WO2018121249A1 - Ssl protocol-based access control method and device - Google Patents

Abstract

The invention relates to the field of telecommunication, and specifically, to a secure sockets layer (SSL) protocol-based access control method and device. The method comprises: a portal server receives an access request transmitted from a terminal; the portal server determines a SSL authentication method corresponding to the access request; if bi-directional authentication is determined, after the bidirectional authentication is successfully performed between the portal server and the terminal, the portal server adds identifier information of the terminal into the access request and transmits the same to a backend server; and the backend server determines, according to whether the access request contains the identifier information of the terminal, an access permission of the terminal. The invention is utilized to resolve an issue of low resource utilization efficiency owing to establishing separate authentication systems for different authentication methods in the prior art.

Description

Access control method and device based on SSL protocol

This application claims the priority of the Chinese patent application filed on December 30, 2016, the Intellectual Property Office of the People's Republic of China, the application number is 201611264199.4, and the invention name is "an access control method and device based on the SSL protocol". This is incorporated herein by reference.

Technical field

The embodiments of the present invention relate to the field of communications technologies, and in particular, to an access control method and apparatus based on an SSL protocol.

Background technique

With the development of network technology and the popularity of intelligent terminals, in the field of Internet payment such as e-commerce and online banking, the security of information interaction has become the focus of attention. Generally, the way in which an encrypted channel is established on both sides of the communication to encrypt and transmit the transmitted data has been widely used.

SSL (Secure Sockets Layer) is a security protocol that provides security and data integrity for network communications. The SSL protocol is between the TCP (Transmission Control Protocol) layer and the application layer. It is a protocol for secure exchange of information between a Web browser and a Web server. It provides two basic security services: authentication and confidentiality. The SSL protocol can be divided into two layers: the SSL Record Protocol: it is built on a reliable transport protocol (such as TCP) to provide basic functions such as data encapsulation, compression, and encryption for higher layer protocols. SSL Handshake Protocol: It is built on the SSL record protocol to authenticate the identity, negotiate encryption algorithms, and exchange encryption keys before the actual data transmission begins.

According to different authentication methods, the SSL protocol is divided into one-way authentication and two-way authentication. One-way authentication requires the server to provide a digital certificate to the client, and the client authenticates the server. Two-way authentication requires both the client and the server to provide a digital certificate to each other and verify the digital certificate of the other party. In the current technical solution, one server (unique IP address and port) provides external SSL services, mostly using a single authentication method, either using one-way authentication or using dual To the certification, the authentication system needs to be set up separately for different authentication methods, and the utilization efficiency of resources is low.

Summary of the invention

The embodiment of the invention provides an access control method and device based on the SSL protocol, which is used to solve the problem that the authentication system needs to be separately set up in different authentication modes in the prior art, and the resource utilization efficiency is low.

In a first aspect, the SSL protocol-based access control method provided by the embodiment of the present invention includes: an ingress server receiving an access request sent by a terminal; the ingress server determining a secure socket layer SSL authentication mode corresponding to the access request; After the two-way authentication with the terminal is passed, the portal server adds the identifier information of the terminal to the access request and sends the identifier to the background server, where the background server is configured to carry the identifier of the terminal according to the access request. Information to determine the access rights of the terminal.

Optionally, the ingress server performs the bidirectional authentication with the terminal, including: the ingress server sends the certificate of the ingress server to the terminal, and receives an authentication result of the terminal to the ingress server; The portal server sends a certificate acquisition request to the terminal; the portal server receives the terminal certificate sent by the terminal, and the terminal certificate includes the identifier information of the terminal; the portal server completes the Terminal authentication.

Optionally, the terminal certificate is obtained by: the terminal generating a certificate request CSR file according to the identifier information of the terminal; the terminal sending the CSR to a certificate authority, so that the certificate authority is configured according to the certificate authority The CSR generates the terminal certificate; the terminal receives the terminal certificate sent by the certificate authority.

Optionally, the ingress server determines the SSL authentication mode corresponding to the access request, where the ingress server receives the access request sent by the terminal, where the access request includes a port number; The port number determines that the SSL authentication mode corresponding to the access request is two-way authentication or one-way authentication.

Optionally, the portal server receives the access request sent by the terminal, where the ingress server receives the https request sent by the terminal, and the portal server adds the identifier information of the terminal to the access request and sends the request a background server, including: the portal server will be the https The request is converted into an http request, and the identification information of the terminal is inserted in the header of the http request; the portal server sends the http request that adds the identification information to the background server.

In a second aspect, the embodiment of the present invention provides an access control method based on SSL authentication, which includes: a background server receives an access request sent by an ingress server; and the background server determines, according to whether the access request includes identifier information of the terminal, The SSL authentication mode corresponding to the access request; the background server verifies the terminal according to the SSL authentication mode corresponding to the access request; and the background server processes the access request after verifying the terminal, and The portal server sends the processing result.

Optionally, the background server performs the verification on the terminal according to the SSL authentication mode corresponding to the access request, including: if the SSL authentication mode corresponding to the access request is one-way authentication, the access request includes The login account and the password of the terminal, the background server verifies whether the login account and the password match; if the SSL authentication mode corresponding to the access request is two-way authentication, the packet header of the access request includes The identification information of the terminal, the background server verifies whether the identification information of the terminal is already registered.

In a third aspect, an embodiment of the present invention provides an access control device based on an SSL protocol, including: an ingress transceiver module, configured to receive an access request sent by a terminal, and an ingress authentication module, configured to determine an SSL authentication mode corresponding to the access request An ingress processing module, configured to add the identification information of the terminal to the access request after the bidirectional authentication is passed, and the access transceiver module is further configured to: The request is sent to the background server, and the background server is configured to determine the access authority of the terminal according to whether the access request carries the identification information of the terminal.

Optionally, the ingress and receiving transceiver module is configured to: send a certificate of the ingress server to the terminal, and receive an authentication result of the terminal to the ingress server; send a certificate obtaining request to the terminal; The terminal certificate sent by the terminal, the terminal certificate includes the identifier information of the terminal, and the ingress processing module is specifically configured to complete the authentication of the terminal according to the terminal certificate.

Optionally, the terminal certificate is obtained by: the terminal generating a certificate request CSR file according to the identifier information of the terminal; the terminal sending the CSR to a certificate authority, The certificate issuing authority generates the terminal certificate according to the CSR; the terminal receives the terminal certificate sent by the certificate issuing authority.

Optionally, the access request includes a port number, and the ingress authentication module is configured to determine, according to the port number, that the SSL authentication mode corresponding to the access request is two-way authentication or one-way authentication.

Optionally, the ingress transceiver module is configured to receive an https request sent by the terminal; the ingress processing module is specifically configured to convert the https request into an http request, and in the header of the http request Inserting the identifier information of the terminal; the ingress transceiver module is configured to send the http request for adding the identifier information to the background server.

In a fourth aspect, an embodiment of the present invention provides an access control apparatus based on SSL authentication, including:

a background transceiver module, configured to receive an access request sent by the portal server;

a background authentication module, configured to determine an SSL authentication mode corresponding to the access request according to whether the access request includes the identifier information of the terminal;

a background processing module, configured to perform verification on the terminal according to an SSL authentication manner corresponding to the access request;

The background processing module is further configured to process the access request after verifying the pass of the terminal;

The background transceiver module is further configured to send a processing result to the portal server.

Optionally, the background processing module is further configured to: if the SSL authentication mode corresponding to the access request is one-way authentication, the access request includes a login account and a password of the terminal, and verify the login account. Whether the password is matched with the password; if the SSL authentication mode corresponding to the access request is two-way authentication, the packet header of the access request includes the identifier information of the terminal, and it is verified whether the identifier information of the terminal is already registered.

In a fifth aspect, an embodiment of the present application provides an electronic device, including a transceiver, a processor, a memory, and a communication interface, wherein the transceiver, the processor, the memory, and the communication interface pass through a bus connection;

The transceiver is configured to receive an access request sent by the terminal, and send the access request to a background server, where the background server is configured to: according to whether the access request carries the identifier information of the terminal. Determine the access rights of the terminal;

The processor is configured to read a program in the memory and perform the following methods:

Determining an SSL authentication mode corresponding to the access request; if the two-way authentication is performed, adding the identification information of the terminal to the access request after the two-way authentication is passed;

The memory is configured to store one or more executable programs, and may store data used by the processor when performing operations.

In a sixth aspect, an embodiment of the present application provides an electronic device, including a transceiver, a processor, a memory, and a communication interface, wherein the transceiver, the processor, the memory, and the communication interface pass through a bus connection;

The transceiver is configured to receive an access request sent by an ingress server, and send a processing result to the ingress server;

The processor, the processor, is configured to read a program in the memory, and execute the following method:

Determining, according to the identifier information of the terminal, the SSL authentication mode corresponding to the access request, and verifying the terminal according to the SSL authentication mode corresponding to the access request; Access request

The memory is configured to store one or more executable programs, and may store data used by the processor when performing operations.

In a seventh aspect, the embodiment of the present application provides a non-transitory computer readable storage medium, where the non-transitory computer readable storage medium stores computer instructions for causing the computer to perform the first aspect or the The method of any of the possible implementations of the aspect, or the computer instructions for causing the computer to perform the method of the second aspect or any possible implementation of the second aspect.

In an eighth aspect, an embodiment of the present application provides a computer program product, where the computer program product includes a calculation program stored on a non-transitory computer readable storage medium, the computer program includes program instructions, when the program instruction is The computer executes the first aspect when the computer executes Or a method in any of the possible implementations of the first aspect, or causing a computer to perform the method of the second aspect or any possible implementation of the second aspect.

In the embodiment of the present invention, the ingress server receives the access request sent by the terminal, and determines whether the corresponding SSL authentication mode is two-way authentication or one-way authentication according to the access request. If the SSL authentication mode of the access request is two-way authentication, the ingress server and the terminal perform mutual authentication. After the two-way authentication is passed, the ingress server adds the identification information of the terminal to the access request, and sends an access request for adding the identification information to the background server. Since two-way authentication can provide a more secure guarantee for terminal access, one-way authentication is less secure than two-way authentication. Therefore, for different authentication methods, the permissions of the corresponding access request are different. The background server may determine the SSL authentication mode between the terminal and the portal server according to whether the access request carries the identifier information of the terminal, thereby further determining the access authority of the terminal. In this way, the SSL mutual authentication system and the SSL one-way authentication system can be set on the same backend server (unique IP address and port), which improves the flexibility of the background server to process access requests, saves server resources, and solves the problem. There are different authentication methods in the technology that require the establishment of a separate authentication system.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention, Those skilled in the art can also obtain other drawings based on these drawings without paying for inventive labor.

1 is a schematic diagram of a system architecture to which an embodiment of the present invention is applied;

2 is a flowchart of an access control method based on an SSL protocol according to an embodiment of the present invention;

3 is a flowchart of an SSL-based access control method in which an SSL authentication mode is one-way authentication according to Embodiment 1 of the present invention;

4 is a flowchart of an SSL-based access control method in which the SSL authentication mode is two-way authentication according to Embodiment 2 of the present invention;

FIG. 5 is a schematic structural diagram of an access control apparatus based on an SSL protocol according to an embodiment of the present invention; FIG.

6 is a schematic structural diagram of another access control apparatus based on an SSL protocol according to an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of an electronic device according to an embodiment of the present disclosure;

FIG. 8 is a schematic structural diagram of an electronic device according to an embodiment of the present application.

detailed description

The present invention will be further described in detail with reference to the accompanying drawings, in which . All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

As shown in FIG. 1 , a system architecture applicable to an embodiment of the present invention includes a terminal 101, an ingress server 102, and a background server 103. The terminal 101 may be an electronic device with a wireless communication function, such as a mobile phone, a tablet computer, or a dedicated handheld device, or may be a device connected to the Internet by a wired access method such as a personal computer (PC), a notebook computer, or a server. Server 102 can be a network device such as a computer. Preferably, the portal server 102 is an F5 server that provides Internet access portals and load balancing of the various portals. The processing of different SSL authentication modes may be processed by different portal servers 102, that is, one portal server 102 handles one-way authentication, and another portal server 102 handles mutual authentication; or may be implemented by different ports of the same portal server 102, that is, an entry. One port on server 102 handles one-way authentication, and the other port on the same ingress server 102 handles two-way authentication. The background server 103 can be a stand-alone device, or a server cluster formed by multiple servers, for processing an access request sent by the terminal. If the background server 103 is a plurality of servers, the application deployed in each background server The system is completely consistent, that is, each background server can process the access request corresponding to the two-way authentication and the access request corresponding to the one-way authentication. The portal server 102 and the background server 103 can employ cloud computing technology for information processing.

The terminal 101 can communicate with the server 102 through the INTERNET network, or communicate with the server 102 through a mobile communication system such as a Global System for Mobile Communications (GSM) or a Long Term Evolution (LTE) system. .

FIG. 2 is a schematic flowchart diagram of an access control method based on the SSL protocol provided by an embodiment of the present invention.

Based on the foregoing, as shown in FIG. 2, a monitoring method for monitoring software provided by an embodiment of the present invention includes the following steps:

Step 201: The ingress server receives an access request sent by the terminal.

Step 202: The ingress server determines a secure socket layer SSL authentication mode corresponding to the access request.

Step 203: If the two-way authentication is performed, the portal server adds the identification information of the terminal to the access request and sends the information to the background server after the two-way authentication is passed. Whether the request carries the identification information of the terminal to determine the access right of the terminal.

In the embodiment of the present invention, the ingress server receives the access request sent by the terminal, and determines whether the corresponding SSL authentication mode is two-way authentication or one-way authentication according to the access request. If the SSL authentication mode of the access request is two-way authentication, the ingress server and the terminal perform mutual authentication. After the two-way authentication is passed, the ingress server adds the identification information of the terminal to the access request, and sends an access request for adding the identification information to the background server. Since two-way authentication can provide a more secure guarantee for terminal access, one-way authentication is less secure than two-way authentication. Therefore, for different authentication methods, the permissions of the corresponding access request are different. The background server may determine the SSL authentication mode between the terminal and the portal server according to whether the access request carries the identifier information of the terminal, thereby further determining the access authority of the terminal. In this way, the SSL mutual authentication system and the SSL one-way authentication system can be set on the same backend server (unique IP address and port), which improves the flexibility of the background server to process access requests, saves server resources, and solves the problem. There are different authentication methods in the technology that require the establishment of a separate authentication system.

When the user browses the network resource or manages the network resource, the browser sends an access request to the server through the browser on the terminal, and the server replies to the terminal with the information requested by the terminal based on the access request. The information transmitted between the browser of the terminal and the server may be based on HTTP (Hyper Text Transport Protocol). In order to ensure the security of information transmission between the terminal and the server, the SSL protocol is added to the HTTP, that is, HTTP is changed to HTTPS (Hyper Text Transfer Protocol over Secure Socket Layer).

In the embodiment of the present invention, in step 201, the portal server receives the access request sent by the terminal, including:

The portal server receives an https request sent by the terminal.

HTTP is a standard for requesting and responding between a client and a server. The client is installed on the terminal, and the server can be a website. By using a web browser, web crawler, or other tool, the client initiates an HTTP request to the specified port on the server. Resources are stored on the server, such as HTML (HyperText Markup Language) files and images.

Typically, a request is initiated by the client to establish a TCP connection to the server's designated port. The HTTP server listens on the port for requests sent by the client. After processing the received request, the server replies with a response message to the client, and the content of the response message may be a file requested by the client, an error message, or some other information.

Since HTTP sends messages in clear text, it does not provide any way of data encryption, and the security is very low. If an attacker intercepts a transmission message between the browser and the server, the information can be directly read.

In order to solve this shortcoming of HTTP, another protocol is needed: Secure Sockets Layer Hypertext Transfer Protocol HTTPS. For the security of data transmission, HTTPS adds SSL protocol based on HTTP. SSL relies on digital certificates to verify the identity of the server or client and encrypt the communication between the client and the server.

After the portal server receives the access request sent by the terminal, since the access request is based on HTTPS, the portal server needs to determine how to authenticate the digital certificate according to the access request. Digital certificate The authentication is divided into two modes: two-way authentication and one-way authentication. A digital certificate with two-way authentication and one-way authentication is required on the ingress server. The two-way authenticated digital certificate and the one-way authenticated digital certificate can be configured in different entry servers, such that one ingress server only processes the access request corresponding to the two-way authentication, and the other ingress server only processes the access request corresponding to the one-way authentication. Access requests of different authentication modes are sent to the corresponding ingress server according to different IP addresses or different network domain names, that is, the access request corresponding to the mutual authentication is sent to the ingress server that processes the mutual authentication according to the IP address of the ingress server that processes the mutual authentication; The access request corresponding to the one-way authentication is sent to the ingress server that processes the one-way authentication according to the IP address of the ingress server that processes the one-way authentication. Preferably, in the embodiment of the present invention, the digital certificate of the two-way authentication and the one-way authentication is configured on one of the ingress servers, and the authentication mode corresponding to the access request is distinguished by different ports. Then, in step 202, the ingress server determines the SSL authentication mode corresponding to the access request, including:

The access server receives the access request sent by the terminal, where the access request includes a port number;

The ingress server determines, according to the port number, that the SSL authentication mode corresponding to the access request is two-way authentication or one-way authentication.

The server or port corresponding to the two-way authentication is different from the server or port corresponding to the two-way authentication. That is, if the authentication mode corresponding to the client is two-way authentication, the access request initiated by the client is directly sent to the server or port corresponding to the mutual authentication. If the authentication mode corresponding to the client is one-way authentication, the access request initiated by the client is sent to the server or port corresponding to the one-way authentication. Therefore, if the same ingress server receives the access request sent by the terminal, it can determine the SSL authentication mode corresponding to the access request according to the port number carried in the access request.

After the SSL authentication mode is determined to be two-way authentication or one-way authentication, the ingress server performs SSL authentication with the client.

If the SSL authentication mode is two-way authentication, in the foregoing step 203, the ingress server performs mutual authentication with the terminal, including:

The portal server sends the certificate of the portal server to the terminal and receives an authentication result of the terminal to the portal server;

The portal server sends a certificate acquisition request to the terminal;

Receiving, by the portal server, a terminal certificate sent by the terminal, where the terminal certificate includes identifier information of the terminal;

The portal server completes authentication of the terminal according to the terminal certificate.

Specifically, the ingress server determines that the authentication mode corresponding to the access request sent by the terminal is two-way authentication, and sends the certificate of the ingress server to the terminal, and the terminal authenticates the certificate of the ingress server, and the authentication succeeds after the authentication succeeds. . Because it is a two-way authentication, the ingress server sends a certificate requesting to acquire the terminal to the terminal. After receiving the certificate of the terminal, the portal server verifies the certificate of the terminal, thereby completing the SSL mutual authentication between the ingress server and the terminal.

If the authentication mode corresponding to the access request is one-way authentication, the ingress server only needs to send the digital certificate of the server to the terminal, so that the client verifies the certificate of the ingress server, and the terminal does not need to send the certificate of the terminal to the ingress server.

That is to say, the difference between the two SSL authentication methods is that the terminal sends the certificate to the server in the two-way authentication, and the terminal does not send the certificate to the server in the one-way authentication. Therefore, in the embodiment of the present invention, the two-way authentication sends the certificate to the ingress server, and the identifier information of the terminal is added to the certificate and sent to the ingress server, and the ingress server sends the obtained identification information of the terminal to the access request. To the background server, the background server can obtain the identification information of the terminal from the access request corresponding to the mutual authentication. On the other hand, the one-way authentication is that the ingress server sends the certificate of the ingress server to the terminal, and the terminal does not need to send the certificate of the terminal to the ingress server, the ingress server does not obtain the identification information of the terminal, therefore, in the case of one-way authentication, the portal The access request sent by the server to the background server does not carry the identification information of the terminal. In this way, the background server can determine whether the authentication method corresponding to the access request is two-way authentication or one-way authentication according to whether the access request carries the identifier information of the terminal, thereby determining the authority corresponding to the access request.

The above terminal certificate is obtained by the following methods:

The terminal generates a certificate request CSR file according to the identification information of the terminal;

Sending, by the terminal, the CSR to a certificate authority, so that the certificate issuing authority generates the terminal certificate according to the CSR;

The terminal receives the terminal certificate sent by the certificate authority.

Specifically, the terminal generates a private key file and a CSR (Certificate Signing Request) file by using a unique identifier such as a MAC (Message Authentication Code) of the terminal, a terminal serial number, and the like, and sends the CSR file to the certificate authority. . The certificate authority signs the CSR file by using the private key of the certificate authority, and generates a certificate public key file, that is, a certificate issued to the user terminal, and sends the terminal certificate back to the terminal, and the terminal certificate can be used for authenticating the terminal. Security. Therefore, the terminal certificate carries the identification information of the terminal, and the terminal sends the terminal certificate to the portal server, and the portal server can obtain the identifier information of the terminal from the terminal certificate and add it to the access request.

In addition, the portal server adds the identification information of the terminal to the access request and sends the information to the background server, including:

The ingress server converts the https request into an http request, and inserts the identification information of the terminal in a packet header of the http request;

The portal server sends the http request that joins the identification information to the background server.

Although HTTPS is a more secure communication protocol than HTTP, HTTPS requires the background server to process the certificate sent by the other party, which increases the workload of the background server. Since the connection between the ingress server and the backend server belongs to the intranet connection, the security is already high, and the communication does not need to be encrypted. Therefore, the ingress server converts the https request into an http request and sends it to the background server. At the same time, if the authentication method corresponding to the access request is the two-way authentication, the ingress server adds the http request to the identification information of the terminal, so that the background server can determine the authentication mode corresponding to the access request as the mutual authentication according to the identification information of the terminal in the access request. .

Correspondingly, in the embodiment of the present invention, after receiving the access request, the background server processes the access request according to the authentication mode corresponding to the access request, and specifically includes:

The background server receives the access request sent by the portal server;

Determining, by the background server, an SSL authentication mode corresponding to the access request according to whether the access request includes the identifier information of the terminal;

The background server enters the terminal according to the SSL authentication mode corresponding to the access request. Line verification

After the background server passes the verification of the terminal, the background server processes the access request and sends the processing result to the portal server.

The two types of SSL authentication methods are two-way authentication or one-way authentication. For different authentication methods, the background server performs different authentication on the terminal according to the access request.

If the SSL authentication mode corresponding to the access request is one-way authentication, the access request includes a login account and a password of the terminal, and the background server verifies whether the login account and the password match.

For one-way authentication, since the security of this authentication method is low, the user needs to register the account in advance. After receiving the access request, the background server verifies whether the login account and password carried in the access request are correct and match, and returns the processing result to the terminal according to the source address.

If the SSL authentication mode corresponding to the access request is two-way authentication, the packet header of the access request includes the identifier information of the terminal, and the background server verifies whether the identifier information of the terminal is already registered.

For two-way authentication, the security of this authentication method is high. You do not need to log in through the account password. The background server will register the terminal identification information in advance. In this way, when the terminal sends an access request, the background server verifies whether the identification information of the terminal carried in the access request is stored in the background server, and if so, passes the verification of the access request, otherwise it does not pass.

For a clearer understanding of the present invention, the foregoing process is described in detail with reference to the specific embodiment. The SSL authentication mode in the first embodiment is one-way authentication. The specific steps are as shown in FIG. 3, including:

Step 301: The terminal sends an https request to the portal server, where the https request includes an account and a password, and the access address is a port number. The login account and password, and the port number are used to obtain the registration from the portal server when registering the terminal.

Step 302: The ingress server determines, according to the port number in the https request, that the SSL authentication mode corresponding to the https request is one-way authentication.

Step 303: The portal server sends the certificate of the portal server to the terminal.

Step 304: After receiving the verification pass message fed back by the terminal, the portal server will https please Seek to convert to http request.

Step 305: The portal server sends the http request to the background server.

Step 306: The background server determines that the authentication mode corresponding to the http request is one-way authentication, according to the identifier information of the terminal that does not include the terminal.

Step 307: The background server processes the http request.

Step 308: The background server sends the processing result to the portal server.

Step 309: The portal server sends the processing result to the terminal.

The SSL authentication mode in the second embodiment is two-way authentication. The specific steps are as shown in Figure 4.

Step 401: The terminal sends an https request to the portal server, where the https request includes an access address, that is, a port number.

Step 402: The ingress server determines, according to the port number in the https request, that the SSL authentication mode corresponding to the https request is two-way authentication.

Step 403: The portal server sends the certificate of the portal server to the terminal.

Step 404: The terminal verifies the certificate of the portal server, and feeds back the verification result to the portal server.

Step 405: After receiving the verification pass message fed back by the terminal, the ingress server sends a certificate request to the terminal.

Step 406: The terminal sends the terminal certificate to the portal server, where the terminal certificate includes the identifier information of the terminal.

Step 407: After the portal server verifies the terminal certificate, the https request is converted into an http request, and the identifier information of the terminal is added to the http request.

Step 408: The portal server sends the http request to the background server.

Step 409: The background server determines, according to the identifier information of the terminal in the http request, that the authentication mode corresponding to the http request is two-way authentication.

Step 410: The background server processes the http request.

Step 411: The background server sends the processing result to the portal server.

Step 412: The portal server sends the processing result to the terminal.

Based on the same technical concept, the embodiment of the present invention further provides an apparatus for access control based on the SSL protocol. As shown in FIG. 5, the method includes:

The ingress transceiver module 501 is configured to receive an access request sent by the terminal.

The ingress authentication module 502 is configured to determine an SSL authentication mode corresponding to the access request.

The ingress processing module 503 is configured to add the identifier information of the terminal to the access request after the mutual authentication with the terminal is successful if the two-way authentication is performed.

The ingress and receiving module 501 is further configured to send the access request to the background server, where the background server is configured to determine the access authority of the terminal according to whether the access request carries the identification information of the terminal.

Optionally, the ingress transceiver module 501 is specifically configured to:

Sending the certificate of the portal server to the terminal and receiving an authentication result of the terminal to the portal server;

Sending a certificate acquisition request to the terminal;

Receiving a terminal certificate sent by the terminal, where the terminal certificate includes identification information of the terminal;

The ingress processing module is specifically configured to complete authentication of the terminal according to the terminal certificate.

Optionally, the terminal certificate is obtained by:

The terminal generates a certificate request CSR file according to the identification information of the terminal;

Sending, by the terminal, the CSR to a certificate authority, so that the certificate issuing authority generates the terminal certificate according to the CSR;

The terminal receives the terminal certificate sent by the certificate authority.

Optionally, the access request includes a port number;

The ingress authentication module 502 is configured to determine, according to the port number, that the SSL authentication mode corresponding to the access request is two-way authentication or one-way authentication.

Optionally, the ingress transceiver module 501 is configured to receive an https request sent by the terminal.

The ingress processing module 503 is configured to: convert the https request into an http request, and insert the identifier information of the terminal in a packet header of the http request;

The ingress transceiver module 501 is configured to send the http request that adds the identifier information to the background server.

Another access control device based on SSL authentication, as shown in FIG. 6, includes:

The background transceiver module 601 is configured to receive an access request sent by the portal server;

The background authentication module 602 is configured to determine an SSL authentication mode corresponding to the access request according to whether the access request includes the identifier information of the terminal.

The background processing module 603 is configured to perform verification on the terminal according to the SSL authentication mode corresponding to the access request.

The background processing module 603 is further configured to process the access request after verifying the pass of the terminal;

The background transceiver module 601 is further configured to send a processing result to the portal server.

Optionally, the background processing module 603 is further configured to:

If the SSL authentication mode corresponding to the access request is a one-way authentication, the access request includes a login account and a password of the terminal, and verify whether the login account and the password match;

If the SSL authentication mode corresponding to the access request is a two-way authentication, the packet header of the access request includes the identifier information of the terminal, and the identifier information of the terminal is verified to be registered.

It should be understood that the division of each unit above is only a division of a logical function, and the actual implementation may be integrated into one physical entity in whole or in part, or may be physically separated.

Based on the same concept, the present application provides an electronic device, which can be used to execute the SSL protocol-based access control method process performed by the above-mentioned portal server. FIG. 7 is a schematic structural diagram of an electronic device provided by the present application. The electronic device 700 includes a transceiver 701, a processor 702, a memory 703, and a communication interface 704; wherein the transceiver 701, the processor 7012, the memory 703, and the communication interface 704 are connected to one another via a bus 705.

Among them, the memory 703 is used to store programs. In particular, the program can include program code, the program code including computer operating instructions. The memory 703 may be a volatile memory, such as a random-access memory (RAM), or a non-volatile memory, such as a flash memory. ), hard disk drive (HDD) or solid-state drive (SSD); It can also be any combination of any one or more of the above-described volatile memory and non-volatile memory.

The memory 703 stores the following elements, executable modules or data structures, or a subset thereof, or an extended set thereof:

Operation instructions: include various operation instructions for implementing various operations.

Operating system: Includes a variety of system programs for implementing various basic services and handling hardware-based tasks.

The bus 705 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 7, but it does not mean that there is only one bus or one type of bus.

The communication interface 704 can be a wired communication access port, a wireless communication interface, or a combination thereof, wherein the wired communication interface can be, for example, an Ethernet interface. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface can be a WLAN interface.

The processor 702 can be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and an NP. It can also be a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL) or any combination thereof. .

The transceiver 701 is configured to receive an access request sent by the terminal, and send the access request to the background server, where the background server is configured to determine the access authority of the terminal according to whether the access request carries the identification information of the terminal;

The processor 702 is configured to read a program in the memory 703 and perform the following methods:

Determining an SSL authentication mode corresponding to the access request; if the two-way authentication is performed, adding the identification information of the terminal to the access request after the two-way authentication is passed;

The memory 703 is configured to store one or more executable programs, and may store data used by the processor 702 when performing operations.

Optionally, the transceiver 701 is specifically configured to: send a certificate of the electronic device to the terminal, and receive an authentication result of the terminal to the electronic device; send a certificate acquisition request to the terminal; The terminal certificate sent by the terminal, the terminal certificate includes the identification information of the terminal, and the processor 702 is specifically configured to complete the authentication of the terminal according to the terminal certificate.

Optionally, the terminal certificate is obtained by: the terminal generating a certificate request CSR file according to the identifier information of the terminal; the terminal sending the CSR to a certificate authority, so that the certificate authority is configured according to the certificate authority The CSR generates the terminal certificate; the terminal receives the terminal certificate sent by the certificate authority.

Optionally, the access request includes a port number, and the processor 702 is configured to determine, according to the port number, that the SSL authentication mode corresponding to the access request is two-way authentication or one-way authentication.

Optionally, the transceiver 701 is configured to receive an https request sent by the terminal, and send the http request that adds the identifier information to the background server, where the processor 702 is specifically configured to: The request is converted into an http request, and the identification information of the terminal is inserted in the header of the http request.

In the embodiment of the present invention, the electronic device receives the access request sent by the terminal, and determines, according to the access request, whether the corresponding SSL authentication mode is two-way authentication or one-way authentication. If the SSL authentication mode of the access request is two-way authentication, the electronic device and the terminal perform mutual authentication. After the two-way authentication is passed, the electronic device adds the identification information of the terminal to the access request, and sends the access request for adding the identification information to the background server. Since two-way authentication can provide a more secure guarantee for terminal access, one-way authentication is less secure than two-way authentication. Therefore, for different authentication methods, the permissions of the corresponding access request are different. The background server may determine the SSL authentication mode between the terminal and the electronic device according to whether the access request carries the identification information of the terminal, thereby further determining the final Access rights. In this way, the SSL mutual authentication system and the SSL one-way authentication system can be set on the same backend server (unique IP address and port), which improves the flexibility of the background server to process access requests, saves server resources, and solves the problem. There are different authentication methods in the technology that require the establishment of a separate authentication system.

Based on the same concept, the present application provides an electronic device, which can be used to execute the SSL protocol-based access control method process executed by the background server side. FIG. 8 is a schematic structural diagram of an electronic device provided by the present application. The electronic device 800 includes a transceiver 801, a processor 802, a memory 803, and a communication interface 804; wherein the transceiver 801, the processor 8012, the memory 803, and the communication interface 804 are connected to one another via a bus 805.

Among them, the memory 803 is used to store programs. In particular, the program can include program code, the program code including computer operating instructions. The memory 803 may be a volatile memory, such as a random-access memory (RAM), or a non-volatile memory, such as a flash memory. A hard disk drive (HDD) or a solid-state drive (SSD); or any combination of any one or more of the above-mentioned volatile memory and non-volatile memory.

The memory 803 stores the following elements, executable modules or data structures, or a subset thereof, or an extended set thereof:

Operation instructions: include various operation instructions for implementing various operations.

Operating system: Includes a variety of system programs for implementing various basic services and handling hardware-based tasks.

The bus 805 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 8, but it does not mean that there is only one bus or one type of bus.

The communication interface 804 can be a wired communication access port, a wireless communication interface, or a combination thereof, wherein the wired communication interface can be, for example, an Ethernet interface. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface can be a WLAN interface.

The processor 802 can be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and an NP. It can also be a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL) or any combination.

The transceiver 801 is configured to receive an access request sent by an ingress server, and send a processing result to the ingress server.

The processor 802 is configured to read a program in the memory 803 and perform the following methods:

Determining, according to the identifier information of the terminal, the SSL authentication mode corresponding to the access request, and verifying the terminal according to the SSL authentication mode corresponding to the access request; Access request

The memory 803 is configured to store one or more executable programs, and may store data used by the processor 802 when performing operations.

Optionally, the processor 802 is further configured to: if the SSL authentication mode corresponding to the access request is one-way authentication, the access request includes a login account and a password of the terminal, and verify the login account. Whether the password is matched with the password; if the SSL authentication mode corresponding to the access request is two-way authentication, the packet header of the access request includes the identifier information of the terminal, and it is verified whether the identifier information of the terminal is already registered.

In the embodiment of the present invention, the portal server receives the access request sent by the terminal, and according to the access The request determines whether the corresponding SSL authentication mode is two-way authentication or one-way authentication. If the SSL authentication mode of the access request is two-way authentication, the ingress server and the terminal perform mutual authentication. After the two-way authentication is passed, the ingress server adds the identification information of the terminal to the access request, and sends an access request for adding the identification information to the electronic device. Since two-way authentication can provide a more secure guarantee for terminal access, one-way authentication is less secure than two-way authentication. Therefore, for different authentication methods, the permissions of the corresponding access request are different. The electronic device may determine the SSL authentication mode between the terminal and the portal server according to whether the access request carries the identifier information of the terminal, thereby further determining the access authority of the terminal. In this way, the SSL mutual authentication system and the SSL one-way authentication system can be set on the same electronic device (unique IP address and port), which improves the flexibility of the electronic device to process access requests, saves server resources, and solves the problem. There are different authentication methods in the technology that require the establishment of a separate authentication system.

Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, system, or computer program product. Therefore, the embodiments of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, embodiments of the present application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

Embodiments of the present application are described with reference to flowchart illustrations and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the computer readable memory is stored in the computer readable memory. The instructions in the production result include an article of manufacture of the instruction device that implements the functions specified in one or more blocks of the flowchart or in a flow or block of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

It is apparent that those skilled in the art can make various modifications and variations to the embodiments of the present application without departing from the spirit and scope of the application. Thus, it is intended that the present invention cover the modifications and variations of the embodiments of the present invention.

Claims (23)

1. An access control method based on the SSL protocol, which is characterized in that it comprises:

   The portal server receives an access request sent by the terminal;

   Determining, by the portal server, a secure socket layer SSL authentication mode corresponding to the access request;

   If the two-way authentication is performed, the ingress server adds the identification information of the terminal to the access request and sends the identifier to the background server after the bidirectional authentication is passed. The identification information of the terminal is carried to determine the access authority of the terminal.
2. The method of claim 1, wherein the portal server is authenticated by the terminal in both directions, including:

   The portal server sends the certificate of the portal server to the terminal and receives an authentication result of the terminal to the portal server;

   The portal server sends a certificate acquisition request to the terminal;

   Receiving, by the portal server, a terminal certificate sent by the terminal, where the terminal certificate includes identifier information of the terminal;

   The portal server completes authentication of the terminal according to the terminal certificate.
3. The method of claim 2 wherein said terminal certificate is obtained by:

   The terminal generates a certificate request CSR file according to the identification information of the terminal;

   Sending, by the terminal, the CSR to a certificate authority, so that the certificate issuing authority generates the terminal certificate according to the CSR;

   The terminal receives the terminal certificate sent by the certificate authority.
4. The method of claim 1, wherein the ingress server determines an SSL authentication mode corresponding to the access request, including:

   The access server receives the access request sent by the terminal, where the access request includes a port number;

   Determining, by the portal server, the SSL authenticator corresponding to the access request according to the port number The formula is two-way authentication or one-way authentication.
5. The method of claim 2, wherein the portal server receives an access request sent by the terminal, including:

   The portal server receives an https request sent by the terminal;

   The ingress server adds the identification information of the terminal to the access request and sends the information to the background server, including:

   The ingress server converts the https request into an http request, and inserts the identification information of the terminal in a packet header of the http request;

   The portal server sends the http request that joins the identification information to the background server.
6. An access control method based on SSL authentication, comprising:

   The background server receives the access request sent by the portal server;

   Determining, by the background server, an SSL authentication mode corresponding to the access request according to whether the access request includes the identifier information of the terminal;

   The background server performs verification on the terminal according to the SSL authentication mode corresponding to the access request;

   After the background server passes the verification of the terminal, the background server processes the access request and sends the processing result to the portal server.
7. The method according to claim 6, wherein the background server performs verification on the terminal according to the SSL authentication mode corresponding to the access request, including:

   If the SSL authentication mode corresponding to the access request is a one-way authentication, the access request includes a login account and a password of the terminal, and the background server verifies whether the login account and the password match;

   If the SSL authentication mode corresponding to the access request is two-way authentication, the packet header of the access request includes the identifier information of the terminal, and the background server verifies whether the identifier information of the terminal is already registered.
8. An access control device based on the SSL protocol, comprising:

   An access transceiver module, configured to receive an access request sent by the terminal;

   An ingress authentication module, configured to determine an SSL authentication mode corresponding to the access request;

   An ingress processing module, configured to add the identification information of the terminal to the access request after the two-way authentication is passed, if the two-way authentication is performed;

   The ingress and receiving module is further configured to send the access request to the background server, where the background server is configured to determine the access authority of the terminal according to whether the access request carries the identification information of the terminal.
9. The device according to claim 8, wherein the ingress transceiver module is specifically configured to:

   Sending the certificate of the portal server to the terminal and receiving an authentication result of the terminal to the portal server;

   Sending a certificate acquisition request to the terminal;

   Receiving a terminal certificate sent by the terminal, where the terminal certificate includes identification information of the terminal;

   The ingress processing module is specifically configured to complete authentication of the terminal according to the terminal certificate.
10. The apparatus of claim 9, wherein the terminal certificate is obtained by:

    The terminal generates a certificate request CSR file according to the identification information of the terminal;

    Sending, by the terminal, the CSR to a certificate authority, so that the certificate issuing authority generates the terminal certificate according to the CSR;

    The terminal receives the terminal certificate sent by the certificate authority.
11. The apparatus according to claim 8, wherein said access request includes a port number;

    The ingress authentication module is configured to determine, according to the port number, that the SSL authentication mode corresponding to the access request is two-way authentication or one-way authentication.
12. The device of claim 9 wherein:

    The ingress transceiver module is configured to receive an https request sent by the terminal;

    The ingress processing module is configured to: convert the https request into an http request, and insert the identifier information of the terminal in a packet header of the http request;

    The ingress transceiver module is configured to send the http request that adds the identifier information to the background server.
13. An access control device based on SSL authentication, comprising:

    a background transceiver module, configured to receive an access request sent by the portal server;

    a background authentication module, configured to determine an SSL authentication mode corresponding to the access request according to whether the access request includes the identifier information of the terminal;

    a background processing module, configured to perform verification on the terminal according to an SSL authentication manner corresponding to the access request;

    The background processing module is further configured to process the access request after verifying the pass of the terminal;

    The background transceiver module is further configured to send a processing result to the portal server.
14. The device according to claim 13, wherein the background processing module is further configured to:

    If the SSL authentication mode corresponding to the access request is a one-way authentication, the access request includes a login account and a password of the terminal, and verify whether the login account and the password match;

    If the SSL authentication mode corresponding to the access request is a two-way authentication, the packet header of the access request includes the identifier information of the terminal, and the identifier information of the terminal is verified to be registered.
15. An electronic device, comprising: a transceiver, a processor, a memory, and a communication interface, wherein the transceiver, the processor, the memory, and the communication interface are connected by a bus;

    The transceiver is configured to receive an access request sent by the terminal, and send the access request to the background server, where the background server is configured to determine the access authority of the terminal according to whether the access request carries the identification information of the terminal;

    The processor is configured to read a program in the memory and perform the following methods:

    Determining an SSL authentication mode corresponding to the access request; if the two-way authentication is performed, adding the identification information of the terminal to the access request after the two-way authentication is passed;

    The memory is configured to store one or more executable programs, and may store data used by the processor when performing operations.
16. The electronic device according to claim 15, wherein the transceiver is specifically configured to:

    Transmitting a certificate of the electronic device to the terminal and receiving an authentication result of the electronic device by the terminal;

    Sending a certificate acquisition request to the terminal;

    Receiving a terminal certificate sent by the terminal, where the terminal certificate includes identification information of the terminal;

    The processor is specifically configured to complete authentication of the terminal according to the terminal certificate.
17. The electronic device of claim 16, wherein the terminal certificate is obtained by:

    The terminal generates a certificate request CSR file according to the identification information of the terminal;

    Sending, by the terminal, the CSR to a certificate authority, so that the certificate issuing authority generates the terminal certificate according to the CSR;

    The terminal receives the terminal certificate sent by the certificate authority.
18. The electronic device according to claim 15, wherein the access request includes a port number;

    The processor is specifically configured to determine, according to the port number, that the SSL authentication mode corresponding to the access request is two-way authentication or one-way authentication.
19. The electronic device of claim 16 wherein:

    The transceiver is configured to receive an https request sent by the terminal, and send the http request that adds the identifier information to the background server;

    The processor is specifically configured to convert the https request into an http request, and at the http The identification information of the terminal is inserted into the requested packet header.
20. An electronic device, comprising: a transceiver, a processor, a memory, and a communication interface, wherein the transceiver, the processor, the memory, and the communication interface are connected by a bus;

    The transceiver is configured to receive an access request sent by an ingress server, and send a processing result to the ingress server;

    The processor, the processor, is configured to read a program in the memory, and execute the following method:

    Determining, according to the identifier information of the terminal, the SSL authentication mode corresponding to the access request, and verifying the terminal according to the SSL authentication mode corresponding to the access request; Access request

    The memory is configured to store one or more executable programs, and may store data used by the processor when performing operations.
21. The electronic device according to claim 20, wherein the processor is further configured to:

    If the SSL authentication mode corresponding to the access request is a one-way authentication, the access request includes a login account and a password of the terminal, and verify whether the login account and the password match;

    If the SSL authentication mode corresponding to the access request is a two-way authentication, the packet header of the access request includes the identifier information of the terminal, and the identifier information of the terminal is verified to be registered.
22. A non-transitory computer readable storage medium, wherein the non-transitory computer readable storage medium stores computer instructions for causing the computer to perform the method of any one of claims 1 to 5. Or the computer instructions are for causing the computer to perform the method of any of claims 6-7.
23. A computer program product, comprising: a computing program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer, The computer executes the method of any one of claims 1 to 5; or causes the computer to perform the method of any of claims 6-7.

Images