CN108011873A - A kind of illegal connection determination methods based on set covering - Google Patents

Abstract

The invention discloses a method for judging an illegal connection based on set coverage, comprising the following steps: step 1, establishing a server and a plurality of clients, where registration information corresponding to client information is stored in the client; step 2, the client Send an authentication request to the server, and the server compares the registration information of the client with the legal terminal list; step 3, the legitimate client receives the legal terminal list, when the legitimate client receives the communication request sent by other clients, the legitimate client Identify the registration information of the client that sends the communication request, and determine whether the registration information exists in the legal terminal list. When the present invention establishes a communication environment, the legal terminal list is sent to each legal client, and the server does not need to perform identity recognition separately. This judgment method is convenient and quick, and the work of identity recognition is distributed to each client, which reduces the workload of the server. , and improved work efficiency.

Description

A Judgment Method of Illegal Connection Based on Set Covering

technical field

The invention relates to the technical field of data connection, in particular to a method for judging an illegal connection based on set coverage.

Background technique

At present, illegal connection is the main factor causing security risks such as data leakage, especially illegal external connection. Illegal external connection means that the machine where the client is installed accesses the external network without permission.

The traditional connection legitimacy judgment method mostly uses the server to independently identify the identities of multiple clients, so as to ensure the legitimacy of each client identity, but when there is a data connection between an illegal device and the client, the server cannot promptly identify the Illegal devices can be identified. Illegal devices can steal information stored on the client and even use the client to obtain data stored in the server, causing information leakage to a certain extent.

Contents of the invention

In order to solve the deficiencies of the prior art, the purpose of the present invention is to provide a method for judging illegal connections based on collective coverage, which sends a list of legal terminals to each legal client, without requiring the server to perform identity identification separately. This judging method is convenient and fast. Distributing the work of identity recognition to each client reduces the workload of the server and improves work efficiency.

In order to achieve the above object, the present invention adopts the following technical solutions:

A method for judging an illegal connection based on set coverage, comprising:

Step 1, establish a server and multiple clients, the client stores registration information corresponding to the client information, the server stores a list of legal terminals, and the list of legal terminals contains the registration information of multiple clients;

Step 2, the client sends an authentication request to the server, and the server compares the registration information of the client with the legal terminal list;

If the comparison is successful, the server continues to establish a communication channel with the client, and the server sends a list of legal terminals to the client, and records the client as a legal client;

If the comparison is unsuccessful, the server will record the client as an illegal client and stop communicating with the client;

Step 3: The legitimate client adopts the trusted network connection technology to form a network trust chain model M-TNC, uses the trusted network connection technology TNC, and realizes terminal access control in the network environment by using the terminal technology provided by the trusted host; M- TNC's authority control rules use the integrity check of the terminal to check the credibility of the terminal;

The architecture of M-TNC is divided into the following three types of entities: terminal visitor AP, rule judger RJP, and rule definer RDP;

The terminal visitor is the terminal access device and requests the resources of the server; the rule judge and rule definer are the terminal security access control system;

The element definition of M-TNC includes the following two definitions:

The first definition: resource set R={ri|i=1…N}, resource set of enterprise office network;

The second definition: resource service domain RS={R, SDP, AP, ISP}, R is the resource set provided by the enterprise network, RJP is an absolutely credible rule determiner, RDP manages the APs of the entire domain and assists network service providers ISP (Internet Service Provider) verifies the credibility of M-TNC, and at the same time accepts cross-domain service request messages from M-TNC in other domains;

The terminal trusted access algorithm includes the following steps:

In step a, RDP formulates corresponding ACL rules according to the trustworthiness of the AP: ACLPolicy←getACLPolicy();

Step b, AP requests access: send an access request, collect the evaluation value of the terminal's credibility and send it to the RJP, and wait for the RJP to judge the credibility of the terminal device: APCredibility←CollectAPCredibility();CredibilityResult←SendJudgeRequest();

Step c, RDP completes the integrity and authenticity verification of the MTAM (Mobile Terminal Access Module) module, and is responsible for issuing trusted certificates for terminal devices in MTAM: CredibilityCertificate←InRealityIntegrityCheck();

Step d, RDP is responsible for formulating and distributing AP credibility determination rules, and verifying its certificate to evaluate the credibility of the access device: CredibilityPolicy←RDPMakeAndAllocatePolicy(); Identify the identity of MTAM and verify the AP certificate , verify the authenticity of the AP device: VerifyAPValidity();

The analysis process of the access mechanism includes: MTAM registers with RDP and applies for the trusted evaluation certificate issued by RDP. After obtaining the certificate, MTAM can interact with ISP, and ISP completes the authenticity of MTAM by verifying the validity of the trusted evaluation certificate Reliability evaluation; RDP obtains a trusted certificate issued by the terminal trusted judgment center CMJC. The certificate contains the RDP public key and CMJC signature and other information, and publishes the public key to external devices such as terminals through a secure way, and the entity identity of each terminal The format of the certificate is as follows: CertA={IDA,KPubA,DateA,LFA, EKSCAC{IDA,KPA,DateA,LFA}} where KPubA is the public key of terminal A, EKSCA is the private key of CMJC, DateA is the issue date of the certificate, LFA is the validity period of the certificate.

In the aforementioned method for judging an illegal connection based on collective coverage, M-TNC adopts an access method of first connecting after security assessment.

In the aforementioned method for judging an illegal connection based on set coverage, the registration information includes the IP address and MAC address of the client.

In the aforementioned method for judging an illegal connection based on set coverage, in step 2, the client sends an authentication request to the server, and the server compares the registration information of the client with the legal terminal list;

If the comparison is successful, the server continues to establish a communication channel with the client, and the server sends a list of legal terminals to the client, and records the client as a legal client;

If the comparison is unsuccessful, the server will record the client as an illegal client and stop communicating with the client. At the same time, the server will send alarm information to multiple clients whose registration information is stored in the legal terminal list.

The aforementioned method for judging an illegal connection based on set coverage,

Step 2, the client sends an authentication request to the server, and the server compares the registration information of the client with the legal terminal list;

If the comparison is successful, the server continues to establish a communication channel with the client, and the server sends a list of legal terminals to the client, and records the client as a legal client;

If the comparison is unsuccessful, the server will record the client as an illegal client and stop communicating with the client. At the same time, the server will call the illegal client to mark the illegal client's tag information, and store the tag information in the illegal connection address book , to record the number of illegal client accesses; the above tag information contains the unique identifier of the terminal.

The aforementioned method for judging an illegal connection based on set coverage,

Step 2, the client sends an authentication request to the server, the server compares the registration information of the client with the legal terminal list, and the server sends the local security policy to the legal client in real time;

If the comparison is successful, the server continues to establish a communication channel with the client, and the server sends a list of legal terminals to the client, and records the client as a legal client;

If the comparison is unsuccessful, the server will record the client as an illegal client and stop communicating with the client.

The aforementioned method for judging an illegal connection based on set coverage,

The illegal client can send a security identification request to the server, and after the server allows the illegal client to connect, the tag information of the illegal client will be deleted from the illegal connection address book.

The aforementioned method for judging an illegal connection based on set coverage further includes: step 4, the server periodically identifies the corresponding multiple clients in the legal terminal list.

The benefits of the present invention are:

The present invention identifies the identity of the client when the communication environment is established, and sends a list of legal terminals to each legal client. When communicating between the clients, the server does not need to identify the identity separately. This judgment method is convenient and fast. Distributing the work of identity recognition to each client reduces the workload of the server and improves work efficiency.

The invention can collect and organize illegal clients by illegally connecting to the address book, making it convenient for staff to retrieve data and intuitively check the illegal clients, grasp the access situation of the illegal clients, identify maliciously accessed devices and perform follow-up processing.

The server of the present invention has the function of performing identification again. After the identification is successful, the marking information of the illegal client is deleted from the illegal connection address book, and the registration information is distributed to the illegal client according to the marking information of the illegal client. The registration information is stored in the legal terminal list, so that the identity of the illegal client is legal, and it can be connected normally with other clients and servers in the future.

Description of drawings

Figure 1 is a flowchart of an embodiment of the present invention.

Detailed ways

The present invention will be specifically introduced below in conjunction with the accompanying drawings and specific embodiments.

A method for judging an illegal connection based on set coverage, comprising:

Step 1. Establish a server and multiple clients. The client stores registration information corresponding to the client information. The server stores a list of legal terminals, which contains the registration information of multiple clients; the registration information includes client IP address and MAC address of the terminal.

Step 2, the client sends an authentication request to the server, and the server compares the registration information of the client with the legal terminal list;

If the comparison is successful, the server continues to establish a communication channel with the client, and the server sends a list of legal terminals to the client, and records the client as a legal client;

If the comparison is unsuccessful, the server will record the client as an illegal client and stop communicating with the client;

Preferred embodiment 1, step 2, the client sends an authentication request to the server, and the server compares the registration information of the client with the legal terminal list;

If the comparison is successful, the server continues to establish a communication channel with the client, and the server sends a list of legal terminals to the client, and records the client as a legal client;

If the comparison is unsuccessful, the server will record the client as an illegal client and stop communicating with the client. At the same time, the server will call the illegal client to mark the illegal client's tag information, and store the tag information in the illegal connection address book , to record the number of illegal client accesses; the above tag information contains the unique identification of the terminal; through the tag information, both the server and the client can perform accurate identification.

By illegally connecting to the address book, illegal clients can be collected and sorted, which is convenient for staff to retrieve data and visually view illegal clients, grasp the access status of illegal clients, identify maliciously accessed devices and follow-up processing.

Preferred embodiment 2, step 2, the client sends an authentication request to the server, the server compares the registration information of the client with the legal terminal list, and the server sends the local security policy to the legal client in real time; through the local security policy, the legal client It can perform data processing tasks such as identification, connection, and rejection according to the requirements of the server, so as to ensure the overall smooth connection work.

If the comparison is successful, the server continues to establish a communication channel with the client, and the server sends a list of legal terminals to the client, and records the client as a legal client;

If the comparison is unsuccessful, the server will record the client as an illegal client and stop communicating with the client.

Preferred embodiment 3, step 2, the client sends an authentication request to the server, and the server compares the registration information of the client with the legal terminal list;

If the comparison is successful, the server continues to establish a communication channel with the client, and the server sends a list of legal terminals to the client, and records the client as a legal client;

If the comparison is unsuccessful, the server will record the client as an illegal client and stop communicating with the client. At the same time, the server will send alarm information to multiple clients whose registration information is stored in the legal terminal list.

Such a design can inform multiple clients whose registration information is stored in the legal terminal list that there is an illegal connection situation, so as to remind information protection.

Step 3: The legal client adopts the trusted network connection technology to form a network trust chain model M-TNC, uses the trusted network connection technology TNC, and realizes terminal access control in the network environment by using the terminal technology provided by the trusted host; M- TNC's authority control rules use the integrity check of the terminal to check the credibility of the terminal;

The architecture of M-TNC is divided into the following three types of entities: terminal visitor AP, rule judger RJP, and rule definer RDP;

The terminal visitor is the terminal access device and requests the resources of the server; the rule judge and rule definer are the terminal security access control system;

The element definition of M-TNC includes the following two definitions:

The first definition: resource set R={ri|i=1…N}, resource set of enterprise office network;

The second definition: resource service domain RS={R, SDP, AP, ISP}, R is the resource set provided by the enterprise network, RJP is an absolutely credible rule determiner, RDP manages the APs of the entire domain and assists network service providers ISP (Internet Service Provider) verifies the credibility of M-TNC, and at the same time accepts cross-domain service request messages from M-TNC in other domains;

The terminal trusted access algorithm includes the following steps:

In step a, RDP formulates corresponding ACL rules according to the trustworthiness of the AP: ACLPolicy←getACLPolicy();

Step b, AP requests access: send an access request, collect the evaluation value of the terminal's credibility and send it to the RJP, and wait for the RJP to judge the credibility of the terminal device: APCredibility←CollectAPCredibility();CredibilityResult←SendJudgeRequest();

Step c, RDP completes the integrity and authenticity verification of the MTAM (Mobile Terminal Access Module) module, and is responsible for issuing trusted certificates for terminal devices in MTAM: CredibilityCertificate←InRealityIntegrityCheck();

Step d, RDP is responsible for formulating and distributing AP credibility determination rules, and verifying its certificate to evaluate the credibility of the access device: CredibilityPolicy←RDPMakeAndAllocatePolicy(); Identify the identity of MTAM and verify the AP certificate , verify the authenticity of the AP device: VerifyAPValidity();

The analysis process of the access mechanism includes: MTAM registers with RDP and applies for the trusted evaluation certificate issued by RDP. After obtaining the certificate, MTAM can interact with ISP, and ISP completes the authenticity of MTAM by verifying the validity of the trusted evaluation certificate Reliability evaluation; RDP obtains a trusted certificate issued by the terminal trusted judgment center CMJC. The certificate contains the RDP public key and CMJC signature and other information, and publishes the public key to external devices such as terminals through a secure way, and the entity identity of each terminal The format of the certificate is as follows: CertA={IDA,KPubA,DateA,LFA, EKSCAC{IDA,KPA,DateA,LFA}} where KPubA is the public key of terminal A, EKSCA is the private key of CMJC, DateA is the issue date of the certificate, LFA is the validity period of the certificate.

As an embodiment, the MTAM establishes a connection with the RDP, and applies for a trusted certificate issued by the RDP. Before the connection is established, MTAM performs integrity measurement based on RDP. MTAM and RDP negotiate to complete the identity authentication between MTAM and RDP. The identity authentication is two-way. After the authentication is completed, RDP realizes the credibility judgment of the MTAM platform. The MTAM that has passed identity authentication and credibility judgment can obtain a trusted certificate issued by RDP. During the validity period of the certificate, the end user can establish a service connection with the ISP by holding the certificate.

The traditional access method is: M-TNC connects first and then evaluates the security; the present invention is different from the traditional method, M-TNC adopts the access method of evaluating the security first and then connecting. This design can greatly enhance the security of network access.

As a preference, the illegal client can send a security identification request to the server, and after the server allows the illegal client to connect, delete the tag information of the illegal client from the illegal connection address book. In the actual work process, a server and multiple clients are established. The client stores registration information corresponding to the client information, and the server stores a list of legal terminals. The list of legal terminals contains the registration information of multiple clients. There is no guarantee that the number of clients will not be increased in the follow-up work, and there are two situations for increasing the number of clients:

One situation is that a new client is added. At this time, the staff needs to store the registration information in the newly added client, and update the legal terminal list stored in the server, and store the registration information of the newly added client with the legal terminal list. In the terminal list, so that the newly added client can connect normally in the future;

Another situation is that the device that has been connected to the server before and becomes an illegal client may be allowed to communicate with the server in the follow-up work, so the server has the function of re-identification. After the identification is successful, it will be illegal. The tag information of the client is deleted from the illegal connection address book, and the registration information is assigned to the illegal client according to the tag information of the illegal client, and the registration information of the illegal client is stored in the list of legal terminals, so that the identity of the illegal client is legal and can In the subsequent normal connection with other clients and servers.

A method for judging an illegal connection based on set coverage further includes: step 4, the server periodically identifies the corresponding multiple clients in the legal terminal list. In the actual work process, when the number of clients is large, the server may have identification errors, so the server regularly identifies the corresponding multiple clients in the legal terminal list to ensure that the clients are all legitimate clients, avoiding In the case, the client causes the leakage of information without knowing it.

The present invention identifies the identity of the client when the communication environment is established, and sends a list of legal terminals to each legal client. When communicating between the clients, the server does not need to identify the identity separately. This judgment method is convenient and fast. Distributing the work of identity recognition to each client reduces the workload of the server and improves work efficiency.

The invention can collect and organize illegal clients by illegally connecting to the address book, making it convenient for staff to retrieve data and intuitively check the illegal clients, grasp the access situation of the illegal clients, identify maliciously accessed devices and perform follow-up processing.

The server of the present invention has the function of performing identification again. After the identification is successful, the marking information of the illegal client is deleted from the illegal connection address book, and the registration information is distributed to the illegal client according to the marking information of the illegal client. The registration information is stored in the legal terminal list, so that the identity of the illegal client is legal, and it can be connected normally with other clients and servers in the future.

The basic principles, main features and advantages of the present invention have been shown and described above. Those skilled in the industry should understand that the above-mentioned embodiments do not limit the present invention in any form, and all technical solutions obtained by means of equivalent replacement or equivalent transformation fall within the protection scope of the present invention.

Claims (8)

1. A kind of 1. illegal connection determination methods based on set covering, it is characterised in that including：

   Step 1, establishes server and multiple client, is stored with client and the single corresponding registration of client-side information Information, server memory contain legal terminal list, and legal terminal list includes the log-on message of multiple client；

   Step 2, user end to server send certification request, and server is by the log-on message of client and legal terminal list It is compared；

   If comparing successfully, server persistently establishes the passage communicated with client, and server sends legal end to client List is held, and client is denoted as legitimate client；

   If comparison is unsuccessful, client is denoted as illegitimate client by server, and stops being communicated with client；

   Step 3, legitimate client form network trust chain model M-TNC using Trusted network connection, use trustable network Interconnection technique TNC, the terminal technology provided by using trusted host, realizes terminal access control in a network environment；M- The control of authority rule of TNC checks the confidence level of terminal using the completeness check of terminal；

   The framework of M-TNC is divided into following 3 class entity：Terminal access person AP, regular judgement person RJP, regular definien RDP；

   Terminal access person is terminal access equipment, the resource of request server；Regular judgement person and regular definien pacify for terminal Full access control system；

   The element definition of M-TNC includes following two definition：

   First definition：Resource set R=ri | i=1＆hellip;N }, the resource collection of enterprise's office network；

   Second definition：Resource service domain RS={ R, SDP, AP, ISP }, R are the resource sets that enterprise network provides, and RJP is definitely may be used The regular judgement person of letter, RDP manage AP and assisted network ISP ISP (the Internet Service in whole domain Provider) verify the credibility of M-TNC, while accept the cross-domain services request message of other domains M-TNC；

   Trusted end-user Access Algorithm includes the following steps：

   Step a, RDP formulate corresponding acl rule according to the confidence level of AP：ACLPolicy←getACLPolicy()；

   Step b, AP request access：Access request is sent, the reliability assessment value of the terminal is collected and is sent to RJP, waits RJP The confidence level of terminal device is judged： APCredibility←CollectAPCredibility ()； CredibilityResult←SendJudgeRequest()；Step c, RDP completion is to MTAM (Mobile Terminal Access Module) module integrality and authenticity verification, the terminal device being responsible in MTAM is issued can Believe certificate： CredibilityCertificate←InRealityIntegrityCheck()；

   Step d, RDP is responsible to define and distributes the confidence level decision rule of AP, and its certificate is verified, to assess the access The credibility of equipment： CredibilityPolicy←RDPMakeAndAllocatePolicy()；To the body of MTAM Part is differentiated, verifies the validity of AP certificates, verifies the credibility of AP equipment： VerifyAPValidity()；

   Access mechanism analytic process includes：The credible evaluation certificate that MTAM is issued to RDP registration services, application RDP, is somebody's turn to do After certificate, MTAM can be interacted with ISP, and ISP is by verifying that the legitimacy of credible evaluation certificate is completed to the credible of MTAM Degree assessment；RDP obtains the trusted certificates signed and issued by trusted end-user judgement center CMJC, and certificate includes the public key and CMJC label of RDP The information such as name, and public key is announced to external equipments such as terminals by secure way, the entity identities certificate format of each terminal is such as Under：CertA={ IDA, KPubA, DateA, LFA, EKSCAC { IDA, KPA, DateA, LFA } } wherein KPubA is terminal A Public key, EKSCA are the private keys of CMJC, and DateA is the date of issue of certificate, and LFA is the term of validity of certificate.
2. A kind of 2. illegal connection determination methods based on set covering according to claim 1, it is characterised in that above-mentioned M- TNC is using the latter linked access way of first security evaluation.
3. A kind of 3. illegal connection determination methods based on set covering according to claim 1, it is characterised in that above-mentioned note Volume information includes the IP address and MAC Address of client.
4. A kind of 4. illegal connection determination methods based on set covering according to claim 1, it is characterised in that step Two, user end to server sends certification request, and the log-on message of client is compared server with legal terminal list；

   If comparing successfully, server persistently establishes the passage communicated with client, and server sends legal end to client List is held, and client is denoted as legitimate client；

   If comparison is unsuccessful, client is denoted as illegitimate client by server, and stopping is communicated with client, serviced at the same time The multiple client that device is stored in legal terminal list to log-on message sends warning message.
5. A kind of 5. illegal connection determination methods based on set covering according to claim 1, it is characterised in that step Two, user end to server sends certification request, and the log-on message of client is compared server with legal terminal list；

   If comparing successfully, server persistently establishes the passage communicated with client, and server sends legal end to client List is held, and client is denoted as legitimate client；

   If comparison is unsuccessful, client is denoted as illegitimate client by server, and stopping is communicated with client, serviced at the same time Device calls the label information that can be easy to mark illegitimate client to illegitimate client, and label information deposit illegal connection is led to News record, the number that record illegitimate client accesses；Above-mentioned label information is to include terminal unique identifier.
6. A kind of 6. illegal connection determination methods based on set covering according to claim 1, it is characterised in that step Two, user end to server sends certification request, and the log-on message of client is compared server with legal terminal list, Local security policy is sent to legitimate client by server in real time；

   If comparing successfully, server persistently establishes the passage communicated with client, and server sends legal end to client List is held, and client is denoted as legitimate client；

   If comparison is unsuccessful, client is denoted as illegitimate client by server, and stopping is communicated with client.
7. A kind of 7. illegal connection determination methods based on set covering according to claim 1, it is characterised in that illegal visitor Family end can send safety identification request to server, after device to be serviced allows illegitimate client to be attached, by illegal client The label information at end is deleted from illegal connection address list.
8. 8. a kind of illegal connection determination methods based on set covering according to claim 1, it is characterised in that also wrap Include：Step 4, server are periodically identified corresponding multiple client in legal terminal list.