions for multiple application business types are formulated, and the multiple application business types are divided into multiple different groups according to the different access permissions.

[0031] The policy control module formulates the access permissions of each application business type of the system, i.e., divides them into different groups (group); according to the permission group information of the user terminal returned by the LDAP server, the two are compared to generate a user token (UserToken) of the user's access resources. The application business type is associated with the user IP address.

[0032] S105: Based on the binding relationship between the application business type and the IP address in the user token, dynamically authorize the access permission of the user terminal when accessing the Internet subsequently.

[0033] In an exemplary embodiment, based on the binding relationship between the application service type and the IP address in the user token, the access right of the user terminal in subsequent access to the Internet is dynamically authorized, specifically comprising: when the user terminal initiates a new Internet access request, the application service type and the IP address of the current Internet access request are extracted through deep packet detection technology; the application service type and the IP in the new Internet access request are compared with the binding relationship stored in the user token, and when the application service type matches and the IP is consistent, the user terminal is granted the access right of the new Internet access request.

[0034] In an exemplary embodiment, the method further comprises: when it is detected that the application service type in the new Internet access request exceeds the authorized range of the application service type feature library or the IP is not matched, re-redirecting to the authentication page provided by the portal server.

[0035] Specifically, the router issues the UserToken to the client browser cookie, grants the user the ability to access the corresponding resource, and redirects to the URL of the original access resource. When the user accesses different services, the router authorizes the user's access right to the corresponding application service according to the relationship between the access user IP and the UserToken established in the authentication process.

[0036] In an exemplary embodiment, the present application provides a user access right control diagram as shown in Figure 2 , as shown in Figure 2 , as shown in Figure 2 , wherein 1, 2, 3, 4, 5, 6, 7, and 8 are steps.

[0037] 1. The user accesses the external network, and the router uses the deep packet detection technology to detect the application service type and records the user IP address.

[0038] 2. The router requires user authentication and redirects to the authentication page of the portal server.

[0039] 3. The user inputs the username and password on the web page provided by the portal server to perform authentication.

[0040] 4. The router receives the user authentication request, and the policy control module (router policy) queries the user information from the LDAP server.

[0041] 5. The LDAP server receives the request, and if the authentication is passed, the user group information is replied.

[0042] 6、router policy module formulates the access right of each application service type (service) of the system, that is, divides into different groups; according to the user group information returned by the LDAP server, the two are compared, and the ability of the user to access resources UserToken is generated, and the service is associated with the user IP address.

[0043] 7、router issues UserToken to the client browser cookie, grants the user the corresponding access resource ability, and redirects to the original access resource URL.

[0044] 8、The user accesses different services, and the router authorizes the user to access the access right of the corresponding application service according to the relationship between the access user IP and the UserToken established in the authentication process.

[0045] The application considers that all application service traffic is not trusted, and takes security measures for all application services, and strictly limits the access rights of different users by using the minimum authorization strategy.

[0046] The application reduces the continuous dynamic security access control technology of the security risk of the access process, all data sources and computing services are considered as resources, the authorization of single resource access is the authorization of each connection, the access to the resource is determined by the strategy, and the user identity authentication is dynamic and is forced to be executed before allowing access.

[0047] When the application service access control method based on the user equipment provided by the application is applied, the IP address of the user terminal can not be recorded according to the application service type of the user terminal. Figure 1 The order of each step shown in the figure can be executed according to the needs, and the application does not limit the execution order of each step.

[0048] The above is the application service access control method based on the user equipment provided by one or more embodiments of the application, based on the same idea, the application also provides a corresponding application service access control device based on the user equipment, as shown in Figure 3 .

[0049] Figure 3 A kind of application service access control device based on user equipment provided by the application is shown in the schematic diagram, comprising: The identification module 301 is used to identify the application service type when the user terminal accesses the Internet by the packet deep detection technology of the router, and record the IP address of the user terminal.

[0050] The redirection module 302 is used to intercept the access of the unauthenticated user terminal, and is redirected to the authentication page provided by the portal server.

[0051] The acquisition module 303 is used to forward the authentication information submitted by the user terminal on the authentication page to the LDAP server for verification in order to obtain the user terminal's permission group information.

[0052] The generation module 304 is used to compare the permission group information with multiple different groups, generate a user token, and write the user token into the client cookie of the user terminal; the user token includes the binding relationship between the application service type and the IP address.

[0053] The authorization module 305 is used to dynamically authorize the user terminal's access permissions when accessing the Internet in the future, based on the binding relationship between the application service type and IP address in the user token.

[0054] Specific limitations regarding the application service access control device based on user equipment can be found in the limitations of the application service access control method based on user equipment mentioned above, and will not be repeated here. Each module in the aforementioned application service access control device based on user equipment can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0055] The present invention also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figure 1 The provided method for application service access control based on user equipment.

[0056] The present invention also provides Figure 4 The schematic diagram of the computer device shown is as follows: Figure 4 As shown, at the hardware level, this computer device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then executes it to achieve the above. Figure 1 The provided method for application service access control based on user equipment.

[0057] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiments of the methods. In the embodiments of the present application, any reference to memory, storage, database or other medium can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0058] The technical features of the above embodiments can be combined in any way. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, but as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

Claims

1. A method for controlling access to application services based on user equipment, characterized by, The method comprises: identifying the application service type when the user terminal accesses the Internet through the packet deep detection technology of the router, and recording the IP address of the user terminal; intercepting the access of the unauthenticated user terminal, and redirecting to the authentication page provided by the portal server; forwarding the authentication information submitted by the user terminal on the authentication page to the LDAP server for verification to obtain the permission group information of the user terminal; comparing the permission group information with a plurality of different groups to generate a user token, and writing the user token into the client cookie of the user terminal; the user token comprises a binding relationship between the application service type and the IP address; based on the binding relationship between the application service type and the IP address in the user token, dynamically authorizing the access permission of the user terminal when subsequently accessing the Internet.

2. The method of claim 1, wherein, The method for identifying the application service type when the user terminal accesses the Internet through the packet deep detection technology of the router specifically comprises: listening to the request packet sent by the user terminal when accessing the Internet; parsing the content in the request packet, and matching the preset application service type feature library according to the parsing result; the application service type feature library comprises the MIME type identifier of the video stream media, the extension name feature of the file download, and the User-Agent rule of the web browsing; when detecting that the request packet comprises encrypted traffic, identifying the application service type of the domain name belonging through the SNI field and the TLS handshake protocol.

3. The method of claim 1, wherein, The permission group information supports a multi-level nested structure, comprising an administrator group, a general user group, and a temporary visitor group, and different groups correspond to different business type access white lists.

4. The method of claim 1, wherein, The method for dynamically authorizing the access permission of the user terminal when subsequently accessing the Internet based on the binding relationship between the application service type and the IP address in the user token specifically comprises: when the user terminal initiates a new Internet access request, extracting the application service type and the IP address of the current Internet access request through the deep packet detection technology; comparing the application service type and the IP in the new Internet access request with the binding relationship stored in the user token, and granting the user terminal the access permission of the new Internet access request when the application service type matches and the IP is consistent.

5. The method of claim 4, wherein, The method further comprises: when detecting that the application service type in the new Internet access request exceeds the authorized range of the application service type feature library or the IP does not match, redirecting to the authentication page provided by the portal server again.

6. An apparatus for controlling access to application services based on user equipment, characterized by The device comprises: an identification module configured to identify the application service type when the user terminal accesses the Internet through the packet deep detection technology of the router, and record the IP address of the user terminal; a redirection module configured to intercept the access of the unauthenticated user terminal, and redirect to the authentication page provided by the portal server; an acquisition module configured to forward the authentication information submitted by the user terminal on the authentication page to the LDAP server for verification to obtain the permission group information of the user terminal; The generating module is configured to compare the permission group information with a plurality of different groups, generate a user token, and write the user token into a client cookie of the user terminal; The user token comprises a binding relationship between an application service type and an IP address. The authorization module is configured to dynamically authorize access permission of the user terminal when the user terminal accesses the Internet based on the binding relationship between the application service type and the IP address in the user token.

7. A computer readable storage medium characterized in that, The storage medium stores a computer program, and the computer program is executed by the processor to implement the method in any one of claims 1-5.

8. A computer device, comprising: The computer program is stored in the memory and executable on the processor, and the processor implements the method in any one of claims 1-5 when executing the program.

Images