CN108040033A - Intranet security cut-in method and system based on cloud computing and mobile common platform - Google Patents

Abstract

The invention discloses a method and system for secure access to an intranet based on cloud computing and a mobile public platform. The intranet security access method of the present invention includes: entry of initial fingerprints and fingerprint identification, entry of initial fingerprints includes: transmitting the entered initial fingerprints to a terminal server, and the terminal server converts the entered fingerprints into fingerprint information and uploads them to the cloud server Fingerprint library; fingerprint identification includes: inputting the fingerprint of the registrant and accessing the fingerprint information from the fingerprint library; comparing the collected fingerprint with the connected fingerprint information, and entering the intranet after the comparison is successful. The present invention is based on cloud computing and a method for secure access to the internal network of the mobile public platform, and is equipped with a special encryption card that can be connected to the company's internal network security platform to realize safe and reliable access of the mobile operation terminal to the company's internal network and provide an external fingerprint collector that can support Mobile phone terminals, thereby improving the security of the data interaction interface of the internal and external networks.

Description

Intranet security access method and system based on cloud computing and mobile public platform

technical field

The invention relates to the technical field of network security, in particular to an intranet security access method and system based on cloud computing and a mobile public platform.

Background technique

With the rapid development of informatization construction, there are more and more computer terminals in the unit. How to manage the network security access of intranet terminals and avoid the leakage of terminal information data has become the first choice for enterprises.

At present, the network access control technology of most intranet security management systems is mostly based on the working mode of "scan-discover-block". Through the management center of the network access control system, the network is continuously scanned, and the scanned The computer performs a legality check to determine whether the terminal is a legal terminal. When the terminal is found to be illegal, the ARP spoofing method is used to block the terminal from accessing the network.

There are following deficiencies in above-mentioned technology:

1. Illegal terminals can survive on the Internet for a period of time

Since it is necessary to scan all addresses on the entire network, there is a certain scan interval for each address. Therefore, during this period of time, illegal access terminals can survive in the network for a certain period of time, and during this period, attackers may Part of the attack has been completed.

2. In some cases, the network access control system cannot discover illegal terminals that access

Since the network range to be scanned needs to be specified, when the address used by the illegal access terminal is outside the specified scanning range, the network access control system cannot "discover" the illegal device that is accessed.

3. Consume valuable network resources

The network access control system needs to continuously scan the network in order to find illegal access terminals, which will consume a lot of valuable network resources, especially in large-scale networks, this problem is more prominent.

Contents of the invention

In view of the deficiencies in the above-mentioned prior art, the present invention provides a method for secure access to an intranet based on cloud computing and a mobile public platform, so as to realize management and control of terminal security.

In order to solve the problems of the technologies described above, the technical solution adopted in the present invention is:

Intranet security access method based on cloud computing and mobile public platform, which includes: initial fingerprint entry and fingerprint identification;

The entry of the initial fingerprint includes:

S1. Transmitting the entered initial fingerprint to the terminal server;

S2. The terminal server converts the entered fingerprint into fingerprint information and uploads it to the fingerprint database in the cloud;

The fingerprint identification includes:

S3. Enter the fingerprint of the registrant and access the fingerprint information from the fingerprint database;

S4. Compare the collected fingerprint with the docked fingerprint information, and enter the intranet after the comparison is successful.

Preferably, in the step S1, the initial fingerprint is entered through a fingerprint module, and the fingerprint module is connected to the terminal server through any communication interface among USB and UART.

Preferably, the fingerprint module is connected with a single-chip microcomputer, which is used to provide the input of the power supply of the fingerprint module to make the fingerprint module work and complete corresponding commands.

Preferably, the fingerprint module communicates with the server terminal through half-duplex asynchronous serial communication, the baud rate is 57600bps, and the transmitted frame format is 10 bits, of which 1 is zero level, 8 data bits and 2 stop bits .

Preferably, in the step S2, the fingerprint information is a fingerprint feature code, and each fingerprint feature code corresponds to 384 bytes.

Preferably, in the step S2, the fingerprint information is a fingerprint feature code and a fingerprint image, and each fingerprint feature code corresponds to 384 bytes.

Preferably, in the step S4, the 384 bytes corresponding to the fingerprint feature code accessed in the fingerprint library are compared with the 384 bytes corresponding to the fingerprint feature code collected by the registrant.

Another object of the present invention is to provide an intranet security access system based on cloud computing and a mobile public platform, which includes an initial fingerprint entry unit and a fingerprint identification unit;

The entry unit of the initial fingerprint includes: transmitting the entered initial fingerprint to the terminal server;

The terminal server converts the entered fingerprints into fingerprint information and uploads them to the fingerprint database in the cloud;

The fingerprint identification unit includes: entering the fingerprint of the registrant and accessing the fingerprint information from the fingerprint database;

Compare the collected fingerprint with the docked fingerprint information, and enter the intranet after the comparison is successful.

The present invention has following beneficial effect:

The present invention is based on cloud computing and a method for secure access to the internal network of the mobile public platform, and is equipped with a special encryption card that can be connected to the company's internal network security platform to realize safe and reliable access of the mobile operation terminal to the company's internal network and provide an external fingerprint collector that can support Mobile phone terminals, thereby improving the security of the data interaction interface of the internal and external networks. Once an illegal terminal is found to access the network, it will be blocked immediately to avoid security threats caused by the illegal terminal's survival time after accessing the network. When the terminal address does not belong to the specified range, as long as it is an illegal terminal and a user who has not been properly authorized, the network access control system prohibits access to the network. The network access control system does not need to use the "continuous scanning" method, but blocks illegal terminals through the authorization method between the switch and the network access control system.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained according to these drawings without any creative effort.

Fig. 1 is the processing flowchart of UART of the present invention and USB order packet;

Fig. 2 is the sending flowchart of UART packet of the present invention;

Fig. 3 is the receiving flowchart of UART packet of the present invention;

Fig. 4 is the sending flowchart of USB packet of the present invention;

FIG. 5 is a flow chart of receiving USB data packets in the present invention.

Detailed ways

The specific embodiments of the present invention will be further described below in conjunction with the accompanying drawings. It should be noted here that the descriptions of these embodiments are used to help understand the present invention, but are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below may be combined with each other as long as they do not constitute a conflict with each other.

Example 1

This embodiment provides a method for secure access to an intranet based on cloud computing and a mobile public platform, which includes: initial fingerprint entry and fingerprint identification.

The entry of the initial fingerprint:

S1. Transmitting the entered initial fingerprint to the terminal server;

S2. The terminal server converts the entered fingerprint into fingerprint information and uploads it to the fingerprint database in the cloud;

The fingerprinting:

S3. Enter the fingerprint of the registrant and access the fingerprint information from the fingerprint database;

S4. Compare the collected fingerprint with the docked fingerprint information, and enter the intranet after the comparison is successful.

In the present invention, in the step S1, the initial fingerprint is entered through the fingerprint module, and the fingerprint module is connected to the terminal server through any communication interface in USB and UART. The fingerprint module is used as a slave device, and the master device sends relevant commands to the terminal server. It controls. The flow chart of the processing of UART and USB command packets is shown in Figure 1.

Among them, the fingerprint module is the SF2013 fingerprint module. The SF2013 fingerprint module is an integrated fingerprint processing module that integrates the fingerprint algorithm chip and the fingerprint processing part. It has the characteristics of small size, low power consumption, simple interface, high reliability and fast recognition speed. , Good adaptability to dry and wet fingers, and fast fingerprint search speed. When reading fingerprint images, it has a sensitive response and judgment to dry and wet fingers, and obtains the best imaging quality, which is suitable for a wide range of people. The self-learning adaptation function can also be customized to automatically adjust parameters according to changes in user habits and climate to achieve better matching. With self-learning function, during the fingerprint identification process, new fingerprint feature values are extracted, and the feature values are fused into the previous fingerprint features after successful identification.

Specifically, the sending process of the UART data packet is shown in Figure 2. Before the UART transmits the data packet, it must first receive the instruction packet for the transmission data packet, send a successful response packet after the transmission is ready, and finally start to transmit the data. Bag. The data packet mainly includes: packet header, chip address, packet identification, packet length, data and checksum. There are two types of packet identifiers for data packets: 02H and 08H. 02H: data packet, and there is a follow-up packet. 08H: The last data packet, namely the end packet. The data length is pre-set, mainly divided into four types: 32, 64, 128, and 256. Among them, the length of the data to be transmitted is 1K bytes, and the preset data length in the data packet is 128 bytes, then the data of 1K bytes must be divided into 8 data packets for transmission. Each data packet includes: 2bytes packet header, 4bytes chip address, 1bytes packet identification, 2bytes packet length, 128bytes data and 2bytes checksum, and the length of each packet is 139bytes. In addition, among the 8 data packets, the report identifier of the first 7 data packets is 02H, and the report identifier of the last end data packet is 08H. Finally, it should be noted that if the length of the end packet does not reach 139 bytes, it will be transmitted with the actual length and will not be expanded to 139 bytes in other ways.

The receiving process of the UART data packet is shown in Figure 3. Before the UART transmits the data packet, it must first receive the instruction packet for transmitting the data packet, and then send a successful response packet after making preparations for transmission, and finally start transmitting the data packet. The data packet mainly includes: packet header, chip address, packet identification, packet length, data and checksum. There are two types of packet identifiers for data packets: 02H and 08H. 02H: data packet, and there is a follow-up packet. 08H: The last data packet, namely the end packet. The data length is pre-set, mainly divided into four types: 32, 64, 128, and 256. For example, if the length of the data to be transmitted is 1K bytes, and the preset data length in the data packet is 128 bytes, then the data of 1K bytes must be divided into 8 data packets for transmission. Each data packet includes: 2bytes packet header, 4bytes chip address, 1bytes packet identification, 2bytes packet length, 128bytes data and 2bytes checksum, each packet length is 139bytes. In addition, among the 8 data packets, the report identifier of the first 7 data packets is 02H, and the report identifier of the last end data packet is 08H. Finally, it should be noted that if the length of the end packet does not reach 139 bytes, the actual length of the transmission will not be expanded to 139 bytes in other ways.

The sending and receiving process of the USB data packet is shown in Figure 4 and Figure 5. Before the USB transmits the data packet, it must first receive the instruction packet for the transmission data packet, and then send a successful response packet after making preparations for transmission, and finally start to transmit data. Bag. The USB data packet only has data, without packet header, chip address, packet identification, packet length and checksum, and is different from UART packet transmission, USB is entire packet transmission.

The fingerprint module is connected with the single-chip microcomputer, and is used for providing the input of the power supply of the fingerprint module, making the fingerprint module work, and completing corresponding commands.

Specifically, it can communicate with the single chip microcomputer or other MCU with 3.3V power supply. Considering the power consumption of the overall circuit, the fingerprint module only has two states of working and non-working, and there is no sleep or standby state; normally the power input of the fingerprint module is turned off, and the fingerprint module does not work; when the single-chip microcomputer (MCU) needs to access the fingerprint module, Provide the power input of the fingerprint module, the fingerprint module works, and completes the corresponding command. If the fingerprint module is no longer used, the power supply of the fingerprint module is cut off, and the fingerprint module enters the non-working state.

The fingerprint module communicates with the server terminal through half-duplex asynchronous serial communication, the baud rate is 57600bps, and the transmitted frame format is 10 bits, including 1 zero-level bit, 8 data bits and 2 stop bits.

In the step S2, the fingerprint information is a fingerprint feature code, and each fingerprint feature code corresponds to 384 bytes.

In the step S4, the 384 bytes corresponding to the fingerprint feature code accessed in the fingerprint database are compared with the 384 bytes corresponding to the fingerprint feature code collected by the registrant.

It can be understood that in step S1, the fingerprint library can use the original system fingerprint library, and it is necessary to obtain the fingerprint identification code in the current fingerprint library of the transportation inspection system and its fingerprint collection method. Combined with its corresponding unified standard encryption and fingerprint algorithm to design the corresponding fingerprint acquisition module. It is also possible to use the fingerprint library that comes with the new fingerprint collection device for the new fingerprint library, and integrate it with the corresponding software system. After the system goes online, the user needs to re-enter the fingerprint module.

Example 2

The present embodiment provides a system for intranet security access based on cloud computing and a mobile public platform, which includes an initial fingerprint entry unit and a fingerprint identification unit;

The entry unit of the initial fingerprint includes: transmitting the entered initial fingerprint to the terminal server;

The terminal server converts the entered fingerprints into fingerprint information and uploads them to the fingerprint database in the cloud;

The fingerprint identification unit includes: entering the fingerprint of the registrant and accessing the fingerprint information from the fingerprint database;

Compare the collected fingerprint with the docked fingerprint information, and enter the intranet after the comparison is successful.

In the entry unit of the initial fingerprint, the initial fingerprint is entered through the fingerprint module, and the fingerprint module is connected with the terminal server through any communication interface among USB and UART. The fingerprint module is connected with the single-chip microcomputer, and is used for providing the input of the power supply of the fingerprint module, making the fingerprint module work, and completing corresponding commands.

The embodiments of the present invention have been described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. For those skilled in the art, without departing from the principle and spirit of the present invention, various changes, modifications, substitutions and modifications to these embodiments still fall within the protection scope of the present invention.

Claims (10)

1. the intranet security cut-in method based on cloud computing and mobile common platform, it is characterised in that including：The record of initial fingerprint Enter and fingerprint recognition；

The typing of the initial fingerprint includes：

S1, by the initial fingerprint of typing be transmitted to terminal server；

The fingerprint of typing is converted to finger print information and the fingerprint base for being uploaded to high in the clouds by S2, terminal server；

The fingerprint recognition includes：

S3, the fingerprint of typing registrant simultaneously access finger print information from fingerprint base；

S4, contrasted the fingerprint of collection with the finger print information docked, enters Intranet after contrasting successfully.

2. intranet security cut-in method according to claim 1, it is characterised in that in the step S1, pass through fingerprint mould Block typing initial fingerprint, the fingerprint module are connected by any one communication interface in USB and UART with terminal server.

3. intranet security cut-in method according to claim 2, it is characterised in that the fingerprint module and a microcontroller phase Connection, for providing the input of fingerprint module power supply, makes fingerprint module work, and completes corresponding order.

4. intranet security cut-in method according to claim 2, it is characterised in that the fingerprint module and server terminal By half-duplex asynchronous serial communication, its baud rate is 57600bps, and the frame format of transmission is 10, wherein 1 zero level, 8 Position data bit and 2 stop positions.

5. intranet security cut-in method according to claim 1, it is characterised in that in the step S2, the fingerprint letter Cease and correspond to 384 bytes for fingerprint character code, each fingerprint character code.

6. intranet security cut-in method according to claim 1, it is characterised in that in the step S2, the fingerprint letter Cease and correspond to 384 bytes for fingerprint character code and fingerprint image, each fingerprint character code.

7. the intranet security cut-in method according to claim 5 or 6, it is characterised in that in the step S4, by referring to 384 bytes, 384 words corresponding with the fingerprint character code that registrant gathers corresponding to the fingerprint character code accessed in line storehouse Section is compared.

8. the intranet security access system based on cloud computing and mobile common platform, it is characterised in that the record including initial fingerprint Enter unit and fingerprint identification unit；

The typing unit of the initial fingerprint includes：The initial fingerprint of typing is transmitted to terminal server；Eventually

The fingerprint of typing is converted to finger print information and the fingerprint base for being uploaded to high in the clouds by end server；

The fingerprint identification unit includes：The fingerprint of typing registrant simultaneously accesses finger print information from fingerprint base；

The fingerprint of collection is contrasted with the finger print information docked, enters Intranet after contrasting successfully.

9. intranet security access system according to claim 8, it is characterised in that the typing unit of the initial fingerprint In, by fingerprint module typing initial fingerprint, the fingerprint module passes through any one communication interface and terminal in USB and UART Server is connected.

10. intranet security access system according to claim 9, it is characterised in that the fingerprint module and a microcontroller It is connected, for providing the input of fingerprint module power supply, fingerprint module is worked, and completes corresponding order.