Data connection method, system and device

Abstract

The invention provides a data connection method. The method comprises the following steps: an authentication access gateway acquires a data connection message sent by terminal equipment and then judges whether the terminal equipment is successfully authenticated; the authentication access gateway correspondingly processes the data connection message according to the judgment result, and then sends the processed data connection message to an authorization control gateway; and the authorization control gateway judges whether sending the data connection message to a server according to an authorization policy corresponding to the terminal equipment. According to the above scheme, through the complete separation of authentication and authorization, a more effective and secure network access control and authorization method is provided, and meanwhile, impersonation attacks of IP addresses can be effectively prevented.

Description

technical field [0001] The present invention relates to the communication field, in particular to a data connection method, system and device. Background technique [0002] Such as figure 1 As shown, in some large cross-regional enterprises or industries, there are hundreds of user networks and multiple information centers inside. Each user network and information center is connected through a dedicated wide area network, and all of the networks are peer nodes. There is no Network Address Translation (NAT). Clients located in the user network often need to access multiple different information centers at the same time. Usually, each information center belongs to different competent departments, which require unique authorization for different visiting users, and this kind of authorization management is usually determined by the respective information center competent departments, and unified authorization management for the whole industry cannot be carried out. Such enter...

AI Technical Summary

Problems solved by technology

[0006] 1) From the perspective of security: a. The traditional authentication gateway solution only verifies the user's identity during access authentication. After the authentication is completed, all access control of the client is converted into a strategy based on the IP address. Usually, the user network and the information center There is a large open network whose addresses can be easily spoofed or impersonated

b. The VPN tunnel encapsulation scheme reduces the egress gateway of the user network and lacks basic access authentication filtering. The ingress gateway of the information center becomes the bottleneck of access, which may face a large number of unauthenticated illegal access and is vulnerable to denial of service attacks

[0007] 2) From the perspective of performance: For the tunnel encapsulation scheme, the establishment of the tunnel and the reassembly of the message need to consume more time and resources, which may lead to a sharp drop in network throughput performance, and the ingress gateway of the information center needs stronger processing capacity, otherwise it is difficult to maintain a large number of concurrent user access

In the same way, for a large number of old client hosts in the user network, its hardware configuration is sometimes not competent

[0008] 3) From the perspective of deployment: For the VPN tunnel solution, according to the encapsulation method, the source address, destination address or access path of the network message will usually be changed to varying degrees, and the server or application program in the original information center may need to be modified or rewrite

At the same time, this type of solution requires the installation of a VPN client program on each client host. In addition to increasing the deployment work, it will also cause a large number of compatibility issues

Images