WO2023151445A1 - 信息处理方法、网关和通信系统 - Google Patents

信息处理方法、网关和通信系统 Download PDF

Info

Publication number
WO2023151445A1
WO2023151445A1 PCT/CN2023/071565 CN2023071565W WO2023151445A1 WO 2023151445 A1 WO2023151445 A1 WO 2023151445A1 CN 2023071565 W CN2023071565 W CN 2023071565W WO 2023151445 A1 WO2023151445 A1 WO 2023151445A1
Authority
WO
WIPO (PCT)
Prior art keywords
user terminal
gateway
security
security server
terminal
Prior art date
Application number
PCT/CN2023/071565
Other languages
English (en)
French (fr)
Inventor
卢梭
刘少华
孙秉乾
Original Assignee
北京沃东天骏信息技术有限公司
北京京东世纪贸易有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京沃东天骏信息技术有限公司, 北京京东世纪贸易有限公司 filed Critical 北京沃东天骏信息技术有限公司
Publication of WO2023151445A1 publication Critical patent/WO2023151445A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/108—Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/163—In-band adaptation of TCP data exchange; In-band control procedures

Definitions

  • the present disclosure relates to the field of information processing, and in particular to an information processing method, gateway and communication system.
  • the most commonly used identity authentication method for emails is to use email account passwords for identity authentication.
  • the mail provider adopts a higher-level authentication method such as MFA (Multi Factor Authentication, multi-factor authentication) for identity authentication to improve information security.
  • MFA Multi Factor Authentication, multi-factor authentication
  • an information processing method executed by a gateway including: after receiving a connection establishment request sent by a user terminal, establishing a TCP connection between the gateway and the user terminal; Sending a first verification request to a security server, so that the security server verifies whether the identity information included in the first verification request and the terminal feature of the user terminal are bound to the user terminal; if the the binding success message sent by the security server, and send the authentication success message to the user terminal, so that the user terminal interacts with the service server through the gateway.
  • before sending the first verification request to the security server it further includes: sending the connection establishment request to the service server, so that the service server can authenticate the identity information included in the connection establishment request ; Sending the first verification request to the security server if the authentication success message sent by the service server is received.
  • the TCP connection is closed.
  • a timer is started, and the timer has a preset timing duration; after the timer expires, the first verification The request is sent to the security server.
  • the second verification request is sent to the security server, so that the security server information and the characteristics of the terminal to determine whether there is a security risk; if a no security risk indication message sent by the security server is received, the TCP connection is established between the gateway and the user terminal.
  • the connection establishment request is rejected.
  • establishing a TCP connection between the gateway and the user terminal includes: selecting a TCP connection information that is not used by other users from the connection pool, so as to connect between the gateway and the user terminal Establish a TCP connection.
  • the terminal characteristics of the user terminal include at least one of an IP address of the user terminal, a unique device identifier and a user agent.
  • a gateway including: a connection establishment module configured to establish a TCP connection between the gateway and the user terminal after receiving a connection establishment request sent by the user terminal ; a first information processing module configured to send a first verification request to a security server, so that the security server can verify whether the identity information and the terminal features included in the first verification request are consistent with the user terminal Binding; the second information processing module is configured to send the authentication success message to the user terminal if receiving the binding success message sent by the security server, so that the user terminal communicates with the user terminal through the gateway
  • a connection establishment module configured to establish a TCP connection between the gateway and the user terminal after receiving a connection establishment request sent by the user terminal ;
  • a first information processing module configured to send a first verification request to a security server, so that the security server can verify whether the identity information and the terminal features included in the first verification request are consistent with the user terminal Binding;
  • the second information processing module is configured to send the authentication success message to the user terminal if receiving the binding success message sent by the security server
  • a gateway including: a memory configured to store instructions; a processor coupled to the memory, and the processor is configured to execute instructions stored in the memory to implement any of the above embodiments the method described.
  • a communication system including: the gateway as described in any one of the above embodiments; a security server configured to, after receiving the first verification request sent by the gateway, verify Whether the identity information and the terminal features of the user terminal included in the first verification request are bound to the user terminal, and if the identity information and the terminal features are successfully bound to the user terminal, send a message to the gateway Send a binding success message.
  • the communication system further includes: a service server configured to, after receiving the connection establishment request sent by the gateway, authenticate the identity information included in the connection establishment request, and send The gateway sends an authentication success message.
  • the security server is configured to send a binding failure message to the gateway to perform security authentication on the user terminal if the identity information and the terminal features are not successfully bound to the user terminal After the security authentication is passed, bind the identity information and the terminal features with the user terminal, and send a connection instruction to the user terminal, so that the user terminal can resend a connection establishment request to the gateway.
  • the security authentication is multi-factor authentication.
  • the security server is configured to, after receiving the second verification request sent by the gateway, determine whether there is a security risk according to the identity information and the terminal characteristics included in the second verification request, If the identity information and the terminal features have no security risk, send a no security risk indication message to the gateway.
  • the security server is configured to send a security risk indication message to the gateway if the identity information or the terminal feature has a security risk.
  • a computer-readable storage medium stores computer instructions, and when the instructions are executed by a processor, the method involved in any of the above-mentioned embodiments is implemented.
  • FIG. 1 is a schematic flowchart of an information processing method according to an embodiment of the present disclosure
  • FIG. 2 is a schematic structural diagram of a gateway according to an embodiment of the present disclosure
  • FIG. 3 is a schematic structural diagram of a gateway according to another embodiment of the present disclosure.
  • Fig. 4 is a schematic structural diagram of a communication system according to an embodiment of the present disclosure.
  • the present disclosure provides an information processing solution capable of providing security services for email clients provided by a third party.
  • FIG. 1 is a schematic flowchart of an information processing method according to an embodiment of the present disclosure. In some embodiments, the following information processing methods are performed by the gateway.
  • step 101 after receiving the connection establishment request sent by the user terminal, a TCP (Transmission Control Protocol, Transmission Control Protocol) connection is established between the gateway and the user terminal.
  • TCP Transmission Control Protocol, Transmission Control Protocol
  • the gateway after receiving the connection establishment request sent by the user terminal, the gateway sends the second verification request to the security server, so that the security server can judge whether there is a security risk according to the identity information and terminal characteristics included in the second verification request. . In this way, illegal requests such as brute force cracking, credentialing, and malicious IP can be filtered out. If the no security risk indication message sent by the security server is received, a TCP connection is established between the gateway and the user terminal.
  • the terminal characteristics of the user terminal include at least one of the IP address of the user terminal, the unique device identifier and the user agent.
  • the gateway selects a TCP connection information not used by other users from the connection pool, so as to establish a TCP connection between the gateway and the user terminal. In this way, information leakage caused by different users using the same TCP connection can be effectively avoided.
  • the connection establishment request is rejected, so as to effectively reject the request with security risk.
  • the aforementioned gateway is an email gateway.
  • the mail gateway After the mail gateway receives the connection establishment request, it analyzes the protocol of the connection establishment request to determine the mail protocol used, and extracts relevant identity information, such as account information.
  • step 102 the first verification request is sent to the security server, so that the security server verifies whether the identity information included in the first verification request and the terminal features of the user terminal are bound with the user terminal.
  • the above step 102 includes: sending the connection establishment request to the service server, so that the service server can authenticate the identity information included in the connection establishment request. If the authentication success message sent by the service server is received, the first verification request is sent to the security server.
  • the service server after receiving the connection establishment request sent by the gateway, the service server authenticates the identity information included in the connection establishment request, and sends an authentication success message to the gateway after successful authentication.
  • the service server is a mail server.
  • the security server since the security server is set separately from the business server, the security server can provide security services for the mail client provided by the third party.
  • step 103 if the binding success message sent by the security server is received, the authentication success message is sent to the user terminal, so that the user terminal interacts with the service server through the gateway.
  • the gateway if the gateway receives the binding failure message sent by the security server, it closes the TCP connection.
  • the security server when the identity information and terminal features are not successfully bound to the user terminal, the security server sends a binding failure message to the gateway, so that the gateway closes the established TCP connection.
  • the security server performs security authentication on the user terminal, binds the identity information and terminal characteristics with the user terminal after the security authentication is passed, and sends a connection instruction to the user terminal, so that the user terminal can resend a connection establishment request to the gateway.
  • security services can be provided for email clients provided by a third party by using a security server set separately from the service server for security authentication.
  • the gateway after receiving the binding success message sent by the security server, the gateway starts a timer, and the timer has a preset timing duration. After the timer expires, the first verification request is sent to the security server.
  • the gateway will send relevant identity information and user terminal characteristics to the security server for re-checking at regular intervals (for example, half an hour), so as to effectively prevent security issues such as password leakage and account fraudulent use .
  • Fig. 2 is a schematic structural diagram of a gateway according to an embodiment of the present disclosure. As shown in FIG. 2 , the gateway includes a connection establishment module 21 , a first information processing module 22 and a second information processing module 23 .
  • the connection establishment module 21 is configured to establish a TCP connection between the gateway and the user terminal after receiving the connection establishment request sent by the user terminal.
  • the connection establishment module 21 after receiving the connection establishment request sent by the user terminal, the connection establishment module 21 sends the second verification request to the security server, so that the security server can determine whether to There is a security risk. In this way, illegal requests such as brute force cracking, credentialing, and malicious IP can be filtered out. If the no security risk indication message sent by the security server is received, a TCP connection is established between the gateway and the user terminal.
  • the terminal characteristics of the user terminal include at least one of the IP address of the user terminal, the unique device identifier and the user agent.
  • the connection establishment module 21 selects a TCP connection information not used by other users from the connection pool, so as to establish a TCP connection between the gateway and the user terminal. In this way, information leakage caused by different users using the same TCP connection can be effectively avoided.
  • connection establishment module 21 if the connection establishment module 21 receives the security risk indication message sent by the security server, it rejects the connection establishment request, so as to effectively reject the request with security risk.
  • the aforementioned gateway is an email gateway.
  • the connection establishment module 21 determines the email protocol used by analyzing the protocol of the connection establishment request, and extracts relevant identity information, such as account information.
  • the first information processing module 22 is configured to send the first verification request to the security server, so that the security server can verify whether the identity information and terminal features included in the first verification request are bound to the user terminal.
  • the first information processing module 22 sends the connection establishment request to the service server, so that the service server can authenticate the identity information included in the connection establishment request. After receiving the authentication success message sent by the service server, the first information processing module 22 sends the first verification request to the security server.
  • the service server after receiving the connection establishment request sent by the gateway, the service server authenticates the identity information included in the connection establishment request, and sends an authentication success message to the first information processing module 22 after successful authentication.
  • the service server is a mail server.
  • the security server since the security server is set separately from the business server, the security server can provide security services for the mail client provided by the third party.
  • the second information processing module 23 is configured to send an authentication success message to the user terminal if receiving the binding success message sent by the security server, so that the user terminal interacts with the service server through the gateway.
  • the second information processing module 23 if the second information processing module 23 receives the binding failure message sent by the security server, it closes the TCP connection.
  • the security server when the identity information and terminal features are not successfully bound to the user terminal, the security server sends a binding failure message to the gateway, so that the gateway closes the established TCP connection.
  • the security server performs security authentication on the user terminal, binds the identity information and terminal characteristics with the user terminal after the security authentication is passed, and sends a connection instruction to the user terminal, so that the user terminal can resend a connection establishment request to the gateway.
  • Fig. 3 is a schematic structural diagram of a gateway according to another embodiment of the present disclosure. As shown in FIG. 3 , the gateway includes a memory 31 and a processor 32 .
  • the memory 31 is used to store instructions
  • the processor 32 is coupled to the memory 31 , and the processor 32 is configured to execute and implement the method involved in any embodiment in FIG. 1 based on the instructions stored in the memory.
  • the gateway also includes a communication interface 33 for exchanging information with other devices. Meanwhile, the gateway also includes a bus 34 , and the processor 32 , the communication interface 33 , and the memory 31 communicate with each other through the bus 34 .
  • the memory 31 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one magnetic disk memory.
  • the memory 31 may also be a memory array.
  • the storage 31 may also be divided into blocks, and the blocks can be combined into virtual volumes according to certain rules.
  • processor 32 may be a central processing unit CPU, or may be an application specific integrated circuit ASIC, or one or more integrated circuits configured to implement embodiments of the present disclosure.
  • the present disclosure also relates to a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and when the instructions are executed by a processor, the method involved in any embodiment in FIG. 1 is implemented.
  • Fig. 4 is a schematic structural diagram of a communication system according to an embodiment of the present disclosure.
  • the communication system includes a gateway 41 , a security server 43 and a user terminal 44 .
  • the gateway 41 is the gateway involved in any one of the embodiments in FIG. 2 or FIG. 3 .
  • the gateway 41 is a mail gateway
  • the service server 42 is a mail server
  • the security server 43 is configured to, after receiving the first verification request sent by the gateway 41, verify whether the identity information included in the first verification request and the terminal features of the user terminal are bound to the user terminal, if the identity information and the terminal features are consistent with the user terminal If the terminal is successfully bound, it sends a binding success message to the gateway 41 .
  • the terminal characteristics of the user terminal include at least one of the IP address of the user terminal, the unique device identifier and the user agent.
  • the communication system further includes a service server 42 .
  • the service server 42 is configured to, after receiving the connection establishment request sent by the gateway 41 , authenticate the identity information included in the connection establishment request, and send an authentication success message to the gateway 41 after successful authentication.
  • the security server 43 is configured to, after receiving the first verification request sent by the gateway 41, verify whether the identity information included in the first verification request and the terminal features of the user terminal are bound to the user terminal.
  • the security server 43 is configured to send a binding failure message to the gateway 41 if the identity information and terminal features are not successfully bound to the user terminal, and perform security authentication on the user terminal 44, for example, the security authentication is MFA authentication , after the security authentication is passed, bind the identity information and terminal features with the user terminal, and send a connection instruction to the user terminal 41, so that the user terminal 44 sends a connection establishment request to the gateway 41 again.
  • the security authentication is MFA authentication
  • the security server 43 is configured to determine whether there is a security risk according to the identity information and terminal characteristics included in the second verification request after receiving the second verification request sent by the gateway 41, if the identity information and terminal characteristics If there is no security risk, a no security risk indication message is sent to the gateway.
  • the security server 43 is configured to send a security risk indication message to the gateway 41 if the identity information or terminal features have a security risk.
  • the user terminal 44 sends a connection establishment request to the gateway 41 .
  • the gateway 41 sends the risk verification request to the security server 43 after receiving the connection establishment request.
  • the security server 43 judges whether there is a security risk according to the identity information included in the risk inspection request and the terminal characteristics of the user terminal. If there is no security risk in the identity information and the terminal features of the user terminal, a no security risk indication message is sent to the gateway 41 .
  • the gateway 41 establishes a TCP connection between the gateway 41 and the user terminal 44 after receiving the no security risk indication message.
  • the gateway 41 sends the connection establishment request to the service server 42 .
  • the service server 42 authenticates the identity information included in the connection establishment request, and sends an authentication success message to the gateway 41 after the authentication is successful.
  • the gateway 41 sends the binding detection request to the security server 43 after receiving the authentication success message.
  • the security server 43 checks whether the identity information included in the first verification request and the terminal features of the user terminal are bound with the user terminal.
  • step 9 If the identity information and the terminal features of the user terminal are bound with the user terminal, then perform step 9; otherwise, perform step 11.
  • the security server 43 sends a binding success message to the gateway 41 .
  • the gateway 41 After receiving the binding success message, the gateway 41 sends the authentication success message to the user terminal 44, so that the user terminal 44 interacts with the service server 42 through the gateway 41.
  • the gateway 41 establishes a TCP connection with the service server 42 in advance, thus by using the TCP connection between the gateway 41 and the user terminal 44, and the TCP connection between the gateway 41 and the service server 42, between the user terminal 44 and the service server 42 Sending and receiving of emails is realized between business servers 42 .
  • the security server 43 sends a binding failure message to the gateway 41, so that the gateway 41 closes the TCP connection between the gateway 41 and the user terminal 44.
  • the security server 43 performs security authentication on the user terminal, binds the identity information and terminal features with the user terminal after the security authentication is passed, and sends a connection instruction to the user terminal 44, so that the user terminal 44 sends the connection establishment to the gateway 41 again ask.
  • the functional unit modules described above can be implemented as a general-purpose processor, a programmable logic controller (Programmable Logic Controller, referred to as: PLC), a digital signal processor ( Digital Signal Processor (DSP for short), Application Specific Integrated Circuit (ASIC for short), Field-Programmable Gate Array (FPGA for short), or other programmable logic devices, discrete gates or transistors Logic devices, discrete hardware components, or any suitable combination thereof.
  • PLC programmable logic controller
  • DSP Digital Signal Processor
  • ASIC Application Specific Integrated Circuit
  • FPGA Field-Programmable Gate Array
  • the program can be stored in a computer-readable storage medium.
  • the above-mentioned The storage medium mentioned may be a read-only memory, a magnetic disk or an optical disk, and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开提供一种信息处理方法、网关和通信系统。信息处理方法包括：在接收到用户终端发送的连接建立请求后，在网关和用户终端之间建立TCP连接；将第一检验请求发送给安全服务器，以便安全服务器检验第一检验请求中包括的身份信息和用户终端的终端特征是否与用户终端绑定；若接收到安全服务器发送的绑定成功消息，将认证成功消息发送给用户终端，以便用户终端通过网关与业务服务器交互。

Description

信息处理方法、网关和通信系统
相关申请的交叉引用
本公开是以CN申请号为202210118526.4，申请日为2022年2月8日的申请为基础，并主张其优先权，该CN申请的公开内容在此作为整体引入本公开中。
技术领域
本公开涉及信息处理领域，特别涉及一种信息处理方法、网关和通信系统。
背景技术
目前，电子邮件最常用的身份认证方式是利用邮箱账号密码进行身份认证。为了避免账号密码被非法盗取，邮件提供商通过采用诸如MFA(Multi Factor Authentication，多因子认证)的安全级别更高的认证方式进行身份认证，以提高信息安全性。
发明内容
根据本公开实施例的第一方面，提供一种信息处理方法，由网关执行，包括：在接收到用户终端发送的连接建立请求后，在所述网关和所述用户终端之间建立TCP连接；将第一检验请求发送给安全服务器，以便所述安全服务器检验所述第一检验请求中包括的所述身份信息和所述用户终端的终端特征是否与所述用户终端绑定；若接收到所述安全服务器发送的绑定成功消息，将所述认证成功消息发送给所述用户终端，以便所述用户终端通过所述网关与所述业务服务器交互。
在一些实施例中，在将第一检验请求发送给安全服务器之前，还包括：将所述连接建立请求发送给业务服务器，以便所述业务服务器对所述连接建立请求中包括的身份信息进行认证；若接收到所述业务服务器发送的认证成功消息，将所述第一检验请求发送给所述安全服务器。
在一些实施例中，若接收到所述安全服务器发送的绑定失败消息，则关闭所述TCP连接。
在一些实施例中，在接收到所述安全服务器发送的绑定成功消息后，启动定时器，所述定时器具有预设的定时时长；在所述定时器超时后，将所述第一检验请求发送给 所述安全服务器。
在一些实施例中，在接收到所述用户终端发送的连接建立请求后，将第二检验请求发送给所述安全服务器，以便所述安全服务器根据所述第二检验请求中包括的所述身份信息和所述终端特征判断是否存在安全风险；若接收到所述安全服务器发送的无安全风险指示消息，则在所述网关和所述用户终端之间建立所述TCP连接。
在一些实施例中，若接收到所述安全服务器发送的安全风险指示消息，则拒绝所述连接建立请求。
在一些实施例中，在所述网关和所述用户终端之间建立TCP连接包括：从连接池中选择一个未被其它用户使用的TCP连接信息，以便在所述网关和所述用户终端之间建立TCP连接。
在一些实施例中，所述用户终端的终端特征包括所述用户终端的IP地址，设备唯一标识和用户代理中的至少一项。
根据本公开实施例的第二方面，提供一种网关，包括：连接建立模块，被配置为在接收到用户终端发送的连接建立请求后，在所述网关和所述用户终端之间建立TCP连接；第一信息处理模块，被配置为将第一检验请求发送给安全服务器，以便所述安全服务器检验所述第一检验请求中包括的所述身份信息和所述终端特征是否与所述用户终端绑定；第二信息处理模块，被配置为若接收到所述安全服务器发送的绑定成功消息，将所述认证成功消息发送给所述用户终端，以便所述用户终端通过所述网关与所述业务服务器交互。
根据本公开实施例的第三方面，提供一种网关，包括：存储器，被配置为存储指令；处理器，耦合到存储器，处理器被配置为基于存储器存储的指令执行实现如上述任一实施例所述的方法。
根据本公开实施例的第四方面，提供一种通信系统，包括：如上述任一实施例所述的网关；安全服务器，被配置为在接收到所述网关发送的第一检验请求后，检验所述第一检验请求中包括的身份信息和用户终端的终端特征是否与所述用户终端绑定，若所述身份信息和所述终端特征与所述用户终端成功绑定，则向所述网关发送绑定成功消息。
在一些实施例中，通信系统还包括：业务服务器，被配置为在接收到所述网关发送的连接建立请求后，对所述连接建立请求中包括的身份信息进行认证，并在认证成功后向所述网关发送认证成功消息。
在一些实施例中，安全服务器被配置为若所述身份信息和所述终端特征与所述用户终端未成功绑定，则向所述网关发送绑定失败消息，对所述用户终端进行安全认证，在安全认证通过后将所述身份信息和所述终端特征与所述用户终端进行绑定，并向所述用户终端发送连接指示，以便所述用户终端重新向所述网关发送连接建立请求。
在一些实施例中，所述安全认证为多因子认证。
在一些实施例中，安全服务器被配置为在接收到所述网关发送的第二检验请求后，根据所述第二检验请求中包括的所述身份信息和所述终端特征判断是否存在安全风险，若所述身份信息和所述终端特征没有安全风险，则向所述网关发送无安全风险指示消息。
在一些实施例中，安全服务器被配置为若所述身份信息或所述终端特征有安全风险，则向所述网关发送安全风险指示消息。
根据本公开实施例的第五方面，提供一种计算机可读存储介质，其中，计算机可读存储介质存储有计算机指令，指令被处理器执行时实现如上述任一实施例涉及的方法。
通过以下参照附图对本公开的示例性实施例的详细描述，本公开的其它特征及其优点将会变得清楚。
附图说明
构成说明书的一部分的附图描述了本公开的实施例，并且连同说明书一起用于解释本公开的原理。
参照附图，根据下面的详细描述，可以更加清楚地理解本公开，其中：
图1为本公开一个实施例的信息处理方法的流程示意图；
图2为本公开一个实施例的网关的结构示意图；
图3为本公开另一个实施例的网关的结构示意图；
图4为本公开一个实施例的通信系统的结构示意图。
应当明白，附图中所示出的各个部分的尺寸并不是按照实际的比例关系绘制的。此外，相同或类似的参考标号表示相同或类似的构件。
具体实施方式
下面将结合本公开实施例中的附图，对本公开实施例中的技术方案进行清楚、完 整地描述，显然，所描述的实施例仅仅是本公开一部分实施例，而不是全部的实施例。以下对至少一个示例性实施例的描述实际上仅仅是说明性的，决不作为对本公开及其应用或使用的任何限制。基于本公开中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本公开保护的范围。
除非另外具体说明，否则在这些实施例中阐述的部件和步骤的相对布置、数字表达式和数值不限制本公开的范围。
同时，应当明白，为了便于描述，附图中所示出的各个部分的尺寸并不是按照实际的比例关系绘制的。
对于相关领域普通技术人员已知的技术、方法和设备可能不作详细讨论，但在适当情况下，所述技术、方法和设备应当被视为授权说明书的一部分。
在这里示出和讨论的所有示例中，任何具体值应被解释为仅仅是示例性的，而不是作为限制。因此，示例性实施例的其它示例可以具有不同的值。
应注意到：相似的标号和字母在下面的附图中表示类似项，因此，一旦某一项在一个附图中被定义，则在随后的附图中不需要对其进行进一步讨论。
发明人注意到，由于邮件提供商将安全级别更高的认证方式绑定在自己的平台上，因此无法为第三方提供的邮件客户端提供安全服务。
据此，本公开提供一种信息处理方案，能够为第三方提供的邮件客户端提供安全服务。
图1为本公开一个实施例的信息处理方法的流程示意图。在一些实施例中，下列的信息处理方法由网关执行。
在步骤101，在接收到用户终端发送的连接建立请求后，在网关和用户终端之间建立TCP(Transmission Control Protocol，传输控制协议)连接。
在一些实施例中，网关在接收到用户终端发送的连接建立请求后，将第二检验请求发送给安全服务器，以便安全服务器根据第二检验请求中包括的身份信息和终端特征判断是否存在安全风险。由此可过滤出暴力破解、撞库、恶意IP等非法请求。若接收到安全服务器发送的无安全风险指示消息，则在网关和用户终端之间建立TCP连接。
在一些实施例中，用户终端的终端特征包括用户终端的IP地址，设备唯一标识和用户代理中的至少一项。
在一些实施例中，网关从连接池中选择一个未被其它用户使用的TCP连接信息， 以便在网关和用户终端之间建立TCP连接。由此可有效避免因不同用户使用同一TCP连接而造成的信息泄露。
在一些实施例中，若接收到安全服务器发送的安全风险指示消息，则拒绝连接建立请求，以便有效拒绝有安全风险的请求。
在一些实施例中，上述网关为邮件网关。邮件网关在接收到连接建立请求后，通过对连接建立请求进行协议分析以确定所使用的邮件协议，并提取出相关的身份信息，例如帐号信息等。
在步骤102，将第一检验请求发送给安全服务器，以便安全服务器检验第一检验请求中包括的身份信息和用户终端的终端特征是否与用户终端绑定。
在一些实施例中，上述步骤102包括：将连接建立请求发送给业务服务器，以便业务服务器对连接建立请求中包括的身份信息进行认证。若接收到业务服务器发送的认证成功消息，将第一检验请求发送给安全服务器。
在一些实施例中，业务服务器在接收到网关发送的连接建立请求后，对连接建立请求中包括的身份信息进行认证，并在认证成功后向网关发送认证成功消息。
在一些实施例中，业务服务器为邮件服务器。
这里需要说明的是，由于安全服务器是与业务服务器分立设置的，因此安全服务器能够为第三方提供的邮件客户端提供安全服务。
在步骤103，若接收到安全服务器发送的绑定成功消息，将认证成功消息发送给用户终端，以便用户终端通过网关与业务服务器交互。
在一些实施例中，若网关接收到安全服务器发送的绑定失败消息，则关闭TCP连接。
需要说明的是，安全服务器在身份信息和终端特征与用户终端未成功绑定的情况下，向网关发送绑定失败消息，以便网关关闭已经建立的TCP连接。此外，安全服务器对用户终端进行安全认证，在安全认证通过后将身份信息和终端特征与用户终端进行绑定，并向用户终端发送连接指示，以便用户终端重新向网关发送连接建立请求。
在本公开上述实施例提供的信息处理方法中，通过利用与业务服务器分立设置的安全服务器进行安全认证，从而能够为第三方提供的邮件客户端提供安全服务。
在一些实施例中，网关在接收到安全服务器发送的绑定成功消息后，启动定时器，定时器具有预设的定时时长。在定时器超时后，将第一检验请求发送给安全服务器。
也就是说，为了确保安全，网关每隔一段时间(例如半小时)，会将相关的身份 信息和用户终端特征发送给安全服务器重新进行安全检测，从而有效防止密码泄露、账号冒用等安全问题。
图2为本公开一个实施例的网关的结构示意图。如图2所示，网关包括连接建立模块21、第一信息处理模块22和第二信息处理模块23。
连接建立模块21被配置为在接收到用户终端发送的连接建立请求后，在网关和用户终端之间建立TCP连接。
在一些实施例中，连接建立模块21在接收到用户终端发送的连接建立请求后，将第二检验请求发送给安全服务器，以便安全服务器根据第二检验请求中包括的身份信息和终端特征判断是否存在安全风险。由此可过滤出暴力破解、撞库、恶意IP等非法请求。若接收到安全服务器发送的无安全风险指示消息，则在网关和用户终端之间建立TCP连接。
在一些实施例中，用户终端的终端特征包括用户终端的IP地址，设备唯一标识和用户代理中的至少一项。
在一些实施例中，连接建立模块21从连接池中选择一个未被其它用户使用的TCP连接信息，以便在网关和用户终端之间建立TCP连接。由此可有效避免因不同用户使用同一TCP连接而造成的信息泄露。
在一些实施例中，若连接建立模块21接收到安全服务器发送的安全风险指示消息，则拒绝连接建立请求，以便有效拒绝有安全风险的请求。
在一些实施例中，上述网关为邮件网关。连接建立模块21在接收到连接建立请求后，通过对连接建立请求进行协议分析以确定所使用的邮件协议，并提取出相关的身份信息，例如帐号信息等。
第一信息处理模块22被配置为将第一检验请求发送给安全服务器，以便安全服务器检验第一检验请求中包括的身份信息和终端特征是否与用户终端绑定。
在一些实施例中，第一信息处理模块22将连接建立请求发送给业务服务器，以便业务服务器对所述连接建立请求中包括的身份信息进行认证。第一信息处理模块22在接收到业务服务器发送的认证成功消息后，将第一检验请求发送给安全服务器。
在一些实施例中，业务服务器在接收到网关发送的连接建立请求后，对连接建立请求中包括的身份信息进行认证，并在认证成功后向第一信息处理模块22发送认证成功消息。
在一些实施例中，业务服务器为邮件服务器。
这里需要说明的是，由于安全服务器是与业务服务器分立设置的，因此安全服务器能够为第三方提供的邮件客户端提供安全服务。
第二信息处理模块23被配置为若接收到安全服务器发送的绑定成功消息，将认证成功消息发送给用户终端，以便用户终端通过网关与业务服务器交互。
在一些实施例中，若第二信息处理模块23接收到安全服务器发送的绑定失败消息，则关闭TCP连接。
需要说明的是，安全服务器在身份信息和终端特征与用户终端未成功绑定的情况下，向网关发送绑定失败消息，以便网关关闭已经建立的TCP连接。此外，安全服务器对用户终端进行安全认证，在安全认证通过后将身份信息和终端特征与用户终端进行绑定，并向用户终端发送连接指示，以便用户终端重新向网关发送连接建立请求。
图3为本公开另一个实施例的网关的结构示意图。如图3所示，网关包括存储器31和处理器32。
存储器31用于存储指令，处理器32耦合到存储器31，处理器32被配置为基于存储器存储的指令执行实现如图1中任一实施例涉及的方法。
如图3所示，该网关还包括通信接口33，用于与其它设备进行信息交互。同时，该网关还包括总线34，处理器32、通信接口33、以及存储器31通过总线34完成相互间的通信。
存储器31可以包含高速RAM存储器，也可还包括非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。存储器31也可以是存储器阵列。存储器31还可能被分块，并且块可按一定的规则组合成虚拟卷。
此外，处理器32可以是一个中央处理器CPU，或者可以是专用集成电路ASIC，或是被配置成实施本公开实施例的一个或多个集成电路。
本公开同时还涉及一种计算机可读存储介质，其中计算机可读存储介质存储有计算机指令，指令被处理器执行时实现如图1中任一实施例涉及的方法。
图4为本公开一个实施例的通信系统的结构示意图。如图4所示，通信系统包括网关41、安全服务器43和用户终端44。网关41为图2或图3中任一实施例涉及的网关。
例如，网关41为邮件网关，业务服务器42为邮件服务器。
安全服务器43被配置为在接收到网关41发送的第一检验请求后，检验第一检验请求中包括的身份信息和用户终端的终端特征是否与用户终端绑定，若身份信息和终 端特征与用户终端成功绑定，则向网关41发送绑定成功消息。
在一些实施例中，用户终端的终端特征包括用户终端的IP地址，设备唯一标识和用户代理中的至少一项。
在一些实施例中，如图4所示，通信系统还包括业务服务器42。
业务服务器42被配置为在接收到网关41发送的连接建立请求后，对连接建立请求中包括的身份信息进行认证，并在认证成功后向网关41发送认证成功消息。
安全服务器43被配置为在接收到网关41发送的第一检验请求后，检验第一检验请求中包括的身份信息和用户终端的终端特征是否与用户终端绑定。
在一些实施例中，安全服务器43被配置为若身份信息和终端特征与用户终端未成功绑定，则向网关41发送绑定失败消息，对用户终端44进行安全认证，例如安全认证为MFA认证，在安全认证通过后将身份信息和终端特征与用户终端进行绑定，并向用户终端41发送连接指示，以便用户终端44重新向网关41发送连接建立请求。
在一些实施例中，安全服务器43被配置为在接收到网关41发送的第二检验请求后，根据第二检验请求中包括的身份信息和终端特征判断是否存在安全风险，若身份信息和终端特征没有安全风险，则向网关发送无安全风险指示消息。
在一些实施例中，安全服务器43被配置为若身份信息或终端特征有安全风险，则向网关41发送安全风险指示消息。
下面通过一个具体示例对本公开方案进行说明，如图4所示：
1、用户终端44向网关41发送连接建立请求。
2、网关41在接收到连接建立请求后，将风险检验请求发送给安全服务器43。
3、安全服务器43根据风险检验请求中包括的身份信息和用户终端的终端特征判断是否存在安全风险。若身份信息和用户终端的终端特征不存在安全风险，则向网关41发送无安全风险指示消息。
4、网关41在接收到无安全风险指示消息后，在网关41和用户终端44之间建立TCP连接。
5、网关41将连接建立请求发送给业务服务器42。
6、业务服务器42对连接建立请求中包括的身份信息进行认证，并在认证成功后向网关41发送认证成功消息。
7、网关41在接收到认证成功消息后，将绑定检测请求发送给安全服务器43。
8、安全服务器43检验第一检验请求中包括的身份信息和用户终端的终端特征是 否与用户终端绑定。
若身份信息和用户终端的终端特征与用户终端绑定，则执行步骤9；否则执行步骤11。
9、安全服务器43将绑定成功消息发送给网关41。
10、网关41在接收到绑定成功消息后，将认证成功消息发送给用户终端44，以便用户终端44通过网关41与业务服务器42交互。
需要说明的是，网关41预先与业务服务器42建立TCP连接，由此通过利用网关41和用户终端44之间的TCP连接，以及网关41与业务服务器42之间的TCP连接，在用户终端44和业务服务器42之间实现邮件收发。
11、安全服务器43将绑定失败消息发送给网关41，以便网关41关闭网关41和用户终端44之间的TCP连接。
12、安全服务器43对用户终端进行安全认证，在安全认证通过后将身份信息和终端特征与用户终端进行绑定，并向用户终端44发送连接指示，以便用户终端44重新向网关41发送连接建立请求。
通过实施本公开，能够得到以下有益效果：
1)无需修改邮件客户端或服务端、或改变协议，使得安全检测与认证可以无缝接入；
2)实现多协议识别，具备扩展性；
3)安全检测与认证是实时处理的，非异步或旁路处理，因此不会漏过风险；
4)不对邮件内容做处理，有效保护数据隐私。
在一些实施例中，在上面所描述的功能单元模块可以实现为用于执行本公开所描述功能的通用处理器、可编程逻辑控制器(Programmable Logic Controller，简称：PLC)、数字信号处理器(Digital Signal Processor，简称：DSP)、专用集成电路(Application Specific Integrated Circuit，简称：ASIC)、现场可编程门阵列(Field-Programmable Gate Array，简称：FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件或者其任意适当组合。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
本公开的描述是为了示例和描述起见而给出的，而并不是无遗漏的或者将本公开 限于所公开的形式。很多修改和变化对于本领域的普通技术人员而言是显然的。选择和描述实施例是为了更好说明本公开的原理和实际应用，并且使本领域的普通技术人员能够理解本公开从而设计适于特定用途的带有各种修改的各种实施例。

Claims (17)

  1. 一种信息处理方法，由网关执行，包括：
    在接收到用户终端发送的连接建立请求后，在所述网关和所述用户终端之间建立TCP连接；
    将第一检验请求发送给安全服务器，以便所述安全服务器检验所述第一检验请求中包括的所述身份信息和所述用户终端的终端特征是否与所述用户终端绑定；
    若接收到所述安全服务器发送的绑定成功消息，将所述认证成功消息发送给所述用户终端，以便所述用户终端通过所述网关与所述业务服务器交互。
  2. 根据权利要求1所述的方法，其中，在将第一检验请求发送给安全服务器之前，还包括：
    将所述连接建立请求发送给业务服务器，以便所述业务服务器对所述连接建立请求中包括的身份信息进行认证；
    若接收到所述业务服务器发送的认证成功消息，将所述第一检验请求发送给所述安全服务器。
  3. 根据权利要求1所述的方法，还包括：
    若接收到所述安全服务器发送的绑定失败消息，则关闭所述TCP连接。
  4. 根据权利要求1所述的方法，还包括：
    在接收到所述安全服务器发送的绑定成功消息后，启动定时器，所述定时器具有预设的定时时长；
    在所述定时器超时后，将所述第一检验请求发送给所述安全服务器。
  5. 根据权利要求1-4中任一项所述的方法，还包括：
    在接收到所述用户终端发送的连接建立请求后，将第二检验请求发送给所述安全服务器，以便所述安全服务器根据所述第二检验请求中包括的所述身份信息和所述终端特征判断是否存在安全风险；
    若接收到所述安全服务器发送的无安全风险指示消息，则在所述网关和所述用户 终端之间建立所述TCP连接。
  6. 根据权利要求5所述的方法，还包括：
    若接收到所述安全服务器发送的安全风险指示消息，则拒绝所述连接建立请求。
  7. 根据权利要求5所述的方法，其中，在所述网关和所述用户终端之间建立TCP连接包括：
    从连接池中选择一个未被其它用户使用的TCP连接信息，以便在所述网关和所述用户终端之间建立TCP连接。
  8. 根据权利要求5所述的方法，其中，
    所述用户终端的终端特征包括所述用户终端的IP地址，设备唯一标识和用户代理中的至少一项。
  9. 一种网关，包括：
    连接建立模块，被配置为在接收到用户终端发送的连接建立请求后，在所述网关和所述用户终端之间建立TCP连接；
    第一信息处理模块，被配置为将第一检验请求发送给安全服务器，以便所述安全服务器检验所述第一检验请求中包括的所述身份信息和所述终端特征是否与所述用户终端绑定；
    第二信息处理模块，被配置为若接收到所述安全服务器发送的绑定成功消息，将所述认证成功消息发送给所述用户终端，以便所述用户终端通过所述网关与所述业务服务器交互。
  10. 一种网关，包括：
    存储器，被配置为存储指令；
    处理器，耦合到存储器，处理器被配置为基于存储器存储的指令执行实现如权利要求1-8中任一项所述的方法。
  11. 一种通信系统，包括：
    如权利要求9或10所述的网关；
    安全服务器，被配置为在接收到所述网关发送的第一检验请求后，检验所述第一检验请求中包括的身份信息和用户终端的终端特征是否与所述用户终端绑定，若所述身份信息和所述终端特征与所述用户终端成功绑定，则向所述网关发送绑定成功消息。
  12. 根据权利要求11所述的系统，还包括：
    业务服务器，被配置为在接收到所述网关发送的连接建立请求后，对所述连接建立请求中包括的身份信息进行认证，并在认证成功后向所述网关发送认证成功消息。
  13. 根据权利要求11所述的系统，其中，
    安全服务器被配置为若所述身份信息和所述终端特征与所述用户终端未成功绑定，则向所述网关发送绑定失败消息，对所述用户终端进行安全认证，在安全认证通过后将所述身份信息和所述终端特征与所述用户终端进行绑定，并向所述用户终端发送连接指示，以便所述用户终端重新向所述网关发送的连接建立请求。
  14. 根据权利要求13所述的系统，其中，
    所述安全认证为多因子认证。
  15. 根据权利要求11-14中任一项所述的系统，其中，
    安全服务器被配置为在接收到所述网关发送的第二检验请求后，根据所述第二检验请求中包括的所述身份信息和所述终端特征判断是否存在安全风险，若所述身份信息和所述终端特征没有安全风险，则向所述网关发送无安全风险指示消息。
  16. 根据权利要求15所述的系统，其中，
    安全服务器被配置为若所述身份信息或所述终端特征有安全风险，则向所述网关发送安全风险指示消息。
  17. 一种非瞬态计算机可读存储介质，其中，计算机可读存储介质存储有计算机指令，指令被处理器执行时实现如权利要求1-8中任一项所述的方法。
PCT/CN2023/071565 2022-02-08 2023-01-10 信息处理方法、网关和通信系统 WO2023151445A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210118526.4A CN114500066A (zh) 2022-02-08 2022-02-08 信息处理方法、网关和通信系统
CN202210118526.4 2022-02-08

Publications (1)

Publication Number Publication Date
WO2023151445A1 true WO2023151445A1 (zh) 2023-08-17

Family

ID=81479181

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/071565 WO2023151445A1 (zh) 2022-02-08 2023-01-10 信息处理方法、网关和通信系统

Country Status (2)

Country Link
CN (1) CN114500066A (zh)
WO (1) WO2023151445A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114500066A (zh) * 2022-02-08 2022-05-13 北京沃东天骏信息技术有限公司 信息处理方法、网关和通信系统

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102420800A (zh) * 2010-09-28 2012-04-18 俞浩波 通过多因子身份认证完成服务的方法、系统及认证终端
CN102882853A (zh) * 2012-09-05 2013-01-16 孙银海 一种互联网用户身份验证的系统和方法
CN104253787A (zh) * 2013-06-26 2014-12-31 华为技术有限公司 业务认证方法和系统
CN105024980A (zh) * 2014-04-29 2015-11-04 孙银海 一种基于手机号码的网上近场支付系统和方法
US20170208464A1 (en) * 2014-07-07 2017-07-20 Finpin Technologies Gmbh Method and system for authenticating a user
CN107493280A (zh) * 2017-08-15 2017-12-19 中国联合网络通信集团有限公司 用户认证的方法、智能网关及认证服务器
CN114500066A (zh) * 2022-02-08 2022-05-13 北京沃东天骏信息技术有限公司 信息处理方法、网关和通信系统

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100579012C (zh) * 2005-03-30 2010-01-06 中兴通讯股份有限公司 一种终端用户安全接入软交换网络的方法

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102420800A (zh) * 2010-09-28 2012-04-18 俞浩波 通过多因子身份认证完成服务的方法、系统及认证终端
CN102882853A (zh) * 2012-09-05 2013-01-16 孙银海 一种互联网用户身份验证的系统和方法
CN104253787A (zh) * 2013-06-26 2014-12-31 华为技术有限公司 业务认证方法和系统
CN105024980A (zh) * 2014-04-29 2015-11-04 孙银海 一种基于手机号码的网上近场支付系统和方法
US20170208464A1 (en) * 2014-07-07 2017-07-20 Finpin Technologies Gmbh Method and system for authenticating a user
CN107493280A (zh) * 2017-08-15 2017-12-19 中国联合网络通信集团有限公司 用户认证的方法、智能网关及认证服务器
CN114500066A (zh) * 2022-02-08 2022-05-13 北京沃东天骏信息技术有限公司 信息处理方法、网关和通信系统

Also Published As

Publication number Publication date
CN114500066A (zh) 2022-05-13

Similar Documents

Publication Publication Date Title
JP4965558B2 (ja) ピアツーピア認証及び権限付与
CN105847245B (zh) 一种电子邮箱登录认证方法和装置
EP2705642B1 (en) System and method for providing access credentials
WO2016155668A1 (zh) 集群系统中应用统一鉴权方法、服务器与终端
CN104954330B (zh) 一种对数据资源进行访问的方法、装置和系统
CA2914426C (en) Method for authenticating a user, corresponding server, communications terminal and programs
US20070050630A1 (en) Authentication method and system for asynchronous eventing over the internet
JP2009508261A (ja) リモートリソースとの安全な対話型接続の生成
WO2017067160A1 (zh) 基于mptcp的主流连接建立方法及装置
CN103874069B (zh) 一种无线终端mac认证装置和方法
WO2022247751A1 (zh) 远程访问应用的方法、系统、装置、设备及存储介质
CN104158808A (zh) 基于APP应用的Portal认证方法及其装置
WO2014201931A1 (zh) 资源处理方法和站点服务器
WO2016188335A1 (zh) 用户数据的访问控制方法、装置及系统
CN107888592A (zh) 一种vpn登录认证方法及装置
WO2023151445A1 (zh) 信息处理方法、网关和通信系统
CN105592046A (zh) 一种免认证访问方法和装置
CN116346375A (zh) 访问控制方法、访问控制系统、终端及存储介质
CN111949958A (zh) Oauth协议中的授权认证方法及装置
CN107493293A (zh) 一种sip终端接入鉴权的方法
CN114389916A (zh) 一种组网通信方法、装置、系统及网络设备
CN111949959A (zh) Oauth协议中的授权认证方法及装置
CN115022047A (zh) 基于多云网关的账户登录方法、装置、计算机设备及介质
WO2011040192A1 (ja) 仮想マシン、仮想マシンのプログラム、アプリケーションサービス提供システム及びアプリケーションサービス提供方法
US10341338B1 (en) Smart card redirection

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23752225

Country of ref document: EP

Kind code of ref document: A1