WO2020035046A1 - 访问认证方法、装置及认证设备 - Google Patents

访问认证方法、装置及认证设备 Download PDF

Info

Publication number
WO2020035046A1
WO2020035046A1 PCT/CN2019/100959 CN2019100959W WO2020035046A1 WO 2020035046 A1 WO2020035046 A1 WO 2020035046A1 CN 2019100959 W CN2019100959 W CN 2019100959W WO 2020035046 A1 WO2020035046 A1 WO 2020035046A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
user terminal
authentication
domain name
target
Prior art date
Application number
PCT/CN2019/100959
Other languages
English (en)
French (fr)
Inventor
徐勇刚
Original Assignee
新华三技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 新华三技术有限公司 filed Critical 新华三技术有限公司
Publication of WO2020035046A1 publication Critical patent/WO2020035046A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved

Definitions

  • access authentication is required when a user accesses a website through a user terminal. For example, when an unauthenticated user accesses the website through a user terminal, forcing the user to log in to a set site, the user can pass The terminal accesses the services in the setting site for free. If users need to use other information in the Internet, they must be authenticated, and Internet resources can only be used after passing the authentication.
  • FIG. 1 is a schematic diagram of an application scenario provided by the present disclosure.
  • FIG. 2 is a schematic block diagram of an authentication device provided by the present disclosure.
  • FIG. 3 is a schematic flowchart of an access authentication method provided by the present disclosure.
  • FIG. 4 is a schematic interaction diagram for implementing access authentication provided by the present disclosure.
  • FIG. 5 is another interaction schematic diagram for implementing access authentication provided by the present disclosure.
  • FIG. 6 is a schematic block diagram of an access authentication device provided by the present disclosure.
  • Icons 10-DNS server; 20-authentication device; 21-storage; 22-processor; 23-network module; 24-access authentication device; 241-request information transmission module; 242-response information transmission module; 243-information processing Module; 30-user terminal; 40-authentication server.
  • a user In a scenario where a user needs to perform access authentication when accessing a website through a user terminal, the user is required to perform access authentication on a set authentication website, such as a portal website, and the Internet resources can be used after the authentication is passed.
  • a set authentication website such as a portal website
  • the Internet resources can be used after the authentication is passed.
  • users can actively access known authentication websites and enter authentication information, such as usernames and passwords for authentication, thereby achieving active authentication.
  • authentication information such as usernames and passwords for authentication
  • HTTP Hypertext Transfer Protocol
  • the present disclosure provides an application scenario for implementing access authentication.
  • the application scenario includes a Domain Name System (DNS) server 10, an authentication device 20, a user terminal 30, and an authentication server 40.
  • DNS Domain Name System
  • the DNS server 10 is in communication connection with the authentication device 20, and the user terminal 30 is in communication with the authentication device 20 and the authentication server 40, respectively.
  • the DNS server 10 is a server that performs domain name (Domain Name) and Internet Protocol (IP) address corresponding to the domain name.
  • the authentication device 20 is a network device having communication and processing functions such as a router, a switch, and a wireless controller. Authentication information, such as an authentication certificate, is pre-stored in the authentication device 20, and the authentication certificate may be issued by the authentication server 40.
  • the authentication device 20 performs authentication negotiation with the user terminal 30 when the user accesses other external networks through the user terminal 30, thereby enabling the user terminal 30 to perform authentication interaction with the authentication server 40, thereby implementing forced authentication.
  • HTTPS Hyper Text Transfer Protocol Secure Over Socket Layer
  • the authentication device 20 needs to perform HTTPS spoofing and perform authentication negotiation with the user terminal 30 of the user.
  • the pre-stored authentication information of the authentication device 20, such as the authentication certificate does not match the authentication information of the website to be accessed by the user, causing the interface of the user terminal 30 to pop up an illegal certificate warning message, and the user needs to manually choose to ignore the certificate.
  • Legitimacy can carry out subsequent interactions, the convenience of access authentication needs to be improved, and the access methods are not friendly enough, which adversely affects the user experience.
  • the present disclosure provides an access authentication method, device, and authentication device 20.
  • the authentication device 20 receives request response information sent by the DNS server 10 for a DNS request sent by the user terminal 30, and requests The response information carries the target IP address corresponding to the domain name requested by the DNS request.
  • the authentication device 20 stores the domain name information corresponding to the target IP address, and performs authentication negotiation with the user terminal 30 according to the stored domain name information.
  • the domain name information matches the domain name information of the website that the user wants to visit, thereby avoiding the pop-up of illegal certificate alarm information, improving the convenience of access authentication, and further improving the user experience.
  • FIG. 2 it is a block diagram of an authentication device 20 provided by the present disclosure.
  • the authentication device 20 in the present disclosure may be a network device having a communication and processing function, such as a router, a switch, or a wireless controller.
  • the authentication device 20 is located in the application scenario shown in FIG. 1 and can communicate with the DNS server 10 and the user terminal 30.
  • the authentication device 20 includes: a memory 21, a processor 22, a network module 23, and an access authentication device 24.
  • the memory 21, the processor 22, and the network module 23 are directly or indirectly electrically connected to each other to implement data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses or signal lines.
  • the memory 21 stores an access authentication device 24.
  • the access authentication device 24 includes at least one software function module that can be stored in the memory 21 in the form of software or firmware.
  • the processor 22 is stored in the memory by running. Software programs and modules in 21, such as the access authentication device 24 in the present disclosure, execute various functional applications and data processing, that is, implement the access authentication method in the present disclosure.
  • the memory 21 may be, but is not limited to, Random Access Memory (RAM), Read Only Memory (ROM), and Programmable Read-Only Memory (PROM). , Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Read-Only Memory (Electric Erasable Programmable Read-Only Memory, EEPROM), etc.
  • RAM Random Access Memory
  • ROM Read Only Memory
  • PROM Programmable Read-Only Memory
  • EPROM Erasable Programmable Read-Only Memory
  • EEPROM Electrically Erasable Read-Only Memory
  • the processor 22 may be an integrated circuit chip and has data processing capabilities.
  • the above-mentioned processor 22 may be a general-purpose processor, including a central processing unit (CPU), a network processor (Network Processor), and the like. Various methods, steps, and logic block diagrams disclosed in this disclosure may be implemented or performed.
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the network module 23 is configured to establish a communication connection between the authentication device 20 and an external communication terminal through a network, and implement network signal and data transmission and reception operations.
  • the network signal may include a wireless signal or a wired signal.
  • FIG. 2 is only schematic, and the authentication device 20 may further include more or fewer components than those shown in FIG. 2, or have a different configuration from that shown in FIG. 2.
  • Each component shown in FIG. 2 may be implemented by hardware, software, or a combination thereof.
  • the present disclosure also provides a computer-readable storage medium, the computer-readable storage medium includes a computer program, and when the computer program runs, controls the authentication device 20 where the computer-readable storage medium is located to perform the following access Authentication method.
  • the present disclosure provides an access authentication method, which is applicable to the application scenario shown in FIG. 1, and the method may be executed by the authentication device 20 in FIG. 1.
  • the method includes the following steps.
  • Step S11 Receive a Domain Name System (DNS) request sent by the user terminal 30, and forward the DNS request to the DNS server 10.
  • DNS Domain Name System
  • the DNS request may be an IP (Internet Protocol) address corresponding to a certain domain name.
  • the authentication device 20 can perform whitelist processing on DNS information, such as DNS request messages, so that after receiving the DNS request, the DNS request is directly forwarded to the DNS server 10.
  • the DNS server 10 After receiving the DNS request, the DNS server 10 obtains request response information corresponding to the DNS request and sends it to the authentication device 20.
  • the request response information may be a request response message, such as a DNS response message.
  • the request response message carries a target IP address corresponding to the domain name requested by the DNS request.
  • Step S12 Receive request response information sent by the DNS server 10 according to the DNS request, and forward the request response information to the user terminal 30.
  • the request response information carries a target IP address corresponding to the domain name requested by the DNS request. For example, if the DNS request is the IP address corresponding to the request domain name WWW.XXXX.com, then the request response information carries the IP address corresponding to the domain name WWW.XXXXX.com. After receiving the request response information sent by the DNS server 10, the authentication device 20 forwards the request response information to the user terminal 30.
  • step S13 it is detected whether domain name information corresponding to the target IP address is stored. If domain name information corresponding to the target IP address is not stored, step S14 is performed.
  • step S14 the domain name information corresponding to the target IP address is stored, and authentication negotiation is performed with the user terminal 30 according to the stored information to avoid pop-up illegal certificate alarm information.
  • the authentication device 20 detects whether the domain name information corresponding to the target IP address is stored. If the domain name information corresponding to the target IP address is not stored, the domain name information corresponding to the target IP address is stored. In order to perform authentication negotiation with the user terminal 30 according to the stored information.
  • the authentication device 20 stores the domain name information corresponding to the target IP address in various ways. For example, the authentication device 20 can always store the domain name information corresponding to the target IP address locally, thereby ensuring the comprehensiveness of the stored information. For another example, the authentication device 20 may cache the domain name information corresponding to the target IP address for a set duration, and after the set duration expires, delete the domain name information corresponding to the target IP address, thereby releasing the cache space and ensuring that the cache space meets the demand.
  • the statistics are re-stated The cache time of the domain name information corresponding to the target IP address.
  • the authentication device 20 may store the domain name information corresponding to the target IP address locally, and determine whether to delete the domain name information corresponding to the target IP address according to the use of the domain name information corresponding to the target IP address, such as corresponding to a target IP address.
  • the domain name information corresponding to the target IP address is deleted; otherwise, the domain name information corresponding to a target IP address is used for authentication negotiation.
  • the domain name information corresponding to the target IP address is continuously stored.
  • the user terminal 30 Since the user terminal 30 mainly determines the validity of the authentication by verifying whether the received authentication information matches the domain name to be accessed, during the DNS request interaction process, the domain name information corresponding to the target IP address is stored, so that during the authentication negotiation After receiving the information sending request that the destination IP address sent by the user terminal 30 is the destination IP address, the domain name information corresponding to the destination IP address can be found from the stored information based on the destination IP address, and the domain name information is used Perform authentication negotiation with the user terminal 30. Since the domain name information used by the authentication device 20 to match the domain name to be accessed by the user terminal 30 is negotiated with the user terminal 30, the user terminal 30 determines that the authentication performed by the authentication device 20 is a legitimate authentication, so that illegal authentication does not pop up information.
  • the authentication device 20 may use the authentication certificate to negotiate with the user terminal 30.
  • an authentication certificate may be pre-stored in the authentication device 20, and the authentication certificate may be issued by the authentication server 40.
  • the authentication device 20 interacts with the authentication server 40 to obtain the authentication certificate from the authentication server 40.
  • the authentication certificate corresponds to pre-configured domain name information, such as the domain name information corresponding to the authentication server 40, and the domain name information of the address to be accessed.
  • the pre-stored authentication certificate is directly used for authentication negotiation with the user terminal 30, illegal authentication information will pop up.
  • authentication negotiation may be performed with the user terminal 30 in the following manner.
  • the preset phishing authentication conditions can be flexibly set.
  • the preset phishing authentication conditions can be set ports as the destination port number corresponding to the information sending request. Accordingly, the authentication device 20 determines whether the information transmission request satisfies a preset counterfeit authentication condition by determining whether the destination port number corresponding to the information transmission request is a set port number. If the destination port number of the message sending request is the set port number, it is determined that the message sending request meets the preset phishing authentication conditions; if the destination port number corresponding to the message sending request is not the set port number, it is determined that the message sending request does not meet the preset phishing authentication condition.
  • the set port number can be set flexibly.
  • the set port numbers can be port 80 and port 443.
  • the set port numbers can be 8080 port and 8443 port.
  • the preset phishing authentication condition may be that the destination IP address of the information sending request is a set IP address. Accordingly, the authentication device 20 determines whether the information transmission request satisfies a preset counterfeit authentication condition by determining whether the destination IP address of the information transmission request is a set IP address. If the destination IP address corresponding to the message sending request is the set IP address, it is determined that the message sending request meets the preset phishing authentication conditions; if the destination IP address corresponding to the message sending request is not the set IP address, it is judged that the message sending request does not meet the preset spoofing. Certification conditions.
  • the authentication device 20 intercepts the information sending request, performs connection interaction with the user terminal 30 by spoofing the target IP address, and uses the domain name information corresponding to the target IP address to perform certificate negotiation with the user terminal 30.
  • the authentication device 20 can impersonate the target IP address to connect and interact with the user terminal 30, and use the domain name information corresponding to the target IP address to perform certificate negotiation with the user terminal 30.
  • the authentication device 20 impersonates the target IP address and performs a three-way handshake of Transmission Control Protocol (TCP) with the user terminal 30 to establish a connection with the user terminal 30.
  • TCP Transmission Control Protocol
  • the user terminal 30 sends a Transport Layer Security (TLS) interaction request, such as sending a TLS client Hello message.
  • TLS Transport Layer Security
  • the authentication device 20 After receiving the TLS interaction request sent by the user terminal 30, the authentication device 20 performs TLS interaction with the user terminal 30.
  • TLS interaction process the authentication device 20 replaces the domain name information in the pre-stored authentication certificate with the domain name information corresponding to the target IP address, and sends the authentication certificate after the domain name information replacement to the user terminal 30, so as to achieve with the user terminal 30 Certificate negotiation.
  • the domain name corresponding to the destination IP address of the information sending request is WWW.XXXX.com
  • the domain name in the authentication certificate pre-stored by the authentication device 20 is WWW.YYY.cn, because the original domain name information in the authentication certificate and the user terminal 30 want to access The domain name information of the domain name does not match. Therefore, if the pre-stored authentication certificate is used to perform authentication negotiation with the user terminal 30, an illegal certificate warning message will pop up, and the user needs to manually choose to ignore the validity of the certificate, thereby reducing the user experience.
  • the authentication device 20 replaces the domain name information WWW.YYY.cn in the authentication certificate with WWW.XXXX.com, and sends the domain name information to WWW.XXXXX.com after the authentication certificate is sent.
  • the user terminal 30 checks that the domain name information in the authentication certificate is WWW.XXXX.com, matches the requested domain name information, and determines that the certificate is legitimate, so that the illegal certificate warning message does not pop up, and the user does not need to manually choose to ignore the validity of the certificate. Improve the convenience of access authentication and user experience.
  • the domain names are mainly distinguished by the root domain name, for example, WWW.YYY.cn and WWW.XXXX.com are mainly distinguished by the root domain name * .YYY.cn and the root domain name * .XXXX.com, so the domain name information can be Is the root domain name. Accordingly, the domain name information in the authentication certificate is the root domain name information, and the user terminal 30 can match the root domain name in the authentication certificate with the root domain name of the requested domain name, thereby implementing authentication negotiation.
  • the user terminal 30 After the authentication device 20 completes the authentication negotiation with the user terminal 30, the user terminal 30 sends a message, such as a HTTPS request message, and the Uniform Resource Locator (URL) in the header of the message is to be accessed by the user terminal 30 Website address, such as https://WWW.XXXX.com.
  • the authentication device 20 receives a message sent by the user terminal 30, parses the message, and obtains that a website address to be accessed by the user terminal 30 is https://WWW.XXXX.com.
  • the authentication device 20 constructs a redirection message, so that the redirection message carries the location address of the authentication server 40, and the location address of the authentication server 40 may be pre-stored in the authentication device 20.
  • the authentication device 20 sends a redirect message to the user terminal 30, so that the user terminal 30 performs authentication interaction with the authentication server 40 according to the location address. For example, if the location address of the authentication server 40 is WWW.YYY.cn, then WWW.YYY.cn may be pre-stored in the authentication certificate of the authentication device 20. After the authentication device 20 sends the redirection message to the user terminal 30, the user terminal 30 parses the redirection message to obtain WWW.YYY.cn, and accesses WWW.YYY.cn to perform authentication interaction with the authentication server 40.
  • a scenario in which the authentication device 20 enables Portal authentication is taken as an example.
  • the implementation flow of the access authentication method in the present disclosure and the access in the present disclosure are not used.
  • the implementation process of the authentication method is compared with an example.
  • Portal (entry) authentication is also commonly called Web (World Wide Web, also known as the World Wide Web) authentication, and Portal authentication websites are generally called portal websites.
  • the access authentication method is applicable to the scenario shown in FIG. 1.
  • the authentication device 20 pre-stores an authentication certificate, and the authentication certificate includes a pre-configured location address: the root domain name of WWW.YYY.cn: * .YYY.cn.
  • the preset phishing authentication conditions are destination port numbers 80 and 443.
  • the DNS request initiated by the user terminal 30 is the IP address corresponding to the request WWW.XXXXX.com. Please refer to FIG. 4 in combination.
  • the implementation principle of access authentication is as follows.
  • the user terminal 30 initiates a DNS request for an IP address corresponding to the WWW.XXXXX.com domain name.
  • the authentication device 20 receives the DNS request sent by the user terminal 30 and performs whitelist processing on the DNS request, thereby directly forwarding the DNS request to the DNS server 10.
  • the DNS server 10 After receiving the DNS request, the DNS server 10 responds to the DNS response message, and the DNS response message carries the IP address corresponding to the WWW.XXXXX.com domain name, such as 115.239.210.27.
  • the authentication device 20 receives the dns response message returned by the DNS server 10, and forwards the dns response message to the user terminal 30.
  • the user terminal 30 receives the DNS response message, and resolves that the IP address corresponding to WWW.XXXX.com is 115.239.210.27.
  • the user terminal 30 sends a message sending request to the authentication device 20, and the destination IP address of the message sending request is 115.239.210.27 and the destination port number is 443.
  • the authentication device 20 Since the authentication device 20 enables Portal authentication, and the preset spoofing authentication conditions are that the destination port numbers are 80 and 443, the authentication device 20 will intercept all packets with the destination port numbers 80 and 443.
  • the authentication device 20 After the authentication device 20 intercepts a request to send a packet with a destination IP address of 115.239.210.27 and a destination port number of 443, it spoofs the IP address 115.239.210.27 and performs a three-way TCP handshake with the user terminal 30 to establish a connection with the user terminal 30.
  • the user terminal 30 After the authentication device 20 establishes a connection with the user terminal 30, the user terminal 30 sends a Secure Sockets Layer (SSL) negotiation, and the authentication device 20 sends the built-in authentication certificate to the user terminal 30, where the authentication certificate includes a pre-configured location
  • SSL Secure Sockets Layer
  • the user terminal 30 receives the authentication certificate sent by the authentication device 20, and detects that the * .YYY.cn in the authentication certificate does not match the root domain name * .XXXX.com of the domain name corresponding to the IP address 115.239.210.27, and an illegal certificate alert pops up.
  • the user terminal 30 manually chooses to ignore the validity of the authentication certificate, and the user terminal 30 no longer checks the validity of the certificate, so as to perform subsequent operations.
  • the user terminal 30 After the SSL negotiation is completed, the user terminal 30 starts to send an HTTPS request message, and the URL of the header of the request message is the website address to be accessed by the user terminal 30: https://WWW.XXXX.com.
  • the authentication device 20 receives the HTTPS request message sent by the user terminal 30, parses the request message, and obtains a website address to be accessed by the user terminal 30 as https://WWW.XXXX.com.
  • the authentication device 20 responds to the user terminal 30 with a redirection message No. 302 according to the location address http://WWW.YYY.cn of the authentication server 40, and the redirection message carries http://WWW.YYY.cn.
  • the user terminal 30 parses the redirect message, obtains WWW.YYY.cn, and sends a request to the address WWW.YYY.cn.
  • the WWW.YYY.cn address is in the white list of the authentication device 20, and the authentication device 20 directly releases the message.
  • the subsequent user terminal 30 establishes a connection with the authentication server 40 through the TCP three-way handshake, and performs authentication interaction with the authentication server 40 by accessing WWW.YYY.cn.
  • the authentication device 20 does not know in advance that the domain name information to be accessed by the user terminal 30 is * .XXXX.com, and the domain name information in the authentication certificate of the authentication device 20 is * .YYY.cn.
  • the user terminal 30 determines that the authentication device 20 sends the In order to illegally authenticate a certificate, an illegal certificate alarm message pops up. The user needs to manually choose to ignore the validity of the certificate, which is inconvenient to implement and leads to a poor user experience.
  • the user terminal 30 initiates a DNS request for an IP address corresponding to the WWW.XXXXX.com domain name.
  • the authentication device 20 receives the DNS request sent by the user terminal 30 and performs whitelist processing on the DNS request, thereby directly forwarding the DNS request to the DNS server 10.
  • the DNS server 10 After receiving the DNS request, the DNS server 10 responds to the DNS response message, and the DNS response message carries the IP address corresponding to the WWW.XXXXX.com domain name, such as 115.239.210.27.
  • the authentication device 20 receives the dns response message returned by the DNS server 10, and forwards the dns response message to the user terminal 30.
  • the authentication device 20 detects whether the domain name information WWW.XXXX.com corresponding to the IP address 115.239.210.27 is stored. If the domain name information WWW.XXXX.com corresponding to the IP address 115.239.210.27 is not stored. , The domain name information WWW.XXXXX.com corresponding to the IP address 115.239.210.27 is cached, such as for ten minutes. If the domain name information WWW.XXXX.com corresponding to the IP address 115.239.210.27 has been stored, the cache duration of the domain name information WWW.XXXX.com is re-counted.
  • the user terminal 30 receives the DNS response message, and resolves that the IP address corresponding to WWW.XXXX.com is 115.239.210.27.
  • the user terminal 30 sends a message sending request to the authentication device 20, and the destination IP address of the message sending request is 115.239.210.27 and the destination port number is 443.
  • the authentication device 20 Since the authentication device 20 enables Portal authentication, and the preset spoofing authentication conditions are that the destination port numbers are 80 and 443, the authentication device 20 will intercept all packets with the destination port numbers 80 and 443.
  • the authentication device 20 After the authentication device 20 intercepts a request to send a packet with a destination IP address of 115.239.210.27 and a destination port number of 443, it spoofs the IP address 115.239.210.27 and performs a three-way TCP handshake with the user terminal 30 to establish a connection with the user terminal 30.
  • the authentication device 20 Based on the destination IP address 115.239.210.27 of the message sending request, the authentication device 20 finds the root domain name of the domain name corresponding to the IP address 115.239.210.27 from the stored information as * .XXXXX.com.
  • the authentication device 20 After the authentication device 20 establishes a connection with the user terminal 30, the user terminal 30 sends a TLS client Hello message, and after receiving the client Hello message sent by the user terminal 30, the authentication device 20 performs TLS interaction with the user terminal 30.
  • the authentication device 20 analyzes and obtains the root domain name of the location address originally configured in the authentication certificate: * .YYY.cn, the root domain name in the authentication certificate * .YYY.cn, and the destination IP address of the message sending request.
  • the root domain name * .XXXX.com corresponding to 115.239.210.27 does not match, so the root domain name * .YYY.cn in the certificate is replaced with the root domain name * .XXXX.com.
  • the authentication device 20 sends an authentication certificate with the root domain name replaced by * .XXXXX.com to the user terminal 30.
  • the user terminal 30 receives the authentication certificate sent by the authentication device 20, detects that the * .XXXX.com in the authentication certificate matches the root domain name * .XXXX.com of the domain name corresponding to the IP address 115.239.210.27, determines that the certificate is legitimate, and does not pop up an illegal certificate alarm Information, thereby eliminating the need for users to manually choose to ignore the validity of the certificate, thereby improving the convenience of access authentication and improving the user experience.
  • the user terminal 30 After the TLS negotiation is completed, the user terminal 30 starts sending an HTTPS request message, and the URL of the header of the request message is the website address to be accessed by the user terminal 30: https://WWW.XXXX.com.
  • the authentication device 20 receives the HTTPS request message sent by the user terminal 30, parses the request message, and obtains a website address to be accessed by the user terminal 30 as https://WWW.XXXX.com.
  • the authentication device 20 according to the configured authentication server 40
  • the root domain name of the location address http: //WWW.YYY.cn*.YYY.cn responds to the user terminal 30 with a redirection message No. 302, and the redirection message carries the location address http://WWW.YYY.cn .
  • the user terminal 30 parses the redirect message, obtains WWW.YYY.cn, and sends a request to the address WWW.YYY.cn.
  • the WWW.YYY.cn address is in the white list of the authentication device 20, the authentication device 20 directly releases the message, and the subsequent user terminal 30 establishes a connection with the authentication server 40 through the TCP three-way handshake, and accesses WWW.YYY.cn to communicate with the authentication server. 40 for authentication interaction.
  • XXXXX in WWW.XXXX.com may refer to a domain name composed of any number of the same or different characters, for example, it may be baidu, google, taobao, etc.
  • YYY in WWW.YYY.cn can refer to a domain name composed of any number of the same or different characters. For example, it can be h3c, chaofan, etc., and this disclosure does not limit this.
  • the present disclosure further provides an access authentication device 24 applied to the authentication device 20 shown in FIG. 2.
  • the access authentication device 24 includes a request information transmission module 241, a response information transmission module 242, and an information processing module 243.
  • the request information transmission module 241 is configured to receive a domain name system DNS request sent by the user terminal 30 and forward the DNS request to the DNS server 10.
  • request information transmission module 24 For the implementation manner of the request information transmission module 241, reference may be made to the related description of step S11 in FIG. 3, and details are not described herein.
  • the response information transmission module 242 is configured to receive request response information sent by the DNS server 10 according to the DNS request, and forward the request response information to the user terminal 30, where the request response information carries the DNS Request the target IP address corresponding to the requested domain name.
  • response information transmission module 242 For the implementation of the response information transmission module 242, reference may be made to the related description of step S12 in FIG. 3, and details are not described herein.
  • the information processing module 243 is configured to detect whether the domain name information corresponding to the target IP address is stored. If the domain name information corresponding to the target IP address is not stored, the domain name information corresponding to the target IP address is stored and stored according to the storage.
  • the authentication information is negotiated with the user terminal 30 to avoid pop-up illegal certificate alarm information.
  • step S13 and step S14 in FIG. 3 For the implementation manner of the information processing module 243, reference may be made to the related descriptions of step S13 and step S14 in FIG. 3, and details are not described herein.
  • the information processing module 243 performs authentication negotiation with the user terminal 30 according to the stored information in the following manner: receiving the information that the destination IP address sent by the user terminal 30 is the target IP address Request to determine whether the information sending request satisfies a preset spoofing authentication condition; if the information sending request meets the preset spoofing authentication condition, spoof the target IP address to connect and interact with the user terminal 30 and use The domain name information corresponding to the target IP address is authenticated and negotiated with the user terminal 30.
  • the information processing module 243 impersonates the target IP address to connect and interact with the user terminal 30, and uses the domain name information corresponding to the target IP address to perform the connection with the user terminal 30.
  • Authentication negotiation masquerading the target IP address and performing a three-way handshake with the user terminal 30 as a transmission control protocol TCP to establish a connection with the user terminal 30; receiving a secure transport layer protocol TLS interaction request sent by the user terminal 30; The domain name information in the pre-stored authentication certificate is replaced with the domain name information corresponding to the target IP address and sent to the user terminal 30, so as to implement certificate negotiation with the user terminal 30.
  • the information processing module 243 determines whether the information sending request meets a preset counterfeit authentication condition by determining whether the destination port number corresponding to the information sending request is a set port number, and if The set port number determines whether the information sending request satisfies a preset counterfeit authentication condition.
  • the information processing module 243 stores the domain name information corresponding to the target IP address in the following manner: caches the domain name information corresponding to the target IP address for a set duration, and reaches the set duration Then, delete the domain name information corresponding to the target IP address.
  • the information processing module 243 is further configured to re-count the cache duration of the domain name information corresponding to the target IP address if the domain name information corresponding to the target IP address is stored.
  • the information processing module 243 is further configured to, after completing authentication negotiation with the user terminal, receive a message sent by the user terminal; parse the message, and construct a redirect message So that the redirection message carries the location address of the pre-stored authentication server; and sending the redirection message to the user terminal, so that the user terminal communicates with the authentication server according to the location address Authentication interaction.
  • an authentication device 20 provided by the present disclosure includes: a memory, a processor, and a computer program stored on the memory and executable on the processor.
  • the processor executes the program, the following steps are implemented: receiving The domain name system DNS request sent by the user terminal forwards the DNS request to a DNS server; receives the request response information sent by the DNS server according to the DNS request, and forwards the request response information to the user terminal.
  • the request response information carries a target IP address corresponding to the domain name requested by the DNS request; detecting whether domain name information corresponding to the target IP address is stored, and if domain name information corresponding to the target IP address is not stored, The domain name information corresponding to the target IP address is stored, and authentication negotiation is performed with the user terminal according to the stored information to avoid pop-up illegal certificate alarm information.
  • the processor when the processor executes the program, the processor performs authentication negotiation with the user terminal according to the stored information by receiving the information that the destination IP address sent by the user terminal is the target IP address. Send a request to determine whether the information sending request satisfies a preset spoofing authentication condition; if the information sending request meets the preset spoofing authentication condition, spoof the target IP address to connect and interact with the user terminal, and use The domain name information corresponding to the target IP address is authenticated and negotiated with the user terminal.
  • the processor executes the program, the following steps are used to impersonate the target IP address to connect and interact with the user terminal, and use the domain name information corresponding to the target IP address to communicate with the user terminal.
  • the domain name information in the authentication certificate is replaced with the domain name information corresponding to the target IP address and sent to the user terminal, thereby implementing certificate negotiation with the user terminal.
  • the processor executes the program, the following steps are performed to determine whether the information sending request meets a preset counterfeit authentication condition: determining whether a destination port number corresponding to the information sending request is a set port number If it is the set port number, it is determined that the information sending request meets a preset phishing authentication condition.
  • the domain name information corresponding to the target IP address is stored by storing the domain name information corresponding to the target IP address for a set duration to reach the After setting the duration, the domain name information corresponding to the target IP address is deleted; the processor executes the program to further implement the following steps: if the domain name information corresponding to the target IP address is stored, re-counting the target IP address correspondence The cache time of the domain name information.
  • the processor executes the program to further implement the following steps: receiving a message sent by the user terminal; parsing the message, and constructing a repeat message.
  • a directed message so that the redirection message carries a location address of a pre-stored authentication server; and sending the redirection message to the user terminal, so that the user terminal communicates with the location address according to the location address
  • the authentication server performs authentication interaction.
  • the access authentication method, device and authentication device in the present disclosure store the domain name information corresponding to the target IP address during the DNS request interaction process, and use the domain name information corresponding to the target IP address to perform authentication negotiation with the user terminal, thereby avoiding illegal pop-ups.
  • Authentication alert information improves the convenience of access authentication and thus improves the user experience.
  • each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, which contains one or more components for implementing a specified logical function Executable instructions.
  • the functions marked in the blocks may also occur in a different order than those marked in the drawings.
  • each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts can be implemented in a dedicated hardware-based system that performs the specified function or action. , Or it can be implemented with a combination of dedicated hardware and computer instructions.
  • the functional modules in the various embodiments of the present disclosure may be integrated together to form an independent part, or each of the modules may exist alone, or two or more modules may be integrated to form an independent part.
  • the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present disclosure is essentially a part that contributes to the existing technology or a part of the technical solution may be embodied in the form of a software product.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, an authentication device, or a network device, etc.) to perform all or part of the steps of the method described in various embodiments of the present disclosure.
  • the foregoing storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks or optical disks and other media that can store program codes .
  • ROM read-only memory
  • RAM random access memory
  • the access authentication method, device and authentication device provided by the present disclosure avoid the pop-up of illegal authentication alarm information, thereby improving the convenience of access authentication and further improving the user experience.

Abstract

本公开提供一种访问认证方法、装置及认证设备，涉及通信技术领域。访问认证方法应用于认证设备，所述方法包括接收用户终端发送的域名系统DNS请求，将所述DNS请求转发至DNS服务器；接收所述DNS服务器根据所述DNS请求发送的请求响应信息，并将所述请求响应信息转发至所述用户终端，所述请求响应信息中携带有所述DNS请求所请求的域名所对应的目标IP地址；检测是否存储有所述目标IP地址对应的域名信息，若未存储有所述目标IP地址对应的域名信息，将所述目标IP地址对应的域名信息进行存储，并根据存储的信息与所述用户终端进行认证协商，以避免弹出非法证书告警信息。从而提高访问认证的便捷性。

Description

访问认证方法、装置及认证设备
相关申请的交叉引用
本公开要求于2018年08月16日提交中国专利局的申请号为CN2018109379011，名称为“访问认证方法、装置及认证设备”的中国专利申请的优先权，其全部内容通过引用结合在本公开中。
背景技术
随着互联网技术的快速发展，在很多应用场景中需要在用户通过用户终端访问网站时进行访问认证，例如，在未认证用户通过用户终端上网时，强制用户登录到设定站点，用户可以通过用户终端免费访问设定站点中的服务。若用户需要使用互联网中的其它信息，则必须进行认证，只有认证通过后才可以使用互联网资源。
附图说明
为了更清楚地说明本公开的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，应当理解，以下附图仅示出了本公开的某些实施例，因此不应被看作是对范围的限定，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他相关的附图。
图1为本公开提供的一种应用场景示意图。
图2为本公开提供的一种认证设备的方框示意图。
图3为本公开提供的一种访问认证方法的流程示意图。
图4为本公开提供的一种实现访问认证的交互示意图。
图5为本公开提供的另一种实现访问认证的交互示意图。
图6为本公开提供的一种访问认证装置的方框示意图。
图标：10-DNS服务器；20-认证设备；21-存储器；22-处理器；23-网络模块；24-访问认证装置；241-请求信息传输模块；242-响应信息传输模块；243-信息处理模块；30-用户终端；40-认证服务器。
具体实施方式
在用户通过用户终端访问网站时需要进行访问认证的场景中，需要用户在设定的认证网站，如门户网站进行访问认证，认证通过后方可以使用互联网资源。为了实现访问认证，用户可以主动访问已知的认证网站，输入认证信息，如用户名和密码进行认证，从而实现 主动认证。反之，若用户在未主动认证的情况下，试图直接访问其他外网，如通过超文本传输协议(HTTP，Hyper Text Transfer Protocol)访问其他外网，将被强制访问认证网站，从而开始访问认证过程，实现强制认证。
如图1所示，本公开提供一种实现访问认证的应用场景，该应用场景中包括域名系统(Domain Name System)DNS服务器10、认证设备20、用户终端30和认证服务器40。其中，DNS服务器10与认证设备20通信连接，用户终端30与认证设备20和认证服务器40分别通信连接。DNS服务器10是进行域名(Domain Name)和与域名相对应的网络协议(Internet Protocol，IP)地址转换的服务器。认证设备20为路由器、交换机、无线控制器等具有通信及处理功能的网络设备。认证设备20中预存有认证信息，如认证证书，该认证证书可以由认证服务器40颁发。认证设备20在用户通过用户终端30访问其他外网时与用户终端30进行认证协商，从而使得用户终端30与认证服务器40进行认证交互，进而实现强制认证。
经研究发现，目前的很多网站均为HTTPS(Hyper Text Transfer Protocol over Secure Socket Layer，超文本传输安全协议)网站，为了在用户访问其他外网时实现强制认证，当用户访问外网如HTTPS网站时，认证设备20需要进行HTTPS仿冒，并与用户的用户终端30进行认证协商。在认证协商过程中，由于认证设备20预存的认证信息，如认证证书与用户所要访问的网站的认证信息不匹配，从而导致用户终端30的界面弹出非法证书告警信息，需用户手动选择忽略证书的合法性方能进行后续交互，访问认证的便捷性有待提高，访问方式不够友好，对用户体验产生不利影响。
有鉴于此，本公开提供一种访问认证方法、装置及认证设备20，在进行DNS请求交互过程中，认证设备20接收DNS服务器10针对用户终端30发送的DNS请求所发送的请求响应信息，请求响应信息中携带有DNS请求所请求的域名所对应的目标IP地址。认证设备20在本地未存储有目标IP地址对应的域名信息时，将目标IP地址对应的域名信息进行存储，并根据存储的域名信息与用户终端30进行认证协商，鉴于所存储的目标IP地址对应的域名信息与用户所要访问的网站的域名信息匹配，从而避免弹出非法证书告警信息，提高访问认证的便捷性，进而提高用户体验。
针对以上方案所存在的缺陷，均是发明人在经过实践并仔细研究后得出的结果，因此，上述问题的发现过程以及下文中本公开针对上述问题所提出的解决方案，都应该是发明人在本公开过程中对本公开做出的贡献。
下面将结合本公开中附图，对本公开中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本公开一部分实施例，而不是全部的实施例。通常在此处附图中描述 和示出的本公开的组件可以以各种不同的配置来布置和设计。因此，以下对在附图中提供的本公开的实施例的详细描述并非旨在限制要求保护的本公开的范围，而是仅仅表示本公开的选定实施例。基于本公开的实施例，本领域技术人员在没有做出创造性劳动的前提下所获得的所有其他实施例，都属于本公开保护的范围。
应注意到：相似的标号和字母在下面的附图中表示类似项，因此，一旦某一项在一个附图中被定义，则在随后的附图中不需要对其进行进一步定义和解释。
如图2所示，是本公开提供的认证设备20的一种方框示意图。本公开中的认证设备20可以为路由器、交换机、无线控制器等具有通信及处理功能的网络设备。该认证设备20位于图1所示应用场景中，能够与DNS服务器10和用户终端30通信。如图2所示，认证设备20包括：存储器21、处理器22、网络模块23及访问认证装置24。
所述存储器21、处理器22以及网络模块23相互之间直接或间接地电性连接，以实现数据的传输或交互。例如，这些元件相互之间可通过一条或多条通讯总线或信号线实现电性连接。存储器21中存储有访问认证装置24，所述访问认证装置24包括至少一个可以软件或固件(firmware)的形式存储于所述存储器21中的软件功能模块，所述处理器22通过运行存储在存储器21内的软件程序以及模块，如本公开中的访问认证装置24，从而执行各种功能应用以及数据处理，即实现本公开中的访问认证方法。
其中，所述存储器21可以是，但不限于，随机存取存储器(Random Access Memory，RAM)，只读存储器(Read Only Memory，ROM)，可编程只读存储器(Programmable Read-Only Memory，PROM)，可擦除只读存储器(Erasable Programmable Read-Only Memory，EPROM)，电可擦除只读存储器(Electric Erasable Programmable Read-Only Memory，EEPROM)等。其中，存储器21用于存储程序，所述处理器22在接收到执行指令后，执行所述程序。
所述处理器22可能是一种集成电路芯片，具有数据的处理能力。上述的处理器22可以是通用处理器，包括中央处理器(Central Processing Unit，CPU)、网络处理器(Network Processor，NP)等。可以实现或者执行本公开中公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
网络模块23用于通过网络建立认证设备20与外部通信终端之间的通信连接，实现网络信号及数据的收发操作。上述网络信号可包括无线信号或者有线信号。
可以理解，图2所示的结构仅为示意，认证设备20还可包括比图2中所示更多或者更少的组件，或者具有与图2所示不同的配置。图2中所示的各组件可以采用硬件、软件或其组合实现。
在上述基础上，本公开还提供一种计算机可读存储介质，所述计算机可读存储介质包括计算机程序，所述计算机程序运行时控制所述计算机可读存储介质所在认证设备20执行下述访问认证方法。
请结合参阅图3，本公开提供一种访问认证方法，适用于图1所示应用场景，该方法可以由图1中的认证设备20执行。
所述方法包括以下步骤。
步骤S11，接收用户终端30发送的域名系统DNS(Domain Name System)请求，将所述DNS请求转发至DNS服务器10。
DNS请求可以为请求某一域名对应的IP(Internet Protocol，网络协议)地址。认证设备20对于DNS信息，如DNS请求报文可以进行白名单处理，从而在接收到DNS请求后，直接将该DNS请求转发至DNS服务器10。
DNS服务器10接收到DNS请求后，获取与DNS请求对应的请求响应信息，并发送至认证设备20。其中，请求响应信息可以为一请求响应报文，如dns reponse报文，请求响应报文中携带有DNS请求所请求的域名所对应的目标IP地址。
步骤S12，接收所述DNS服务器10根据所述DNS请求发送的请求响应信息，并将所述请求响应信息转发至所述用户终端30。
其中，所述请求响应信息中携带有DNS请求所请求的域名所对应的目标IP地址。例如，若DNS请求为请求域名WWW.XXXXX.com对应的IP地址，那么，请求响应信息中携带有域名WWW.XXXXX.com对应的IP地址。认证设备20接收到DNS服务器10发送的请求响应信息后，将该请求响应信息转发至用户终端30。
步骤S13，检测是否存储有所述目标IP地址对应的域名信息，若未存储有所述目标IP地址对应的域名信息，执行步骤S14。
步骤S14，将所述目标IP地址对应的域名信息进行存储，并根据存储的信息与所述用户终端30进行认证协商，以避免弹出非法证书告警信息。
请求响应信息经过认证设备20时，认证设备20检测是否存储有目标IP地址对应的域名信息，若未存储有目标IP地址对应的域名信息，则将目标IP地址对应的域名信息进行存储。以便于根据存储的信息与用户终端30进行认证协商。
其中，认证设备20将目标IP地址对应的域名信息进行存储的方式有多种，例如，认证设备20可以将目标IP地址对应的域名信息一直存储在本地，从而确保存储信息的全面性。又例如，认证设备20可以将目标IP地址对应的域名信息缓存设定时长，达到设定时长后，删除该目标IP地址对应的域名信息，从而释放缓存空间，确保缓存空间满足需求。 在根据缓存时长判断是否删除域名信息的情况下，为了确保对于目标IP地址对应的域名信息存储的可靠性，若步骤S13中判定认证设备20已经存储有目标IP地址对应的域名信息，那么重新统计目标IP地址对应的域名信息的缓存时长。又例如，认证设备20可以将目标IP地址对应的域名信息存储在本地，根据目标IP地址对应的域名信息被使用情况判断是否删除该目标IP地址对应的域名信息，如在某一目标IP地址对应的域名信息被用于进行认证协商的使用率低于设定值时，删除该目标IP地址对应的域名信息；反之，在某一目标IP地址对应的域名信息被用于进行认证协商的使用率高于设定值时，继续存储该目标IP地址对应的域名信息。
鉴于用户终端30主要通过验证接收到的认证信息是否与所要访问的域名匹配来判定认证合法性，因而，在进行DNS请求交互过程中，对目标IP地址对应的域名信息进行存储，使得在认证协商中，接收到用户终端30发送的目的IP地址为目标IP地址的信息发送请求后，基于该目标IP地址即可从存储的信息中查找出与目标IP地址对应的域名信息，从而使用该域名信息与用户终端30进行认证协商。由于认证设备20采用的为与用户终端30所要访问的域名匹配的域名信息与用户终端30进行协商，因而，用户终端30会判定认证设备20所进行的认证为合法认证，从而不会弹出非法认证信息。
作为一种可选实现方式，认证设备20可以使用认证证书与用户终端30进行协商。例如，认证设备20中可以预存一认证证书，该认证证书可以由认证服务器40颁发，如认证设备20与认证服务器40进行交互，从而从认证服务器40获得认证证书。认证证书中对应一预先配置的域名信息，如与认证服务器40对应的域名信息，又如待访问地址的域名信息等。该种情况下，由于认证证书中原有的域名信息与用户终端30所要访问的域名的域名信息不匹配，因而，若直接使用预存的认证证书与用户终端30进行认证协商会弹出非法认证信息。为了避免弹出非法认证信息，可以通过以下方式与用户终端30进行认证协商。
接收所述用户终端30发送的目的IP地址为所述目标IP地址的信息发送请求，判断所述信息发送请求是否满足预设仿冒认证条件。
其中，预设仿冒认证条件可以灵活设定，例如，预设仿冒认证条件可以为信息发送请求对应的目的端口号为设定端口。相应地，认证设备20通过判断信息发送请求对应的目的端口号是否为设定端口号来判定信息发送请求是否满足预设仿冒认证条件。若信息发送请求的目的端口号为设定端口号，判定信息发送请求满足预设仿冒认证条件；若信息发送请求对应的目的端口号非设定端口号，判定信息发送请求不满足预设仿冒认证条件。其中，设定端口号可以灵活设定，例如，设定端口号可以为80端口和443端口。又例如，设定端口号可以为8080端口和8443端口等。
又例如，预设仿冒认证条件可以为信息发送请求的目的IP地址为设定IP地址。相应地，认证设备20通过判断信息发送请求的目的IP地址是否为设定IP地址来判定信息发送请求是否满足预设仿冒认证条件。若信息发送请求对应的目的IP地址为设定IP地址，判定信息发送请求满足预设仿冒认证条件；若信息发送请求对应的目的IP地址非设定IP地址，判定信息发送请求不满足预设仿冒认证条件。
若信息发送请求满足预设仿冒认证条件，认证设备20对信息发送请求进行拦截，仿冒目标IP地址与用户终端30进行连接交互，并使用目标IP地址对应的域名信息与用户终端30进行证书协商。
在认证设备20中预存有认证证书的情况下，认证设备20可以通过以下方式仿冒目标IP地址与用户终端30进行连接交互，并使用目标IP地址对应的域名信息与用户终端30进行证书协商。
认证设备20仿冒所述目标IP地址与所述用户终端30进行传输控制协议(Transmission Control Protocol，TCP)的三次握手，从而与用户终端30建立连接。认证设备20与用户终端30建立连接后，用户终端30发送安全传输层协议(Transport Layer Security，TLS)交互请求，如发送TLS的client hello报文。认证设备20接收到用户终端30发送的TLS交互请求后，与用户终端30进行TLS交互。在TLS交互过程中，认证设备20将预存的认证证书中的域名信息替换为目标IP地址对应的域名信息，并将进行域名信息替换后的认证证书发送至用户终端30，从而与用户终端30实现证书协商。例如，信息发送请求的目的IP地址对应的域名为WWW.XXXXX.com，认证设备20预存的认证证书中的域名为WWW.YYY.cn，由于认证证书中原有的域名信息与用户终端30所要访问的域名的域名信息不匹配，因而，若直接使用预存的认证证书与用户终端30进行认证协商会弹出非法证书告警信息，需用户手动选择忽略证书合法性，从而降低了用户体验。为了避免弹出非法认证信息，本公开中，认证设备20将认证证书中的域名信息WWW.YYY.cn替换为WWW.XXXXX.com，并将域名信息替换为WWW.XXXXX.com后的认证证书发送至用户终端30，从而与用户终端30实现证书协商。用户终端30检查该认证证书中的域名信息为WWW.XXXXX.com，与所请求的域名信息匹配，认定证书合法，从而不会弹出非法证书告警信息，进而无需用户手动选择忽略证书合法性，从而提高访问认证的便捷性，提高用户体验。
考虑到各域名之间主要通过根域名部分区分，例如，WWW.YYY.cn与WWW.XXXXX.com主要通过根域名*.YYY.cn和根域名*.XXXXX.com区分，因而，域名信息可以为根域名。相应地，认证证书中的域名信息为根域名信息，用户终端30可以将认证 证书中的根域名与所请求的域名的根域名匹配，从而实现认证协商。
认证设备20与用户终端30完成认证协商后，用户终端30发送报文，如HTTPS的请求报文，该报文的头部的统一资源定位符(Uniform Resource Locator，URL)为用户终端30所要访问的网站地址，如https://WWW.XXXXX.com。认证设备20接收用户终端30发送的报文，解析该报文，得到用户终端30所要访问的网站地址为https://WWW.XXXXX.com。认证设备20构建重定向报文，以使重定向报文中携带认证服务器40的location地址，该认证服务器40的location地址可以预存在认证设备20中。认证设备20将重定向报文发送至用户终端30，以使用户终端30根据所述location地址与所述认证服务器40进行认证交互。例如，若认证服务器40的location地址为WWW.YYY.cn，那么WWW.YYY.cn可以预存在认证设备20的认证证书中。认证设备20将重定向报文发送至用户终端30后，用户终端30解析该重定向报文，得到WWW.YYY.cn，通过访问WWW.YYY.cn从而与认证服务器40进行认证交互。
为了更为清楚地阐述本公开的实现原理和优越性，现以认证设备20开启了Portal(入口)认证的场景为例，对未采用本公开中访问认证方法的实现流程与采用本公开中访问认证方法的实现流程进行对比性的举例说明。Portal(入口)认证通常也称为Web(World Wide Web，全球广域网，也称为万维网)认证，一般将Portal认证网站称为门户网站。
其中，访问认证方法适用于图1所示场景。在该场景中，认证设备20预存有认证证书，认证证书中包括预先配置的location地址：WWW.YYY.cn的根域名：*.YYY.cn。预设仿冒认证条件为目的端口号为80端口和443端口。假设用户终端30发起的DNS请求为请求WWW.XXXXX.com对应的IP地址，请结合参阅图4，未采用本公开中访问认证方法的情况下，访问认证实现原理如下。
用户终端30发起DNS请求，请求WWW.XXXXX.com域名对应的IP地址。
认证设备20接收用户终端30发送的DNS请求，对DNS请求进行白名单处理，从而将DNS请求直接转发给DNS服务器10。
DNS服务器10接收到DNS请求后，回应dns reponse报文，在dns reponse报文中携带WWW.XXXXX.com域名对应的IP地址，如115.239.210.27。
认证设备20接收DNS服务器10回应的dns reponse报文，并将该dns reponse报文转发至用户终端30。
用户终端30接收到dns reponse报文，解析出WWW.XXXXX.com对应的IP地址为115.239.210.27。
用户终端30向认证设备20发送报文发送请求，该报文发送请求的目的IP地址为 115.239.210.27，目的端口号为443。
由于认证设备20开启了Portal认证，且预设仿冒认证条件为目的端口号为80端口和443端口，因此认证设备20会对所有目的端口号为80端口和443端口的报文进行拦截。
认证设备20拦截下目的IP地址为115.239.210.27，目的端口号为443的报文发送请求后，仿冒IP地址115.239.210.27与用户终端30进行TCP的三次握手，与用户终端30建立连接。
认证设备20与用户终端30建立连接后，用户终端30发送安全套接层(Secure Sockets Layer，SSL)协商，认证设备20将内置的认证证书发送给用户终端30，其中，认证证书包括预先配置的location地址的根域名：*.YYY.cn。
用户终端30接收认证设备20发送的认证证书，检测认证证书中的*.YYY.cn与IP地址115.239.210.27对应的域名的根域名*.XXXXX.com不匹配，从而弹出非法证书告警，用户在用户终端30上手动选择忽略认证证书合法性，用户终端30则不再检查该合法性，从而进行后续操作。
SSL协商完成后，用户终端30开始发送HTTPS的请求报文，该请求报文的头部的URL为用户终端30所要访问的网站地址：https://WWW.XXXXX.com。
认证设备20接收用户终端30发送的HTTPS的请求报文，解析该请求报文，得到用户终端30所要访问的网站地址为https://WWW.XXXXX.com。认证设备20根据认证服务器40的location地址http://WWW.YYY.cn，向用户终端30回应302号重定向报文，在重定向报文中携带http://WWW.YYY.cn。
用户终端30解析重定向报文，得到WWW.YYY.cn，往地址WWW.YYY.cn发送请求，WWW.YYY.cn地址在认证设备20的白名单中，认证设备20直接放行该报文。后续用户终端30通过TCP三次握手，与认证服务器40建立连接，并通过访问WWW.YYY.cn从而与认证服务器40进行认证交互。
分析可知，采用上述访问认证方案，认证设备20未事先得知用户终端30所要访问的域名信息为*.XXXXX.com，认证设备20的认证证书中的域名信息为*.YYY.cn，采用认证证书与用户终端30进行认证协商过程中，由于认证证书中的域名信息*.YYY.cn与用户终端30所要访问的域名信息*.XXXXX.com不匹配，导致用户终端30判定认证设备20发送的为非法认证证书，从而弹出非法证书告警信息，需用户手动选择忽略证书合法性，实现较为不便，且导致用户体验不佳。
请结合参阅图5，采用本公开中的方案，实现原理如下。
用户终端30发起DNS请求，请求WWW.XXXXX.com域名对应的IP地址。
认证设备20接收用户终端30发送的DNS请求，对DNS请求进行白名单处理，从而将DNS请求直接转发给DNS服务器10。
DNS服务器10接收到DNS请求后，回应dns reponse报文，在dns reponse报文中携带WWW.XXXXX.com域名对应的IP地址，如115.239.210.27。
认证设备20接收DNS服务器10回应的dns reponse报文，并将该dns reponse报文转发至用户终端30。
dns reponse报文经过认证设备20时，认证设备20检测是否存储有IP地址115.239.210.27对应的域名信息WWW.XXXXX.com，若未存储有IP地址115.239.210.27对应的域名信息WWW.XXXXX.com，则将IP地址115.239.210.27对应的域名信息WWW.XXXXX.com进行缓存，如缓存十分钟。若已存储有IP地址115.239.210.27对应的域名信息WWW.XXXXX.com，则重新统计域名信息WWW.XXXXX.com的缓存时长。
用户终端30接收到dns reponse报文，解析出WWW.XXXXX.com对应的IP地址为115.239.210.27。
用户终端30向认证设备20发送报文发送请求，该报文发送请求的目的IP地址为115.239.210.27，目的端口号为443。
由于认证设备20开启了Portal认证，且预设仿冒认证条件为目的端口号为80端口和443端口，因此认证设备20会对所有目的端口号为80端口和443端口的报文进行拦截。
认证设备20拦截下目的IP地址为115.239.210.27，目的端口号为443的报文发送请求后，仿冒IP地址115.239.210.27与用户终端30进行TCP的三次握手，与用户终端30建立连接。
认证设备20基于报文发送请求的目的IP地址115.239.210.27从存储的信息中查找出IP地址115.239.210.27对应的域名的根域名为*.XXXXX.com。
认证设备20与用户终端30建立连接后，用户终端30发送TLS的client hello报文，认证设备20接收用户终端30发送的client hello报文后，与用户终端30进行TLS交互。在TLS交互过程中，认证设备20分析得出认证证书中原本配置的location地址的根域名：*.YYY.cn，认证证书中的根域名*.YYY.cn与报文发送请求的目的IP地址115.239.210.27对应的根域名*.XXXXX.com不匹配，从而将认证证书中的根域名*.YYY.cn替换为根域名*.XXXXX.com。
认证设备20将根域名替换为*.XXXXX.com的认证证书发送至用户终端30。
用户终端30接收认证设备20发送的认证证书，检测认证证书中的*.XXXXX.com与IP地址115.239.210.27对应的域名的根域名*.XXXXX.com匹配，认定证书合法，不弹出非法 证书告警信息，进而无需用户手动选择忽略证书合法性，从而提高访问认证的便捷性，提高用户体验。
TLS协商完成后，用户终端30开始发送HTTPS的请求报文，该请求报文的头部的URL为用户终端30所要访问的网站地址：https://WWW.XXXXX.com。
认证设备20接收用户终端30发送的HTTPS的请求报文，解析该请求报文，得到用户终端30所要访问的网站地址为https://WWW.XXXXX.com，认证设备20根据配置的认证服务器40的location地址http://WWW.YYY.cn的根域名*.YYY.cn向用户终端30回应302号重定向报文，在重定向报文中携带location地址http://WWW.YYY.cn。
用户终端30解析重定向报文，得到WWW.YYY.cn，往地址WWW.YYY.cn发送请求。WWW.YYY.cn地址在认证设备20的白名单中，认证设备20直接放行该报文，后续用户终端30通过TCP三次握手与认证服务器40建立连接，通过访问WWW.YYY.cn从而与认证服务器40进行认证交互。
将图4中的交互流程和图5中的交互流程进行对比分析可知，采用本公开中的方案，通过对认证设备20的巧妙设计，使得认证设备20与用户终端30进行认证协商过程中不会弹出非法证书告警信息，无需用户手动选择忽略证书合法性，从而有效提高访问认证的便捷性和用户体验。
应当理解，本公开中，WWW.XXXXX.com中的“XXXXX”可以泛指由任意数量的、相同或者不同的字符所构成的域名，例如，可以为baidu、google、taobao等。WWW.YYY.cn中的“YYY”可以泛指由任意数量的、相同或者不同的字符所构成的域名，例如，可以为h3c、chaofan等，本公开对此不作限制。
请参阅图6，本公开还提供一种访问认证装置24，应用于图2所示认证设备20，访问认证装置24包括请求信息传输模块241、响应信息传输模块242和信息处理模块243。
其中，请求信息传输模块241用于接收用户终端30发送的域名系统DNS请求，将所述DNS请求转发至DNS服务器10。
关于请求信息传输模块241的实现方式可以参阅图3中步骤S11的相关描述，在此不作赘述。
响应信息传输模块242用于接收所述DNS服务器10根据所述DNS请求发送的请求响应信息，并将所述请求响应信息转发至所述用户终端30，所述请求响应信息中携带有所述DNS请求所请求的域名所对应的目标IP地址。
关于响应信息传输模块242的实现方式可以参阅图3中步骤S12的相关描述，在此不作赘述。
信息处理模块243用于检测是否存储有所述目标IP地址对应的域名信息，若未存储有所述目标IP地址对应的域名信息，将所述目标IP地址对应的域名信息进行存储，并根据存储的信息与所述用户终端30进行认证协商，以避免弹出非法证书告警信息。
关于信息处理模块243的实现方式可以参阅图3中步骤S13和步骤S14的相关描述，在此不作赘述。
在一种实现方式中，所述信息处理模块243通过以下方式根据存储的信息与所述用户终端30进行认证协商：接收所述用户终端30发送的目的IP地址为所述目标IP地址的信息发送请求，判断所述信息发送请求是否满足预设仿冒认证条件；若所述信息发送请求满足所述预设仿冒认证条件，则仿冒所述目标IP地址与所述用户终端30进行连接交互，并使用所述目标IP地址对应的域名信息与所述用户终端30进行认证协商。
在一种实现方式中，所述信息处理模块243通过以下方式仿冒所述目标IP地址与所述用户终端30进行连接交互，并使用所述目标IP地址对应的域名信息与所述用户终端30进行认证协商：仿冒所述目标IP地址与所述用户终端30进行传输控制协议TCP的三次握手，从而与所述用户终端30建立连接；接收所述用户终端30发送的安全传输层协议TLS交互请求；将预存的认证证书中的域名信息替换为所述目标IP地址对应的域名信息并发送至所述用户终端30，从而与所述用户终端30实现证书协商。
在一种实现方式中，所述信息处理模块243通过以下方式判断所述信息发送请求是否满足预设仿冒认证条件：判断所述信息发送请求对应的目的端口号是否为设定端口号，若为所述设定端口号，判定所述信息发送请求满足预设仿冒认证条件。
在一种实现方式中，所述信息处理模块243通过以下方式将所述目标IP地址对应的域名信息进行存储：将所述目标IP地址对应的域名信息缓存设定时长，达到所述设定时长后，删除该目标IP地址对应的域名信息。所述信息处理模块243还用于若存储有所述目标IP地址对应的域名信息，则重新统计所述目标IP地址对应的域名信息的缓存时长。
在一种实现方式中，所述信息处理模块243还用于，在与所述用户终端完成认证协商后，接收所述用户终端发送的报文；解析所述报文，并构建重定向报文，以使所述重定向报文中携带预存的认证服务器的location地址；将所述重定向报文发送至所述用户终端，以使所述用户终端根据所述location地址与所述认证服务器进行认证交互。
在上述基础上，本公开提供的一种认证设备20包括：存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述程序时实现以下步骤：接收用户终端发送的域名系统DNS请求，将所述DNS请求转发至DNS服务器；接收所述DNS服务器根据所述DNS请求发送的请求响应信息，并将所述请求响应信息转发至所述用户终 端，所述请求响应信息中携带有所述DNS请求所请求的域名所对应的目标IP地址；检测是否存储有所述目标IP地址对应的域名信息，若未存储有所述目标IP地址对应的域名信息，将所述目标IP地址对应的域名信息进行存储，并根据存储的信息与所述用户终端进行认证协商，以避免弹出非法证书告警信息。
在一种实现方式中，所述处理器执行所述程序时通过以下步骤根据存储的信息与所述用户终端进行认证协商：接收所述用户终端发送的目的IP地址为所述目标IP地址的信息发送请求，判断所述信息发送请求是否满足预设仿冒认证条件；若所述信息发送请求满足所述预设仿冒认证条件，则仿冒所述目标IP地址与所述用户终端进行连接交互，并使用所述目标IP地址对应的域名信息与所述用户终端进行认证协商。
在一种实现方式中，所述处理器执行所述程序时通过以下步骤仿冒所述目标IP地址与所述用户终端进行连接交互，并使用所述目标IP地址对应的域名信息与所述用户终端进行认证协商：仿冒所述目标IP地址与所述用户终端进行传输控制协议TCP的三次握手，从而与所述用户终端建立连接；接收所述用户终端发送的安全传输层协议TLS交互请求；将预存的认证证书中的域名信息替换为所述目标IP地址对应的域名信息并发送至所述用户终端，从而与所述用户终端实现证书协商。
在一种实现方式中，所述处理器执行所述程序时通过以下步骤判断所述信息发送请求是否满足预设仿冒认证条件：判断所述信息发送请求对应的目的端口号是否为设定端口号，若为所述设定端口号，判定所述信息发送请求满足预设仿冒认证条件。
在一种实现方式中，所述处理器执行所述程序时通过以下步骤将所述目标IP地址对应的域名信息进行存储：将所述目标IP地址对应的域名信息缓存设定时长，达到所述设定时长后，删除该目标IP地址对应的域名信息；所述处理器执行所述程序还实现以下步骤：若存储有所述目标IP地址对应的域名信息，则重新统计所述目标IP地址对应的域名信息的缓存时长。
在一种实现方式中，在与所述用户终端完成认证协商后，所述处理器执行所述程序还实现以下步骤：接收所述用户终端发送的报文；解析所述报文，并构建重定向报文，以使所述重定向报文中携带预存的认证服务器的location地址；将所述重定向报文发送至所述用户终端，以使所述用户终端根据所述location地址与所述认证服务器进行认证交互。
本公开中的访问认证方法、装置及认证设备，在进行DNS请求交互过程中，存储目标IP地址对应的域名信息，并使用目标IP地址对应的域名信息与用户终端进行认证协商，从而避免弹出非法认证告警信息，提高访问认证的便捷性，进而提高用户体验。
在本公开所提供的几个实施例中，应该理解到，所揭露的装置和方法，也可以通过其 它的方式实现。以上所描述的装置和方法实施例仅仅是示意性的，例如，附图中的流程图和框图显示了根据本公开的多个实施例的装置、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段或代码的一部分，所述模块、程序段或代码的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。也应当注意，在有些作为替换的实现方式中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个连续的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图和/或流程图中的每个方框、以及框图和/或流程图中的方框的组合，可以用执行规定的功能或动作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。
另外，在本公开各个实施例中的各功能模块可以集成在一起形成一个独立的部分，也可以是各个模块单独存在，也可以两个或两个以上模块集成形成一个独立的部分。
所述功能如果以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本公开的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，认证设备，或者网络设备等)执行本公开各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
以上所述仅为本公开的可选实施例而已，并不用于限制本公开，对于本领域的技术人员来说，本公开可以有各种更改和变化。凡在本公开的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本公开的保护范围之内。
工业实用性
本公开提供的访问认证方法、装置及认证设备，避免了弹出非法认证告警信息，从而提高了访问认证的便捷性，进而提高了用户体验。

Claims (15)

  1. 一种访问认证方法，其特征在于，应用于认证设备，所述方法包括：
    接收用户终端发送的域名系统DNS请求，将所述DNS请求转发至DNS服务器；
    接收所述DNS服务器根据所述DNS请求发送的请求响应信息，并将所述请求响应信息转发至所述用户终端，所述请求响应信息中携带有所述DNS请求所请求的域名所对应的目标IP地址；
    检测是否存储有所述目标IP地址对应的域名信息，若未存储有所述目标IP地址对应的域名信息，将所述目标IP地址对应的域名信息进行存储，并根据存储的信息与所述用户终端进行认证协商，以避免弹出非法证书告警信息。
  2. 根据权利要求1所述的访问认证方法，其特征在于，根据存储的信息与所述用户终端进行认证协商的步骤，包括：
    接收所述用户终端发送的目的IP地址为所述目标IP地址的信息发送请求，判断所述信息发送请求是否满足预设仿冒认证条件；
    若所述信息发送请求满足所述预设仿冒认证条件，则仿冒所述目标IP地址与所述用户终端进行连接交互，并使用所述目标IP地址对应的域名信息与所述用户终端进行认证协商。
  3. 根据权利要求2所述的访问认证方法，其特征在于，仿冒所述目标IP地址与所述用户终端进行连接交互，并使用所述目标IP地址对应的域名信息与所述用户终端进行认证协商的步骤，包括：
    仿冒所述目标IP地址与所述用户终端进行传输控制协议TCP的三次握手，从而与所述用户终端建立连接；
    接收所述用户终端发送的安全传输层协议TLS交互请求；
    将预存的认证证书中的域名信息替换为所述目标IP地址对应的域名信息并发送至所述用户终端，从而与所述用户终端实现证书协商。
  4. 根据权利要求2所述的访问认证方法，其特征在于，判断所述信息发送请求是否满足预设仿冒认证条件的步骤，包括：
    判断所述信息发送请求对应的目的端口号是否为设定端口号，若为所述设定端口号，判定所述信息发送请求满足预设仿冒认证条件。
  5. 根据权利要求1所述的访问认证方法，其特征在于，将所述目标IP地址对应的域名信息进行存储的步骤，包括：将所述目标IP地址对应的域名信息缓存设定时长，达到所述设定时长后，删除该目标IP地址对应的域名信息；
    所述方法还包括：
    若存储有所述目标IP地址对应的域名信息，则重新统计所述目标IP地址对应的域名信息的缓存时长。
  6. 根据权利要求1所述的访问认证方法，其特征在于，在与所述用户终端完成认证协商后，所述方法还包括：
    接收所述用户终端发送的报文；
    解析所述报文，并构建重定向报文，以使所述重定向报文中携带预存的认证服务器的location地址；
    将所述重定向报文发送至所述用户终端，以使所述用户终端根据所述location地址与所述认证服务器进行认证交互。
  7. 一种访问认证装置，其特征在于，应用于认证设备，所述访问认证装置包括：
    请求信息传输模块，配置成接收用户终端发送的域名系统DNS请求，将所述DNS请求转发至DNS服务器；
    响应信息传输模块，配置成接收所述DNS服务器根据所述DNS请求发送的请求响应信息，并将所述请求响应信息转发至所述用户终端，所述请求响应信息中携带有所述DNS请求所请求的域名所对应的目标IP地址；
    信息处理模块，配置成检测是否存储有所述目标IP地址对应的域名信息，若未存储有所述目标IP地址对应的域名信息，将所述目标IP地址对应的域名信息进行存储，并根据存储的信息与所述用户终端进行认证协商，以避免弹出非法证书告警信息。
  8. 根据权利要求7所述的访问认证装置，其特征在于，所述信息处理模块通过以下方式根据存储的信息与所述用户终端进行认证协商：
    接收所述用户终端发送的目的IP地址为所述目标IP地址的信息发送请求，判断所述信息发送请求是否满足预设仿冒认证条件；
    若所述信息发送请求满足所述预设仿冒认证条件，则仿冒所述目标IP地址与所述用户终端进行连接交互，并使用所述目标IP地址对应的域名信息与所述用户终端进行认证协商。
  9. 根据权利要求8所述的访问认证装置，其特征在于，所述信息处理模块通过以下方式仿冒所述目标IP地址与所述用户终端进行连接交互，并使用所述目标IP地址对应的域名信息与所述用户终端进行认证协商：
    仿冒所述目标IP地址与所述用户终端进行传输控制协议TCP的三次握手，从而与所述用户终端建立连接；
    接收所述用户终端发送的安全传输层协议TLS交互请求；
    将预存的认证证书中的域名信息替换为所述目标IP地址对应的域名信息并发送至所述用户终端，从而与所述用户终端实现证书协商。
  10. 一种认证设备，其特征在于，包括：存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述程序时实现以下步骤：
    接收用户终端发送的域名系统DNS请求，将所述DNS请求转发至DNS服务器；
    接收所述DNS服务器根据所述DNS请求发送的请求响应信息，并将所述请求响应信息转发至所述用户终端，所述请求响应信息中携带有所述DNS请求所请求的域名所对应的目标IP地址；
    检测是否存储有所述目标IP地址对应的域名信息，若未存储有所述目标IP地址对应的域名信息，将所述目标IP地址对应的域名信息进行存储，并根据存储的信息与所述用户终端进行认证协商，以避免弹出非法证书告警信息。
  11. 根据权利要求10所述的认证设备，其特征在于，所述处理器执行所述程序时通过以下步骤根据存储的信息与所述用户终端进行认证协商：
    接收所述用户终端发送的目的IP地址为所述目标IP地址的信息发送请求，判断所述信息发送请求是否满足预设仿冒认证条件；
    若所述信息发送请求满足所述预设仿冒认证条件，则仿冒所述目标IP地址与所述用户终端进行连接交互，并使用所述目标IP地址对应的域名信息与所述用户终端进行认证协商。
  12. 根据权利要求11所述的认证设备，其特征在于，所述处理器执行所述程序时通过以下步骤仿冒所述目标IP地址与所述用户终端进行连接交互，并使用所述目标IP地址对应的域名信息与所述用户终端进行认证协商：
    仿冒所述目标IP地址与所述用户终端进行传输控制协议TCP的三次握手，从而与所述用户终端建立连接；
    接收所述用户终端发送的安全传输层协议TLS交互请求；
    将预存的认证证书中的域名信息替换为所述目标IP地址对应的域名信息并发送至所述用户终端，从而与所述用户终端实现证书协商。
  13. 根据权利要求11所述的认证设备，其特征在于，所述处理器执行所述程序时通过以下步骤判断所述信息发送请求是否满足预设仿冒认证条件：
    判断所述信息发送请求对应的目的端口号是否为设定端口号，若为所述设定端口号，判定所述信息发送请求满足预设仿冒认证条件。
  14. 根据权利要求10所述的认证设备，其特征在于，所述处理器执行所述程序时通过以下步骤将所述目标IP地址对应的域名信息进行存储：将所述目标IP地址对应的域名信 息缓存设定时长，达到所述设定时长后，删除该目标IP地址对应的域名信息；
    所述处理器执行所述程序还实现以下步骤：
    若存储有所述目标IP地址对应的域名信息，则重新统计所述目标IP地址对应的域名信息的缓存时长。
  15. 根据权利要求10所述的认证设备，其特征在于，在与所述用户终端完成认证协商后，所述处理器执行所述程序还实现以下步骤：
    接收所述用户终端发送的报文；
    解析所述报文，并构建重定向报文，以使所述重定向报文中携带预存的认证服务器的location地址；
    将所述重定向报文发送至所述用户终端，以使所述用户终端根据所述location地址与所述认证服务器进行认证交互。
PCT/CN2019/100959 2018-08-16 2019-08-16 访问认证方法、装置及认证设备 WO2020035046A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810937901.1 2018-08-16
CN201810937901.1A CN109150874B (zh) 2018-08-16 2018-08-16 访问认证方法、装置及认证设备

Publications (1)

Publication Number Publication Date
WO2020035046A1 true WO2020035046A1 (zh) 2020-02-20

Family

ID=64789961

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/100959 WO2020035046A1 (zh) 2018-08-16 2019-08-16 访问认证方法、装置及认证设备

Country Status (2)

Country Link
CN (1) CN109150874B (zh)
WO (1) WO2020035046A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112579933A (zh) * 2020-12-24 2021-03-30 中国农业银行股份有限公司 一种信息处理方法及装置
CN113660177A (zh) * 2021-09-23 2021-11-16 深信服科技股份有限公司 一种流量控制方法、装置、系统及可读存储介质
CN114095415A (zh) * 2021-11-26 2022-02-25 山石网科通信技术股份有限公司 路由确定方法、装置、网关设备和存储介质
CN114338809A (zh) * 2021-12-28 2022-04-12 山石网科通信技术股份有限公司 访问控制方法、装置、电子设备和存储介质
CN114826692A (zh) * 2022-04-07 2022-07-29 中国联合网络通信集团有限公司 信息登录系统、方法、电子设备及存储介质

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109150874B (zh) * 2018-08-16 2020-10-16 新华三技术有限公司 访问认证方法、装置及认证设备
CN112261047B (zh) * 2020-10-22 2023-11-03 上海擎感智能科技有限公司 网关访问方法、移动终端及计算机存储介质
CN112953962A (zh) * 2021-03-15 2021-06-11 杭州迪普科技股份有限公司 域名访问方法及装置
CN113301058B (zh) * 2021-07-27 2021-10-29 北京国电通网络技术有限公司 信息加密传输方法、装置、电子设备和计算机可读介质
CN115460286A (zh) * 2022-09-02 2022-12-09 浙江正泰物联技术有限公司 信息获取方法、装置、电子设备和存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130198065A1 (en) * 2011-10-03 2013-08-01 Verisign, Inc. Adaptive name resolution
CN104168269A (zh) * 2014-07-24 2014-11-26 深圳市腾讯计算机系统有限公司 安全连接建立方法、装置及系统
CN104541492A (zh) * 2012-05-11 2015-04-22 高通股份有限公司 用于域名系统查询的系统和方法
CN109150874A (zh) * 2018-08-16 2019-01-04 新华三技术有限公司 访问认证方法、装置及认证设备

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016025827A1 (en) * 2014-08-15 2016-02-18 Interdigital Patent Holdings, Inc. Edge caching of https content via certificate delegation
WO2016159954A1 (en) * 2015-03-30 2016-10-06 Ruckus Wireless, Inc. Zero-touch onboarding in a mesh network
CN105991640B (zh) * 2015-07-16 2019-06-04 杭州迪普科技股份有限公司 处理http请求的方法及装置
CN105681047B (zh) * 2016-03-25 2019-01-04 中国互联网络信息中心 一种ca证书签发方法及系统
CN106230861A (zh) * 2016-09-07 2016-12-14 上海斐讯数据通信技术有限公司 一种路由器防火墙下网络访问方法及路由器
CN108337257B (zh) * 2018-01-31 2020-12-04 新华三技术有限公司 一种免认证访问方法和网关设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130198065A1 (en) * 2011-10-03 2013-08-01 Verisign, Inc. Adaptive name resolution
CN104541492A (zh) * 2012-05-11 2015-04-22 高通股份有限公司 用于域名系统查询的系统和方法
CN104168269A (zh) * 2014-07-24 2014-11-26 深圳市腾讯计算机系统有限公司 安全连接建立方法、装置及系统
CN109150874A (zh) * 2018-08-16 2019-01-04 新华三技术有限公司 访问认证方法、装置及认证设备

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112579933A (zh) * 2020-12-24 2021-03-30 中国农业银行股份有限公司 一种信息处理方法及装置
CN112579933B (zh) * 2020-12-24 2023-12-08 中国农业银行股份有限公司 一种信息处理方法及装置
CN113660177A (zh) * 2021-09-23 2021-11-16 深信服科技股份有限公司 一种流量控制方法、装置、系统及可读存储介质
CN114095415A (zh) * 2021-11-26 2022-02-25 山石网科通信技术股份有限公司 路由确定方法、装置、网关设备和存储介质
CN114095415B (zh) * 2021-11-26 2024-05-07 山石网科通信技术股份有限公司 路由确定方法、装置、网关设备和存储介质
CN114338809A (zh) * 2021-12-28 2022-04-12 山石网科通信技术股份有限公司 访问控制方法、装置、电子设备和存储介质
CN114826692A (zh) * 2022-04-07 2022-07-29 中国联合网络通信集团有限公司 信息登录系统、方法、电子设备及存储介质
CN114826692B (zh) * 2022-04-07 2023-11-07 中国联合网络通信集团有限公司 信息登录系统、方法、电子设备及存储介质

Also Published As

Publication number Publication date
CN109150874B (zh) 2020-10-16
CN109150874A (zh) 2019-01-04

Similar Documents

Publication Publication Date Title
WO2020035046A1 (zh) 访问认证方法、装置及认证设备
US10003616B2 (en) Destination domain extraction for secure protocols
US8756697B2 (en) Systems and methods for determining vulnerability to session stealing
US10157280B2 (en) System and method for identifying security breach attempts of a website
US8893255B1 (en) Device authentication using device-specific proxy addresses
US9112897B2 (en) System and method for securing a network session
US8527631B1 (en) Web site reputation service using proxy auto-configuration
US11736446B2 (en) Object property getter and setter for clientless VPN
US9407650B2 (en) Unauthorised/malicious redirection
US10911485B2 (en) Providing cross site request forgery protection at an edge server
JP2008532133A (ja) Ｄｎｓ偽装をするトロイの木馬を検出及び緩和するシステム及び方法
US20100064353A1 (en) User Mapping Mechanisms
US8108904B1 (en) Selective persistent storage of controller information
US20130117817A1 (en) Prevention of cross site request forgery attacks by conditional use cookies
JP5864598B2 (ja) ユーザにサービスアクセスを提供する方法およびシステム
US20230247003A1 (en) Zero trust private application access for government applications
US11520852B2 (en) Encoding-free javascript stringify for clientless VPN
US20230019448A1 (en) Predefined signatures for inspecting private application access
US11784993B2 (en) Cross site request forgery (CSRF) protection for web browsers
US10360379B2 (en) Method and apparatus for detecting exploits
US20140122651A1 (en) Network Access Control Based on Risk Factor
Sørensen et al. Automatic profile-based firewall for iot devices
US20200021563A1 (en) Software Defined Network Routing For Secured Communications and Information Security
Larose et al. RFC 8952: Captive Portal Architecture
KR102642602B1 (ko) 프로세스 정보를 사용한 dns 보안을 제공하는 방법 및 시스템

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19850490

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19850490

Country of ref document: EP

Kind code of ref document: A1