WO2014059604A1 - Method and device for secure access to resource - Google Patents

Abstract

The present invention relates to the technical field of communications/information technology. An embodiment of the present invention provides a method and device for secure access to a resource; said embodiment enables authentication of the identity authentication information and the browser software summary of a user, enabling a user to access a resource of a server securely and protecting the server resource. The method comprises: acquiring both the identity authentication information and the browser software summary of a user; generating a result for user authorization if the identity authentication information matches the corresponding user information prestored in a list of trusted users, and if the browser software summary matches the corresponding browser software summary information prestored in a list of trusted browsers; displaying a list of accessible resources, so that the user can enter an access instruction according to said list of accessible resources; and acquiring a prestored resource or server resource as indicated in the access instruction.

Description

 Resource security access method and device

 The present invention relates to the field of communication/information technology, and in particular, to a resource security access method and apparatus.

Background technique

 With the rapid development of integrated circuit technology, mobile terminals have acquired powerful processing capabilities and are moving from simple call tools to an integrated information processing platform. In recent years, more and more enterprises have begun to choose mobile terminals to access the intranet for mobile office work, to improve the efficiency of enterprise employees and make full use of the convenience of mobile internet. Among them, the webpage is the main carrier of the enterprise information technology business, and most of the enterprise business will provide web-based applications, such as: enterprise portal, office automation system, mail, enterprise resource planning, customer relationship management and financial system, etc. Web services are provided to facilitate users to access through various types of terminals. Therefore, business access based on browser web pages has gradually become the main form of corporate office, and with

With the rise of HTML 5 (Hypertext Markup Language 5, Hypertext Markup Language 5th Edition), the popularity of web applications will become more apparent. In turn, the security requirements for web applications are increasing.

 In the prior art, a universal security technology for implementing secure access of a mobile terminal is a VPN (Virtual Private Network). However, on the one hand, the existing VPN technology needs to obtain advanced access rights, and the operating system is required to perform authorization. Therefore, for different application manufacturers, compatibility development is required, which results in poor versatility of the VPN technology. On the other hand, the VPN cannot perform fine access control, and the enterprise data is not protected after being downloaded to the local area through the VPN, and there is a large The risk of leaking.

Summary of the invention

The embodiments of the present invention provide a resource security access method, device, and system, which can verify user authentication information and browser software digest, so that users can securely access server resources and protect server resources. To achieve the above objective, the embodiment of the present invention adopts the following technical solutions: In a first aspect, an embodiment of the present invention provides a resource security access method, where the method includes:

 Obtain the user's authentication information and browser software summary;

 If the authentication information matches the corresponding user information pre-stored in the user trust list, and the browser software summary matches the corresponding browser software summary information pre-stored in the browser trust list, generating the user's Authorization result, the authorization result includes a list of accessible resources;

 Displaying the accessible resource list to cause the user to input an access instruction according to the accessible resource list;

 Obtaining a pre-stored resource or a resource of the server indicated by the access instruction. In a first possible implementation manner, according to the first aspect, the method further includes: acquiring a hardware key identifier;

 If the hardware key identifier matches the corresponding hardware key information pre-stored in the hardware key list, the authorization result of the user is generated.

 In a second possible implementation manner, in combination with the first aspect or the first possible implementation manner, the authorization result further includes a resource usage policy;

 The acquiring the resources of the pre-stored resource or the server indicated by the access instruction includes:

 Obtaining a pre-stored resource or a resource of the server indicated by the access instruction according to the resource usage policy.

 In a third possible implementation, in combination with the first aspect or the first possible implementation manner or the second possible implementation manner, the method further includes:

 If the access instruction input by the user is received after the preset period, the resource of the server indicated by the access instruction is not acquired.

 In a fourth possible implementation, in combination with the first aspect or the first possible implementation manner to the third possible implementation manner, the method further includes:

The authorization result further includes user rights information, and the user rights information indicates whether the user is allowed to upload or download resources. In a fifth possible implementation, in combination with the first aspect or the first possible implementation manner to the fourth possible implementation manner, the method further includes:

 The authorization result further includes resource security access level information, and the resource security access level information indicates a level of resources that the user is allowed to download.

 In a second aspect, the embodiment of the present invention further provides a resource security access device, where the device includes:

 a local service module, configured to obtain authentication information and a browser software summary of the user, and display the accessible resource list, so that the user inputs an access instruction according to the accessible resource list;

 An authentication module, configured to: if the authentication information matches the corresponding user information pre-stored in the user trust list, and the browser software summary matches the corresponding browser software summary information pre-stored in the browser trust list, Generating an authorization result of the user, where the authorization result includes a list of accessible resources;

 And a secure communication module, configured to acquire resources of a pre-stored resource or server indicated by the access instruction.

 In a first possible implementation manner, according to the second aspect,

 The local service module is further configured to obtain a hardware key identifier;

 The authentication module is further configured to generate an authorization result of the user if the hardware key identifier matches a corresponding hardware key information pre-stored in the hardware key list.

 In a second possible implementation manner, in combination with the second aspect or the first possible implementation manner, the authorization result further includes a resource usage policy;

 The secure communication module is specifically configured to obtain, according to the resource usage policy, a pre-stored resource or a resource of the server indicated by the access instruction.

 In a third possible implementation, the security communication module is further configured to receive user input after a preset period, in combination with the second aspect or the first possible implementation manner or the second possible implementation manner. The access instruction does not acquire the resource of the server indicated by the access instruction.

In a fourth possible implementation manner, combining the second aspect or the first possible implementation manner to the third possible implementation manner, the authorization result further includes a user authority information. The user rights information indicates whether the user is allowed to upload or download resources. In a fifth possible implementation manner, in combination with the second aspect or the first possible implementation manner to the fourth possible implementation manner, the authorization result further includes resource security access level information, and the resource security access level information Indicates the level of resources that the user is allowed to download.

 In a third aspect, the embodiment of the present invention further provides a resource security accessor, where the resource security accessor includes:

 a secure browser for obtaining authentication information and a browser software summary of the user, and displaying the accessible resource list, so that the user inputs an access instruction according to the accessible resource list, and acquiring the access a pre-stored resource or server resource indicated by the instruction;

 a security gateway, configured to: if the authentication information matches the corresponding user information pre-stored in the user trust list, the browser software summary matches the corresponding browser software summary information pre-stored in the browser trust list, Generating an authorization result of the user, the authorization result including a list of accessible resources.

 In a first possible implementation manner, according to the third aspect,

 The secure browser is further configured to obtain a hardware key identifier;

 The security gateway is further configured to generate an authorization result of the user if the hardware key identifier matches the corresponding hardware key information pre-stored in the hardware key list.

 In a second possible implementation manner, in combination with the third aspect or the first possible implementation manner, the authorization result further includes a resource usage policy;

 The secure browser is specifically configured to acquire, according to the resource usage policy, a pre-stored resource or a resource of the server indicated by the access instruction.

The method and device for securely accessing resources provided by the embodiment of the present invention obtains the user's identity verification information and the browser software summary, and if the identity verification information matches the corresponding user information pre-stored in the user trust list, the browser software abstract and The corresponding browser software summary information pre-stored in the browser trust list matches, and the user's authorization result is generated, wherein the authorization result includes a list of accessible resources, and displays a list of accessible resources, so that the user is accessible according to the Enter the access command in the resource list, And obtaining a pre-stored resource or a resource of the server indicated by the access instruction. With this solution, since the user's authentication information, the browser software digest, and the hardware key identifier are authenticated, only the authenticated user can access the server, thereby enabling the user to securely access the server's resources and implement the server resources. protection of. DRAWINGS

 In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

 1 is a schematic flowchart 1 of a resource security access method according to an embodiment of the present invention; FIG. 2 is a schematic flowchart 2 of a resource security access method according to an embodiment of the present invention; FIG. 3 is a schematic structural diagram of a resource security access device according to an embodiment of the present invention; 4 is a schematic structural diagram of a resource security access device according to an embodiment of the present invention; FIG. 5 is a schematic structural diagram 3 of a resource security access device according to an embodiment of the present invention; FIG. 6 is a schematic structural diagram of a resource security accessor according to an embodiment of the present invention; .

detailed description

 The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

 The embodiment of the invention provides a resource security access method. As shown in FIG. 1, the method includes:

 S101. The resource security access device obtains the user's authentication information and the browser software summary.

In the modern enterprise office mode, business access based on browser web pages has gradually become the main form of corporate office. The method for secure access of resources according to the embodiment of the present invention, when the resource security access device is activated by the user, the resource security access device first Reading the built-in user's authentication page, the user needs to input the authentication information through the user's authentication page, insert the hardware key as needed, and if the hard key is inserted, the resource security access device automatically extracts the hardware key identifier. The hardware key of the embodiment of the present invention may be a reliable high-speed small-sized storage device with a password verification function directly connected to a computer through a USB (Universal Serial BUS).

 It should be noted that, according to different policies, the authentication information may be an account name or a password set by the user, or may be a personal information such as a user's name, a work number, an ID number, or a digital certificate, a dynamic password, or the like. Information, where digital certificate refers to a series of data in the Internet communication that identifies the identity information of the parties to the communication, and provides a way to verify the identity of the user on the Internet, which is similar to the driver's license or the ID card in daily life. Dynamic passwords are random number combinations that are generated according to a special algorithm. The main forms are mobile phone text messages, hardware tokens, mobile phone tokens, and dynamic passwords.

 When the resource security access device is activated by the user, the resource security access device also reads the browser software summary used by the user, and the browser software summary is the identifier of the browser, which may be a string, through the string, the resource. The secure access device can determine whether it is overwritten by an external illegal operation to create an unsafe hidden danger.

 S102. If the identity verification information matches the corresponding user information pre-stored in the user trust list, and the browser software summary matches the corresponding browser software summary information pre-stored in the browser trust list, the resource security access device generates the user. The authorization result, the authorization result includes a list of accessible resources.

 After the resource security access device obtains the user's authentication information and the browser software summary, it checks it separately. The resource security access device authenticates the obtained user authentication information and the browser software summary to the authentication module of the resource security access device through a tunnel established by SSL (Secure Sockets Layer) negotiation, wherein, S SL is a secure protocol that provides security and data integrity for network communications, encrypting network connections at the transport layer.

It should be noted that the user's authentication letter obtained by the resource security access device The information and browser software summary is not limited to authentication by the authentication module sent to the resource security access device through the tunnel established by the SSL protocol, or may be tunneled based on a security protocol such as TLS (Transport Layer Security). The authentication module of the resource security access device performs authentication.

 The resource security access device sends the obtained authentication information of the user and the browser software summary to the authentication module of the resource security access device through the tunnel established by the SSL negotiation, and the authentication information is pre-stored in the user trust list. The user information matches, and the browser software summary matches the corresponding browser software summary information pre-stored in the browser trust list, indicating that the user is authenticated, thereby allowing the user to browse resources.

 After the user passes the identity information verification, the resource security access device generates the authorization result of the user, and the authorization result includes a list of accessible resources, so that the user can access the resource through the resource list.

 S103. The resource security access device displays the accessible resource list, so that the user inputs the access instruction according to the accessible resource list.

 After the user passes the identity information verification, the resource security access device generates a user authorization result, and the authorization result includes an accessible resource list and a resource usage policy, and is displayed to the user through the resource security access device, so that the user can input through the resource list. instruction.

 It should be added that the authorization result generated by the resource security access device includes a list of accessible resources, wherein the resource list is displayed to the user in the form of a resource bookmark page, and the resource bookmark is based on a resource page built in the resource security access device. The template is constructed not only by web resources, but also by applications, desktops, virtual machines, etc., so that users can find their own resources clearly and conveniently, and then input access commands.

 S104. The resource security access device acquires a resource of a pre-stored resource or server indicated by the access instruction.

The resource security access device receives the access instruction input by the user, and acquires a pre-stored resource or a resource of the server indicated by the access instruction. It should be added that the pre-stored resources indicated by the access instruction or the resources of the server respectively represent different resource types, and the resource security access device divides the resources into offline resources and resources that the user needs to access online. The pre-stored resource refers to a resource that the user can access offline. The resource of the server refers to a resource that the user needs to access online. The offline resource is a resource that is stored in the resource security access device and is obtained from the server in advance by the resource security access device.

 If the resource of the server indicated by the access instruction is obtained, that is, the resource that the user needs to access online, the server transmits the data according to the encrypted tunnel of the security protocol, and the resource is collectively displayed to the user.

 A method for securely accessing resources according to an embodiment of the present invention obtains user identity verification information and browser software summary, and if the identity verification information matches the corresponding user information pre-stored in the user trust list, the browser software abstract Corresponding to the corresponding browser software summary information pre-stored in the browser trust list, the authorization result of the user is generated, wherein the authorization result includes a list of accessible resources, and displays a list of accessible resources, so that the user is accessible according to the The resource list enters an access instruction and obtains a pre-stored resource or server resource indicated by the access instruction. With this solution, since the user's authentication information, the browser software digest, and the hardware key identifier are authenticated, only the authenticated user can access the server, thereby enabling the user to securely access the server's resources and implement the server resources. protection of.

 The embodiment of the invention provides a resource security access method. As shown in FIG. 2, the method includes:

 The S20 resource security access device obtains the user's authentication information, browser software summary, and hardware key identifier.

In the modern enterprise office mode, business access based on browser web pages has gradually become the main form of corporate office, which can improve the work efficiency of enterprise employees and make full use of the convenience of the Internet. In the method for secure access of resources provided by the embodiment of the present invention, when the resource security access device is activated by the user, the resource security access device first reads the identity verification page of the built-in user, and the user needs to input the identity through the identity verification page of the user. Verify the information, then insert the hardware key, the resource security access device automatically extracts The hardware key identifier, wherein the hardware key of the embodiment of the present invention may be a small-sized storage device with a password verification function and a reliable high-speed connection directly connected to the computer through the USB.

 It should be noted that, according to different policies, the authentication information may be an account name or a password set by the user, or may be a personal information such as a user's name, a work number, an ID number, or a digital certificate, a dynamic password, or the like. Information, where digital certificate refers to a series of data in the Internet communication that identifies the identity information of the parties to the communication, and provides a way to verify the identity of the user on the Internet, which is similar to the driver's license or the ID card in daily life. Dynamic passwords are random number combinations that are generated according to a special algorithm. The main forms are mobile phone text messages, hardware tokens, mobile phone tokens, and dynamic passwords.

 When the resource security access device is activated by the user, the resource security access device also reads the browser software summary used by the user, and the browser software summary is the identifier of the browser, which may be a string, through the string, the resource. The secure access device can determine whether it is overwritten by an external illegal operation to create an unsafe hidden danger.

 S202. If the authentication information matches the corresponding user information pre-stored in the user trust list, and the browser software summary matches the corresponding browser software summary information pre-stored in the browser trust list, and the hardware key identifier and pre-stored When the corresponding hardware key information in the hardware key list matches, the resource security access device generates an authorization result of the user, and the authorization result includes an accessible resource list and a resource usage policy.

 After the resource security access device obtains the user's authentication information, the browser software summary, and the hardware key identifier, it is verified separately. The resource security access device authenticates the obtained user's authentication information, the browser software digest, and the hardware key identifier through an authentication module established by the SSL negotiation to the resource security access device, where the S SL is for network communication. A security protocol that provides security and data integrity, encrypting network connections at the transport layer.

It should be noted that the authentication information, the browser software digest, and the hardware key identifier of the user acquired by the resource security access device are not limited to being authenticated by the authentication module sent to the resource security access device through the tunnel established by the S SL protocol. , also may The authentication module that sends the tunnel to the resource security access device is established by using a security protocol such as TLS to perform authentication.

 The resource security access device sends the obtained user's authentication information, the browser software digest, and the hardware key identifier to the authentication module of the resource security access device through the tunnel established by the S SL negotiation, and the authentication information is pre-stored. The corresponding user information in the user trust list matches, and the browser software summary matches the corresponding browser software summary information pre-stored in the browser trust list, and the hardware key identifier and the corresponding hardware pre-stored in the hardware key list If the key information matches, it indicates that the user is authenticated, thereby allowing the user to browse resources.

 After the user passes the identity information verification, the resource security access device generates the authorization result of the user, and the authorization result includes an accessible resource list and a resource usage policy, so that the user can access the resource through the resource list.

 It should be added that the pre-stored resources indicated by the access instruction or the resources of the server respectively represent different resource types, and the resource security access device divides the resources into offline resources and resources that the user needs to access online. The pre-stored resource refers to a resource that the user can access offline, and the resource of the server refers to a resource that the user needs to access online. The offline resource is a resource that is stored in the resource security access device and is obtained from the server in advance by the resource security access device.

 Exemplarily, the resource security access device divides the security level of all files into 10 levels according to a policy. User A is an employee whose company is still in the internship period, and the user rights information indicates that the user is not allowed to upload and download resources, and user B is a certain The general employee of the company, the user permission information indicates that the user is allowed to upload and download resources, and the resource security access level information is level 3, that is, the level of the resource that the user is allowed to download is 3, indicating that the user can download the resource level to level 1, Level 2 and Level 3, User C is the administrator of a company. The user rights information indicates that the user is allowed to upload and download resources. The resource security access level information is level 10, that is, the level of the resource that the user is allowed to download is 10, indicating that All resources that users can download.

S203. The resource security access device displays the accessible resource list, so that the user inputs the access instruction according to the accessible resource list. After the user passes the identity information verification, the resource security access device generates a user authorization result, and the authorization result includes an accessible resource list and a resource usage policy, and is displayed to the user through the resource security access device, so that the user can input through the resource list. instruction.

 It should be added that the authorization result generated by the resource security access device includes the accessible resource list and the resource usage policy, wherein the resource list is displayed to the user in the form of a resource bookmark page, and the resource bookmark is based on the resource security access device. Built-in resource page templates are constructed. The bookmarks not only include web resources, but also applications, desktops, virtual machines and other resources, so that users can find their own resources clearly and conveniently, and then input access commands.

 S204. The resource security access device acquires a pre-stored resource or a resource of the server indicated by the access instruction according to the resource usage policy.

 The resource security access device receives the access instruction input by the user, and acquires the pre-stored resource or the resource of the server indicated by the access instruction according to the resource usage policy.

 It should be added that the pre-stored resources indicated by the access instruction or the resources of the server respectively refer to different resource types, and the resource security access device divides the resources into resources that can be accessed offline and resources that need to be accessed by users online. The pre-stored resource refers to the resource that the user can access offline. The resource of the server refers to the resource that the user needs to access online. The resource that the user can access offline is pre-made in the browser before the user uses the browser.

 If the resource of the server indicated by the access instruction is obtained, that is, the resource that the user needs to access online, the server transmits the data according to the encrypted tunnel of the security protocol, and the resource is displayed to the user according to the resource usage policy.

 S205. The resource security access device stores the resource acquired from the server.

 S206. The resource security access device encrypts the resources of the obtained server. Next, in conjunction with steps S205 and S206, the steps of how the resource security access device obtains resources from the server and encrypts the resources are described.

The pre-stored resources indicated by the access instruction or the resources of the server respectively refer to different resource types, and the resource security access device divides the resources into offline-accessible resources. Source and resources that require user access online. Pre-stored resources refer to resources that users can access offline. Server resources refer to resources that users need to access online.

 When the user accesses the offline, the offline resource is stored in the browser before the user uses the browser, and the offline resource is encrypted by the resource security access device to prevent the data from being viewed by the illegal software outside.

 When the user accesses the network, the server transmits the data based on the encrypted tunnel of the security protocol. After the data cache is encrypted, an encryption token and a temporary index key are attached to the HTTP (Hypertext Transport Protocol) response header, and the response information is passed. After the resource security access device parses, according to the encryption mark and the temporary key index, the security gateway of the resource security access device is requested to obtain a one-time session key, and the encrypted document is decrypted by the key and displayed to the user.

 It should be added that the resource security access device stores the resources acquired from the server in addition to the cache and offline resources, and also includes the user's behavior policy, wherein the user's behavior policy refers to recording the user access behavior, the downloaded file, and the opened file. Documents, etc.

 5207. If an access instruction input by the user is received after the preset period, the resource security access device does not acquire the resource of the server indicated by the access instruction.

 If the access instruction input by the user is received after the preset period, the access time of the user is timed out, and the resource security access device automatically terminates the access operation of the user, and does not obtain the resources of the server indicated by the access instruction.

 5208. If receiving the logout or exit instruction input by the user, the resource security access device deletes the stored resource acquired from the server and deletes the resource downloaded by the user.

 If the log-out or exit command is received by the user, the resource security access device triggers the log-out behavior, and the resource security access device deletes the stored resources acquired from the server and deletes the resources downloaded by the user, thereby ensuring data security.

A method for securely accessing resources according to an embodiment of the present invention obtains user identity verification information, browser software summary, and hardware key identifier, and if the identity verification information matches the corresponding user information pre-stored in the user trust list. The browser software summary matches the corresponding browser software summary information pre-stored in the browser trust list, and the hardware key identifier is associated with the corresponding hardware key information pre-stored in the hardware key list. If the matching is performed, the authorization result of the user is generated, where the authorization result includes an accessible resource list, a resource usage policy, and a list of accessible resources, so that the user inputs the access instruction according to the accessible resource list, and according to the resource usage policy. Obtain the pre-stored resource or resource of the server indicated by the access instruction. With this solution, since the user's authentication information, the browser software digest, and the hardware key identifier are authenticated, only the authenticated user can access the server, thereby enabling the user to securely access the server's resources and implement the server resources. protection of.

 The embodiment of the present invention provides a resource security access device 1 . The functional unit of the resource security access device 1 can be used in the foregoing method steps. As shown in FIG. 3 , the method includes:

 The local service module 10 is configured to obtain the user's authentication information and the browser software summary, and display the accessible resource list, so that the user inputs the access instruction according to the accessible resource list.

 Further, the local service module 10 is further configured to obtain a hardware key identifier.

 In the modern enterprise office mode, business access based on browser web pages has gradually become the main form of enterprise office, which can improve the work efficiency of enterprise employees and make full use of the convenience of the Internet. When the resource security access device 1 is started by the user, the local service module 10 reads the identity verification page of the built-in user, and the user needs to input through the user's identity verification page. The authentication information is then inserted into the hardware key according to the user's requirement. If the hard key is inserted, the resource security access device 1 automatically extracts the hardware key identifier. The hardware key of the embodiment of the present invention may be directly through the USB. A reliable, high-speed, small-sized storage device with password authentication that is connected to a computer.

It should be noted that, according to different policies, the authentication information may be an account name or a password set by the user, or may be a personal information such as a user's name, a work number, an ID number, or a digital certificate, a dynamic password, or the like. Information, where digital certificate refers to a series of data in the Internet communication that identifies the identity information of the parties to the communication, and provides a way to verify the identity of the user on the Internet, which is similar to the driver's license or the ID card in daily life. Dynamic passwords are randomly generated according to specialized algorithms. The digital combination mainly produces mobile phone text messages, hardware tokens, mobile phone tokens, and dynamic passwords.

 When the resource security access device 1 is started by the user, the local service module 10 also reads the browser software summary used by the user, and the browser software summary is the identifier of the browser, which may be a string, through the string. The resource security access device 1 can determine whether it is overwritten by an external illegal operation to generate an unsafe hidden danger.

 After the user passes the identity information verification, the resource security access device 1 generates a user authorization result, and the authorization result includes a list of accessible resources, and is displayed to the user through the resource security access device 1 to enable the user to input the access command through the resource list.

 Further, the resource security access device 1 generates a user authorization result including an accessible resource list and a resource usage policy, wherein the resource list is displayed to the user in the form of a resource bookmark page, and the resource bookmark is according to the resource security access device 1 Built-in resource page templates are constructed. The bookmarks not only include web resources, but also applications, desktops, virtual machines and other resources, so that users can find their own resources clearly and conveniently, and then input access commands.

 The authentication module 1 1 is configured to: if the authentication information matches the corresponding user information pre-stored in the user trust list, and the browser software summary matches the corresponding browser software summary information pre-stored in the browser trust list, the user is generated. The authorization result, the authorization result includes a list of accessible resources.

 Further, the authentication module 1 1 is further configured to generate an authorization result of the user if the hardware key identifier matches the corresponding hardware key information pre-stored in the hardware key list.

 Further, the authorization result further includes a resource usage policy.

After the resource security access device 1 obtains the user's authentication information, the browser software digest, and the hardware key identifier, it is verified separately. The resource security access device 1 authenticates the obtained user's authentication information, the browser software digest, and the hardware key identifier to the authentication module 1 1 of the resource security access device 1 through the tunnel established based on the S SL negotiation, where, S SL is a security protocol that provides security and data integrity for network communications, encrypting network connections at the transport layer. It should be noted that the authentication information, the browser software digest, and the hardware key identifier of the user acquired by the resource security access device 1 are not limited to the authentication module sent to the resource security access device 1 through the tunnel established based on the S SL protocol. 1 1 For authentication, the tunnel may be sent to the authentication module 11 of the resource security access device 1 for authentication based on a security protocol such as TLS.

 The resource security access device 1 sends the obtained user's authentication information, the browser software digest, and the hardware key identifier to the authentication module 1 1 of the resource security access device 1 through the tunnel established based on the SSL negotiation for authentication, if the identity verification information Matches the corresponding user information pre-stored in the user trust list, and the browser software summary matches the corresponding browser software summary information pre-stored in the browser trust list, and the hardware key identifier is pre-stored in the hardware key list. If the corresponding hardware key information matches, the user has passed the authentication, so that the resource can continue to be browsed.

 After the user passes the identity information verification, the resource security access device 1 generates a user authorization result, and the authorization result includes an accessible resource list and a resource usage policy, so that the user can access the resource through the resource list.

 It should be added that after the user passes the identity information verification, the resource security access device 1 generates the authorization result of the user, and the authorization result includes the accessible resource list and the resource usage policy, so that the user can access the resource through the resource list, and includes User rights information and resource security access level information, wherein the user rights information indicates whether the user is allowed to upload or download resources, and the resource security access level information indicates the level of resources that the user is allowed to download.

Exemplarily, the resource security access device 1 divides the security level of all files into 10 levels according to a policy. User A is an employee whose company is still in the internship period, and the user rights information indicates that the user is not allowed to upload and download resources, and user B is A common employee of a company, the user rights information indicates that the user is allowed to upload and download resources, and the resource security access level information is level 3, that is, the level of the resource that the user is allowed to download is 3, indicating that the user can download the resource level to level 1. Level 2 and Level 3, User C is the administrator of a company. The user rights information indicates that the user is allowed to upload and download resources. The resource security access level information is level 10, that is, the level of resources that the user is allowed to download is 10, All resources that the user can download.

 The secure communication module 12 is configured to obtain a pre-stored resource or a resource of the server indicated by the access instruction according to the resource usage policy.

 Further, the secure communication module 12 is specifically configured to acquire, according to the resource usage policy, a pre-stored resource or a resource of the server indicated by the access instruction.

 The resource security access device 1 receives the access command input by the user, and acquires a pre-stored resource or a resource of the server indicated by the access command according to the resource usage policy.

 It should be added that the pre-stored resources indicated by the access instruction or the resources of the server respectively refer to different resource types, and the resource security access device 1 divides the resources into resources that can be accessed offline and resources that need to be accessed by users online. Pre-stored resources refer to resources that users can access offline. Server resources refer to resources that users need to access online. Resources that users can access offline are pre-made in the browser before users use the browser.

 If the resource of the server indicated by the access instruction is obtained, that is, the resource that the user needs to access online, the server transmits the data according to the encrypted tunnel of the security protocol, and the resource is displayed to the user according to the resource usage policy.

 Further, the secure communication module 12 is further configured to not acquire the resource of the server indicated by the access instruction if the access instruction input by the user is received after the preset period.

 If the access instruction input by the user is received after the preset period, the access time of the user is timed out, and the resource security access device 1 automatically terminates the access operation of the user, and does not acquire the resource of the server indicated by the access instruction.

 Further, as shown in FIG. 4, the resource security access device 1 further includes: a storage module 13 that stores resources acquired from the server.

 Further, as shown in FIG. 5, the resource security access device 1 further includes: an encryption module 14 configured to encrypt the resources of the obtained server.

The pre-stored resources indicated by the access instruction or the resources of the server respectively refer to different resource types, and the resource security access device 1 divides the resources into resources that can be accessed offline and resources that need to be accessed by the user online. Pre-stored resources refer to resources that users can access offline. Server resources refer to resources that users need to access online. When the user accesses the offline, the offline resource is stored in the browser before the user uses the browser, and the offline resource is encrypted by the resource security access device 1 to prevent the data from being viewed by the illegal software outside.

 When the user accesses the network, the server transmits the data based on the encrypted tunnel of the security protocol. After the data cache is encrypted, the encryption token and the temporary index key are attached to the HTTP response header. After the response information is parsed by the resource security access device 1, the encryption is performed according to the encryption. The tag and the temporary key index request the security gateway of the resource security access device 1 to acquire the one-time session key, and the encrypted document is decrypted by the key and presented to the user.

 It should be added that the resource security access device 1 stores the resources acquired from the server in addition to the cache and offline resources, and also includes the user's behavior policy, wherein the user's behavior policy refers to recording user access behavior, downloaded files, and playing. Documents and so on.

 Further, the storage module 13 is further configured to delete the stored resource acquired from the server and delete the resource downloaded by the user if receiving the logout or exit instruction input by the user.

 If the log-out or exit command is received by the user, the resource security access device 1 triggers the log-out behavior, and the resource security access device 1 deletes the stored resources acquired from the server and deletes the resources downloaded by the user, thereby ensuring data security. .

 The device 1 for secure access of resources provided by the embodiment of the present invention obtains the user's identity verification information and the browser software summary, and if the identity verification information matches the corresponding user information pre-stored in the user trust list, the browser software The summary matches the corresponding browser software summary information pre-stored in the browser trust list, and generates a user authorization result, where the authorization result includes a list of accessible resources, and displays a list of accessible resources, so that the user can The accessed resource list enters an access instruction and obtains a pre-stored resource or server resource indicated by the access instruction. With this solution, since the user's authentication information, the browser software digest, and the hardware key identifier are authenticated, only the authenticated user can access the server, thereby enabling the user to securely access the server's resources and implement the server resources. protection of.

The embodiment of the present invention provides a resource security accessor 2, which corresponds to the foregoing solution embodiment, and each functional unit of the resource security accessor 2 can be used in the foregoing method steps. As shown in Figure 6, it includes:

 The secure browser 20 is configured to obtain the user's authentication information and the browser software summary, and display the accessible resource list, so that the user inputs the access instruction according to the accessible resource list, and obtains the pre-stored indication indicated by the access instruction. Resource or server resource.

 Further, the secure browser is further configured to obtain a hardware key identifier.

 In the modern enterprise office mode, business access based on browser web pages has gradually become the main form of enterprise office, which can improve the work efficiency of enterprise employees and make full use of the convenience of the Internet. The method for secure access of resources according to the embodiment of the present invention, when the resource security accessor 2 is started by the user, first reads the identity verification page of the user built in the resource security accessor 2, the user needs to input the authentication information, and then inserts the hardware. The key, the resource security accessor 2 automatically extracts the hardware key identifier, wherein the hardware key refers to a reliable high-speed small storage device with a password verification function directly connected to the computer through the USB.

 It should be noted that, according to different policies, the authentication information may be an account name or a password set by the user, or may be a personal information such as a user's name, a work number, an ID number, or a digital certificate, a dynamic password, or the like. Information, where digital certificate refers to a series of data in the Internet communication that identifies the identity information of the parties to the communication, and provides a way to verify the identity of the user on the Internet, which is similar to the driver's license or the ID card in daily life. Dynamic passwords are random number combinations that are generated according to a special algorithm. The main forms are mobile phone text messages, hardware tokens, mobile phone tokens, and dynamic passwords.

 When the resource security accessor 2 is started by the user, the resource security accessor 2 also reads the browser software summary, and we can treat the browser software summary as a string unique to the browser itself, through the string of characters. String, we can know whether the resource security accessor 2 is overwritten by external illegal operation and creates an insecure risk.

After the user passes the identity information verification, the resource security accessor 2 generates the authorization result of the user, and the authorization result includes the accessible resource list and the resource usage policy, and is displayed to the user through the resource security accessor 2, so that the user can pass the resource list. Input visit Ask for instructions.

 It should be added that the resource security accessor 2 generates the user's authorization result including the accessible resource list and the resource usage policy, wherein the resource list is presented to the user in the form of a resource bookmark page, and the resource bookmark is based on the resource security access. The built-in resource page template of the device 2 not only includes the webpage resources, but also includes resources such as an application, a desktop, a virtual machine, etc., so that the user can find the resources required by the user clearly and conveniently, and then input the access instruction.

 The resource security accessor 2 receives the access instruction input by the user, and acquires the pre-stored resource or the resource of the server indicated by the access instruction according to the resource usage policy.

 It should be added that the pre-stored resources indicated by the access instruction or the resources of the server respectively refer to different resource types, and the resource security accessor 2 divides the resources into resources that can be accessed offline and resources that need to be accessed by users online. The pre-stored resource refers to the resource that the user can access offline. The resource of the server refers to the resource that the user needs to access online. The resource that the user can access offline is pre-made in the browser before the user uses the browser.

 If the resource of the server indicated by the access instruction is obtained, that is, the resource that the user needs to access online, the server transmits the data according to the encrypted tunnel of the security protocol, and the resource is displayed to the user according to the resource usage policy.

 The security gateway 21 is configured to: if the authentication information matches the corresponding user information pre-stored in the user trust list, and the browser software summary matches the corresponding browser software summary information pre-stored in the browser trust list, the generated user Authorization results, authorization results include a list of accessible resources.

 Further, the security gateway is further configured to generate an authorization result of the user if the hardware key identifier matches the corresponding hardware key information pre-stored in the hardware key list.

 Further, the authorization result further includes a resource usage policy;

 The secure browser is specifically configured to acquire, according to the resource usage policy, a pre-stored resource or a resource of the server indicated by the access instruction.

Resource Security Accessor 2 obtains the user's authentication information, browser software abstract After the hardware key is identified, it is verified separately. The resource security accessor 2 authenticates the obtained user's authentication information, the browser software digest, and the hardware key identifier to the authentication module of the resource security accessor 2 through a tunnel established based on the S SL negotiation, where S SL is A security protocol that provides security and data integrity for network communications, encrypting network connections at the transport layer.

 It should be noted that the authentication information, the browser software digest, and the hardware key identifier of the user acquired by the resource security accessor 2 are not limited to the authentication module sent to the resource security accessor 2 through the tunnel established based on the S SL protocol. For authentication, a tunnel may be sent to the authentication module of the resource security accessor 2 for authentication based on a security protocol such as TLS.

 The resource security accessor 2 sends the obtained user's authentication information, the browser software digest, and the hardware key identifier to the authentication module of the resource security accessor 2 through the tunnel established based on the S SL negotiation for authentication, if the authentication information and the authentication information are The corresponding user information pre-stored in the user trust list matches, and the browser software summary matches the corresponding browser software summary information pre-stored in the browser trust list, and the hardware key identifier is corresponding to the pre-stored in the hardware key list. If the hardware key information matches, the user has passed the authentication, so that the resource can continue to be browsed.

 After the user passes the identity information verification, the resource security accessor 2 generates the authorization result of the user, and the authorization result includes the accessible resource list and the resource usage policy, so that the user can access the resource through the resource list.

 It should be added that after the user passes the identity information verification, the resource security accessor 2 generates the authorization result of the user, and the authorization result includes the accessible resource list and the resource usage policy, so that the user can access the resource through the resource list, and includes User rights information and resource security access level information, wherein the user rights information indicates whether the user is allowed to upload or download resources, and the resource security access level information indicates the level of resources that the user is allowed to download.

Exemplarily, the resource security accessor 2 divides the security level of all files into 10 levels according to the policy. User A is an employee whose company is still in the internship period, and the user rights information indicates that the user is not allowed to upload and download resources, and user B is Ordinary employee of a company, The user right information indicates that the user is allowed to upload and download resources. The resource security access level information is level 3, that is, the level of the resource that is allowed to be downloaded by the user is 3, indicating that the user can download the resource level as level 1, level 2, and level 3. User C is the administrator of a company. The user rights information indicates that the user is allowed to upload and download resources. The resource security access level information is level 10, that is, the level of the resource that the user is allowed to download is 10, indicating that the user can download all resource of.

 Further, the security gateway 21 is further configured to not acquire the resource of the server indicated by the access instruction if the access instruction input by the user is received after the preset period.

 If the access instruction input by the user is received after the preset period, the access time of the user is timed out, and the resource security accessor 2 automatically terminates the access operation of the user, and does not obtain the resource of the server indicated by the access instruction.

 Further, the secure browser 20 is further configured to store resources acquired from the server. Further, the security gateway 21 is further configured to encrypt the resources of the obtained server.

 The pre-stored resources indicated by the access instruction or the resources of the server refer to different resource types, respectively, and the resource security accessor 2 divides the resources into resources that can be accessed offline and resources that need to be accessed online by the user. Pre-stored resources refer to resources that users can access offline. Server resources refer to resources that users need to access online.

 When the user accesses the offline, the offline resource is stored in the browser before the user uses the browser, and the offline resource is encrypted by the resource security accessor 2 to prevent the data from being viewed by the illegal software outside.

 When the user accesses the network, the server transmits the data based on the encrypted tunnel of the security protocol. After the data cache is encrypted, the encryption token and the temporary index key are attached to the HTTP response header, and the response information is parsed by the resource security accessor 2, according to the encryption. The tag and the temporary key index request the security gateway 21 of the resource security accessor 2 to acquire the one-time session key, and the encrypted document is decrypted by the key and displayed to the user.

It should be added that the resource security accessor 2 stores the resources acquired from the server in addition to the cache and offline resources, and also includes the user's behavior policy, wherein the user's behavior policy refers to recording user access behavior, downloaded files, and playing Documents and so on. Further, the resource security accessor 2 is further configured to delete the stored resource acquired by the server and delete the resource downloaded by the user if receiving the logout or exit instruction input by the user.

 If the logout or exit command input by the user is received, the resource security accessor 2 triggers the logout tunneling behavior, and the resource security accessor 2 deletes the stored resources acquired from the server and deletes the resources downloaded by the user, thereby ensuring data security. .

 The device for securely accessing resources according to the embodiment of the present invention obtains the user's identity verification information and the browser software summary, and if the identity verification information matches the corresponding user information pre-stored in the user trust list, the browser software abstract Corresponding to the corresponding browser software summary information pre-stored in the browser trust list, the authorization result of the user is generated, wherein the authorization result includes a list of accessible resources, and displays a list of accessible resources, so that the user is accessible according to the The resource list enters an access instruction and obtains a pre-stored resource or server resource indicated by the access instruction. With this solution, since the user's authentication information, the browser software digest, and the hardware key identifier are authenticated, only the authenticated user can access the server, thereby enabling the user to securely access the server's resources and implement the server resources. protection of.

 It should be noted that, in the embodiment of the present invention, since the user authentication information, the browser software digest, and the hardware key identifier are authenticated, only the authenticated user can access the server, thereby enabling the user to securely access the server. Resources, to protect server resources. However, in addition to being applied to a PC (Personal Computer), the resource security access device can be set in other user devices, for example, a tablet computer, etc., and also enables users to securely access server resources and implement server resources. protection of.

 A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing steps include the steps of the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention It is not limited thereto, and any one skilled in the art can easily conceive changes or substitutions within the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the appended claims.

Claims

claims 1. A resource security access method, characterized by including: Obtain the user's authentication information and browser software summary; If the identity verification information matches the corresponding user information pre-stored in the user trust list, and the browser software summary matches the corresponding browser software summary information pre-stored in the browser trust list, then the user's identity verification information is generated. Authorization result, the authorization result includes a list of accessible resources; Display the accessible resource list so that the user can input access instructions according to the accessible resource list; Obtain the pre-stored resource or server resource indicated by the access instruction. 2. The resource security access method according to claim 1, further comprising: Get the hardware key ID; If the hardware key identifier matches the corresponding hardware key information pre-stored in the hardware key list, an authorization result for the user is generated. 3. The resource security access method according to claim 1 or 2, characterized in that the authorization result also includes a resource usage policy; Wherein, the obtaining the pre-stored resources or server resources indicated by the access instruction includes: Obtain the pre-stored resources or server resources indicated by the access instruction according to the resource usage policy. 4. The resource security access method according to any one of claims 1 to 3, characterized in that, if the access instruction input by the user is received after a preset period, the access instruction indicated by the access instruction is not obtained. Server resources. 5. The resource security access method according to any one of claims 1 to 4, characterized in that the authorization result also includes user permission information, and the user permission information indicates whether the user is allowed to upload or download resources. 6. The resource security access method according to any one of claims 1 to 5, characterized in that the authorization result also includes resource security access level information, and the resource security access level information is The full access level information indicates the level of resources that the user is allowed to download. 7. A resource security access device, characterized by including: A local service module, used to obtain the user's identity verification information and browser software summary, and display the accessible resource list, so that the user can input access instructions according to the accessible resource list; Authentication module, configured to if the identity verification information matches the corresponding user information pre-stored in the user trust list, and the browser software summary matches the corresponding browser software summary information pre-stored in the browser trust list, then Generate an authorization result for the user, where the authorization result includes an accessible resource list; The secure communication module is used to obtain the pre-stored resources or server resources indicated by the access instruction. 8. The resource security access device according to claim 7, characterized in that the local service module is also used to obtain a hardware key identification; The authentication module is also configured to generate an authorization result for the user if the hardware key identifier matches the corresponding hardware key information pre-stored in the hardware key list. 9. The resource security access device according to claim 7 or 8, characterized in that the authorization result also includes a resource usage policy; Wherein, the secure communication module is specifically configured to obtain the pre-stored resources or server resources indicated by the access instruction according to the resource usage policy. 10. The resource security access device according to any one of claims 7-9, characterized in that, The secure communication module is also configured to not obtain the resources of the server indicated by the access instruction if the access instruction input by the user is received after a preset period. 1 1. The device for secure access to resources according to any one of claims 7 to 10, characterized in that the authorization result also includes user permission information, and the user permission information indicates whether the user is allowed to upload or download. resource. 12. The resource security access device according to any one of claims 7-11, characterized in that the authorization result also includes resource security access level information, and the resource security access level information indicates that the user is allowed to download The level of the resource. 13. A resource security accessor, characterized by including: A secure browser, used to obtain the user's identity verification information and browser software summary, and display the accessible resource list, so that the user can input access instructions according to the accessible resource list, and obtain the access Pre-stored resources or server resources indicated by instructions; Security gateway, configured to: if the identity verification information matches the corresponding user information pre-stored in the user trust list, and the browser software summary matches the corresponding browser software summary information pre-stored in the browser trust list, then An authorization result for the user is generated, where the authorization result includes an accessible resource list. 14. The resource security accessor according to claim 13, characterized in that the secure browser is also used to obtain a hardware key identification; The security gateway is also configured to generate an authorization result for the user if the hardware key identifier matches the corresponding hardware key information pre-stored in the hardware key list. 15. The resource security accessor according to claim 13 or 14, wherein the authorization result further includes a resource usage policy; Wherein, the secure browser is specifically configured to obtain the pre-stored resources or server resources indicated by the access instruction according to the resource usage policy.