CN100484024C - System and method for improving differential safety grade application service - Google Patents

Abstract

The present invention provides a method and system for providing application services with different security levels. The method mainly includes: storing the correspondence between various applications and security level information in a server; The stored security level information corresponding to the application requested by the client, negotiates with the client to determine the final security level of the application requested by the client; the server provides the client with the requested application services. The system mainly includes server and client. By using the method and system of the present invention, it is possible to provide different security level services for different applications.

Description

System and method for providing application services with different security levels

technical field

The present invention relates to the communication field, in particular to a system and method for providing application services with different security levels.

Background technique

With the gradual maturity of wireless data networks, various wireless services are also developing rapidly. In addition to traditional voice services, more applications such as multimedia services, data services, e-commerce, and electronic commerce are becoming more and more extensive. For various wireless application services in the wireless data network, communication security is a general problem that every service needs to consider and solve. Therefore, how to ensure the security of business information in wireless applications has become an urgent concern. It is not only related to the vital interests of users, CP (content provider), SP (service provider) and operators, but also directly affects the popularization and use of wireless services.

In the prior art, a method for ensuring the security of service information in wireless applications is: each service implements its own security solution. The security scheme generally includes several aspects such as authentication, authorization, confidentiality, and integrity protection.

The disadvantage of this method is that since each business implements its own security solution, many security functions are repeatedly developed and not effectively reused, resulting in high development costs.

Another method for ensuring the security of service information in wireless applications in the prior art is to use a unified security function framework proposed by the security working group in OMA (Open Mobile Alliance). Using the security function framework, various services can ensure security by reusing the functions of the security framework or using the services of the security framework during development or deployment.

The disadvantage of this method is: the public security function framework provided by OMA provides security services for service engines, and does not take into account that different service engines have different security requirements when serving multiple engines at the same time, and even use the unified service engine Different applications may also have different security requirements. In fact, the security level of the business should be set by specific applications, not uniformly set by the business engine used. Moreover, for different users on the same service, their security levels may also be different.

For example, in practical applications, the various applications provided by the server at the same time often have different security requirements. For example, for general applications, only general integrity and confidentiality services can meet the requirements, while for applications involving Payment, user privacy, or applications that frequently transmit high-value data, and, for different users, the required security level is also different. If the user using the application is a VIP user, there may be a requirement to increase the security level, which requires the server to provide multiple security levels.

For example, for a mobile game service engine, when a game user plays multiple games at the same time through the game server, the security level of game data exchange should be determined by the corresponding game, not by the game platform directly with the client. Unified settings.

Contents of the invention

In view of the above-mentioned problems in the prior art, the purpose of the present invention is to provide a system and method for providing application services with different security levels, so as to provide services with different security levels for different applications.

The purpose of the present invention is achieved through the following technical solutions:

A method of providing application services with different levels of security, comprising:

A. Save the security level information corresponding to the identity of the application in the server;

B. According to the received request message sent by the client that includes the identification of the application to be used, the server queries the stored application identification and corresponding security level information, and obtains the corresponding security level information; the server According to the obtained corresponding security level information, the nature of the browser of the client, the setting of the security level, and the capabilities of the client itself, the final security level of the application requested by the client is determined through negotiation between the control module in the server and the client;

C. The server provides the requested application service to the client according to the final security level.

Described step A specifically comprises:

Various applications send registration information including application identifiers and corresponding security level information to the server, and the server stores the received various application identifiers and corresponding security level information.

Described step A specifically comprises:

The identifiers of various applications and the corresponding security level information are manually configured and saved in the server.

Described step A also includes:

According to the security level information of various applications, the server determines the confidentiality algorithm, integrity algorithm and key length information of various applications, and configures corresponding security parameters for various applications.

Described step B specifically comprises:

When an independent client agent acts as a client, the server receives the application request information sent by the client, queries the correspondence between the stored application and security level information, and obtains the corresponding security level of the application requested by the client information;

The server negotiates with the client to determine that the corresponding security level information is the final security level of the application requested by the client.

Described step B specifically comprises:

When the public browser acts as the client, the server receives the application request information sent by the client, queries the correspondence between the stored application and security level information, and obtains the corresponding security level information of the application requested by the client ;

If the capability of the client can meet the requirements of the corresponding security level, the server negotiates with the client to determine that the corresponding security level is the final security level of the application requested by the client; otherwise, according to the actual situation, determine the corresponding security level as the final security level of the application requested by the client.

Described step B specifically comprises:

When the client is allowed to set the security level by itself, the server receives the application request information sent by the client, queries the correspondence between the stored application and the security level information, and obtains the corresponding security level information of the application requested by the client ;

The server negotiates with the client to select the higher security level of the security level set by the client and the corresponding security level as the final security level of the application requested by the client, or directly selects the security level of the application requested by the client. The security level set by the client is the final security level of the application requested by the client.

A system for providing application services with different security levels, including:

Server: used to save the application identification and corresponding security level information; query the stored application identification and corresponding security level information according to the received request message sent by the client including the identification of the application to be used, Obtain the corresponding security level information; according to the obtained corresponding security level information, the nature of the client's browser, the setting of the security level, and the capabilities of the client itself, the control module in the server negotiates with the client to determine the The final security level of the application; according to the final security level, provide application services to the client;

Client: for sending a request message including the identification of the application to be used to the server, negotiating with the server to determine the final security level of the requested application, and communicating with the server through the corresponding application according to the final security level.

The server includes a security component unit, and the security component unit includes:

Control module: used to receive the registration messages of various applications, transfer the identification information and security level information of various applications to the security configuration library, receive the request message sent by the client, and transfer the application identification information in the request message Give the security configuration library, and negotiate with the client to determine the security level of the application that the client needs to use;

Security configuration library: used to save the identification of various applications and the corresponding security level information, and return the corresponding application security level information to the control module according to the received application identification information.

The control module includes:

Registration module: used to receive registration messages of various applications, receive request messages sent by the client, perform mutual authentication operations with the client or pass the request message to the corresponding application, and the application and the client will perform mutual authentication operations, Pass the application identification information in the request message to the security configuration library;

Security level negotiation module: used for negotiating with the client to determine at least one of the security level information of the application returned by the security configuration library, the nature of the browser of the client, the setting of the security level, and the capability information of the client itself. The final security level of the requested app.

The control module includes:

Security level definition module: used to determine the confidentiality algorithm, integrity algorithm and key length information of various applications according to the security level information of various applications, and configure corresponding security parameters for various applications, the security parameters include encryption algorithms , Digest Algorithm, Key Level, and Whether to Mandatory.

It can be seen from the above-mentioned technical solution provided by the present invention that the present invention saves the identification and security level information of various applications in the security configuration library, so that it can provide unified security services for various applications on the upper layer, and can also Set different security levels for different applications according to the actual situation, and provide services with different security levels. In the present invention there is no need to develop security features for each application individually.

Description of drawings

FIG. 1 is a schematic diagram of a network in which each client interacts with a server respectively;

Fig. 2 is a schematic diagram of a network in which all clients interact with a server through an agent component;

Fig. 3 is a structural diagram of the system of the present invention;

Fig. 4 is a specific processing flow chart of saving the security level information in the security configuration library when the security level information of the application is determined by other devices or modules other than the server;

Fig. 5 is a specific processing flowchart of the method of the present invention.

Detailed ways

The present invention provides a system and method for providing application services with different security levels. The core of the present invention is: saving the identification and security level information of various applications in the security configuration library, and returning the corresponding security level according to the application applied by the user Information, and negotiate with the client to determine the final security level.

The system and method of the present invention must run under the C/S (Client/Server, client and server) architecture. Let's briefly introduce the C/S architecture.

The most basic way to implement the C/S architecture based on the network (including the Internet and wireless network) is to develop applications on the client side and the server side respectively, and deploy them on the terminal side and the server side respectively. In the C/S architecture, the server side provides a unified operation support platform, provides unified management and services for specific applications developed by the upper layer, and provides a unified interface for application calls.

The client of the C/S architecture can have two implementation schemes. One implementation scheme is that each client develops independently and interacts with the corresponding specific application through the server. The network diagram of this implementation scheme is shown in Figure 1; the other One implementation scheme is that all clients share a common proxy component, which is connected to the server through the proxy component, and the proxy component can provide a unified functional interface for all client applications. The network diagram of this implementation scheme is shown in Figure 2 Show.

The server in Figure 1 and Figure 2 can be regarded as a general security service agent, providing security services for various applications or services. In the C/S architecture, the communication between the server and the application is safe, and the communication between the client and the client agent is also safe.

The present invention will be described in detail below in conjunction with the accompanying drawings. The structural diagram of the system of the present invention is shown in FIG. 3 . The system includes server and client.

Server: It is used to save the security level information of various applications, and negotiate with the client to determine the final security level of the application that the client needs to use according to the request message sent by the client and the stored security level information. The server includes a security component unit and other component units. Security component unit includes control module, security configuration library and other modules.

Control module: used to control the security level of the entire security session at the application layer. It is the core scheduling module of the system, responsible for the initial level registration of various applications, the negotiation with the security level of the client, and the scheduling of various other specific algorithm modules. The control module includes a registration module, a security level definition module and a security level negotiation module.

Among them, the registration module: used to receive the initial request message sent by the client, and perform a mutual authentication process with the client, after the mutual authentication is completed, transfer the user identification and application identification information in the initial request message to the security configuration library .

Among them, the security level definition module: used to define and store security level information. The security level of the application is defined according to information such as confidentiality algorithm (encryption algorithm), integrity algorithm (digest algorithm) and key length, and can be searched and used by the security configuration library. Define specific security algorithms for applications when communicating.

Among them, the security level negotiation module: it is used to negotiate with the client according to the security level information of the application returned by the security configuration library, the nature of the client's browser, and the setting of the security level to determine the final security level of the application requested by the user .

Security configuration library: used to store the identities of various applications and the corresponding security level information. The stored information can be entered when the application is registered or directly transmitted by the control module. When the user logs in, the corresponding application security level information is returned to the control module according to the application identification information in the request message sent by the client.

Client: used to send an initial request message to the server including the user ID and the requested application ID when logging in, and perform mutual authentication and security level negotiation operations with the server. Communication is carried out through the server and the corresponding application according to the finally determined security level.

Below we describe the method of the present invention based on the above system.

The method of the present invention first needs to store ID (identification) information and security level information of various applications in the security configuration library. The stored procedure can be realized by manually configuring the security levels of various applications in the server, or by providing security level registration information when the applications are registered to the server. The security level information of the application can be determined by the security level definition module in the control module in the server, or can be determined by other devices or modules outside the server.

The security level definition module in the control module in the server defines the security level of various applications mainly from the following aspects: confidentiality algorithm (encryption algorithm), integrity algorithm (digest algorithm) and key length. The security level definition module can define security parameters for each security level, the security parameters include encryption algorithm, digest algorithm, key level and whether to use it forcibly, etc.

Wherein, the encryption algorithm parameter can specify a specific encryption algorithm (such as DES), the encryption algorithm parameter being NULL means no encryption, and the encryption algorithm parameter being ANY means that any encryption algorithm can be used.

Among them, the digest algorithm parameter can specify a specific algorithm (such as MD5), the encryption algorithm parameter is NULL, which means no encryption is required, and the encryption algorithm parameter is ANY, which means that any encryption algorithm can be used.

Among them, the key level parameter can specify the length of the key of the symmetric encryption algorithm, which is divided into high strength>128bit, medium strength=128bit, and low strength<128bit.

Among them, whether to use the mandatory parameter refers to whether to implement security protection at the application layer under the premise that the security policy has been implemented at the transport layer, and the default is no.

After the server defines the security levels of various applications, it may store the identified identification information and corresponding security level information of various applications in the security configuration library.

When the information stored in the security configuration library is implemented through application registration, its specific processing flow is shown in FIG. 4 . Including the following steps:

Step 41. Each application sends a registration message to the control module in the server. The registration information includes at least the application identification and application security level information, wherein the application security level information is determined by other devices or modules other than the server.

Step 42, the control module in the server transmits the application identification and application security level information in the received registration message to the security configuration library in the server. The security configuration repository stores the received information.

Step 43: After successfully storing the received application identifier and application security level information, the security configuration library returns a registration success message to the application.

Based on the above system, the specific processing flowchart of the method for providing application services with different security levels according to the present invention is shown in Figure 5, including the following steps:

Step 5-1. The client or client proxy sends an initial message to the server, and completes the mutual authentication process with the control module or application.

First, the client or the client agent sends an initial request message to the server, and the initial request message includes at least user id (identification) and application id (identification) information. Then, the control module in the server performs a mutual authentication operation with the client or the client agent; or, the server forwards the initial request message to the corresponding application according to the received application id information, and the corresponding application communicates with the client or the client The end agents perform mutual authentication operations.

Step 5-2, the control module requests the security level of the application required by the user from the security configuration library.

After the mutual authentication operation is completed, the control module in the server sends a request security level message to the security configuration library, and the message includes user id and application id information. The security configuration library queries the stored application identification and application security level information, and then returns the security level information of the application requested by the user to the control module in the server.

Step 5-3: The control module negotiates with the client or the client agent to determine the final security level of the application required by the user.

After the control module receives the application security level information returned by the security configuration library, it needs to negotiate with the client or the client agent to determine the final security level of the application required by the user according to the actual situation.

The process of negotiating the final security level is described as follows:

The general principle of negotiation of the final security level is to execute according to the setting of the server, and the client is in a passive position. Because the service provider or developer has a deep understanding of the service, he can define a suitable security level for the service he opens. The present invention divides following three kinds of situations to deal with the negotiation process of security level respectively:

The first case: for the case where the independent client agent acts as the client. Because the independent client-side agent can be developed together with the server-side security service component, therefore, both the client-side and the server-side security can be supported. When negotiating the security level, the algorithm and level requested by the server are directly used for communication, that is, the security level returned by the security configuration library is directly used for communication.

The second case: the case where the public browser is used as the client. During the authentication process, the client needs to report the security algorithm and level it supports, and the control module of the server will compare the security level supported by the client with the security level set by the server. If the capability of the client can meet the security level requirements of the server, then Directly apply the security level set by the server; if the client's capabilities cannot meet the security level requirements of the server, it will judge whether to continue to execute according to the server's settings, and at the same time send a prompt to the client, and the client can also judge whether to continue to execute. Algorithms approaching application security levels.

The third case: for the case where the client is allowed to set the security level. In this case the client can set the security level in the application or in the client agent. For the security level policy of the client, it can be configured in the server. The configuration items include the following: only the security policy of the server is applied; The application of the terminal security level adopts the client security policy; only the client security policy is applied (big security risks).

At the same time, when the communication between clients is used in the application, the security level can be negotiated between the two clients, and the requested party is treated as a server during the negotiation process.

Step 5-4, the client or the client agent communicates securely with the application through the server.

After the control module negotiates with the client or the client agent to determine the final security level of the application required by the user, the client or the client agent communicates securely with the application through the server according to the determined final security level.

If the security level corresponding to an application needs to be modified, the security level information of the specified application in the security configuration library is modified on the server.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of changes or modifications within the technical scope disclosed in the present invention. Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (11)

1. A method for providing application services with different security levels, comprising: A. Save the application identification and corresponding security level information in the server; B. According to the received request message sent by the client that includes the identification of the application to be used, the server queries the stored application identification and corresponding security level information, and obtains the corresponding security level information; the server According to the obtained corresponding security level information, the nature of the browser of the client, the setting of the security level, and the capabilities of the client itself, the final security level of the application requested by the client is determined through negotiation between the control module in the server and the client; C. The server provides the requested application service to the client according to the final security level. 2. The method for providing application services with different security levels according to claim 1, wherein said step A specifically includes: Various applications send registration information including application identifiers and corresponding security level information to the server, and the server stores the received various application identifiers and corresponding security level information. 3. The method for providing application services with different security levels according to claim 1, wherein said step A specifically includes: The identifiers of various applications and the corresponding security level information are manually configured and saved in the server. 4. The method for providing application services with different security levels according to claim 1, wherein said step A further comprises: According to the security level information of various applications, the server determines the confidentiality algorithm, integrity algorithm and key length information of various applications, and configures corresponding security parameters for various applications. 5. The method for providing application services with different security levels according to any one of claims 1 to 4, wherein the step B specifically includes: When an independent client acts as a client, the server receives the application request information sent by the client, queries the correspondence between the stored application and security level information, and obtains the corresponding security level of the application requested by the client information; The server negotiates with the client to determine that the corresponding security level information is the final security level of the application requested by the client. 6. The method for providing application services with different security levels according to any one of claims 1 to 4, wherein the step B specifically includes: When the public browser acts as the client, the server receives the application request information sent by the client, queries the correspondence between the stored application and security level information, and obtains the corresponding security level information of the application requested by the client ; If the capability of the client can meet the requirements of the corresponding security level, the server negotiates with the client to determine that the corresponding security level is the final security level of the application requested by the client; otherwise, according to the actual situation, determine the corresponding security level as the final security level of the application requested by the client. 7. The method for providing application services with different security levels according to any one of claims 1 to 4, wherein the step B specifically includes: When the client is allowed to set the security level by itself, the server receives the application request information sent by the client, queries the correspondence between the stored application and the security level information, and obtains the corresponding security level information of the application requested by the client ; The server negotiates with the client to select the higher security level of the security level set by the client and the corresponding security level as the final security level of the application requested by the client, or directly selects the security level of the application requested by the client. The security level set by the client is the final security level of the application requested by the client. 8. A system for providing application services with different security levels, characterized by comprising: Server: used to save the application identification and corresponding security level information; query the stored application identification and corresponding security level information according to the received request message sent by the client including the identification of the application to be used, Obtain the corresponding security level information; according to the obtained corresponding security level information, the nature of the client's browser, the setting of the security level, and the capabilities of the client itself, the control module in the server negotiates with the client to determine the The final security level of the application; according to the final security level, provide application services to the client; Client: for sending a request message including the identification of the application to be used to the server, negotiating with the server to determine the final security level of the requested application, and communicating with the server through the corresponding application according to the final security level. 9. The system for providing application services with different security levels according to claim 8, wherein the server includes a security component unit, and the security component unit includes: Control module: used to receive the registration messages of various applications, transfer the identification information and security level information of various applications to the security configuration library, receive the request message sent by the client, and transfer the application identification information in the request message Give the security configuration library, and negotiate with the client to determine the security level of the application that the client needs to use; Security configuration library: used to save the identification of various applications and the corresponding security level information, and return the corresponding application security level information to the control module according to the received application identification information. 10. The system for providing application services with different security levels according to claim 9, wherein the control module includes: Registration module: used to receive registration messages of various applications, receive request messages sent by the client, perform mutual authentication operations with the client or pass the request message to the corresponding application, and the application and the client will perform mutual authentication operations, Pass the application identification information in the request message to the security configuration library; Security level negotiation module: used for negotiating with the client to determine at least one of the security level information of the application returned by the security configuration library, the nature of the browser of the client, the setting of the security level, and the capability information of the client itself. The final security level of the requested app. 11. The system for providing application services with different security levels according to claim 10, wherein the control module includes: Security level definition module: used to determine the confidentiality algorithm, integrity algorithm and key length information of various applications according to the security level information of various applications, and configure corresponding security parameters for various applications, the security parameters include encryption algorithms , Digest Algorithm, Key Level, and Whether to Mandatory.

Images