CN115720171A - Safe intelligent gateway system and data transmission method - Google Patents

Safe intelligent gateway system and data transmission method Download PDF

Info

Publication number
CN115720171A
CN115720171A CN202211515168.7A CN202211515168A CN115720171A CN 115720171 A CN115720171 A CN 115720171A CN 202211515168 A CN202211515168 A CN 202211515168A CN 115720171 A CN115720171 A CN 115720171A
Authority
CN
China
Prior art keywords
gateway
user
access
service
realizing
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202211515168.7A
Other languages
Chinese (zh)
Inventor
黄华
甘滨
李明
李清源
程兴防
陈剑飞
赵丽娜
刘子函
盛华
张婕
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
QINGDAO POWER SUPPLY Co OF STATE GRID SHANDONG ELECTRIC POWER Co
State Grid Corp of China SGCC
Information and Telecommunication Branch of State Grid Shandong Electric Power Co Ltd
Original Assignee
QINGDAO POWER SUPPLY Co OF STATE GRID SHANDONG ELECTRIC POWER Co
State Grid Corp of China SGCC
Information and Telecommunication Branch of State Grid Shandong Electric Power Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by QINGDAO POWER SUPPLY Co OF STATE GRID SHANDONG ELECTRIC POWER Co, State Grid Corp of China SGCC, Information and Telecommunication Branch of State Grid Shandong Electric Power Co Ltd filed Critical QINGDAO POWER SUPPLY Co OF STATE GRID SHANDONG ELECTRIC POWER Co
Priority to CN202211515168.7A priority Critical patent/CN115720171A/en
Publication of CN115720171A publication Critical patent/CN115720171A/en
Pending legal-status Critical Current

Links

Images

Landscapes

  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

The invention provides a safe intelligent gateway system and a data transmission method, comprising the following steps: the system comprises a service system, a honeypot, a unified identity authentication platform docking system and a gateway access module, wherein the gateway access module is used for realizing the access operation of the service system, realizing the flow control of a company service system by accessing the service system and realizing the forwarding, blocking and drainage of service access requests based on the forwarding and processing logic of the service; the functions of selective flow verification and directional flow forwarding based on the detection result of the control gateway are realized; the gateway control module is used for realizing a security detection function based on login state detection and identity real-name authentication; and realizing IP verification, constructing an information IP database according to the blacklist statistical result of the existing third-party threat sensing platform, opening an interface to be butted with the control gateway, judging the request by the control gateway based on the threat information IP database, and returning the judged result to the gateway access module. The invention is helpful to improve the security of remote service handling and effectively prevent illegal invasion.

Description

Safe intelligent gateway system and data transmission method
Technical Field
The invention relates to the technical field of network security, in particular to a secure intelligent gateway system and a data transmission method.
Background
With the continuous rise of emerging technologies such as cloud computing, big data, internet of things and the like, enterprise IT architecture is changing from 'with boundary' to 'without boundary', and simultaneously, the digital development of companies, new services and new scenes are emerging continuously, network chains are extending continuously, the service exposure surface is expanding continuously, and more employees are willing to use their own equipment to work. When more and more service accesses are initiated from the internet environment, the network security protection of the service system becomes more important.
The Chinese patent name: a remote office system, method, intelligent terminal and storage medium, patent number: CN114826704A, which provides a remote office system, a method, an intelligent terminal and a storage medium, and aims to solve the problem that in the prior art, when a remote office user uses an office system for remote office, private data inside an enterprise is easily intercepted and interfered in the transmission process, so that the security of enterprise information is reduced; the user application module is used for realizing the office requirements of the user; the user gateway module is used for sending a data access request to the enterprise terminal; the information authentication module and the enterprise gateway module are used for verifying and establishing communication connection with the user gateway module; the enterprise application module is used for realizing management and scheduling of enterprise data, and the method and the system have the effect of improving the security of private data in the remote office process. The invention protects company information by setting multiple times of verification information, does not carry out further encryption protection in the processes of information transmission and the like, and has low confidentiality degree; if illegal intrusion occurs, the intrusion path cannot be obtained in time.
Disclosure of Invention
Aiming at the problems in the prior art, the invention provides a safe intelligent gateway system and a data transmission method, wherein the safe intelligent gateway system mainly comprises a gateway access module and a gateway control module, and the gateway access module realizes the release of company business system application through an 'access gateway system', the exposed surface convergence, the access admission and the safety audit capability of the business application; the gateway control module realizes the security detection capability based on login state detection and identity real-name authentication.
The technical scheme adopted by the invention is as follows:
a secure intelligent gateway system, comprising: the system comprises a service system, a honeypot, a unified identity authentication platform docking system and a gateway access module, wherein the gateway access module is used for realizing the access operation of the service system, realizing the flow control of a company service system by accessing the service system and realizing the forwarding, blocking and drainage of service access requests based on the forwarding and processing logic of the service; the functions of selective flow verification and directional flow forwarding based on the detection result of the control gateway are realized;
the gateway control module is used for realizing a security detection function based on login state detection and identity real-name authentication; and IP verification is realized, an information IP database is established according to the blacklist statistical result of the existing third-party threat sensing platform, an open interface is butted with the control gateway, the control gateway studies and judges the request based on the threat information IP database, and the study and judgment result is returned to the gateway access module.
A data transmission method of a safety intelligent gateway system is suitable for the safety intelligent gateway system and comprises the following steps:
the method comprises the following steps of uniformly accessing external business applications of a company to a gateway access module of a safe intelligent gateway, realizing uniform release of a business system through the gateway access module, and realizing forwarding, blocking and guiding of a business access request based on self forwarding and processing logic;
the accessed flow is converged into a gateway control module, so that the access request detection work is realized, and the login state detection and identity real-name authentication functions are realized;
judging whether the IP address is an attacker, if so, inductionless guiding the malicious attacked ip address to a company honeypot, and facilitating subsequent source tracing and reverse work; if not, jumping to the unified identity authentication platform docking system, performing identity authentication, and then jumping to a service system.
The beneficial effects of the invention are as follows: the user information storage unit and the real-name authentication and verification unit are arranged for verifying the identity of the user, and meanwhile, the login state management unit is arranged for decrypting the encrypted login state and session information in the cookie through the control gateway to judge whether the user logs in or not, so that the safety is higher; the invention is provided with an illegal access user authentication unit used for carrying out compliance verification on the Cookie decryption result, and the gateway access module carries out source tracing on forwarding the non-compliance request to the honeypot service, so that the illegal path source of the user can be timely reminded, and the illegal path detection is prevented.
Drawings
Embodiments of the present invention will now be described more fully hereinafter with reference to the accompanying drawings. The drawings are, however, to be regarded as illustrative and explanatory only and are not restrictive of the scope of the invention.
FIG. 1 is a block diagram of a secure intelligent gateway of the present invention;
FIG. 2 is a flow chart of a data transmission method of the security intelligent gateway of the present invention;
Detailed Description
The invention is further illustrated by the following examples in conjunction with the accompanying drawings: in order to clearly explain the technical features of the present invention, the following detailed description of the present invention is provided with reference to the accompanying drawings. The following disclosure provides many different embodiments, or examples, for implementing different features of the invention. To simplify the disclosure of the present invention, the components and arrangements of specific examples are described below. Furthermore, the present invention may repeat reference numerals and/or letters in the various examples. This repetition is for the purpose of simplicity and clarity and does not in itself dictate a relationship between the various embodiments and/or configurations discussed. It should be noted that the components illustrated in the figures are not necessarily drawn to scale. Descriptions of well-known components and processing techniques and processes are omitted so as to not unnecessarily limit the invention.
As shown in fig. 1, the present invention provides a secure intelligent gateway system, including: the system comprises a service system, a honeypot, a unified identity authentication platform docking system, a gateway access module and a gateway control module;
the gateway access module is used for realizing the access operation of a service system, realizing the flow control of a company service system through accessing the service system, and realizing the forwarding, blocking and guiding of a service access request based on the forwarding and processing logic of the service; the functions of selective flow verification and directional flow forwarding based on the detection result of the control gateway are realized; the gateway access module includes: a trigger and wait component and a response and disposal component. The wait component is triggered. Based on 6 parameters of user roles, service system labels, major guarantee time, source IP, destination IP and request content keywords, whether the access request is forwarded to the control gateway s1 for detection is determined, different detection rules are triggered aiming at different types of services, and flexible starting and stopping based on different service scene strategies are realized. The response and disposal component dynamically authorizes the identity by continuously monitoring the behavior in the flow according to the analysis and detection result of the gateway control module, releases the network behavior of qualified credit, achieves the fineness distinction between normal access and hacking attack, and automatically triggers related operations when the credit score is lower than a set threshold value, such as sending short messages or mail reminding by abnormal login addresses or illegal attack operations, requiring secondary authentication or manual confirmation when the credit score is too low, and carrying out non-perception drainage to a honeypot after a malicious user logs in. And respectively forwarding the flow in three directions, namely normal forwarding, access blocking and directional drainage to a honeypot system, and generating a safety log. The three forwarding states can be started and stopped by configuring three parameters of a source IP, a target IP and a service system label.
The gateway control module is used for realizing a security detection function based on login state detection and identity real-name authentication; the IP verification is realized, an information IP database is established according to the blacklist statistical result of the existing third-party threat sensing platform, an open interface is connected with a control gateway in a butt joint mode, the control gateway studies and judges the request based on the threat information IP database, the study and judgment result is returned to a gateway access module response and disposal module, IP of malicious attack is drained to a honeypot, the hacker tracing operation is facilitated, and a normal login user can access a normal service system.
The gateway control module is provided with a login state detection unit, captures and detects cookie information requested by a user, judges whether the user logs in, whether the login state is overtime and whether the same cookie comes from the same source IP, and returns a login state detection result to a response and disposal component of the gateway access module.
The gateway control module is provided with a real-name authentication check unit, dynamically captures an application ID of a user access source and a login target system by virtue of an access gateway, and unifies the docking of the identity authentication platform docking system, wherein the unified identity authentication platform docking system is used for storing user identity authentication information and is used for docking the control module to realize the real-name authentication of internet user access.
The gateway control module is provided with a user information storage unit, and after the user logs in and verifies, information such as user ID, login state and session state is encrypted and stored by cookie, so that unified management and control of the identity are ensured.
The gateway control module is configured with a login state management unit, and judges whether the user logs in or not by controlling the gateway to decrypt the encrypted login state and the session information in the cookie. The user does not need to log in again when accessing within the session validity period, and the user experience degree is improved.
The gateway control module is provided with an illegal access user authentication unit, the control gateway carries out compliance verification on the Cookie decryption result, and the access gateway forwards the non-compliance request to the honeypot service for tracing, so that illegal path detection is avoided.
The gateway control module is provided with a real-name authentication unit to ensure that login is safer, whether real-name authentication is performed or not is judged by capturing cookie information of a user, if the real-name authentication is not performed, the user automatically jumps to a page of company real-name authentication, user authentication information is recorded through redis cache, failure time is set, re-authentication is not needed when the user accesses the network for the second time within the validity period, and detection service efficiency is improved. The control gateway can collect malicious accessed real-name authentication information, assist attack behavior analysis and improve the source tracing and control efficiency.
Example one
Fig. 1 shows a structure diagram of a secure intelligent gateway according to an embodiment of the present invention. A gateway control module page service configuration system is provided based on an intelligent gateway control module, the gateway control module configures a uniform web configuration interface according to different services, and the system specifically comprises:
a. the function of importing the white list is supported, and the IP of the white list is allowed to access the service system;
b. adding new user information functions including the service system cookie name, the service system url and the like;
c. capturing and recording a business system user name, and configuring a business system name, a business system url and a business system cookie;
d. the user requests the grabbing and comparison of the user login state in the cookie, and whether the user finishes the login of the corresponding system, whether the login state is overtime (can be configured uniformly), and whether the cookie state is consistent with the last access are judged. The gateway control module realizes the grabbing of cookie information, judges whether a historical login state exists or not and determines whether page access authority is granted or not.
And inquiring the login state, the session information, the access source IP and the like in the cookie according to the configured interface, and judging whether the cookie information is abnormal or not according to whether the returned login state is valid or not. Setting the overtime time of the cookie, automatically directing to a corresponding login interface when the system does not respond, and logging again.
Example two
The embodiment II of the invention provides a unified identity authentication platform system which is connected with an intelligent gateway, locates the identity of the current system of a user by taking a user name submitted when the user logs in the system, a generated cookie and an IP address when the user logs in as main keys, and establishes an identity authentication center based on a user built in the system. And secondly, establishing system identity monitoring. And (3) connecting a safety alarm system, associating user login data with corresponding IP address attack events, establishing a system identity monitoring system, focusing on authorized users with permission to view more exposed surfaces of the system, deeply judging the display condition of user access logic and access pages among different users, and solving the problem of cross-walk unauthorized. And establishing a real name to control the login user. At the side of the intelligent gateway, the identity authentication center completes the real-name identity verification of the user, the real name manages and controls all external service system users, and the credibility of various real user access behaviors in a network space can be evaluated according to the identity monitoring system to sense the credibility of the user behaviors. And finally, realizing the unified management of the identity data. According to the data of the identity authentication center, the account number, the password and the login time are used as latitudes for data analysis, the long-term unused account number is deleted, the problems of weak passwords, null passwords, expired passwords, default passwords and the like are solved, and the risk of the account number password is further reduced.
As shown in fig. 2, the present invention provides a data transmission method for a secure intelligent gateway, which specifically includes:
the method comprises the following steps of uniformly accessing external business applications of a company to a gateway access module of a safe intelligent gateway, realizing uniform release of a business system through the gateway access module, and realizing forwarding, blocking and guiding of a business access request based on self forwarding and processing logic;
the accessed flow is converged into a gateway control module, so that the access request detection work is realized, and the login state detection and identity real-name authentication functions are realized;
judging whether the IP address is an attacker, if so, inductionless guiding the malicious attacked ip address to a company honeypot, and facilitating subsequent source tracing and reverse work; if not, jumping to the unified identity authentication platform docking system, performing identity authentication, and then jumping to a service system.
Finally, it should be noted that: the above embodiments are only for illustrating the technical solutions of the present invention and not for limiting the same, and although the present invention is described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that: modifications and equivalents may be made to the embodiments of the invention without departing from the spirit and scope of the invention, which is to be covered by the claims.

Claims (10)

1. A secure intelligent gateway system, comprising: business system, honeypot system, unified identity authentication platform butt joint system, its characterized in that includes:
the gateway access module is used for realizing the access operation of a service system, realizing the flow control of a company service system through accessing the service system, and realizing the forwarding, blocking and guiding of a service access request based on the forwarding and processing logic of the service; the functions of selective flow verification and directional flow forwarding based on the detection result of the control gateway are realized;
the gateway control module is used for realizing a security detection function based on login state detection and identity real-name authentication; comparing the login IP information database of the captured user; the database comprises blacklist IP addresses of the third-party threat perception platform and manually-entered high-risk IP address data, and the blacklist IP addresses and the manually-entered high-risk IP address data are compared with the gateway control module; studying and judging the IP address logged by the user and the IP address in the database, returning the studying and judging result to the gateway access module, and returning the studying and judging result to the gateway access module according to the studying and judging result of the gateway control module to realize the passing of the IP address;
the gateway access module receives a matching result returned by the control module, determines the access authority of the system, and simultaneously, is in butt joint with a company unified identity authentication platform to check the identity information of the user; for users meeting the login conditions, directly accessing a service system, and for malicious network attack users, introducing the users into a company honey pot area to ensure that only company employees log in; and recording the login user through a cache, setting the failure time, and if the user accesses the login page again within the validity period, not needing to authenticate again.
2. The secure intelligent gateway system of claim 1, wherein the gateway access module comprises a trigger and wait component, a response and handle component;
the triggering and waiting component determines whether to forward the access request to a gateway control module for detection according to the user role, the service system label, the major guarantee time, the source IP, the destination IP and the request content keyword;
and the response and handling component analyzes the detection result according to the gateway control module, forwards the flow and generates a security log.
3. The security intelligent gateway system of claim 1, wherein the gateway control module is configured with a login status detection unit, which captures and detects cookie information requested by a user, determines whether the user logs in, whether the login status is overtime, and whether the same cookie is from the same source IP, and returns the login status detection result to the gateway access module.
4. The secure intelligent gateway system of claim 3, wherein the gateway control module is configured with a real-name authentication verification unit, and dynamically captures an application IP of a user accessing a source and logging in a target system by means of the access gateway; and the system is in communication connection with the unified identity authentication system and is used for storing user identity authentication information and realizing the real-name authentication function of internet user access.
5. The system of claim 4, wherein the user Cookie information is captured to determine whether the authentication is performed by real name authentication, if not, the system automatically jumps to a page of company real name authentication, records the user authentication information through redis cache, sets expiration time, and if the user accesses the login page again within the validity period, the re-authentication is not needed.
6. The secure intelligent gateway system of claim 5, wherein the gateway control module is configured with an illegal access user authentication unit for performing compliance verification on the Cookie decryption result, and the gateway access module performs tracing on forwarding the non-compliance request to the honeypot service to prevent illegal path detection.
7. The secure intelligent gateway system according to claim 6, wherein the gateway control module is configured with a user information storage unit, and after the user login verification, the user information is encrypted and stored by using a Cookie for unified identity management and control; the user information includes: user information ID number, login state, session state information.
8. The system of claim 7, wherein the gateway control module is configured with a login status management unit, which obtains the traffic packet of the user by capturing, decrypts the encrypted login status and session information in the Cookie through the control gateway, determines whether the Cookie attribute has the logged-in attribute, sets the Cookie expiration time to 60s in the control module of the gateway, normally executes the service interface within 1 minute after logging in, and re-logs in to determine whether the user logs in after more than 1 minute.
9. The secure intelligent gateway system of claim 2, wherein the response and handling component forwarding traffic specifically comprises: and the three forwarding states are started and stopped by configuring three parameters of a source IP, a target IP and a service system label.
10. A data transmission method of a secure intelligent gateway system, the method being applied to the secure intelligent gateway system according to any one of claims 1 to 9, the method comprising the steps of:
the method comprises the following steps of uniformly accessing external business applications of a company to a gateway access module of a safe intelligent gateway, realizing uniform release of a business system through the gateway access module, and realizing forwarding, blocking and guiding of a business access request based on self forwarding and processing logic;
the accessed flow is converged into a gateway control module, so that the access request detection work is realized, and the login state detection and identity real-name authentication functions are realized;
judging whether the IP address is an attacker, if so, inductionless guiding the malicious attacked IP address to a company honeypot, and facilitating subsequent source tracing and reverse control work; if not, skipping to the unified identity authentication system, and skipping to the service system after identity authentication.
CN202211515168.7A 2022-11-30 2022-11-30 Safe intelligent gateway system and data transmission method Pending CN115720171A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202211515168.7A CN115720171A (en) 2022-11-30 2022-11-30 Safe intelligent gateway system and data transmission method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202211515168.7A CN115720171A (en) 2022-11-30 2022-11-30 Safe intelligent gateway system and data transmission method

Publications (1)

Publication Number Publication Date
CN115720171A true CN115720171A (en) 2023-02-28

Family

ID=85257020

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202211515168.7A Pending CN115720171A (en) 2022-11-30 2022-11-30 Safe intelligent gateway system and data transmission method

Country Status (1)

Country Link
CN (1) CN115720171A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117202193A (en) * 2023-11-08 2023-12-08 中国电子科技集团公司第三十研究所 Communication module safety protection method and assembly based on host terminal connection authentication

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150013006A1 (en) * 2013-07-02 2015-01-08 Imperva Inc. Compromised insider honey pots using reverse honey tokens
CN110958237A (en) * 2019-11-26 2020-04-03 苏州思必驰信息科技有限公司 Authority verification method and device
CN111510453A (en) * 2020-04-15 2020-08-07 深信服科技股份有限公司 Business system access method, device, system and medium
CN115022077A (en) * 2022-06-30 2022-09-06 绿盟科技集团股份有限公司 Network threat protection method, system and computer readable storage medium

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150013006A1 (en) * 2013-07-02 2015-01-08 Imperva Inc. Compromised insider honey pots using reverse honey tokens
CN110958237A (en) * 2019-11-26 2020-04-03 苏州思必驰信息科技有限公司 Authority verification method and device
CN111510453A (en) * 2020-04-15 2020-08-07 深信服科技股份有限公司 Business system access method, device, system and medium
CN115022077A (en) * 2022-06-30 2022-09-06 绿盟科技集团股份有限公司 Network threat protection method, system and computer readable storage medium

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117202193A (en) * 2023-11-08 2023-12-08 中国电子科技集团公司第三十研究所 Communication module safety protection method and assembly based on host terminal connection authentication
CN117202193B (en) * 2023-11-08 2024-01-05 中国电子科技集团公司第三十研究所 Communication module safety protection method and assembly based on host terminal connection authentication

Similar Documents

Publication Publication Date Title
US11652812B2 (en) Network security dynamic access control and policy
CN110324287A (en) Access authentication method, device and server
CN106027463B (en) A kind of method of data transmission
US11792008B2 (en) Actively monitoring encrypted traffic by inspecting logs
CN105991647B (en) A kind of method of data transmission
US20180083958A1 (en) System and method for network user's authentication and registration by way of third party computing device
CN103455763A (en) Internet surfing log recording system and method capable of protecting personal privacies of users
CN106027466B (en) A kind of identity card cloud Verification System and card-reading system
CN106027476B (en) A kind of identity card cloud Verification System and card-reading system
US20110023088A1 (en) Flow-based dynamic access control system and method
Sathish Babu et al. A dynamic authentication scheme for mobile transactions
CN117040741A (en) Method and device for safely transmitting data based on FTTR networking mode
CN115720171A (en) Safe intelligent gateway system and data transmission method
CN109600395A (en) A kind of device and implementation method of terminal network access control system
CN116192497B (en) Network access and user authentication safe interaction method based on zero trust system
TWI676115B (en) System and method for managing certification for cloud service system
CN116248405A (en) Network security access control method based on zero trust and gateway system and storage medium adopting same
CN115941252A (en) MQTT dynamic access control method based on trust calculation
Chauhan et al. Computer Security and Encryption: An Introduction
CN108093078B (en) Safe document circulation method
Choi IoT (Internet of Things) based Solution Trend Identification and Analysis Research
Phan et al. Threat detection and mitigation with MonB5G components in the aLTEr scenario
Mahlous Threat model and risk management for a smart home iot system
Tang et al. Research on security protection countermeasures of internet of things
KR102362320B1 (en) System and method for communicating of network address mutation on dynamic network security

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination