CN115174258A - VPN data security access method - Google Patents

Abstract

The invention discloses a VPN data security access method, which comprises the following steps: s1, establishing a VPN gateway, and generating a gateway key pair, a global public key file and a mobile user file; s2, injecting a gateway key pair, a global public key file and a mobile user file into the VPN gateway; s3, establishing a user authentication domain on the VPN gateway, and generating a user according to the user authentication domain; and S4, sending a connection request to the VPN gateway through the user, and establishing an access tunnel of the VPN network of the user. The security of network transmission data is ensured by generating a gateway key pair, encrypting the global public key file and the mobile user file, the security risk is reduced and the quality of data security access is improved by establishing a user authentication domain on the VPN gateway and generating a user according to the user authentication domain, and the security and the integrity of user data are ensured by establishing an access tunnel of the user VPN network and adopting a tunnel transmission mode.

Description

A VPN data security access method

technical field

The invention relates to the technical field of network security, in particular to a VPN data security access method.

Background technique

The definition of computer system security by the International Organization for Standardization is: the technical and management security protection established and adopted for data processing systems to protect computer hardware, software and data from accidental and malicious reasons. Therefore, the security of computer network can be understood as: by adopting various technologies and management measures, the network system can run normally, so as to ensure the availability, integrity and confidentiality of network data. Therefore, the purpose of establishing network security protection measures is to ensure that the data transmitted and exchanged through the network will not be added, modified, lost or leaked.

With the development of the power system, the large-scale access of mobile terminals of the Internet of Things terminals at the power edge, the rapid increase in the number of information collection terminal equipment and the substantial growth of business data, the bandwidth of information transmission is faced with great challenges, and the introduction of inaccessible In the process of digital transformation of power communication network, the transmission and shared access of data security has received more and more attention. Virtual Private Network VPN (Virtual Private Network), as a private encrypted network, can provide high security level data security sharing access. In the existing VPN data access control system, the access party (such as the user terminal) establishes a VPN data dedicated channel with the remote data service party through the client for secure data sharing. In the process of data sharing, it is easy to cause data inconsistency due to remote sharing. Security, it is easy to lead to incomplete data, access stability cannot be guaranteed, resulting in the destruction of the entire data sharing link.

SUMMARY OF THE INVENTION

The technical problem to be solved by the present invention is that when the existing VPN data access control system performs remote data sharing, the data is insecure and incomplete, and the access stability cannot be guaranteed, thereby causing the entire data sharing link to be destroyed. The purpose is to Provides a VPN data security access method, which ensures the security of network transmission data by generating a gateway key pair, a global public key file and encrypting mobile user files, and reduces security risks through VPN users' access to the authentication domain. Improve the quality of data access, and use tunnel transmission to ensure the security and integrity of user data.

The present invention is achieved through the following technical solutions:

A VPN data security access method, comprising the following steps:

S1. Establish a VPN gateway, and generate a gateway key pair, a global public key file and a mobile user file;

S2. Inject the gateway key pair, global public key file and mobile user file into the VPN gateway;

S3. Establish a user authentication domain on the VPN gateway, and generate users according to the user authentication domain;

S4. The user sends a connection request to the VPN gateway to establish an access tunnel of the user's VPN network.

The invention generates a gateway key pair, a global public key file and a mobile user file by establishing a VPN gateway; injects the gateway key pair, the global public key file and the mobile user file into the VPN gateway; A user authentication domain is established on the VPN gateway, and users are generated according to the user authentication domain; the access to the authentication domain by VPN users reduces security risks and improves the quality of data security access. Users send connection requests to the VPN gateway to establish a user VPN network The access tunnel, using tunnel transmission to ensure the security and integrity of user data.

Further, the step S1 specifically includes: uploading a license to the VPN gateway, obtaining the NetEyeVPN firewall, generating a root key through the NetEyeVPN firewall, obtaining the IP address and key exchange port information of the VPN gateway, and according to the IP address and password of the VPN gateway. The key exchange port information generates the gateway key, global public key file and mobile user file. The global public key file is used to establish a secure channel between the current VPN gateway and other VPN gateways, and the mobile user file is used to establish a secure channel between the current VPN gateway and a desired VPN gateway.

Further, generating a user according to the user authentication domain specifically includes: creating a user in the authentication domain, adding user name and user password information, generating a user, creating a role name according to the nature of the user, and assigning an IP address to the user according to the role name.

Further, the assigning the IP address for each user according to the role includes: configuring the VPN gateway tunnel IP address pool according to the access tunnel of the user's VPN network, and assigning the corresponding authentication domain of the IP address in the IP address pool to the role.

Further, after the user sends a connection request to the VPN gateway, the user is authenticated and authenticated through the VPN gateway, and an access tunnel to the VPN network of the remote user is established after the authentication is successful.

Further, the specific steps of establishing the access tunnel of the remote user VPN network include: controlling and filtering the access of the user, and the filtering content is the source and destination IP addresses, destination port numbers and connection protocols of the user access information.

Further, the filtered user will access the authorized authentication domain according to the role to which he belongs and the assigned IP address range, and automatically join the authentication domain.

Further, the access tunnel is a many-to-many transmission tunnel established between the source address and the destination address through the VPN gateway.

Further, when the data in the transmission tunnel is transmitted, the transmission data of the transmission tunnel is encapsulated, and the encapsulation includes VPN encapsulation of the transmission data, and IP encapsulation of the transmission data after VPN encapsulation.

Compared with the prior art, the present invention has the following advantages and beneficial effects:

1. Encryption by generating gateway key pair, global public key file and mobile user file to ensure the security of network transmission data, reducing security risks and improving the quality of data security access through VPN users' access to the authentication domain, Use tunnel transmission to ensure the security and integrity of user data;

2. The present invention generates a gateway key and a global public key file by obtaining the IP address and key exchange port information of the VPN gateway, and the global public key file is signed with the private key of the management center, which can prevent being replaced or tampered with during the transmission process. .

Description of drawings

In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the accompanying drawings required in the embodiments will be briefly introduced below. It should be understood that the following drawings only illustrate some embodiments of the present invention, Therefore, it should not be regarded as a limitation of the scope. For those of ordinary skill in the art, other related drawings can also be obtained from these drawings without any creative effort. In the attached image:

FIG. 1 is a flowchart in an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the embodiments and the accompanying drawings. as a limitation of the present invention.

Example 1

As shown in Figure 1, this embodiment provides a VPN data security access method, including the following steps:

S1. Establish a VPN gateway, and generate a gateway key pair, a global public key file and a mobile user file;

S2. Inject the gateway key pair, global public key file and mobile user file into the VPN gateway;

S3. Establish a user authentication domain on the VPN gateway, and generate users according to the user authentication domain;

S4. The user sends a connection request to the VPN gateway to establish an access tunnel of the user's VPN network.

The invention generates a gateway key pair, a global public key file and a mobile user file by establishing a VPN gateway; injects the gateway key pair, the global public key file and the mobile user file into the VPN gateway; A user authentication domain is established on the VPN gateway, and users are generated according to the user authentication domain; the access to the authentication domain by VPN users reduces security risks and improves the quality of data security access. Users send connection requests to the VPN gateway to establish a user VPN network The access tunnel, using tunnel transmission to ensure the security and integrity of user data.

In some possible embodiments, step S1 specifically includes: the step S1 specifically includes: uploading a license to the VPN gateway, obtaining the NetEyeVPN firewall, generating a root key through the NetEyeVPN firewall, and obtaining the IP address and key exchange port of the VPN gateway information, generate the gateway key, global public key file and mobile user file according to the IP address and key exchange port information of the VPN gateway. The global public key file is used to establish a secure channel between the current VPN gateway and other VPN gateways, and the mobile user file is used to establish a secure channel between the current VPN gateway and the desired VPN gateway.

In some possible embodiments, generating a user according to a user authentication domain specifically includes: creating a user in the authentication domain, adding a user name and user password information, generating a user, creating a role name according to the nature of the user, and assigning a role name to the user according to the role name. IP address. Assigning an IP address to each user according to the role includes configuring the VPN gateway tunnel IP address pool according to the access tunnel of the user's VPN network, and assigning the IP addresses in the IP address pool to the role according to the authentication domain.

In some possible embodiments, after the user sends a connection request to the VPN gateway, the user is authenticated and authenticated by the VPN gateway, and an access tunnel to the VPN network of the remote user is established after the authentication is successful. The specific steps of establishing the access tunnel of the remote user VPN network include: controlling and filtering the user's access, and the filtering content is the source and destination IP address, destination port number and connection protocol of the user's access information. Filtered users will access authorized authentication domains according to their roles and assigned IP address ranges, and automatically join the authentication domains.

In some possible embodiments, the access tunnel is a many-to-many transport tunnel established through the VPN gateway between the source address and the destination address. When the data in the transmission tunnel is transmitted, the transmission data of the transmission tunnel is encapsulated, and the encapsulation includes VPN encapsulation of the transmission data, and IP encapsulation of the transmission data after VPN encapsulation.

Example 2

A1. Establish VPN gateway

Establish a VPN gateway, and establish a data transmission tunnel through the established VPN gateway. All transmission data in the transmission tunnel needs to be packaged through the VPN gateway. The source address and destination address of the transmission data are both VPN gateway addresses. After the data is encapsulated by VPN, IP encapsulation is performed on the basis of the VPN encapsulation. The source address is server a, and the destination address is server b. The data transmitted between server a and server b will pass through VPN data packets, and then IP data packet, the final IP data packet includes source IP, destination IP, IP protocol and VPN information.

A2. Management of communication rooms

The key to ensuring VPN transmission data is to ensure the security of key management of the entire system. The present invention adopts a key management framework based on PKI to realize safe and reliable key distribution and management, and establishes a key management center in the network center to provide the entire system. The VPN system is configured with an RSA key pair.

After logging in to the key management center, the root key is generated in the key encryption card. The root key is the RSA public and private key pair, and the RSA key pair of the VPN gateway is negotiated through IKE, and the private key is the identity symbol. Each VPN gateway has a gateway key pair, which is generated by the key management center and injected into the respective VPN gateways. The dedicated key encryption card is used as the key transmission medium, and the encryption key is used to ensure the key Security during issuance.

Obtain the IP address and key exchange port information of the VPN gateway through the key management center, and generate the gateway key pair, global public key file and mobile user file according to the IP address and key exchange port information of the VPN gateway. The key file is signed with the private key of the management center, which can prevent it from being replaced or tampered with during data transmission. Since it is difficult to derive the public key and the private key from each other, the ciphertext encrypted by the public key and the private key can only be decrypted by the corresponding private key or public key, which ensures the confidentiality of the information during transmission.

A3. Gateway configuration

VPN gateway key configuration and user E-Key generation: After uploading the appropriate license for the VPN, the VPN function of the NetEyeVPN firewall will be acquired to form a VPN gateway. Inject the gateway key pair, global public key file, and mobile user file generated by the key management center into the VPN gateway. The global public key file is used to establish a secure channel between the current VPN gateway and other VPN gateways, and the mobile user file is used to establish a secure channel between the current VPN gateway and other VPN gateways. Establish a secure tunnel between the current VPN gateway and the desired VPN gateway. Create a user authentication domain on the VPN gateway. You can select local authentication or Radius authentication during creation. Create a user in the authentication domain (add user name and user password information), and generate a user E-Key, where the user E-Key mainly stores the user authentication certificate. File and user name information to enhance the security of user authentication.

A4. Data transmission processing

When a VPN user sends a connection request to the VPN gateway through the NetEyeVPN client and the VPN client E-Key, the VPN gateway authenticates and authenticates the VPN user, and the session key in the connection request is automatically negotiated and generated according to the IKE protocol. After the VPN gateway authenticates and authenticates the VPN user successfully, it establishes the access tunnel of the remote user by creating the SA and the combination of the SA. NetEyeVPN follows the IPSec security protocol and uses the tunnel mode to provide encryption for user data. , integrity verification, and provide security protection for information transmission through integrated authentication services. NetEyeVPN uses IP encapsulation. After encrypting the original IP packet and adding authentication information, it is completely encapsulated in a new IP packet. The source address and destination address of the IP header in the new IP packet are the external addresses of the client and VPN gateway, respectively. After the packet is encapsulated in this way, the internal network topology is hidden when it is transmitted on the public network, and the security of the network is enhanced. In addition, the confidentiality and integrity of the IP packet are guaranteed by using the standard AH and ESP protocols.

A5. Regional division

When creating users in the authentication domain of the VPN gateway, create multiple role names for users of different natures, which correspond to application areas such as OA, production, network distribution, and marketing, and set the IP address pool of the VPN gateway tunnel virtual device. The IP addresses are assigned to roles respectively, corresponding to each application domain. After the user logs in and is authenticated, the user will be assigned an IP address according to the role to which he belongs, and will be automatically added to his own application domain. The authentication method can be based on E- Key method or password.

VPN users filtered by the firewall security control policy will access authorized application domains according to their roles and assigned IP address ranges, that is, specify an IP address range for each role in the authentication domain, and the specified IP address range must belong to the configuration The IP address in the IP address pool, where the application domain includes one or a combination of several application domains such as access OA, production management, distribution network management, and marketing.

Encryption alone is not enough, comprehensive protection also requires authentication and identification. It ensures that the authentication of users participating in encrypted conversations can be achieved by relying on many mechanisms, from security cards to identity authentication. The security protection of security cards can ensure that only authorized users can interactively access the network through reliable terminals; identity authentication provides a kind of method that generates some form of password or digital signature by which the visited party authenticates the request from the visitor.

A6. Develop security policies

After the VPN network channel is established on the public network between the VPN user and the VPN gateway, it is necessary to further divide the network into different security access areas through the formulation of firewall security policies and security rules, restrict users' access to different security areas, and make the network The security is further improved. The firewall is generally located at the edge control point of the enterprise network, such as the connection with the Internet, and can also be deployed on the control point of the security zone inside the enterprise network.

The weakness of secure zone defense is that it cannot defend against attacks from "legitimate" users inside the zone, such as malicious or unintentional internal users, remote mobile workers without firewalls and weak security protections or SOHO from identity theft, and the existence of security zones Backdoor vulnerabilities (wireless network, remote access), etc. Firewall technology is used to restrict and filter user access by formulating security policies. The main filtering content is the source and destination IP addresses, destination port numbers and connection protocols of user access information. VPN users filtered by the firewall security control policy will access authorized application domains according to their roles and assigned IP address ranges. For example, they can only access one of the OA, production management, distribution network management, and marketing application domains, or A combination of several domains. When configuring the firewall, ensure that the security levels of the VPN devices at both ends of the data transmission channel are the same to ensure the data transmission efficiency of the VPN devices at both ends of the channel.

The specific embodiments described above further describe the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above descriptions are only specific embodiments of the present invention, and are not intended to limit the scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims (10)

1. a VPN data security access method, is characterized in that, comprises the following steps: S1. Establish a VPN gateway, and generate a gateway key pair, a global public key file and a mobile user file; S2. Inject the gateway key pair, global public key file and mobile user file into the VPN gateway; S3. Establish a user authentication domain on the VPN gateway, and generate users according to the user authentication domain; S4. The user sends a connection request to the VPN gateway to establish an access tunnel of the user's VPN network. 2. VPN data security access method according to claim 1, is characterized in that, described step S1 specifically comprises: to VPN gateway upload permission, obtain NetEyeVPN firewall, by NetEyeVPN firewall, generate root key, obtain the IP of VPN gateway Address and key exchange port information, generate gateway key, global public key file and mobile user file according to the IP address of VPN gateway and key exchange port information. 3. VPN data security access method according to claim 2 is characterized in that, described global public key file is used to establish the security channel between current VPN gateway and other VPN gateways, and described mobile user file is used to establish current VPN gateway. A secure tunnel between the VPN gateway and the desired VPN gateway. 4. The VPN data security access method according to claim 1, wherein generating a user according to a user authentication domain specifically comprises: creating a user in the authentication domain, adding a user name and user password information, generating a user, and generating a user according to the user authentication domain. Create a role name and assign IP addresses to users based on the role name. 5. VPN data security access method according to claim 4, is characterized in that, described according to the IP address that each user is allocated and used comprises: configure VPN gateway tunnel IP address pool according to the access tunnel of user VPN network, The IP addresses in the IP address pool are assigned to roles corresponding to the authentication domains. 6. VPN data security access method according to claim 1 is characterized in that, after described user sends connection request to VPN gateway, user is authenticated and authenticated by VPN gateway, after authentication is successful, the access of remote user VPN network is established tunnel. 7. The VPN data security access method according to claim 6, wherein the specific steps of establishing the access tunnel of the remote user VPN network include: controlling and filtering the access of the user, and the filtering content is user access information source and destination IP address, destination port number and connection protocol. 8. VPN data security access method according to claim 7, is characterized in that, the user after described filtering will visit authorized authentication domain according to its role and assigned IP address range, and automatically join this authentication domain middle. 9 . The VPN data security access method according to claim 6 , wherein the access tunnel is a many-to-many transmission tunnel established between a source address and a destination address through a VPN gateway. 10 . 10. The VPN data security access method according to claim 9, characterized in that, when the data in the transmission tunnel is transmitted, the transmission data of the transmission tunnel is encapsulated, and the encapsulation comprises VPN packetization of the transmission data, IP encapsulates the transmission data after VPN encapsulation.

Images