CN111865998A - Network security zone login method and device - Google Patents

Abstract

The invention discloses a method for logging in to a network security zone, comprising the following steps: S1, storing an access channel construction program for building an access channel for accessing the network security zone in a conversion module; S2, a user entering an identity verification through a client module After the information is encrypted by the encryption module, it is sent to the conversion module for decryption, and the authentication module is used for authentication; S3. If the authentication is incorrect, the access is denied; if the authentication is correct, the access channel construction program is called according to the user's authority. The construction of the corresponding access channel, establishes a connection with the network security zone, and realizes the login access of the network security zone; S4. The user who has passed the authentication sends a task request through the client module, and the task request is encrypted by the encryption module and transmitted to the conversion module for decryption. It is transmitted to the network security zone through the access channel for execution. Through the setting of the conversion module, the present invention enables the user to access the network security zone safely and quickly.

Description

Network security zone login method and device

technical field

The invention relates to the technical field of network security, in particular to a method and device for logging in to a network security zone.

Background technique

In the field of network security technology, a common practice is to set the terminals of a group of users in the same network segment. The same network segment refers to the same network address obtained by comparing the Internet Protocol (IP) address and subnet mask. . One or more network segments can also be set in a network security zone, and the network segments in the network security zone are completely isolated from other network segments. Users in the same network security area are usually assigned the same work content, such as developing the same project. When the project is completed, users in the network security area may be assigned different tasks, and these users need to log in to other network security areas. So, how to easily, quickly and safely log users into other network security areas is very important.

SUMMARY OF THE INVENTION

In order to solve the above problems, the present invention provides a method and device for logging in to a network security zone, which can realize the user's safe and fast login.

To achieve the above object, the technical scheme adopted in the present invention is:

The network security zone login method includes the following steps:

S1. Store an access channel construction program for building an access channel for accessing the network security zone in the conversion module;

S2, the user inputs the identity verification information through the client module, after being encrypted by the encryption module, it is sent to the conversion module for decryption, and the identity verification is carried out through the identity verification module;

S3. If the identity verification in step S2 is incorrect, the access is denied; if the identity verification is correct, the access channel construction program is called to construct the corresponding access channel according to the user authority, and a connection is established with the network security zone to realize the login of the network security zone. access;

S4. The user who has passed the authentication sends a task request through the client module, and the task request is encrypted by the encryption module and then transmitted to the conversion module for decryption, and then transmitted to the network security area through the access channel for execution.

Further, the identity verification information adopts biometric information.

Further, different user rights correspond to different access channel construction programs.

Further, it also includes: the user who has passed the authentication sends a disconnection request through the client module, the disconnection request is encrypted by the encryption module and then transmitted to the conversion module for decryption, and the disconnection of the access channel is realized by the access channel disconnection module.

Further, in the described step S4, the user who has passed the identity verification sends a task request through the client module, and the task request is firstly transmitted to the conversion module for decryption after being encrypted by the encryption module, and then carries out security audit, and the task request after completing the security audit is passed. It is transmitted to the network security zone through the access channel for execution.

Further, a dual-channel connection module is used for communication between the client module and the conversion module, and when any one of the channels communicates, the other standby channel performs key update.

The invention also provides a network security zone login device, comprising a client module, the client module is connected with a conversion module, and the conversion module contains an access channel building module for constructing an access channel for accessing the network security zone, the client module and Each of the conversion modules is provided with an encryption module, the conversion module is also provided with an identity verification module, and an independent dual-channel connection module is provided between the client module and the conversion module.

Further, the conversion module is provided with a security auditing module, which is used to realize the auditing of access task safety based on the nearest neighbor classifier. During the audit, the similarity comparison is performed by the nearest neighbor classifier and the pre-stored dangerous task request, and the obtained results are similar. When the temperature falls within the preset threshold, it is considered dangerous.

Through the setting of the conversion module, the present invention enables the user to access the network security zone safely and quickly.

Description of drawings

FIG. 1 is a flowchart of a method for logging in to a network security zone according to Embodiment 1 of the present invention.

FIG. 2 is a flowchart of a method for logging in to a network security zone according to Embodiment 2 of the present invention.

FIG. 3 is a structural block diagram of an apparatus for logging in to a network security zone according to Embodiment 3 of the present invention.

Detailed ways

The present invention will be described in detail below with reference to specific embodiments. The following examples will help those skilled in the art to further understand the present invention, but do not limit the present invention in any form. It should be noted that, for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

Example 1

As shown in Figure 1, the network security zone login method includes the following steps:

S1. Store an access channel construction program for building an access channel for accessing the network security zone in the conversion module;

S2, the user inputs the identity verification information through the client module, after being encrypted by the encryption module, it is sent to the conversion module for decryption, and the identity verification is carried out through the identity verification module;

S3. If the identity verification in step S2 is incorrect, the access is denied; if the identity verification is correct, the access channel construction program is called to construct the corresponding access channel according to the user authority, and a connection is established with the network security zone to realize the login of the network security zone. access;

S4. The user who has passed the authentication sends a task request through the client module, and the task request is encrypted by the encryption module and then transmitted to the conversion module for decryption, and then transmitted to the network security area through the access channel for execution. Specifically, a user who has passed the authentication sends a task request through the client module. After the task request is encrypted by the encryption module, it is first transmitted to the conversion module for decryption, and then a security audit is performed. If the audit result is not safe, the task request will be rejected, and the rejection will be rejected at the same time. The result is fed back to the client. If the audit result is safe, the task request after completing the security audit will be transmitted to the network security zone through the access channel for execution.

In this embodiment, the identity verification information adopts biometric information, and different user rights correspond to different access channel construction programs. A dual-channel connection module is used for communication between the client module and the conversion module. When any one of the channels communicates, the other standby channel performs key update.

Example 2

As shown in Figure 2, the network security zone login method includes the following steps:

S1. Store an access channel construction program for building an access channel for accessing the network security zone in the conversion module;

S2, the user inputs the identity verification information through the client module, after being encrypted by the encryption module, it is sent to the conversion module for decryption, and the identity verification is carried out through the identity verification module;

S3. If the identity verification in step S2 is incorrect, the access is denied; if the identity verification is correct, the access channel construction program is called to construct the corresponding access channel according to the user authority, and a connection is established with the network security zone to realize the login of the network security zone. access;

S4. The user who has passed the authentication sends a task request through the client module, and the task request is encrypted by the encryption module and then transmitted to the conversion module for decryption, and then transmitted to the network security area through the access channel for execution. Specifically, a user who has passed the authentication sends a task request through the client module. After the task request is encrypted by the encryption module, it is first transmitted to the conversion module for decryption, and then a security audit is performed. If the audit result is not safe, the task request will be rejected, and the rejection will be rejected at the same time. The result is fed back to the client. If the audit result is safe, the task request after completing the security audit will be transmitted to the network security zone through the access channel for execution.

S5. The user who has passed the authentication sends a disconnection request through the client module, the disconnection request is encrypted by the encryption module and then transmitted to the conversion module for decryption, and the access channel disconnection is realized through the access channel disconnection module.

In this embodiment, the identity verification information adopts biometric information, and different user rights correspond to different access channel construction programs. A dual-channel connection module is used for communication between the client module and the conversion module. When any one of the channels communicates, the other standby channel performs key update.

Example 3

As shown in FIG. 3, a network security zone login device according to an embodiment of the present invention includes a client module, the client module is connected with a conversion module, and the conversion module contains an access channel building module for constructing access to the network security zone In the channel, the client module and the conversion module are each provided with an encryption module, the conversion module is also provided with an identity verification module, and an independent dual-channel connection module is provided between the client module and the conversion module. The conversion module is equipped with a security audit module, which is used to realize the audit of access task security based on the nearest neighbor classifier. During the audit, the similarity between the nearest neighbor classifier and the pre-stored dangerous task request is compared, and the obtained similarity falls within When the preset threshold is reached, it is considered dangerous.

The specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the above-mentioned specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essential content of the present invention. The embodiments of the present application and features in the embodiments may be arbitrarily combined with each other without conflict.

Claims (8)

1. a network security zone login method, characterized in that: comprising the following steps: S1. Store an access channel construction program for building an access channel for accessing the network security zone in the conversion module; S2, the user inputs the identity verification information through the client module, after being encrypted by the encryption module, it is sent to the conversion module for decryption, and the identity verification is carried out through the identity verification module; S3. If the identity verification in step S2 is incorrect, the access is denied; if the identity verification is correct, the access channel construction program is called to construct the corresponding access channel according to the user authority, and a connection is established with the network security zone to realize the login of the network security zone. access; S4. The user who has passed the authentication sends a task request through the client module, and the task request is encrypted by the encryption module and then transmitted to the conversion module for decryption, and then transmitted to the network security area through the access channel for execution. 2 . The method for logging in to a network security zone according to claim 1 , wherein the identity verification information adopts biometric information. 3 . 3. The method for logging in to a network security zone according to claim 1, wherein different user rights correspond to different access channel construction programs. 4. network security zone login method as claimed in claim 1, is characterized in that: also comprise: the user through identity verification sends disconnection request by client module, disconnection request is transmitted to conversion module decryption after being encrypted by encryption module, The steps of realizing the disconnection of the access channel through the access channel disconnection module. 5. network security zone login method as claimed in claim 1 is characterized in that: in described step S4, the user through identity verification sends task request by client module, and task request is first transmitted to conversion module after encryption by encryption module Decryption, then conduct security audit, and transmit the task request after security audit to the network security zone for execution through the access channel. 6. The method for logging in to a network security zone as claimed in claim 1, wherein the two-channel connection module is used to communicate between the client module and the conversion module, and when any one of the channels communicates, another backup channel carries out the key. renew. 7. The network security zone login device is characterized in that: comprising a client module, the client module is connected with a conversion module, and the conversion module contains an access channel building module for constructing an access channel for accessing the network security zone, the client module and the conversion module Each of the modules is provided with an encryption module, the conversion module is also provided with an identity verification module, and an independent dual-channel connection module is provided between the client module and the conversion module. 8. The network security zone logging device as claimed in claim 7, wherein: a security audit module is set in the conversion module for realizing the audit of access task security based on the nearest neighbor classifier, and during the audit, by the nearest neighbor The classifier compares the similarity with the pre-stored dangerous task request, and when the obtained similarity falls within the preset threshold, it is considered dangerous.

Images