A physical isolation gateway-based identity authentication method and related device

Abstract

This application relates to an identity authentication method and related equipment based on a physically isolated gateway. The method is applied to a physically isolated gateway system comprising a user management subsystem, an identity authentication subsystem, and an access control subsystem deployed on different servers. The method includes: verifying the user's identity using the identity authentication subsystem; generating a gateway token and sending it to the client upon successful authentication; verifying the validity of the gateway token based on an access request sent by the client, including the gateway token; determining user permissions upon successful validity verification; and establishing a secure tunnel based on user permissions through the access control subsystem; receiving business requests sent by the client via the secure tunnel through the access control subsystem, forwarding the business requests to the corresponding business system, and sending the response information from the business system back to the client via the secure tunnel. This method improves network security and reliability.

Description

Technical Field

[0001] This application relates to the field of gateway authentication technology, and in particular to an identity authentication method and related equipment based on a physically isolated gateway. Background Technology

[0002] Identity authentication gateways play a crucial role in the field of network security. Their main function is to verify the identity of users and authorize them to access specific network resources (such as business systems), thereby ensuring the security and reliability of the network.

[0003] In related technologies, identity authentication gateways typically centralize user management, authentication, and permission enforcement on a single gateway device. While this centralized architecture simplifies system design, it introduces a serious security vulnerability due to a single point of failure. Since the gateway device must be exposed to provide services, it inevitably becomes a prime target for attackers. Once the gateway device is compromised, attackers can not only obtain sensitive user information (such as usernames, passwords, and permission levels), but also potentially tamper with authentication logic or permission configurations, leading to the collapse of the entire network's security defenses and causing significant losses.

[0004] There is currently no effective solution to the aforementioned problems in the relevant technologies. Summary of the Invention

[0005] The present invention provides an identity authentication method and related equipment based on a physical isolation gateway, which at least solves the problem that centralized identity authentication gateway systems in related technologies have significant security vulnerabilities, resulting in poor network security and reliability.

[0006] To address the aforementioned problems, one aspect of this invention provides an identity authentication method based on a physically isolated gateway, applied to a physically isolated gateway system. The physically isolated gateway system includes a user management subsystem, an identity authentication subsystem, and an access control subsystem, each deployed on different servers. The servers corresponding to the subsystems are physically isolated from each other but connected via a network. The method includes:

[0007] The identity authentication subsystem verifies the user's identity based on the authentication request sent by the client, and generates a gateway token and sends it to the client if the identity verification is successful.

[0008] The identity authentication subsystem verifies the validity of the gateway token based on the access request sent by the client, which includes the gateway token. If the validity verification is successful, the user's permissions are determined based on the identity authentication subsystem and the user management subsystem. The access control subsystem then establishes a secure tunnel between the client and the access control subsystem based on the user's permissions.

[0009] The access control subsystem receives business requests sent by clients via a secure tunnel, forwards the business requests to the corresponding business systems, and sends the response information from the business systems back to the clients via the secure tunnel.

[0010] In some embodiments, the method further includes:

[0011] In response to the authentication request sent by the client, the access control subsystem forwards the authentication request to the identity authentication subsystem. The identity authentication subsystem verifies the user's identity based on the authentication request. If the identity verification is successful, a gateway token is generated and sent to the client via the access control subsystem. The gateway token includes the user's identity, the number of uses, and the usage time limit.

[0012] In response to an access request sent by the client, which includes a gateway token, the access control subsystem forwards the authentication request to the identity authentication subsystem. The identity authentication subsystem verifies the validity of the gateway token. If the validity verification is successful, the identity authentication subsystem obtains the user permissions corresponding to the access request from the user management subsystem. Based on the user permissions, the access control subsystem establishes a secure tunnel between the client and the access control subsystem.

[0013] The access control subsystem receives business requests sent by clients via a secure tunnel, forwards the business requests to the corresponding business systems, and sends the response information from the business systems back to the clients via the secure tunnel.

[0014] In some embodiments, the method further includes:

[0015] In response to client startup, the system determines the network security level of the client and identifies an authentication scheme for the client based on the network security level. The authentication scheme includes one or more of the following: username and password authentication, smart card authentication, biometric authentication, virtual smart card authentication, and authentication based on user behavior characteristics analysis.

[0016] In some embodiments, the method further includes:

[0017] In response to client startup, the system dials the gateway address of the internal network based on the ICMP protocol.

[0018] If the connection is successful, it indicates that the client is in an intranet office scenario, and the client's authentication scheme is determined to be the username and password authentication scheme.

[0019] If the connection fails, it indicates that the client is in an external office environment, confirming that the client's authentication scheme is a smart card authentication scheme.

[0020] In some embodiments, the authentication steps corresponding to the username / password authentication scheme include:

[0021] After receiving the authentication request sent by the client, the identity authentication subsystem generates a first random number and sends the first random number to the client, so that the client returns the username and the first ciphertext to the identity authentication subsystem through the access control subsystem; wherein, the first ciphertext is obtained by the client processing the first random number and the user password using a first encryption algorithm;

[0022] The identity authentication subsystem retrieves the user password from the user management subsystem based on the received username, processes the first random number and the user password using the first encryption algorithm to obtain the second ciphertext, and verifies whether the second ciphertext is consistent with the received first ciphertext. If they are consistent, the identity authentication is successful.

[0023] The authentication methods corresponding to smart card authentication schemes include:

[0024] After receiving the authentication request from the client, the identity authentication subsystem obtains a second random number from the signature verification server, records the event number, encrypts the second random number using the server's private key to obtain a third ciphertext, and sends it to the client. This enables the client to return a signature certificate, including a fourth ciphertext and the signature public key, to the identity authentication subsystem. The fourth ciphertext is obtained by the client decrypting the third ciphertext using the server's public key to obtain the second random number, and then encrypting the second random number using the signature private key in the smart card.

[0025] The identity authentication subsystem obtains a second random number from the signature verification server based on the event number, decrypts the fourth ciphertext based on the signature public key in the signature certificate to obtain a third random number, and verifies whether the third random number is consistent with the second random number. If they are consistent, the identity verification is successful.

[0026] If the identity verification is successful, the signature certificate is parsed by the identity authentication subsystem to obtain the certificate serial number, and the user identity is obtained from the user management subsystem based on the certificate serial number.

[0027] In some embodiments, the server deploying any subsystem is a cluster server, which includes a master server and at least one backup server; the server also deploys an intrusion detection system and / or an intrusion prevention system; the method further includes:

[0028] When the intrusion detection system and / or intrusion prevention system detects that the main server is exposed to a risk, the target subsystem running on the main server will be switched to run on a backup server in the cluster.

[0029] In some embodiments, the method further includes:

[0030] The access control subsystem receives encrypted service requests sent by clients through a secure tunnel, decrypts the encrypted service requests to obtain plaintext service requests, sends the plaintext service requests to the business system, and receives the returned response information.

[0031] The response information is encrypted to obtain encrypted response information, which is then sent to the client via a secure tunnel.

[0032] To address the aforementioned problems, one aspect of this invention provides a physically isolated gateway system, comprising a user management subsystem, an identity authentication subsystem, and an access control subsystem deployed on different servers. The servers corresponding to the subsystems are physically isolated from each other but connected via a network.

[0033] The identity authentication subsystem is used to verify the user's identity based on the authentication request sent by the client, generate a gateway token and send it to the client if the identity verification is successful; and verify the validity of the gateway token based on the access request sent by the client that includes the gateway token.

[0034] The user management subsystem is used to confirm user permissions in response to requests from the identity authentication subsystem.

[0035] The access control subsystem is used to verify the validity of the gateway token. If the validity verification is successful, the access control subsystem establishes a secure tunnel between the client and the access control subsystem according to the user's permissions. The business requests sent by the client through the secure tunnel are then sent to the business system, and the response information from the business system is sent back to the client through the secure tunnel.

[0036] To address the aforementioned problems, one aspect of this invention provides an electronic device, including: a processor and a memory storing a program, the program including instructions that, when executed by the processor, cause the processor to perform any of the aforementioned authentication methods based on a physically isolated gateway.

[0037] To address the aforementioned problems, one aspect of this invention provides a non-transitory machine-readable medium storing computer instructions for causing a computer to execute any of the aforementioned authentication methods based on a physically isolated gateway.

[0038] The beneficial effects of this invention are as follows: By employing an identity authentication subsystem to verify the user's identity based on the authentication request sent by the client, a gateway token is generated and sent to the client upon successful authentication; the identity authentication subsystem verifies the validity of the gateway token based on the access request sent by the client, including the gateway token; if the validity verification is successful, user permissions are determined based on the identity authentication subsystem and the user management subsystem, and a secure tunnel is established between the client and the access control subsystem based on the user permissions; the access control subsystem receives business requests sent by the client through the secure tunnel, sends the business requests to the corresponding business system, and sends the response information from the business system back to the client through the secure tunnel. This application overcomes the significant security vulnerabilities and poor network security and reliability issues inherent in centralized identity authentication gateway systems in related technologies. It utilizes a physically isolated gateway system, comprising a user management subsystem, an identity authentication subsystem, and an access control subsystem deployed on different servers. These subsystems are physically isolated from each other but connected via a network. This separates user management, identity authentication, and access control onto different, physically isolated physical devices, significantly reducing single points of failure and security risks. Furthermore, by leveraging the cooperation between these subsystems deployed on different physical devices, identity authentication operations are performed before users access business systems, thereby improving network security and reliability.

[0039] Details of one or more embodiments of the present invention are set forth in the following drawings and description, so that other features, objects and advantages of the invention will be more readily understood. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings without creative effort.

[0041] Figure 1 This is a schematic diagram of the main process of an identity authentication method based on a physical isolation gateway, which is one embodiment of the present invention.

[0042] Figure 2 This is a schematic diagram of the main process of a username and password authentication scheme in one embodiment of the present invention.

[0043] Figure 3 This is a schematic diagram of the main process of a smart card authentication scheme in one embodiment of the present invention.

[0044] Figure 4 This is a schematic diagram of the main process of initiating an access request carrying a gateway token, according to one embodiment of the present invention.

[0045] Figure 5 This is a schematic diagram of the main framework of a physical isolation gateway system according to one embodiment of the present invention.

[0046] Figure 6 This is a schematic diagram of the electronic device of the present invention. Detailed Implementation

[0047] Embodiments of the present invention will now be described in more detail with reference to the accompanying drawings. While some embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the invention. It should be understood that the accompanying drawings and embodiments are for illustrative purposes only and are not intended to limit the scope of protection of the invention.

[0048] Identity authentication gateways in related technologies typically centralize user management, authentication, and permission enforcement on a single gateway device. While this centralized architecture simplifies system design, it also introduces serious security vulnerabilities, such as:

[0049] (1) Since gateway devices must be exposed to the outside world to provide services, they become the primary target of attackers. Once a gateway device is compromised, attackers can not only obtain sensitive user information (such as username, password, permission level, etc.), but may also tamper with authentication logic or permission configuration, thereby causing the entire network's security defenses to collapse;

[0050] (2) If a single point of failure occurs in the gateway device (such as a denial of service caused by hardware failure, software vulnerability or network attack), the entire identity authentication system will not be able to work properly, thereby affecting the normal access of all users and causing business interruption;

[0051] (3) The identity authentication grid in related technologies is usually coarse in terms of permission execution, and cannot achieve fine-grained monitoring and control of user behavior, making it difficult for the system to cope with complex network attacks;

[0052] (4) The authentication mechanism or encryption strategy is relatively fixed. In a network environment where user access needs and network threats are constantly changing, the identity authentication gateway in the relevant technology lacks the ability to adapt to the dynamic network environment and cannot dynamically adjust the security strategy according to the real-time network status and user behavior, thus leading to security vulnerabilities.

[0053] To address the aforementioned problems, this invention provides an identity authentication method based on a physically isolated gateway, applied to a physically isolated gateway system. The physically isolated gateway system includes a user management subsystem, an identity authentication subsystem, and an access control subsystem, each deployed on different servers. The servers corresponding to these subsystems are physically isolated from each other but connected via a network. Figure 1 As shown, this authentication method based on a physically isolated gateway mainly includes:

[0054] Step S101: The identity authentication subsystem verifies the user's identity based on the authentication request sent by the client, and generates a gateway token and sends it to the client if the identity verification is successful.

[0055] Step S102: The identity authentication subsystem verifies the validity of the gateway token based on the access request sent by the client, which includes the gateway token. If the validity verification is successful, the user permissions are determined based on the identity authentication subsystem and the user management subsystem, and a secure tunnel is established between the client and the access control subsystem based on the user permissions through the access control subsystem.

[0056] Step S103: The access control subsystem receives the business request sent by the client through the secure tunnel, sends the business request to the corresponding business system, and sends the response information from the business system back to the client through the secure tunnel.

[0057] Based on the above settings, the gateway system with a physically isolated architecture reduces the risk of single point of failure. The servers deploying subsystems maintain necessary collaboration between the subsystems through network connections. Through the physical isolation architecture and the step-by-step authentication / verification process, security risks are reduced (an attacker would need to compromise multiple physically isolated devices simultaneously to cause the entire gateway system's security defenses to collapse), and the accuracy of identity authentication is improved, thereby achieving the technical effect of improving network security and reliability.

[0058] Specifically, the aforementioned physically isolated gateway system includes a user management subsystem (i.e., the business layer, mainly used for storing and managing user accounts and passwords), an identity authentication subsystem (i.e., the control layer, mainly used for executing identity authentication logic, managing random numbers, and generating and verifying gateway tokens), and an access control subsystem (i.e., the traffic layer, mainly used for proxying and forwarding network traffic and establishing secure tunnels; this subsystem does not store sensitive user information, perform user authentication, or make final access decisions). Based on this physically isolated gateway system, this application distributes core functions across different independent servers, eliminating the risk of single points of failure. That is, a failure in a single subsystem (such as an attack on the identity authentication subsystem) will not affect other subsystems (such as the user management subsystem). Furthermore, it is understood that each subsystem can be upgraded or maintained independently, improving system reliability and maintainability.

[0059] For example, the identity authentication subsystem generates a gateway token (containing expiration information, i.e., it is a temporary credential rather than a persistent credential) after verifying the user's identity, but does not directly process business access. This ensures that the identity authentication process is independent of subsequent operations, realizes isolated authentication and access control, and improves the security of the gateway system.

[0060] Furthermore, the access control subsystem only receives verified tokens and permission data, and does not participate in the authentication logic. Physical isolation ensures that it cannot be used to tamper with authentication results, and user permissions are determined before business access is executed, enabling fine-grained access policies. The establishment of a secure tunnel needs to be combined with user permissions, so that the established secure tunnel audits the permission traffic when executing business access data transmission. At the same time, the secure tunnel can also encrypt data transmission to prevent man-in-the-middle attacks.

[0061] Meanwhile, business systems can be decoupled from clients and instead use an access control subsystem as a proxy to filter unauthorized requests. This is combined with a secure tunnel to ensure end-to-end encryption of requests and responses, thus protecting data integrity.

[0062] In some embodiments, the method further includes: responding to an authentication request sent by a client, forwarding the authentication request to an identity authentication subsystem based on the access control subsystem, verifying the user's identity based on the authentication request through the identity authentication subsystem, generating a gateway token if the identity verification is successful, and sending the gateway token to the client through the access control subsystem; wherein, the gateway token includes the user's identity, the number of uses, and the usage time limit; responding to an access request sent by a client including the gateway token, forwarding the authentication request to the identity authentication subsystem based on the access control subsystem, verifying the validity of the gateway token through the identity authentication subsystem, obtaining the user permissions corresponding to the access request from the user management subsystem if the validity verification is successful, establishing a secure tunnel between the client and the access control subsystem based on the user permissions through the access control subsystem; receiving a business request sent by the client through the secure tunnel through the access control subsystem, sending the business request to the corresponding business system, and sending the response information from the business system back to the client through the secure tunnel.

[0063] Based on the above settings, on the one hand, the identity authentication subsystem, which contains sensitive user information, only communicates with the access control subsystem and is not directly exposed to the public network. This prevents attackers from directly scanning or attacking the identity authentication subsystem's interface, significantly reducing the attack surface. Simultaneously, all inbound and outbound traffic must pass through the access control subsystem, making it the only external exposure point of the gateway system. Other physically isolated subsystems can be hidden within the internal network. Combined with the gateway token mechanism, the access control subsystem can form a dual protection of "proxy gatekeeper + token verification." On the other hand, the usage limit setting for the gateway token prevents attackers from intercepting and infinitely reusing it. The usage time limit setting allows for dynamic control of the session lifecycle based on different scenarios (e.g., short-term, highly sensitive operations (such as payments) can be set with a small number of uses and a short time limit; long-term session operations (such as meetings) can be set with a large number of uses and a long time limit), and the usage time limit and usage count also constitute dual time-sensitive control. Furthermore, the gateway token includes the user's identity, so the access control subsystem only needs to parse the user's identity to route requests, reducing the risk of gateway token leakage.

[0064] According to another embodiment of the present invention, the secure tunnel can also be created only when a user initiates an access request and automatically destroyed after an idle timeout. This avoids long-term open ports and reduces the network exposure surface. When faced with permission changes (the user management subsystem provides the latest permission data, such as an administrator revoking user permissions), the control takes effect immediately upon the next access, avoiding unauthorized access due to permission caching. By binding the secure tunnel to user permissions, the permission control subsystem only proxies business requests within the scope of the user's permissions (e.g., if only access to system A is allowed, the tunnel refuses to forward requests to system B), avoiding unauthorized access. Accordingly, the authentication scheme provided in this application does not rely on other extended technologies (such as dynamic authentication schemes), and can significantly improve network security simply through process optimization (such as the timing of secure tunnel creation and timeout destruction; immediate effect of permission changes) and field expansion (such as adjusting the number of times and time limit for gateway token use).

[0065] In some embodiments, the method further includes: in response to the client's initiation, determining the network security level of the client, and determining an authentication scheme for the client based on the network security level; wherein the authentication scheme includes one or more of the following: username and password authentication scheme, smart card authentication scheme, biometric authentication scheme, virtual smart card authentication scheme, and authentication scheme based on user behavior feature analysis.

[0066] By assessing the network environment risk level in real time when the client starts up, and then determining the authentication scheme based on the network environment risk level, an environment-aware security policy is implemented. The authentication strength can be dynamically adjusted according to the actual risk of the network where the client is located, breaking through the limitations of the fixed authentication mode of traditional gateways and realizing proactive defense against threats caused by changes in the network environment: such as downgrading to low-strength authentication in the internal office environment (while taking efficiency into account), and upgrading to high-strength authentication in the external network or high-risk network (to ensure security).

[0067] The determination of an identity authentication scheme can be based on two factors: firstly, the user's network security requirements; and secondly, security and user experience. For example, lightweight authentication (such as username / password-based authentication) can be used in low-risk scenarios to reduce the user's workload; while strong authentication (such as smart card and / or biometric authentication) can be used in high-risk scenarios to provide high security. Understandably, by deploying multiple identity authentication schemes, attackers cannot predict which authentication scheme the target client will trigger, increasing the cost of attacks (requiring the preparation of multiple attack methods simultaneously) and expanding the defense depth of the gateway system.

[0068] In the aforementioned authentication scheme based on user behavior characteristics analysis, artificial intelligence and machine learning technologies can be introduced to perform real-time analysis and prediction of user behavior, thereby further enhancing the security and adaptability of the gateway system.

[0069] Furthermore, risk mitigation measures can be implemented on the client side: such as adding user behavior analysis functions to monitor in real time whether user operations are within their authorized scope, preventing abuse of permissions. Regular audits of user permissions can also be conducted to ensure the rationality of permission allocation.

[0070] In some embodiments, the method further includes: responding to the client's startup by dialing the gateway address of the intranet based on the ICMP protocol; if the connection is successful, it indicates that the client is in an intranet office scenario, and the client's authentication scheme is determined to be a username and password authentication scheme; if the connection fails, it indicates that the client is in an extranet office scenario, and the client's authentication scheme is determined to be a smart card authentication scheme.

[0071] ICMP (Internet Control Message Protocol) is a fundamental network layer protocol that can penetrate most firewalls (it is more reliable than application layer protocols). The gateway address of an internal network is typically the entry point to the enterprise network (such as a router), and its reachability directly reflects whether a client is located in a protected internal network environment.

[0072] This application provides a specific implementation method for assessing the network security level of a client's network environment and determining an authentication scheme based on the above embodiments. This specific implementation method does not require pre-setting client network information (such as IP segment whitelists); it can accurately distinguish network boundaries through active detection, thereby achieving scenario classification and authentication scheme determination. Specifically, if the client successfully establishes ICMP connectivity with the enterprise's intranet gateway (e.g., direct LAN connection / VPN (Virtual Private Network) tunnel connection), it is determined that the current client is in an intranet office scenario; if the client cannot directly reach the intranet gateway, it is determined that the current client is in an external network office scenario.

[0073] Given that intranet office scenarios are low-risk (internal networks generally have physical / network isolation protection), efficiency can be a key factor in selecting an authentication scheme. Using lightweight username / password authentication can reduce the burden of security operations. Given that extranet office scenarios are high-risk (facing information theft and man-in-the-middle attacks in the public network environment), enhanced security should be a key factor in selecting an authentication scheme. Sampling smart card authentication (asymmetric encryption) helps prevent information theft and man-in-the-middle attacks in the public network environment.

[0074] In some embodiments, the authentication steps corresponding to the above-mentioned username and password authentication scheme include: after receiving the authentication request sent by the client, the identity authentication subsystem generates a first random number and sends the first random number to the client, so that the client returns the username and the first ciphertext to the identity authentication subsystem through the access control subsystem; wherein, the first ciphertext is obtained by the client processing the first random number and the user password using a first encryption algorithm; the identity authentication subsystem obtains the user password from the user management subsystem according to the received username, processes the first random number and the user password using the first encryption algorithm to obtain a second ciphertext, and verifies whether the second ciphertext is consistent with the received first ciphertext. If they are consistent, the authentication is successful.

[0075] In this embodiment, the first random number provided is essentially a dynamic salt value, which is combined with the user password for encryption, ensuring that: the ciphertext generated for each login by the same user is different; and the ciphertext is also different when different users use the same password.

[0076] Based on the above settings, in the username and password authentication scheme provided in this application, the dynamic generation characteristic of the first random number makes the first ciphertext generated each time different, so that even if the first ciphertext is intercepted, it cannot be reused; the first random number expands the input space, so that the attack method of cracking the password through the pre-calculation scheme is ineffective; at the same time, the client sends ciphertext (which in turn depends on the dynamically generated random number) to the identity authentication subsystem instead of directly sending the password, thus avoiding man-in-the-middle eavesdropping.

[0077] Meanwhile, based on the above embodiments, the client only transmits the encrypted result (i.e., the first ciphertext), and the username and password are always stored in the client device. Even if an attacker cracks the first encryption algorithm, they still need to obtain both the random number and the password to forge the first ciphertext. Finally, the identity authentication subsystem verifies the user's password by matching the ciphertext, without storing or transmitting the plaintext password, thus achieving zero-knowledge verification and greatly improving the security of the identity authentication process.

[0078] Figure 2 This diagram illustrates the main process of a username-password authentication scheme according to one embodiment of the present invention. Figure 2As shown: The client sends an authentication request to the authentication port 7000 of the traffic layer (i.e., the access control subsystem). The traffic layer forwards the authentication request to the control layer (i.e., the authentication subsystem). After receiving the authentication request, the authentication subsystem generates a first random number R1 and sends it to the client via the traffic layer. The client uses a first encryption algorithm to encrypt the first random number R1 and the user password P to obtain the first ciphertext H1, i.e., H1 = SM3 - HMAC(P + R1). Then, the client returns the username and the first ciphertext H1 to the authentication subsystem via the access control subsystem. The authentication subsystem retrieves the user password P from the user management subsystem based on the received username, processes the first random number R1 and the user password P using the first encryption algorithm to obtain the second ciphertext H2, i.e., H2 = SM3 - HMAC(P + R1), and verifies whether the second ciphertext H2 is consistent with the received first ciphertext H1. If they are consistent, the authentication is successful, a gateway token is generated, and returned to the client; if they are inconsistent, the authentication fails, and an authentication failure is reported.

[0079] In some embodiments, the identity verification corresponding to the smart card authentication scheme includes: after receiving the authentication request sent by the client, the identity authentication subsystem obtains a second random number from the signature verification server, records the event number, encrypts the second random number using the server's private key to obtain a third ciphertext, and sends it to the client, so that: the client returns a signature certificate including a fourth ciphertext and a signature public key to the identity authentication subsystem; wherein, the fourth ciphertext is obtained by the client decrypting the third ciphertext using the server's public key to obtain the second random number, and then encrypting the second random number using the signature private key in the smart card; the identity authentication subsystem obtains the second random number from the signature verification server based on the event number, decrypts the fourth ciphertext based on the signature public key in the signature certificate to obtain the third random number, and verifies whether the third random number is consistent with the second random number. If they are consistent, the identity verification is successful; if the identity verification is successful, the identity authentication subsystem parses the signature certificate to obtain the certificate serial number, and obtains the user identity from the user management subsystem based on the certificate serial number.

[0080] In the smart card authentication scheme provided in this application, the client uses the server's public key to decrypt and obtain a second random number (only the private key held by the real server can generate a valid second random number), thus enabling the client to verify the identity authentication subsystem and avoiding phishing attacks by fake servers. Then, the client uses the smart card's private key to encrypt the second random number to obtain a fourth ciphertext, making the fourth ciphertext unpredictable and unreplayable. Based on the above settings, a two-way encrypted tunnel is established to prevent tampering. Since attackers cannot simultaneously forge both the server (requiring the server's private key) and the client (requiring the smart card's private key), the security threat of man-in-the-middle attacks is effectively reduced.

[0081] Meanwhile, the identity authentication subsystem only operates on the encrypted result—the third ciphertext—without needing to access the server's private key. The server's private key is managed in isolation by the signature verification server, avoiding the risk of its exposure. Furthermore, by recording a timestamp, the generated second random number is ensured to be bound to the current session, thus preventing replay attacks. Finally, using the certificate serial number as the user's identifier avoids the risk of username forgery.

[0082] Figure 3 This is a schematic diagram of the main process of a smart card authentication scheme according to one embodiment of the present invention. Figure 3 As shown: The client sends an authentication request to the authentication port 7000 of the traffic layer (i.e., the access control subsystem). The traffic layer forwards the authentication request to the control layer (i.e., the authentication subsystem). After receiving the authentication request, the authentication subsystem requests a second random number R2 from the signature verification server, records the event ID, and then encrypts the second random number R2 using the server's private key to obtain a third ciphertext H3, which is then sent to the client. The client decrypts the third ciphertext H3 using the server's public key to obtain the second random number R2, and then encrypts the second random number R2 again using the signature private key in the smart card to obtain a fourth ciphertext H4. The client then sends the fourth ciphertext H4 to the client. 4. The signing certificate, along with the signing public key, is sent to the identity authentication subsystem via the traffic layer. The identity authentication subsystem obtains the second random number R2 from the signature verification server based on the event ID, and decrypts the fourth ciphertext H4 based on the signing public key in the signing certificate to obtain the third random number R2'. It then verifies whether the third random number R2' matches the second random number R2. If they match, the authentication is successful. If the authentication is successful, the identity authentication subsystem parses the signing certificate to obtain the certificate serial number, and obtains the user's identity from the user management subsystem based on the certificate serial number. Finally, it generates a gateway token and sends it to the client via the traffic layer. If they do not match, the authentication fails.

[0083] In some embodiments, the server on which any subsystem is deployed is a cluster server, which includes a master server and at least one backup server; an intrusion detection system and / or an intrusion prevention system are also deployed on the server; the method further includes: when the intrusion detection system and / or the intrusion prevention system detects that the master server is exposed to risk, switching the target subsystem running on the master server to run on the backup server in the cluster server.

[0084] Based on the above embodiments, this application adds a clustered architecture and an intrusion detection linkage switching mechanism at the subsystem deployment level. That is, the subsystem is deployed on a cluster server (main server + backup server), and an intrusion detection system and / or intrusion prevention system is deployed in each server. When the intrusion detection system and / or intrusion prevention system detects that the main server has an exposure risk, the target subsystem is automatically switched to the backup server to run.

[0085] The clustered architecture enables the current node server to switch to the backup node server within seconds when a single point of failure causes the service to stop. The clustered architecture also allows for horizontal scaling of nodes, which can not only break through the performance limit of a single machine, but also achieve load balancing. At the same time, when a node server needs to be upgraded or maintained, other node servers can run the subsystem, ensuring the continuity of business operations.

[0086] In some embodiments, the method further includes: the access control subsystem receiving an encrypted service request sent by the client via a secure tunnel, decrypting the encrypted service request to obtain a plaintext service request, sending the plaintext service request to the service system and receiving the returned response information; encrypting the response information to obtain encrypted response information, and sending the encrypted response information to the client via a secure tunnel.

[0087] Based on the above setup, business requests from the client are transmitted in encrypted form to the access control subsystem within a secure tunnel. Responses from the business system are encrypted by the access control subsystem and then returned to the client via the tunnel. By encrypting both business requests and responses throughout the entire process, even if an attacker intercepts the tunnel traffic, they cannot decrypt the business data (requiring the access control subsystem's key). For the business system, there is no need to deploy an encryption module; it only needs to process plaintext data, reducing the risk of attacks. For the client, only basic tunnel encryption needs to be implemented; complex business data encryption is handled by the access control subsystem, alleviating the client's security implementation burden.

[0088] In some of these embodiments, the access control subsystem can dynamically select encryption algorithms based on business type or data sensitivity; encryption keys can also be rotated by session to avoid long-term key leakage leading to the decryption of historical data.

[0089] Understandably, the above setup also creates a double security boundary: the outer layer is the encryption of the secure tunnel itself, and the inner layer is the encryption of the business data. Even if an attacker breaks through the tunnel, they will still obtain encrypted data.

[0090] Furthermore, based on the above settings, even if an attacker eavesdrops on the communication between the business system and the gateway, they will only see the decrypted plaintext request and will not be able to know the original encryption structure and key. This is more secure than simple end-to-end encryption.

[0091] Figure 4 This is a schematic diagram illustrating the main process of initiating an access request carrying a gateway token, according to one embodiment of the present invention. Figure 4As shown: The client sends an access request carrying a gateway token to access port 8000 of the traffic layer (i.e., the access control subsystem). The traffic layer forwards this access request to the control layer (i.e., the authentication subsystem). Upon receiving the access request, the authentication subsystem verifies the validity of the gateway token within the request. If the verification passes, it queries the user management subsystem for user permissions and sends the user permissions to the access control subsystem. The access control subsystem establishes a secure tunnel based on the user permissions. After the secure tunnel is established, the client sends an encrypted service request through the secure tunnel. The access control subsystem decrypts the encrypted service request, sends the plaintext request to the service system, and receives the response information returned by the service system. The access control subsystem encrypts the response information before returning it to the client. If the gateway token validity verification fails, the access control subsystem directly sends an access denial message to the client.

[0092] The identity authentication method based on a physically isolated gateway provided in this embodiment of the invention is applied to a physically isolated gateway system. This system includes a user management subsystem, an identity authentication subsystem, and an access control subsystem deployed on different servers. The servers corresponding to these subsystems are physically isolated but connected via a network. The identity authentication subsystem verifies the user's identity based on an authentication request sent by the client. If the authentication is successful, a gateway token is generated and sent to the client. The identity authentication subsystem verifies the validity of the gateway token based on an access request sent by the client, including the gateway token. If the validity verification is successful, the user's permissions are determined based on the identity authentication subsystem and the user management subsystem. A secure tunnel is established between the client and the access control subsystem based on the user's permissions. The access control subsystem receives data sent by the client through the secure tunnel. This application overcomes the significant security vulnerabilities and poor network security and reliability issues inherent in centralized identity authentication gateway systems. It utilizes a physically isolated gateway system comprising a user management subsystem, an identity authentication subsystem, and an access control subsystem deployed on different servers. These subsystems are physically isolated from each other but connected via a network. This separates user management, identity authentication, and access control onto different, physically isolated physical devices, significantly reducing single points of failure and security risks. Furthermore, by leveraging the cooperation between these subsystems deployed on different physical devices to perform identity authentication operations before users access the business system, it effectively improves network security and reliability.

[0093] Based on the identity authentication method based on a physical isolation gateway provided in the embodiments of the present invention, the embodiments of the present invention also provide a physical isolation gateway system, such as... Figure 5 As shown, the physical isolation gateway system 500 includes: an identity authentication subsystem 501, a user management subsystem 502, and an access control subsystem 503, each deployed on different servers. The servers corresponding to the subsystems are physically isolated from each other but connected via a network.

[0094] The identity authentication subsystem 501 is used to verify the user's identity based on the authentication request sent by the client, generate a gateway token and send it to the client if the identity verification is successful; and verify the validity of the gateway token based on the access request sent by the client that includes the gateway token.

[0095] User management subsystem 502 is used to confirm user permissions in response to requests from the identity authentication subsystem;

[0096] The access control subsystem 503 is used to verify the validity of the gateway token. If the validity verification is successful, the access control subsystem establishes a secure tunnel between the client and the access control subsystem according to the user's permissions. The business request sent by the client through the secure tunnel is sent to the business system, and the response information returned by the business system is sent back to the client through the secure tunnel.

[0097] Since this application is based on the physical isolation gateway system 500 to implement any of the above-mentioned identity authentication methods based on physical isolation gateways, the execution operations of each subsystem within the gateway system are consistent with those in the aforementioned scheme and can achieve all the beneficial effects corresponding to the aforementioned scheme. This application will not elaborate further here.

[0098] This invention also provides a non-transitory machine-readable medium storing a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to an embodiment of this invention.

[0099] This invention also provides a computer program product, including a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform the methods of embodiments of this invention. The computer program product should be understood as a software product that primarily implements the methods described above through a computer program.

[0100] This invention also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, which, when executed by the at least one processor, causes the electronic device to perform the method of this invention.

[0101] refer to Figure 6 The present invention will now be described in the form of a structural block diagram of an electronic device that can serve as an embodiment of the present invention, which is an example of a hardware device that can be applied to various aspects of the present invention. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0102] like Figure 6 As shown, the electronic device includes a computing unit 601, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. The RAM 603 may also store various programs and data required for the operation of the electronic device. The computing unit 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0103] Multiple components in the electronic device are connected to I / O interface 605, including: input unit 606, output unit 607, storage unit 608, and communication unit 609. Input unit 606 can be any type of device capable of inputting information into the electronic device. Input unit 606 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of the electronic device. Output unit 607 can be any type of device capable of presenting information and may include, but is not limited to, a display, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 608 may include, but is not limited to, disks and optical discs. Communication unit 609 allows the electronic device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks, and may include, but is not limited to, modems, network cards, infrared communication devices, and / or wireless communication transceivers, such as Bluetooth devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0104] The computing unit 601 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, CPUs, graphics processing units (GPUs), various special-purpose artificial intelligence (AI) computing units, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. The computing unit 601 performs the various methods and processes described above. For example, in some embodiments, the method embodiments of the present invention can be implemented as a computer program tangibly contained in a machine-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program can be loaded and / or installed on an electronic device via ROM 602 and / or communication unit 609. In some embodiments, the computing unit 601 can be configured to perform the methods described above by any other suitable means (e.g., by means of firmware).

[0105] Computer programs for implementing the methods of embodiments of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0106] In the context of embodiments of the present invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable signal medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, or infrared systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0107] It should be noted that the term "comprising" and its variations used in the embodiments of the present invention are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The modifications of "one" and "multiple" mentioned in the embodiments of the present invention are illustrative and not restrictive. Those skilled in the art should understand that, unless explicitly indicated otherwise in the context, they should be understood as "one or more".

[0108] The information / data involved in the embodiments of this invention (including but not limited to user device information / data, user personal information / data, information / data used for analysis, stored information / data, displayed information / data, etc.) are all information / data authorized by the user or fully authorized by all parties. The collection, use and processing of relevant information / data must comply with the relevant laws, regulations and standards of relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0109] The steps described in the method embodiments provided by this invention can be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of protection of this invention is not limited in this respect.

[0110] The term "embodiment" in this specification refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of the invention. The appearance of this phrase in various places in the specification does not necessarily imply the same embodiment, nor does it imply independence or alternativeity from other embodiments. The various embodiments in this specification are described in a related manner, with reference to each other for similar or identical parts. In particular, for apparatus, device, and system embodiments, since they are substantially similar to method embodiments, the description is relatively simple, and relevant details are referred to in the description of the method embodiments.

[0111] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the appended claims.

Claims

1. An identity authentication method based on a physically isolated gateway, characterized in that, The method is applied to a physically isolated gateway system, which includes a user management subsystem, an identity authentication subsystem, and an access control subsystem deployed on different servers. The servers corresponding to these subsystems are physically isolated from each other but connected via a network. In response to the client's startup, the system dials the intranet gateway address based on the ICMP protocol. If the connection is successful, it indicates that the client is in an intranet office scenario, and the client's authentication scheme is determined to be a username and password authentication scheme. If the connection fails, it indicates that the client is in an extranet office scenario, and the client's authentication scheme is determined to be a smart card authentication scheme. The identity authentication subsystem verifies the user's identity based on the authentication request sent by the client, and generates a gateway token and sends it to the client if the identity verification is successful. The steps for verifying user identity based on the username and password authentication scheme include: after receiving the authentication request sent by the client, the identity authentication subsystem generates a first random number and sends the first random number to the client, so that the client returns the username and a first ciphertext to the identity authentication subsystem via the access control subsystem; wherein, the first ciphertext is obtained by the client processing the first random number and the user password using a first encryption algorithm; the identity authentication subsystem obtains the user password from the user management subsystem based on the received username, processes the first random number and the user password using the first encryption algorithm to obtain a second ciphertext, and verifies whether the second ciphertext is consistent with the received first ciphertext; if they are consistent, the identity verification is successful. The steps for verifying user identity based on the smart card authentication scheme include: after receiving the authentication request sent by the client, the identity authentication subsystem obtains a second random number from the signature verification server, records the event number, encrypts the second random number using the server's private key to obtain a third ciphertext, and sends it to the client, so that: the client returns a signature certificate including a fourth ciphertext and a signature public key to the identity authentication subsystem; wherein, the fourth ciphertext is obtained by the client decrypting the third ciphertext using the server's public key to obtain the second random number, and then encrypting the second random number using the signature private key in the smart card; the identity authentication subsystem obtains the second random number from the signature verification server based on the event number, decrypts the fourth ciphertext based on the signature public key in the signature certificate to obtain the third random number, and verifies whether the third random number is consistent with the second random number. If they are consistent, the identity verification is successful; if the identity verification is successful, the identity authentication subsystem parses the signature certificate to obtain a certificate serial number, and obtains the user identity from the user management subsystem based on the certificate serial number; The identity authentication subsystem verifies the validity of the gateway token based on the access request sent by the client, which includes the gateway token. If the validity verification is successful, the user permissions are determined based on the identity authentication subsystem and the user management subsystem, and a secure tunnel is established between the client and the permission control subsystem based on the user permissions through the permission control subsystem. The access control subsystem receives the service request sent by the client through the secure tunnel, sends the service request to the corresponding service system, and sends the response information from the service system back to the client through the secure tunnel.

2. The method according to claim 1, characterized in that, The method further includes: In response to an authentication request sent by the client, the access control subsystem forwards the authentication request to the identity authentication subsystem. The identity authentication subsystem verifies the user's identity based on the authentication request. If the identity verification is successful, a gateway token is generated and sent to the client via the access control subsystem. The gateway token includes the user's identity, the number of uses, and the usage time limit. In response to an access request sent by a client that includes the gateway token, the authentication request is forwarded to the identity authentication subsystem based on the access control subsystem. The identity authentication subsystem verifies the validity of the gateway token. If the validity verification is successful, the identity authentication subsystem obtains the user permissions corresponding to the access request from the user management subsystem. Based on the user permissions, the access control subsystem establishes a secure tunnel between the client and the access control subsystem. The access control subsystem receives the service request sent by the client through the secure tunnel, sends the service request to the corresponding service system, and sends the response information from the service system back to the client through the secure tunnel.

3. The method according to claim 1, characterized in that, The server deploying any subsystem is a cluster server, which includes a master server and at least one backup server; the server also deploys an intrusion detection system and / or an intrusion prevention system; the method further includes: When the intrusion detection system and / or the intrusion prevention system detects that the main server is exposed to risk, the target subsystem running on the main server is switched to run on a backup server in the cluster server.

4. The method according to claim 1, characterized in that, The method further includes: The access control subsystem receives the encrypted service request sent by the client through the secure tunnel, decrypts the encrypted service request to obtain a plaintext service request, sends the plaintext service request to the service system, and receives the returned response information. The response information is encrypted to obtain encrypted response information, which is then sent to the client via the secure tunnel.

5. A physical isolation gateway system, characterized in that, This includes a network environment assessment module deployed on the client side, and user management, identity authentication, and access control subsystems deployed on different servers. The servers corresponding to these subsystems are physically isolated from each other but connected via a network. The network environment assessment module is used to respond to the client's startup by dialing the gateway address of the intranet based on the ICMP protocol; if the connection is successful, it indicates that the client is in an intranet office scenario, and the client's authentication scheme is determined to be a username and password authentication scheme; if the connection fails, it indicates that the client is in an extranet office scenario, and the client's authentication scheme is determined to be a smart card authentication scheme. The identity authentication subsystem is used to verify the user's identity based on the authentication request sent by the client, generate a gateway token and send it to the client if the identity verification is successful; and verify the validity of the gateway token based on the access request sent by the client that includes the gateway token. The identity authentication subsystem is further configured to verify user identity based on the username-password authentication scheme: after receiving an authentication request from the client, the identity authentication subsystem generates a first random number and sends the first random number to the client, so that the client returns the username and a first ciphertext to the identity authentication subsystem via the access control subsystem; wherein, the first ciphertext is obtained by the client processing the first random number and the user password using a first encryption algorithm; the identity authentication subsystem obtains the user password from the user management subsystem based on the received username, processes the first random number and the user password using the first encryption algorithm to obtain a second ciphertext, and verifies whether the second ciphertext is consistent with the received first ciphertext; if they are consistent, the identity verification is successful. The identity authentication subsystem is further configured to verify user identity based on the smart card authentication scheme: After receiving an authentication request from the client, the identity authentication subsystem obtains a second random number from the signature verification server, records the event number, encrypts the second random number using the server's private key to obtain a third ciphertext, and sends it to the client, so that: the client returns a signature certificate including a fourth ciphertext and a signature public key to the identity authentication subsystem; wherein, the fourth ciphertext is obtained by the client decrypting the third ciphertext using the server's public key to obtain the second random number, and then encrypting the second random number using the signature private key in the smart card; the identity authentication subsystem obtains the second random number from the signature verification server based on the event number, decrypts the fourth ciphertext based on the signature public key in the signature certificate to obtain the third random number, and verifies whether the third random number is consistent with the second random number. If they are consistent, the identity verification is successful; if the identity verification is successful, the identity authentication subsystem parses the signature certificate to obtain a certificate serial number, and obtains the user identity from the user management subsystem based on the certificate serial number; The user management subsystem is used to confirm user permissions in response to requests from the identity authentication subsystem; The access control subsystem is used to verify the validity of the gateway token. If the validity verification is successful, the access control subsystem establishes a secure tunnel between the client and the access control subsystem according to the user's permissions, and sends the business request sent by the client through the secure tunnel to the business system. Then, the response information fed back by the business system is sent back to the client through the secure tunnel.

6. An electronic device, comprising: A processor and a memory storing a program, characterized in that the program includes instructions that, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 4.

7. A non-transitory machine-readable medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1 to 4.

Images