WO2017161706A1

WO2017161706A1 - Method of controlling access to network resource in local area network, device, and gateway equipment

Info

Publication number: WO2017161706A1
Application number: PCT/CN2016/086270
Authority: WO
Inventors: 陈龙; 梁会发; 谢铁民
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-03-25
Filing date: 2016-06-17
Publication date: 2017-09-28
Also published as: CN107231336A

Abstract

The application provides a method of controlling access to a network resource in a local area network, a device, and gateway equipment. The method comprises: acquiring a client permission level and a resource permission level of a first client and configured to initialize a resource connection request message to be sent to gateway equipment; and if a resource permission level corresponding to the client permission level of the first client is found in a preconfigured correspondence table of client permission levels and resource permission levels, forwarding to a target server the resource connection request message initialized by the first client.

Description

Access control method, device and gateway device for intranet network resource

Technical field

The present application relates to, but is not limited to, the field of network security technologies, and in particular, to an access control method, apparatus, and gateway device for intranet resources of a local area network.

Background technique

SSL VPN refers to a VPN (Virtual Private Network) technology that establishes a remote secure access channel based on the SSL (Security Socket Layer) protocol. The SSL protocol runs at the transport layer and encrypts only the application channels carried out by the communicating parties, rather than encrypting the entire channel from one host to another. In communication using the SSL protocol, each application is a secure independent entity that can operate in a transparent mode on a Network Address Translation (NAT) proxy device.

In the SSL connection between the server and the client, both parties can perform identity verification and implement digital signature through an asymmetric key algorithm. Since the data encrypted by the private key can only be decrypted by using the corresponding public key, the identity of the sender can be judged according to whether the decryption is successful, and SSL uses the mechanism provided by the PKI (Public Key Infrastructure) to ensure the public. The authenticity of the key. In the enterprise network application, the certificate system provided by the OpenSSL (Open Security Socket Layer) protocol can be used to establish the certificate system of the unit, and the private certificate and certificate of the server and multiple clients are created through the root certificate, and the client initiates the certificate. The authenticity and uniqueness of the user are ensured when the request is accessed.

SSL VPN network extension refers to the use of SSL protocol to connect dispersed users in the WAN through the construction of virtual LAN.

As shown in Figure 1, the SSL VPN network extends the relationship between users, gateway devices, and internal resources. The user initiates a request to join the local area network to the gateway device through the client. When the connection is established, the gateway device authenticates the user as the server side. If the authentication succeeds, the available virtual local area network address of the virtual local area network is obtained from the address pool to the user. Then, the user side The assigned address is configured into a local virtual Ethernet device (herein referred to as a TUN device) by the running client program, and the gateway device pushes the network route accessible by the intranet to the user; finally, the client receives the accessible access. After the network route is added to the local routing table, the user successfully joins the virtual local area network.

Find the corresponding routing entry based on the user accessing different networks. If the internal network resource of the virtual local area network or the gateway device is accessed, the TUN device sends the data. After the data is sent to the TUN device, the client encrypts the data sent to the TUN device. After the encryption is completed, the client program encapsulates the encrypted data into The specified port number, such as the TCP (Transmission Control Protocol) or UDP (User Datagram Protocol) packet, is sent from the real physical network port to the gateway device; the gateway device determines the TCP after receiving the data. Whether the port number of the UDP port is 1194; if yes, the data packet of the port number is sent to the VPN module of the gateway device for decryption, and the successfully decrypted data is sent to the Ethernet TUN device of the gateway device, and then sent to the TUN device. The data of the device is already in plain text, and it is sent to the protocol stack as if it were sent to a normal Ethernet device.

In practical applications, it is found that for the enterprise, the resources of the internal network have different secret levels, and the user needs to perform security access control, and specific resources require specific permissions to allow access. When the related technology performs security access control, the user initiates access to a certain resource, obtains an access permission level, and determines whether the access right is determined according to the level. This method is inefficient in accessing resources and requires a connection to the requested resource each time, wasting internal network resources.

In addition, when the user requests the resource, when the gateway device checks the validity of the user accessing the resource, the gateway device needs to perform a complex legality check on the user who initiates the resource request according to the user packet information, and once the resource connection is established, the resource dynamics When the permission level is changed, the established connection cannot be updated in time and the security relationship exists.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

The object of the embodiments of the present invention is to provide a method, a device, and a gateway device for accessing a network resource of a local area network, which are used to solve the problem of security risks when the resource access efficiency is low and the resource dynamic change authority is changed when the user accesses the internal resources of the local area network in the related art. The problem.

An access control method for intranet resources of a local area network includes:

Obtaining a user privilege level and a resource privilege level of the first client that initiates the resource connection request message to the gateway device.

And in the corresponding relationship table of the preset user privilege level and the resource privilege level, if the resource privilege level corresponding to the user privilege level of the first client is found, the resource connection request message of the first client is forwarded to the target server.

Optionally, obtaining the first user privilege level of the client that initiates the resource connection request message to the gateway device includes:

Receiving an access connection request initiated by the first client to the gateway device, and acquiring a user permission level of the first client from the access connection request.

Optionally, obtaining the user privilege level of the first client from the access connection request includes:

The user common name of the first client is obtained by using an authentication mechanism of the Secure Sockets Layer (SSL) protocol, and the first client is authenticated according to the digital certificate corresponding to the common name of the user.

When the authentication of the first client passes, the intranet IP address is assigned to the first client, and the access connection with the first client is completed.

And searching for a user permission list to obtain a user authority level of the first client according to the user common name in the access connection request.

Optionally, obtaining a resource permission level of the first client that initiates the resource connection request message to the gateway device includes:

Obtaining a resource connection request message sent by the first client by using a secure socket protocol virtual private network SSL VPN.

Obtaining a resource authority level corresponding to the resource connection request message according to the resource connection request message.

Optionally, the resource permission level corresponding to the resource connection request message is obtained according to the resource connection request message, including:

The content of the packet in the resource connection request message is parsed, and the resource to be connected is obtained as the first resource.

The resource permission list is obtained to obtain a resource authority level corresponding to the first resource.

Optionally, the method further includes: after forwarding the resource connection request message of the first client to the target server, connecting, at the first client, to the target server according to the resource connection request message When the first resource allocated by the resource authority level is described, the attribute information of the first client is saved in the user access list of the first resource.

Optionally, the method further includes:

After the first client disconnects from the first resource, the attribute information of the first client is deleted from the user access list of the first resource.

Optionally, the method further includes:

The user access list update is performed according to the resource authority level or the change of the user authority level.

Optionally, performing the user access list update according to the change of the resource permission level includes:

After the resource authority level is changed, the user access list of the resource whose resource authority level has been changed is searched, and the attribute information of the client that is accessing the resource of the changed resource authority level is acquired.

And in the corresponding relationship table of the preset user privilege level and the resource privilege level, if the user privilege level of the client does not correspond to the changed resource privilege level, the first reset is sent to the client. a message and deleting the attribute information of the client from the user access list.

Optionally, performing the user access list update according to the change of the user privilege level further includes:

After the user privilege level is lowered, if the attribute information of the client that has been reduced by the user privilege level is located in the user access list of the resource corresponding to the resource privilege level before the user privilege level is lowered, the client is at the reduced user privilege level. Sending a second reset message, and deleting the attribute information of the reduced user privilege level client from the user access list.

An access control device for a network intranet resource includes an acquisition module and an execution processing module.

The obtaining module is configured to acquire a user privilege level and a resource privilege level of the first client that initiates the resource connection request message to the gateway device.

Execution processing module is configured to: in the correspondence relationship table of the preset user privilege level and the resource privilege level, if the resource privilege level corresponding to the user privilege level of the first client is found, Then, the resource connection request message of the first client is forwarded to the target server.

Optionally, the obtaining module includes a first acquiring submodule.

The obtaining, by the acquiring module, the user privilege level of the first client that initiates the resource connection request message to the gateway device includes:

The first obtaining sub-module is configured to receive an access connection request initiated by the first client to the gateway device, and obtain a user permission level of the first client from the access connection request.

Optionally, the first obtaining submodule includes an identity verification unit, an access connection unit, and a user privilege level obtaining unit.

Obtaining, by the first obtaining submodule, the user privilege level of the first client from the access connection request includes:

The authentication unit is configured to obtain the user common name of the first client by using an authentication mechanism of the Secure Sockets Layer (SSL) protocol, and perform identity verification on the first client according to the digital certificate corresponding to the common name of the user.

The access connection unit is configured to, when the authentication of the first client passes, assign an intranet IP address to the first client, and complete an access connection with the first client.

The user privilege level obtaining unit is configured to obtain a user privilege level of the first client according to the user privilege name in the access connection request.

Optionally, the obtaining module further includes a second obtaining submodule and a third acquiring submodule.

The obtaining, by the acquiring module, the resource permission level of the first client that initiates the resource connection request message to the gateway device includes:

The second obtaining submodule is configured to obtain a resource connection request message sent by the first client by using a secure socket protocol virtual private network SSL VPN.

The third obtaining sub-module is configured to acquire the resource permission level corresponding to the resource connection request message according to the resource connection request message.

Optionally, the third obtaining submodule includes an analysis processing unit and a resource authority level acquiring unit.

The third obtaining submodule acquires the resource connection according to the resource connection request message. The resource permission levels corresponding to the message include:

The parsing processing unit is configured to parse the content of the packet in the resource connection request message, and obtain the resource to be connected as the first resource.

The resource privilege level obtaining unit is configured to: obtain a resource privilege list, and obtain a resource privilege level corresponding to the first resource.

Optionally, the device further comprises a first processing module.

The first processing module is configured to: after forwarding the resource connection request message of the first client to the target server, the first client connects to the target server according to the resource connection request message, When the first resource allocated by the resource authority level is saved, the attribute information of the first client is saved in the user access list of the first resource.

Optionally, the device further comprises a second processing module.

The second processing module is configured to delete attribute information of the first client from a user access list of the first resource after the first client disconnects from the first resource.

Optionally, the device further includes: an access list update module.

The access list update module is configured to perform a user access list update according to the resource authority level or the change of the user authority level.

Optionally, the access list update module includes: a fourth acquisition submodule and a first update processing submodule.

The access list update module performs user access list update according to the change of the resource permission level, including:

The fourth obtaining submodule is configured to: after the resource authority level is changed, search for a user access list of the resource whose resource authority level has been changed, and acquire an attribute of the client that is accessing the resource of the changed resource permission level. information.

The first update processing sub-module is configured to: if the user privilege level of the client does not correspond to the changed resource privilege level in the correspondence relationship table of the preset user privilege level and the resource privilege level, Sending a first reset message to the client, and deleting the attribute information of the client from the user access list.

Optionally, the access list update module further includes: a second update processing submodule.

The access list update module performs the user access list update according to the change of the user privilege level, and further includes:

The second update processing sub-module is configured to: after the user privilege level is lowered, if the attribute information of the client that has been reduced by the user privilege level is located in the user access list of the resource corresponding to the resource privilege level before the user privilege level is lowered, The client that has been reduced by the user privilege level sends a second reset message, and deletes the attribute information of the reduced user privilege level client from the user access list.

A gateway device includes an access control device for intranet resources of a local area network as described in the foregoing embodiments.

A computer readable storage medium storing computer executable instructions, the computer executable instructions being implemented by a processor to implement the access control method of the intranet resources.

The beneficial effects of the above technical solutions of the embodiments of the present invention are as follows:

In the solution of the embodiment of the present invention, the resource access authority of the client accessing the internal resources of the local area network is determined by the resource authority level corresponding to the user authority level directly on the gateway device, and the resource is accessed when the client has the resource access right. The connection request is forwarded to the target server, which improves the resource access efficiency of the user accessing the internal resources of the local area network, reduces the processing load of the target server, and saves internal network resources; and ensures immediate resetting of the resource connection of the user or resource whose authority is changed. When the resource dynamic change permission is granted, the data security of the internal network resources of the local area network.

BRIEF abstract

1 is a schematic diagram of relationships between an extended user, a gateway device, and internal resources of an SSL VPN network according to an embodiment of the present invention;

2 is a schematic diagram of basic steps of an access control method for intranet resources of a local area network according to an embodiment of the present invention;

3 is a schematic structural diagram of a structure of an access control apparatus for intranet resources of a local area network according to an embodiment of the present invention;

FIG. 4 is a schematic flowchart of a method for controlling access control of intranet resources in a local area network according to an embodiment of the present invention; Figure.

Embodiments of the invention

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

The embodiments of the present invention are directed to the problem that the user has access to the internal resources of the local area network, the resource access efficiency is low, and the resource dynamic change authority has a security risk. The access control method for the intranet resources of the local area network is provided, and the user accesses the internal resources of the local area network. The resource access efficiency is reduced, the processing load of the target server is reduced, the internal network resources are saved, and the data security of the internal network resources of the local area network is ensured when the resource dynamic change authority is ensured.

First embodiment

As shown in FIG. 2, an embodiment of the present invention provides a method for controlling access of intranet resources in a local area network, including steps 11-12:

Step 11: Acquire a user privilege level and a resource privilege level of the first client that initiates the resource connection request message to the gateway device.

It should be noted here that the user privilege level is the privilege level of the user who operates the client, and one user corresponds to one client.

Step 12: In the correspondence table between the preset user privilege level and the resource privilege level, if the resource privilege level corresponding to the user privilege level of the first client is found, the resource connection of the first client is forwarded to the target server. Request message.

The access control method for the intranet resources of the local area network in the embodiment of the present invention determines the resource access authority of the client accessing the internal resources of the local area network according to the resource permission level corresponding to the user authority level directly on the gateway device, and has the resource access authority on the client that accesses the internal resources of the local area network, and has the resource access authority on the client end When the resource access rights are forwarded, the resource connection request is forwarded to the target server, which improves the resource access efficiency of the user accessing the internal resources of the local area network, reduces the processing load of the target server, and saves internal network resources.

Optionally, obtaining the user privilege level of the first client that initiates the resource connection request message to the gateway device in step 11 of the embodiment of the present invention includes: Step 111:

Step 111: Receive an access connection request initiated by the first client to the gateway device, and Obtaining a user privilege level of the first client in the access connection request.

It should be noted that the first client may be an SSL VPN network extension client, and the gateway device may be a virtual private network VPN gateway device.

Here, the step 111 receives an access connection request initiated by the first client to the gateway device, and acquires the user permission level of the first client from the access connection request, including steps 1111-1113:

Step 1111: Obtain a common name of the user of the first client by using an authentication mechanism of the Secure Sockets Layer SSL protocol, and perform identity verification on the first client according to the digital certificate corresponding to the common name of the user.

It should be noted that the user common name is a user identifier that the client uniquely identifies the client when applying for an account to the gateway device administrator.

The digital certificate corresponding to the user's common name can be obtained by the method provided by the Open Secure Sockets Layer protocol OpenSSL. Of course, the private key corresponding to the user's common name can also be obtained by this method, where the digital certificate includes the personal identity information of the client.

Step 1112: When the identity verification of the first client passes, assign an intranet IP address to the first client, and complete an access connection with the first client.

Here, after the identity verification of the first client is passed, after the intranet IP address is assigned to the first client, the gateway device stores the user common name in the data area.

It should be noted that if the identity verification of the first client fails, the gateway device directly rejects the access connection initiated by the first client. In this way, the target server is not required to additionally process the authentication of the client to be accessed, which saves internal network resources and reduces the possibility of illegal clients acquiring internal data of the server.

Step 1113: Search for a user permission list according to the user common name in the access connection request, and obtain a user permission level of the first client.

It should be noted that the user permission list is pre-stored in the gateway device, where the user authority level of different users who can access the intranet resources is stored.

Optionally, obtaining the resource permission level of the first client that initiates the resource connection request message to the gateway device in step 11 of the embodiment of the present invention includes the following steps 112-113:

Step 112: Obtain a resource connection request message sent by the first client by using a secure socket protocol virtual private network SSL VPN.

It should be noted that the gateway device completes the access connection with the first client before obtaining the resource connection request.

Step 113: Acquire, according to the resource connection request message, a resource authority level corresponding to the resource connection request message.

It should be noted that, if the gateway device does not obtain the resource permission level corresponding to the resource connection request message according to the resource connection request message, it indicates that the resource that the client wants to access is not in the resource permission list, that is, The resource does not have a resource privilege level, and no access rights are required. All authenticated clients can access this resource inside the LAN.

Here, the step 113, according to the resource connection request message, acquiring the resource permission level corresponding to the resource connection request message includes steps 1131-1132:

In step 1113, the content of the packet in the resource connection request message is parsed, and the resource to be connected is obtained as the first resource.

Step 1132: Find a resource permission list, and obtain a resource permission level corresponding to the first resource.

It should be noted that the resource permission list is pre-stored in the gateway device, where different resource permission levels corresponding to different resources are stored.

Optionally, the access control method for the intranet resources of the local area network in the embodiment of the present invention may further include step 13:

Step 13: After forwarding the resource connection request message of the first client to the target server, the first client connects to the target server to allocate the first resource resource level according to the resource connection request message. When the resource is used, the attribute information of the first client is saved in the user access list of the first resource.

It should be noted here that the user access list of the first resource stores the client that is currently accessing the first resource.

Optionally, the access control method for the intranet resources of the local area network in the embodiment of the present invention may further include step 14:

Step 14. After the first client disconnects from the first resource, the first The attribute information of the client is deleted from the user access list of the first resource.

It should be noted that the attribute information of the first client is deleted from the user access list of the first resource, that is, the connection between the first client and the target server is immediately disconnected, thereby preventing subsequent users. After the privilege level or resource privilege level is changed, the intranet data is leaked to ensure the security of the intranet data resources.

Optionally, the access control method for the intranet resources of the local area network in the embodiment of the present invention may further include step 15:

Step 15: Perform user access list update according to the resource permission level or the change of the user permission level.

Here, in step 15 , performing user access list update according to the change of the resource authority level includes steps 151-152:

Step 151: After the resource authority level is changed, search for a user access list of the resource whose resource authority level has been changed, and obtain attribute information of the client that is accessing the resource of the changed resource permission level.

Step 152: In the correspondence table between the preset user privilege level and the resource privilege level, if the user privilege level of the client does not correspond to the changed resource privilege level, the method sends the first privilege level to the client. A reset message is deleted and the attribute information of the client is deleted from the user access list.

It should be noted that the correspondence between the preset user privilege level and the resource privilege level may be stored in the gateway device in advance by the gateway device administrator according to the user privilege level.

The above two-step process indicates that when the resource privilege level is changed, the client with insufficient user privilege level is deleted from the user access list of the resource, and the user access list is updated in time to ensure the security of the intranet resource data and effectively prevent resources. The disclosure of data.

Here, the step of performing the user access list update according to the change of the user privilege level in the step 15 further includes the step 153:

Step 153, after the user privilege level is lowered, if the attribute information of the client that has been reduced by the user privilege level is located in the user access list of the resource corresponding to the user privilege level lowering, And sending a second reset message to the client that has been reduced in the privilege level, and deleting the attribute information of the reduced privilege level client from the user access list.

It should be noted that, after the user privilege level is lowered, the client that has been reduced by the privilege level no longer has the right to access the resource corresponding to the privilege level before the user privilege level is lowered, and the attribute of the client that has been reduced by the privilege level is determined. The information is deleted from the access list of the corresponding resource before the user privilege level is lowered, and the user access list is updated in time to ensure the security of the intranet resource data and effectively prevent the leakage of resource data.

The access control method for the intranet resources of the local area network in the embodiment of the present invention determines the resource access authority of the client accessing the internal resources of the local area network according to the resource permission level corresponding to the user authority level directly on the gateway device, and has the resource access authority on the client that accesses the internal resources of the local area network, and has the resource access authority on the client end When the resource access rights are forwarded, the resource connection request is forwarded to the target server, which improves the resource access efficiency of the user accessing the internal resources of the local area network, reduces the processing load of the target server, saves internal network resources, and passes the user or resource that changes the authority. The immediate reset of the resource connection ensures the data security of the internal network resources of the local area network when the resource dynamically changes the authority.

Second embodiment

As shown in FIG. 3, an embodiment of the present invention further provides an access control device for a network resource of a local area network, including: an obtaining module 21 and an execution processing module 22.

The obtaining module 21 is configured to acquire a user privilege level and a resource privilege level of the first client that initiates the resource connection request message to the gateway device.

The execution processing module 22 is configured to: in the correspondence relationship table of the preset user privilege level and the resource privilege level, if the resource privilege level corresponding to the first user privilege level of the client is found, forwarding the A resource connection request message for a client.

Optionally, the obtaining module 21 in the embodiment of the present invention may include:

It should be noted that the first client can be an SSL VPN network extension client, and the gateway is configured. It can be a virtual private network VPN gateway device.

The first obtaining submodule may include:

An identity verification unit, configured to obtain a user common name of the first client by using an authentication mechanism of the Secure Sockets Layer (SSL) protocol, and perform identity verification on the first client according to the digital certificate corresponding to the common name of the user;

The access connection unit is configured to allocate an intranet IP address to the first client when the authentication of the first client passes, and complete an access connection with the first client.

Here, after the identity verification of the first client is passed, after the intranet IP address is assigned to the first client, the gateway device stores the first user common name in the data area.

Here, the obtaining module 21 in the embodiment of the present invention may further include:

The third obtaining sub-module is configured to acquire a resource permission level corresponding to the resource connection request message according to the resource connection request message.

It should be noted that if the gateway device does not obtain the first resource permission level corresponding to the resource connection request message according to the resource connection request message, it indicates that the resource to be accessed by the client is not in the resource permission list. That is, the resource does not have a resource permission level, and no access rights are required, and all authenticated clients can access the resource inside the LAN.

Here, the third obtaining submodule may include:

The resource privilege level obtaining unit is configured to obtain a resource privilege list to obtain a resource privilege level corresponding to the first resource.

Optionally, the access control apparatus for the intranet resources of the local area network in the embodiment of the present invention may further include:

The first processing module 23 is configured to: after forwarding the resource connection request message of the first client to the target server, connect to the target server as the resource permission according to the resource connection request message by the first client When the first resource of the level is allocated, the attribute information of the first client is saved in the user access list of the first resource.

The second processing module 24 is configured to delete the attribute information of the first client from the user access list of the first resource after the first client disconnects the first resource.

It should be noted that the attribute information of the first client is deleted from the user access list of the first resource, that is, the connection between the first client and the target server is immediately disconnected, thereby preventing subsequent users. After the permission level or resource permission level is changed, the intranet data is leaked and guaranteed. Security of intranet data resources.

Optionally, the access control apparatus for the intranet resources of the local area network according to the embodiment of the present invention may further include:

The access list update module 25 is configured to perform a user access list update according to the resource authority level or the change of the user authority level.

Here, the access list update module 25 may include:

The fourth obtaining submodule is configured to: after the resource authority level is changed, search for a user access list of the resource whose resource authority level has been changed, and acquire attribute information of the client that is accessing the resource of the changed resource authority level.

The first update processing sub-module is configured to: in the correspondence relationship table of the preset user privilege level and the resource privilege level, if the user privilege level of the client is found to not correspond to the changed resource privilege level, then The client sends a first reset message and deletes the attribute information of the client from the user access list.

Here, the execution processing of the foregoing obtaining sub-module and the first update processing sub-module indicates that when the resource authority level is changed, the client access list is deleted from the user access list of the resource by the user whose access level is insufficient, so that the user access list is updated in time. It ensures the security of intranet resource data and effectively prevents the leakage of resource data.

Here, the access list update module 25 may further include:

a second update processing sub-module, configured to: after the user privilege level is lowered, if the attribute information of the client that has been reduced by the privilege level is located in a user access list of a resource corresponding to the privilege level before the user privilege level is lowered, The client that has been reduced by the user privilege level sends a second reset message, and deletes the attribute information of the reduced user privilege level client from the user access list.

It should be noted that, after the user privilege level is lowered, the second update processing sub-module does not have the privilege of accessing the corresponding resource before the user privilege level is lowered, and the Reduce the user privilege level of the client's attribute information from the user privilege level The deletion of the access list of the corresponding resource in the lower part realizes the timely update of the user access list, ensures the security of the intranet resource data, and effectively prevents the leakage of resource data.

The embodiment of the invention further provides a gateway device, which comprises the access control device for the intranet resources of the local area network described in the second embodiment.

The access control device for the intranet resources of the local area network in the embodiment of the present invention determines the resource access authority of the client accessing the internal resources of the local area network according to the resource authority level corresponding to the user authority level directly on the execution processing module in the gateway device, and When the client has the resource access right, the resource connection request is forwarded to the target server, which improves the resource access efficiency of the user accessing the internal resources of the local area network, reduces the processing load of the target server, and saves internal network resources; and the gateway device The access list update module ensures the data security of the internal network resources of the local area network when the resources are dynamically changed by the immediate reset of the resource connection of the user or resource whose authority is changed.

Third embodiment

As shown in FIG. 4, it is a schematic flowchart of an access control method for intranet resources of a local area network according to an embodiment of the present invention. The following figure illustrates the implementation process of a user accessing intranet resources of a local area network.

Here, the client is also the client described in the first embodiment and the second embodiment.

Step 301: The gateway device receives an access connection request of a user.

Here, the user's access connection request message is sent to the gateway device through the SSL protocol establishment encryption tunnel.

In step 302, the gateway device verifies whether the user identity is legal.

If the gateway device verifies that the user identity is legal, step 303 is performed; if the gateway device verifies that the user identity is invalid, the process ends and the access connection is disconnected.

It should be noted that the validity verification of the user identity can obtain the user common name of the user through the identity verification mechanism of the SSL protocol, and authenticate the user through the digital certificate corresponding to the common name of the user in the gateway device.

When the verification is passed, the intranet IP address is assigned to the user, and the access connection request is completed, which means that the user can access the internal resources of the local area network.

In step 303, the user common name is recorded and the user permission level is obtained.

Here, the user privilege level of the user can be obtained from the user privilege list in the gateway device by the user common name.

Step 304: The gateway device acquires a resource permission level of the resource accessed by the user.

Here, the gateway device first receives the resource connection request sent by the user, obtains the resource to be accessed by the user according to the resource connection request, and obtains the permission level of the resource to be accessed by the user through the resource permission list in the gateway device.

Step 305: The gateway device determines whether the user has the right to access the resource.

If the gateway device determines that the user has the right to access the resource, step 306 is performed; if the gateway device determines that the user does not have the right to access the resource, the process ends.

It should be noted that, in this step, the gateway device determines whether the resource privilege level corresponding to the user privilege level of the user is higher than or equal to the resource privilege level of the user to access the resource, and if the user privilege level corresponding to the user has a high resource privilege level At or equal to the resource privilege level of the resource that the user wants to access, the user has the privilege to access the resource.

Step 306: The gateway device forwards the resource connection request of the user to the target server.

Here, by directly determining the resource access rights of the user on the gateway device, the resource access efficiency of the user accessing the internal resources of the local area network is improved, the processing load of the target server is reduced, and internal network resources are saved.

In step 307, the user connects and obtains the resource to be accessed.

In step 308, the gateway device disconnects and deletes the access record of the user from the user access list of the resource.

It should be noted that deleting the user's access record from the user access list of the resource may prevent intranet data leakage after the user privilege level or resource privilege level is changed, thereby ensuring the security of the intranet data resource. It is also convenient for the user to access the list to update in time when the user privilege level or resource privilege level is changed.

The access control method for the intranet resources of the local area network in the embodiment of the present invention determines the resource access authority of the client accessing the internal resources of the local area network according to the resource permission level corresponding to the user authority level directly on the gateway device, and has the resource access authority on the client that accesses the internal resources of the local area network, and has the resource access authority on the client end When the resource access rights are forwarded, the resource connection request is forwarded to the target server, which improves the resource access efficiency of the user accessing the internal resources of the local area network, and The processing load of the target server is alleviated, and internal network resources are saved. Moreover, the data connection of the internal network resources of the local area network is ensured when the resources are dynamically changed by the immediate reset of the resource connection of the user or resource whose authority is changed.

One of ordinary skill in the art will appreciate that all or a portion of the steps of the above-described embodiments can be implemented using a computer program flow, which can be stored in a computer readable storage medium, such as on a corresponding hardware platform (eg, The system, device, device, device, etc. are executed, and when executed, include one or a combination of the steps of the method embodiments.

Alternatively, all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.

The devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.

When the device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium. The above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Industrial applicability

Claims

An access control method for intranet resources of a local area network includes:

Obtaining a user privilege level and a resource privilege level of the first client that initiates the resource connection request message to the gateway device;

And in the corresponding relationship table of the preset user privilege level and the resource privilege level, if the resource privilege level corresponding to the user privilege level of the first client is found, the resource connection request message of the first client is forwarded to the target server. .
The access control method for the intranet resources of the local area network according to claim 1, wherein the obtaining the user privilege level of the first client that initiates the resource connection request message to the gateway device comprises:

Receiving an access connection request initiated by the first client to the gateway device, and acquiring a user permission level of the first client from the access connection request.
The access control method for the intranet resources of the local area network according to claim 2, wherein the obtaining the user privilege level of the first client from the access connection request comprises:

Obtaining a common name of the user of the first client by using an authentication mechanism of the Secure Sockets Layer (SSL) protocol, and performing identity verification on the first client according to the digital certificate corresponding to the common name of the user;

When the identity verification of the first client is passed, the intranet IP address is allocated to the first client, and the access connection with the first client is completed;

And searching for a user permission list to obtain a user authority level of the first client according to the user common name in the access connection request.
The access control method for the intranet resources of the local area network according to claim 1, wherein the obtaining the resource permission level of the first client that initiates the resource connection request message to the gateway device comprises:

Obtaining a resource connection request message sent by the first client by using a secure socket protocol virtual private network SSL VPN;

Obtaining a resource authority level corresponding to the resource connection request message according to the resource connection request message.
The access control method for intranet resources of a local area network according to claim 4, wherein said Obtaining, according to the resource connection request message, the resource permission level corresponding to the resource connection request message includes:

Parsing the content of the packet in the resource connection request message, and acquiring the resource to be connected as the first resource;

The resource permission list is obtained to obtain a resource authority level corresponding to the first resource.
The access control method for intranet resources of a local area network according to claim 1, further comprising: after forwarding the resource connection request message of the first client to the target server, according to the resource at the first client And a connection request message, when the first resource allocated by the target server for the resource authority level is connected, the attribute information of the first client is saved in a user access list of the first resource.
The access control method for intranet resources of a local area network according to claim 6, the method further comprising:

After the first client disconnects from the first resource, the attribute information of the first client is deleted from the user access list of the first resource.
The access control method for intranet resources of a local area network according to claim 6 or 7, the method further comprising:

The user access list update is performed according to the resource authority level or the change of the user authority level.
The access control method for the intranet resources of the local area network according to claim 8, wherein the performing the user access list update according to the change of the resource permission level comprises:

After the resource authority level is changed, searching for a user access list of the resource whose resource authority level has been changed, and acquiring attribute information of the client that is accessing the resource of the changed resource permission level;

And in the corresponding relationship table of the preset user privilege level and the resource privilege level, if the user privilege level of the client does not correspond to the changed resource privilege level, the first reset is sent to the client. a message and deleting the attribute information of the client from the user access list.
The access control method for intranet resources of a local area network according to claim 8, wherein According to the change of the user privilege level, performing the user access list update further includes:

After the user privilege level is lowered, if the attribute information of the client that has been reduced by the privilege level is located in the user access list of the resource corresponding to the privilege level before the user privilege level is lowered, the privilege level is sent to the client that has been reduced by the privilege level. And second deleting the message, and deleting the attribute information of the reduced user authority level client from the user access list.
An access control device for a network intranet resource includes: an obtaining module and an execution processing module;

The acquiring module is configured to acquire a user privilege level and a resource privilege level of the first client that initiates the resource connection request message to the gateway device;

The execution processing module is configured to: in the correspondence relationship table of the preset user privilege level and the resource privilege level, if the resource privilege level corresponding to the user privilege level of the first client is found, forwarding the The resource connection request message of the first client.
The access control device for the intranet resources of the local area network according to claim 11, wherein the obtaining module comprises a first acquiring submodule;

The obtaining, by the acquiring module, the user privilege level of the first client that initiates the resource connection request message to the gateway device includes:

The first obtaining sub-module is configured to receive an access connection request initiated by the first client to the gateway device, and obtain a user permission level of the first client from the access connection request.
The access control device for intranet resources of a local area network according to claim 12, wherein the first acquisition submodule comprises an identity verification unit, an access connection unit, and a user authority level acquisition unit;

Obtaining, by the first obtaining submodule, the user privilege level of the first client from the access connection request includes:

The authentication unit is configured to obtain a common name of the user of the first client by using an authentication mechanism of the Secure Sockets Layer (SSL) protocol, and perform identity verification on the first client according to the digital certificate corresponding to the common name of the user;

The access connection unit is configured to, when the authentication of the first client passes, assign an intranet IP address to the first client, and complete an access connection with the first client;

The user privilege level obtaining unit is configured to obtain a user privilege level of the first client according to the user privilege name in the access connection request.
The access control device for the intranet resources of the local area network according to claim 11, wherein the obtaining module further comprises a second obtaining submodule and a third obtaining submodule;

The obtaining, by the acquiring module, the resource permission level of the first client that initiates the resource connection request message to the gateway device includes:

The second obtaining submodule is configured to obtain a resource connection request message sent by the first client by using a secure socket protocol virtual private network SSL VPN;

The third obtaining sub-module is configured to acquire the resource permission level corresponding to the resource connection request message according to the resource connection request message.
The access control device for the intranet resources of the local area network according to claim 14, wherein the third acquisition submodule comprises an analysis processing unit and a resource authority level acquisition unit;

The obtaining, by the third obtaining sub-module, the resource permission level corresponding to the resource connection request message according to the resource connection request message includes:

The parsing processing unit is configured to parse the content of the packet in the resource connection request message, and obtain the resource to be connected as the first resource;

The resource privilege level obtaining unit is configured to: obtain a resource privilege list, and obtain a resource privilege level corresponding to the first resource.
The access control device for intranet resources of a local area network according to claim 11, wherein the device further comprises a first processing module;

The first processing module is configured to: after forwarding the resource connection request message of the first client to the target server, the first client connects to the target server according to the resource connection request message, When the first resource allocated by the resource authority level is saved, the attribute information of the first client is saved in the user access list of the first resource.
The access control device for intranet resources of a local area network according to claim 16, wherein the device further comprises a second processing module:

The second processing module is configured to: after the first client disconnects from the first resource, delete attribute information of the first client from a user access list of the first resource except.
The access control device for intranet resources of a local area network according to claim 16 or 17, wherein the device further comprises: an access list update module;

The access list update module is configured to perform a user access list update according to the resource authority level or the change of the user authority level.
The access control device for the intranet resources of the local area network according to claim 18, wherein the access list update module comprises: a fourth acquisition submodule and a first update processing submodule;

The access list update module performs user access list update according to the change of the resource permission level, including:

The fourth obtaining submodule is configured to: after the resource authority level is changed, search for a user access list of the resource whose resource authority level has been changed, and acquire an attribute of the client that is accessing the resource of the changed resource permission level. information;

The first update processing sub-module is configured to: if the user privilege level of the client does not correspond to the changed resource privilege level in the correspondence relationship table of the preset user privilege level and the resource privilege level, Sending a first reset message to the client, and deleting the attribute information of the client from the user access list.
The access control device for the intranet resources of the local area network according to claim 18, wherein the access list update module further comprises: a second update processing submodule;

The access list update module performs the user access list update according to the change of the user privilege level, and further includes:

The second update processing sub-module is configured to: after the user privilege level is lowered, if the attribute information of the client that has been reduced by the user privilege level is located in the user access list of the resource corresponding to the resource privilege level before the user privilege level is lowered, The client that has been reduced by the user privilege level sends a second reset message, and deletes the attribute information of the reduced user privilege level client from the user access list.
A gateway device comprising the access control device for intranet resources of a local area network according to any one of claims 11-20.
A computer readable storage medium storing computer executable instructions, the computer An access control method for implementing intranet resources of the local network according to any one of claims 1 to 10 when the executable instructions are executed by the processor.