WO2010081380A1

WO2010081380A1 - Method and gateway device for local area network access control

Info

Publication number: WO2010081380A1
Application number: PCT/CN2009/076252
Authority: WO
Inventors: 张战兵; 陈爱平; 徐蒙; 孙宏
Original assignee: 成都市华为赛门铁克科技有限公司
Priority date: 2009-01-19
Filing date: 2009-12-30
Publication date: 2010-07-22
Also published as: CN101478485A; CN101478485B

Abstract

A method for local area network (LAN) access control includes that: a first gateway performs the registration user information synchronization interacting with a second gateway; the first gateway receives an access request of the user; according to the registration user information synchronized with the second gateway, the first gateway performs the access control for the user accessing a LAN. A gateway device includes: an information synchronization unit which is used to perform the registration user information synchronization interacting with another gateway; an access control unit which is used to receive the access request of the user, and perform the access control for the user accessing a LAN according to the registration user information synchronized with another gateway. It can be implemented that the user can obtain the authority of accessing multiple LANs resources after registering at one gateway.

Description

LAN access control method and gateway device

This application claims priority to Chinese Patent Application No. 200910005547.X, filed on Jan. 19, 2009, entitled "LAN Access Control Method and Gateway Device", the entire contents of which are incorporated by reference. In this application.

Technical field

The present invention relates to the field of communications technologies, and in particular, to a method for access control of a local area network and a gateway device.

Background technique

With the continuous development of Internet (Internet) network technology, information security and information protection have received more and more attention. The existing gateway access modes are mainly Security Socket Layer (SSL) and Security Architecture for IP network (IPSec). They are usually connected behind the firewall and before the LAN resources. , providing secure access to external network users.

In the SSL access mode, if you want to access the resources of the LAN where the gateway is located, you need to log in at the gateway. After logging in, you can obtain resources according to the permissions granted to the user by the gateway. The process of users logging in to the gateway is generally:

The user enters a user name and password on the login interface, and the gateway performs a full certificate on the user name and password input by the user according to the saved user information database. After the full certificate is passed, the gateway negotiates an SSL-encrypted key with the user. , then complete the login. Thereafter, the data packets transmitted between the gateway and the user are encrypted using the key, and the gateway and the user can use the key to decapsulate the transmitted data packets. To achieve security control of data transmission.

A significant disadvantage of the SSL access gateway is that if a user wants to access multiple physical LANs, it needs to register separately on multiple gateways of the multiple LANs. The user operation is cumbersome and inconvenient.

Summary of the invention

The embodiment of the invention provides a method for accessing a local area network and a gateway device, which can obtain the right to access a plurality of local area network resources after the user registers with a gateway.

The embodiment of the invention provides a method for access control of a local area network, including:

The first gateway interacts with the second gateway to synchronize the registered user information; The first gateway receives an access request of the user;

The first gateway performs access control on the user access to the local area network according to the registered user information synchronized with the second gateway.

The embodiment of the invention further provides a gateway device, including:

An information synchronization unit, configured to perform synchronization with another gateway to perform registration of user information; an access control unit, configured to receive an access request of the user, and connect the user to access the local area network according to the registered user information synchronized with another gateway Into control.

It can be seen from the above technical solution that the registration user information is synchronized through the interaction between the gateways; when the user registers with one gateway and then logs in to other gateways, other gateways can access the local area network according to the synchronized registered user information. Perform access control. It is not necessary to repeat the registration in other gateways according to the prior art, which simplifies the process of user registration, so that once the user is used to obtain access rights at a gateway, the user can log in to multiple local area networks to obtain resources, which greatly facilitates the user.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor.

1 is a schematic diagram of networking in accordance with an embodiment of the present invention;

2 is a flowchart of a method for access control of a local area network according to an embodiment of the present invention; FIG. 3 is a flowchart of a method for access control of a local area network according to an embodiment of the present invention; FIG. 4 is a structure of a gateway device according to an embodiment of the present invention; Schematic diagram

FIG. 5 is a schematic structural diagram of a gateway device according to an embodiment of the present invention; FIG.

FIG. 6 is a schematic structural diagram of a communication system according to an embodiment of the present invention.

detailed description

BRIEF DESCRIPTION OF THE DRAWINGS The technical solutions in the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative work are within the scope of the present invention.

Embodiments of the present invention provide a method for access control of a local area network, and a gateway device and a communication system Method.

As shown in FIG. 1 , a networking diagram of an embodiment of the present invention establishes an IPSec (Security Architecture for IP network, IP layer) between gateways (first gateway and second gateway) of different local area networks (LAN 1 and LAN 2). Protocol security structure) tunnel, the first gateway and the second gateway interact through the IPsec channel to maintain synchronization of registered user information. When the user registers with one of the gateways, the other gateway can obtain the registration of the user through data synchronization. User information, wherein the first gateway is in the local area network 1 and the second gateway is in the local area network 2; in this example, data transmission using the IPSec channel can ensure the security of communication between the local area network 1 and the local area network 2.

After the user logs in on the first gateway, LAN 1 and LAN 2 are safe for the user. You can directly access the resources of LAN 1 and LAN 2. The data sent to the local area network 2 is intercepted by the first gateway, encapsulated into an IPsec message and sent to the second gateway, and then parsed by the second gateway and forwarded to the local area network 2, and vice versa. It can be understood that the user can directly access the local area network 2 without going through the local area network 1. Since the user has already registered at the first gateway, it is not necessary to repeat the registration at the second gateway, and the resources of the local area network 2 can be directly accessed through the verification of the second gateway.

Preferred embodiments of the present invention are described in detail below.

As shown in FIG. 2, the method for accessing local area network access control according to an embodiment of the present invention includes: A1, the first gateway interacts with the second gateway to synchronize the registered user information;

There are a variety of specific synchronization methods, for example: The synchronization process can be divided into an initial synchronization phase and an update synchronization phase:

The initial synchronization phase: the gateway copies all the registered user information of each other to complete the initial synchronization; when the registered user information between the gateways is completely consistent, the update synchronization phase is entered;

Update synchronization phase: After the initial synchronization, when the registered user information of a certain gateway changes, the changed data is notified to other gateways with synchronization relationship, and other gateways perform data update.

In the embodiment of the present invention, after the first gateway and the second gateway perform the synchronization of the registered user information, if the registered user information configured by one of the first gateway and the second gateway changes, the update is performed. The information is sent to another gateway for configuration updates. To ensure that the first gateway and the second gateway have the same registered user information.

In this embodiment, the registered user information includes:

The user's login identity verification information and the corresponding user access security control policy. The login identity verification information of the user may be in various forms for identifying the user, generally in the form of a user name and a password, which may be understood, and may also be used, such as: a user's Internet Protocol (IP) address, media access. A control (MAC) address or the like that can identify the identity of the user.

The security control policy includes: a user's permission setting and a local area network resource corresponding to the permission.

For example: User permissions can be divided into administrator level, user level, and visitor level;

Users with administrator-level privileges have the highest authority to access and modify all resources in the LAN, and manage the resource configuration and data system of the LAN;

Users with user-level privileges can access and tamper with resources in the shared area;

Users with guest-level permissions can only get resources for the shared zone in a "read-only" manner.

In the above update synchronization phase, the registration user information changes include: registration of new users, destruction of user information, change of user privilege level, change of resource configuration corresponding to privilege level, and the like.

Specifically, the communication between the first gateway and the second gateway is established by using the embodiment of the present invention.

The IPsec tunnel implements data transmission between the first gateway and the second gateway through an IPsec tunnel, and encapsulates the data into an IPsec format before the data transmission. . The communication in the IPsec tunnel mode can make the data exchanged between the gateways more secure, because only the gateway having the tunnel identifier can decapsulate the IPsec packet, and the present invention is not limited to the manner of completing the gateway between the gateways. Communication, existing conventional communication methods can be used, such as a conventional conversation mode, etc., and the specific manner does not constitute a limitation of the present invention. It can be understood that if the IPsec tunnel is disconnected, the first gateway and the second gateway renegotiate to establish an IPsec tunnel to ensure real-time connectivity.

A2. The first gateway receives an access request of the user.

The first gateway performs access control on the user accessing the local area network according to the registered user information synchronized with the second gateway.

Determining, according to the registered user information that is synchronized with the second gateway, whether the user accessing the first gateway is legal, and if the user is legal, allowing the user to access, and if not, rejecting the user. Access.

Specifically, the process of determining whether the user is registered in the first gateway includes:

Obtain the username and password in the user access request;

Checking whether the user name is included in the registration information synchronized with the second gateway; if the user is Name; continue to check whether the password is correct, if the password is correct, the confirmation is legal; if the user name or password of the user is not correct, the confirmation is invalid.

It can be understood that the process of specifically determining whether the user is registered in the first gateway may be: acquiring an IP address or a MAC address in the user access request, and checking whether the registration information synchronized with the second gateway includes the The IP address or MAC address, if included, allows access by the user.

In this embodiment, the method further includes: the first gateway receives the packet and performs packet forwarding processing. In the embodiment of the present invention, the gateway can receive three types of packets and can perform different processing on different packets.

If the packet received by the first gateway is a Secure Sockets Layer SSL packet, the packet is decapsulated, and the security control policy of the user is checked. If the gateway security policy is not met, the packet is discarded. If the security control policy of the gateway is met, the destination address of the packet is further determined. If the destination address is the local area network where the first gateway is located, the forwarding is performed directly, if the destination address of the packet is the second address. The local area network of the gateway is encapsulated into IPsec packets and sent to the second gateway through the IPsec tunnel.

If the packet received by the first gateway is a packet of the local area network where the first gateway is located, if the destination address of the packet is a public network, the packet is encapsulated into an SSL packet and sent; if the packet is The local area address is the local area network where the second gateway is located, and is encapsulated into an IPsec message and sent to the second gateway through an IPsec tunnel with the second gateway.

If the packet received by the first gateway is an IPsec packet sent by the second gateway, it is determined whether the destination address of the packet is the local area network of the gateway, and if yes, the IPsec decapsulation is performed and then forwarded.

In the embodiment of the present invention, the registration user information is synchronized by the interaction between the gateways; when the user registers with another gateway and then logs in to other gateways, the other gateways can access the local area network according to the synchronized registered user information. Into control. The process of registering with other gateways is not required in the prior art, which simplifies the process of user registration, so that once the user is used to obtain access rights at a gateway, the user can log in to multiple local area networks to obtain resources, which greatly facilitates the user.

Further, in the embodiment of the present invention, an IPsec tunnel is established between the gateways, and the registered user information is synchronized and data transmitted through the established IPsec tunnel, so that the data transmission between the gateways is more secure and reliable.

An embodiment of the present invention describes a feasible processing manner of a gateway for different packets, and the process As shown in Figure 3, it includes:

B1, the gateway receives the 艮 text;

B2, checking the type of the message; if the type of the message is an ordinary message, that is, the message is a message inside the local area network of the gateway, proceed to step B3; if the type of the message is an SSL message, continue the step B4; If the type of the packet is an IPsec packet, proceed to step B5;

B3, the ordinary message processing is performed, and the specific processing manner is as follows: if the destination address of the ordinary packet is a public network, the packet is sent after being encapsulated by SSL; if the destination address of the ordinary packet is the local area network where the gateway is located If the destination address of the ordinary packet is another local area network, the packet is encapsulated into an IPsec message and sent to the opposite gateway through an IPsec tunnel with the gateway in the other local area network.

B4, parsing the SSL packet and proceeding to step B6.

B5, determining whether the destination address of the IPsec packet is the local area network of the gateway, and if so, decapsulating and forwarding, if not, searching for the IPsec tunnel according to the destination address, forwarding through the IPsec tunnel, and ending the process.

B6: Performs security policy matching on the data that is synchronized with other gateways. If the matching succeeds, proceed to step B8. If the matching fails, proceed to step B7.

B7, discards the packet and ends the process.

B8, determining whether the destination address of the packet is the local area network of the gateway, and if yes, proceeding to step B9, if no, proceeding to step B10.

B9: Forwards the packet according to the destination address, and ends the process.

B10: Search for an IPsec tunnel according to the destination address of the packet. If found, proceed to step B11. If no, continue to step B12.

It can be understood that the gateway saves the IPsec tunnel established with other gateways and saves it as an Access Control List (ACL). When IPsec packets are sent, the ACL is searched for an IPsec tunnel.

Bl 1 , sending the IPsec message to other gateways by using the found IPsec tunnel. B12, discarding the IPsec text. And end this process.

Based on the foregoing method, the gateway in the embodiment of the present invention can process IPsec and SSL packets. After the IPsec tunnel is configured, the gateway maintains the communication relationship between the two ends of the IPsec tunnel. Once the tunnel is broken, The gateway will re-negotiate to establish a tunnel. After each tunnel is established, the gateway can re-synchronize the registered user information at both ends.

In the process of synchronizing the registered user information through the IPsec tunnel, each time the registered user information between the gateways is transmitted one by one for comparison, in addition to spending more time, the IPsec tunnel may be blocked, which is not conducive to the operation of the service.

Therefore, in the embodiment of the present invention, only the changed data can be updated to reduce the amount of data transmitted during synchronization, and specifically, the changed data can be sent to the opposite gateway by updating the information. The changed data here can include: modified data, added data, deleted data.

The following examples are given by way of a specific example, and the following examples are merely illustrative of a possible embodiment of the invention and are not intended to limit the invention.

A flag bit, a serial number, and an aging bit are set for each registered user information. The registered user information includes: a user's login identity verification information and a corresponding user access security control policy, and the security control policy includes: a user's permission setting and a local area network resource whose permission corresponds to the access.

The registered user information of different gateways has different sequence numbers assigned. This serial number is used to uniquely identify each registered user information.

The flag bit is used to identify the status of each registered user information. The meaning of the representation of the value of the flag bit is shown in Table 1.

Registered user information with flags 1 and 5 will not take effect and will only be saved in the gateway for synchronization. Registered user information with flags 2, 3, and 4 will take effect; the configuration information with flag 3 indicates that the synchronization between gateways is normal, and other values indicate synchronization exceptions.

Table 1

The following uses the information synchronization process in this example to explain the use of Table 1: After the gateway first configures the registered user information, the flag position of each registered user information is 1. Then the current gateway will send the registered user information to the correspondent gateway, and set the flag bit to 2. Once the confirmation of the peer gateway is received, the flag position is 3. The error retransmission mechanism ensures that information can be sent to the other party.

After receiving the configuration registration user information, the receiver gateway sets the registration user information flag to 2 and sends an acknowledgement message. Once the confirmation message of the other party is received, set the flag to 3.

A configuration registration user information will take effect when the status is 2 or 3. The gateway periodically registers the user information with the query flag bit other than 3, sends it to the peer gateway, and modifies the value of the aging bit plus one. Here, the aging bit is the preset number of transmissions. When the number of times of sending the preset reaches the critical value and the registered user information cannot be synchronized, the gateway sets the registered user information flag to 4, reports the network management, the recording configuration is abnormal, and the transmission is no longer sent. Configure registered user information.

For example, if the threshold value of the preset aging bit is 3, then the first transmission will set the aging position to 1, the second transmission will aging the position 2, the third transmission will aging the position 3, and the critical value will be reached. When the confirmation to the other party's gateway is confirmed, the user information flag position 4 will be registered.

For the modified registered user information, the local gateway marks it as changing back to 2 and sends the registered user information to the opposite gateway, and then sets it to 3 after receiving the correct response from the peer. If the local gateway receives the modified registered user information, the registered user information is modified. If the modification is successful, the flag bit is unchanged, and if the flag is ¹ J, the flag is set to 5 and reported to the network management.

For the configuration to be deleted, the registered user information is marked with a flag of 5, and the serial number of the registered user information is sent to the opposite gateway. After the other gateway correct response is received, the local delete, no shellfish ¹ J, the flag 4 the NMS.

Receive the serial number to be deleted by the gateway of the other party, and send the response message after the local deletion. If the local deletion fails, the flag is 5 and reported to the NMS.

For configurations with flags 4 and 5, the administrator can choose to initiate a resend or delete the information locally. The administrator can also choose to send all local configuration information to overwrite the remote gateway information or request the remote gateway to send all configuration information to the gateway.

As shown in FIG. 4, the gateway device provided by an embodiment of the present invention includes: an information synchronization unit 410, configured to perform synchronization with another gateway to perform registration of user information; and an access control unit 420, configured to receive a user. Access request, according to the synchronization with another gateway The registered user information controls the access of the user to the local area network.

The gateway device 500 according to another embodiment of the present invention provides an example of a specific feasible processing manner of the access control unit. This example should be understood as the implementation of the access control unit function applied to a specific scenario. The limitation of the invention is as shown in FIG. 5, which includes:

The information synchronization unit 510 is configured to perform synchronization with the other gateway to perform registration of the user information. The access control unit 520 is configured to: when the gateway receives the packet sent by the user, according to the registered user information synchronized with another gateway. The user accesses the local area network for access control.

The IPsec tunnel establishing unit 530 is configured to establish an IPsec tunnel with another gateway, where the IPsec tunnel is used to transmit data between the gateways, and the data is encapsulated into an IPsec format before the data transmission. .

The packet forwarding unit 540 is configured to receive the packet and perform forwarding processing.

The packet forwarding unit 540 includes:

The message classification unit 541 is configured to detect the type of the received message; if the received message is an SSL message, the message is sent to the SSL message processing unit; if the received message is an ordinary message, The packet is sent to the normal packet processing unit for processing; if the received packet is an IPsec packet, the packet is sent to the IPsec packet processing unit for processing;

The SSL packet processing unit 542 is configured to receive the SSL packet of the packet classification unit 541, and then perform the packet unblocking; check the security control policy of the user, and if the gateway security policy is not met, discard the packet; The security control policy of the gateway further determines the destination address of the packet. If the destination address is the local area network where the first gateway is located, the device directly forwards the packet if the destination address of the packet is the second gateway. The local area network is encapsulated into an IPsec message and sent to another gateway through an IPsec tunnel;

The normal packet processing unit 543 is configured to receive the normal packet of the packet classification unit 541. If the destination address of the packet is a public network, the packet is encapsulated into an SSL packet, and the destination address of the packet is The local area network where the other gateway is located is encapsulated into an IPsec packet and sent to another gateway through an IPsec tunnel;

The IPsec packet processing unit 544 is configured to receive the IPsec packet of the packet classification unit 541, and determine whether the destination address of the packet is the local area network where the gateway is located, and if yes, perform IPsec decapsulation and then forward the packet. In this embodiment, the registration of the user information is synchronized by the interaction between the gateways. When a gateway receives the packet sent by the user, the gateway can access the local area network according to the registered user information synchronized with the other gateways. control. The process of user authentication and authorization is more convenient and simpler. Once used to obtain access rights in a gateway, it is possible to repeatedly log in to other gateways without the prior art, and directly and freely access other local area networks through unified security policy management. Great convenience for users.

Further, in the embodiment of the present invention, when data synchronization is performed between gateways, only the changed data may be updated, that is, the changed data is sent to the opposite gateway by the update information to achieve the purpose of reducing the amount of synchronized data. Synchronization is achieved by making the data exchanged less between the gateways, thereby saving network bandwidth and improving synchronization efficiency.

A person skilled in the art can understand that all or part of the process of implementing the above embodiment method can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium, the program When executed, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM). The description of the examples is only for helping to understand the method and the idea of the present invention; at the same time, for those skilled in the art, according to the idea of the present invention, there will be changes in the specific embodiments and application scopes. The description is not to be construed as limiting the invention.

Claims

Rights request

A method for access control of a local area network, comprising:

The first gateway interacts with the second gateway to synchronize the registered user information;

The first gateway receives an access request of the user;

The method according to claim 1, wherein the registered user information comprises: a login identity verification information of the user and a corresponding security control policy of the user access.

The method according to claim 1, wherein, after the first gateway and the second gateway exchange the registration user information, if one of the first gateway and the second gateway is configured When the registered user information changes, the changed data is sent to another gateway for update configuration by updating the information.

The method according to claim 1, wherein the first gateway and the second gateway perform data transmission through an IP layer protocol security structure IPsec tunnel, wherein the first gateway or the The second gateway encapsulates the data into an IPsec format before the data transmission.

The method according to claim 4, wherein if the IPsec tunnel is disconnected, the first gateway and the second gateway renegotiate to establish the IPsec tunnel.

The method of claim 1, wherein the process for the first gateway to perform access control on the user accessing the local area network according to the registered user information synchronized with the second gateway comprises:

Determining whether the access of the user is legal according to the registered user information that is synchronized with the second gateway. If the access is legal, the access of the user is allowed. If not, the access of the user is denied.

The method according to claim 6, wherein determining whether the access of the user is legal comprises:

Obtain the username and password in the user access request;

Checking whether the user name is synchronized in the registration information synchronized with the second gateway; if there is the user name; continuing to check whether the password is correct; if the password is correct, the confirmation is legal; if there is no user name of the user If the password is incorrect, it is confirmed to be illegal.

8. The method according to claim 4, further comprising:

The first gateway receives the packet and performs packet forwarding processing.

The method of claim 8, wherein if the packet received by the first gateway is a Secure Sockets Layer SSL packet, the packet is decapsulated;

Checking the security control policy of the user;

If the first gateway security policy is not met, the packet is discarded;

If the security policy of the first gateway is met, the destination address of the packet is further determined; if the destination address is the local area network where the first gateway is located, the forwarding is performed directly; if the destination address of the packet is The local area network of the second gateway is encapsulated into an IPsec packet and sent to the second gateway through an IPsec tunnel.

The method according to claim 8, wherein the packet received by the first gateway is a packet of a local area network where the first gateway is located;

If the destination address of the packet is a public network, the packet is encapsulated into an SSL packet and sent; if the destination address of the packet is the local area network of the second gateway, the packet is encapsulated into an IPsec packet and passed through the An ip _sec tunnel between the second gateways is sent to the second gateway.

The method according to claim 8, wherein the packet received by the first gateway is an IPsec packet sent by the second gateway, and if the destination address of the IPsec packet sent by the second gateway is the The local area network where the first gateway is located, the first gateway performs IPsec decapsulation and then forwards.

12. A gateway device, comprising:

The gateway device according to claim 12, wherein the gateway device further comprises: an IPsec tunnel establishing unit, configured to establish an IPsec tunnel with the another gateway,

An IPsec tunnel is used for the gateway device and the other gateway to transmit data.

The gateway device according to claim 13, wherein the gateway device further comprises: a message forwarding unit, configured to receive a message and perform forwarding processing.

The gateway device according to claim 14, wherein the message forwarding unit further comprises:

a message classification unit, configured to detect the type of the received message; if the received message is an SSL message, the message is processed by the SSL message processing unit; if the received message is an ordinary message, the ordinary message is used. Processing by the processing unit; if the received packet is an IPsec packet, the IPsec packet processing unit processes; the SSL packet processing unit is configured to receive an SSL packet from the packet classification unit, and The packet is decapsulated by the SSL packet; the security control policy of the user is checked, and if the security control policy of the gateway device is met, the destination address of the packet is determined; if the destination address is the local area network where the gateway device is located If the destination address of the packet is the local area network of the other gateway, the packet is encapsulated into an IPsec packet and sent to the other gateway through the IPsec tunnel.

a normal message processing unit, configured to receive an ordinary message from the message classification unit, and if the destination address of the ordinary message is a public network, the packet is encapsulated into an SSL message and sent; if the ordinary message is The destination address is the local area network where the other gateway is located, and is encapsulated into an IPsec packet and sent to the another gateway through an IPsec tunnel with the other gateway;

An IPsec packet processing unit, configured to receive an IPsec packet from the packet classification unit, and determine

IPsec is decapsulated and forwarded.