METHOD AND APPARATUS FOR REMOTE ACCESS

• US 20170230335A1
• Filed: 04/28/2017
• Published: 08/10/2017
• Est. Priority Date: 10/31/2014
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Walker, William Robert
• Granted Patent: US 10,681,010 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

The embodiments of the present invention provide a method for remote access and a server. The method includes: obtaining, by a Virtual Private Network VPN server, trust data of a user accessing a first network; determining, by the VPN server, a first trust level corresponding to the trust data according to a first correspondence, wherein the first correspondence comprises the trust data and the first trust level; determining, by the VPN server, a first access zone of the first network corresponding to the first trust level according to a second correspondence, wherein the second correspondence comprises the first trust level and the first access zone; and establishing, by the VPN server, a first VPN connection between a device used by the user and the first access zone. The technical solution provides an adaptive security mechanism for the remote access.

Claims

1. A method for remote access, comprising:

obtaining, by a Virtual Private Network (VPN) server, trust data of a user accessing a first network;

determining, by the VPN server, a first trust level corresponding to the trust data according to a first correspondence, wherein the first correspondence comprises the trust data and the first trust level;

determining, by the VPN server, a first access zone of the first network corresponding to the first trust level according to a second correspondence, wherein the second correspondence comprises the first trust level and the first access zone; and

establishing, by the VPN server, a first VPN connection between a device used by the user and the first access zone.

2. The method according to claim 1, further comprises:

monitoring, by the VPN server, a change of the trust data;

determining, by the VPN server, a second trust level corresponding to changed trust data according to a third correspondence if the VPN server obtains the changed trust data, wherein the third correspondence comprises the changed trust data and the second trust level;

determining, by the VPN server, a second access zone of the first network corresponding to the second trust level according to a fourth correspondence, wherein the fourth correspondence comprises the second trust level and the second access zone; and

establishing, by the VPN server, a second VPN connection between the device and the second access zone.

3. The method according to claim 2, further comprises:

comparing, by the VPN server, the second trust level with the first trust level; and

keeping, by the VPN server, the first VPN connection alive if the second trust level is higher than the first trust level, and closing, by the VPN server, the first VPN connection if the second trust level is lower than the first trust level.

4. The method according to claim 1, further comprises:

monitoring, by the VPN server, a change of the trust data;

determining, by the VPN server, a second trust level corresponding to changed trust data according to a third correspondence if the VPN server obtains the changed trust data, wherein the third correspondence comprises the changed trust data and the second trust level;

determining, by the VPN server, a second access zone of the first network corresponding to the second trust level according to a fourth correspondence, wherein the fourth correspondence comprises the second trust level and the second access zone;

modifying, by the VPN server, configuration of the first VPN connection so that the first VPN connection is changed into a second VPN connection between the device and the second access zone.

5. The method according to claim 1, further comprises:

determining, by the VPN server, there is a third trust level corresponding to the user, wherein the third trust level is lower than the first trust level;

determining, by the VPN server, a third access zone of the first network corresponding to the third trust level according to a fifth correspondence, wherein the fifth correspondence comprises the third trust level and the third access zone;

establishing, by the VPN server, a third VPN connection between the device and the third access zone.

6. The method according to claim 1, wherein the trust data comprises at least one of a trust data element for determining whether the user is reliable, a trust data element for determining whether the device is reliable, and a trust data element for determining whether a second network which connects the device to the first network is reliable.

7. The method according to claim 6, wherein the trust data further comprises information for indicating that the remote access passes a third network which fails to provide a trust data element for determining whether the third network is reliable, and the first trust level is lower than a trust level of the remote access determined by trust data which does not comprise the information.

8. The method according to claim 6, wherein the trust data element for determining whether the user is reliable comprises an identification of the user, a biometric key, a password, a personal identification number (PIN), a Radio Frequency Identification (RFID) tag, or a Near Field Communication (NFC) Tag;

wherein the trust data element for determining whether the device is reliable comprises a serial number of the device, a Media Access Control (MAC) address of the device, an International Mobile Equipment Identity (IMEI) of the device, a Subscriber Identity Module, SIM, number of the device or a Global Positioning System (GPS) position of the device,

wherein the second network comprises at least one of an access network, a carrier network, and an Internet exchange network.

9. A server, comprising:

an obtaining unit, configured to obtain trust data of a user accessing a first network;

a first determining unit, configured to determine a first trust level corresponding to the trust data according to a first correspondence, wherein the first correspondence comprises the trust data and the first trust level;

a second determining unit, configured to determine a first access zone of the first network corresponding to the first trust level according to a second correspondence, wherein the second correspondence comprises the first trust level and the first access zone; and

an establishing unit, configured to establish a first Virtual Private Network (VPN) connection between a device used by the user and the first access zone.

10. The server according to claim 9, further comprises:

a monitoring unit, configured to monitor a change of the trust data;

the first determining unit is further configured to determine a second trust level corresponding to the changed trust data according to a third correspondence if the monitoring unit obtains the changed trust data, wherein the third correspondence comprises the changed trust data and the second trust level;

the second determining unit is further configured to determine a second access zone of the first network corresponding to the second trust level according to a fourth correspondence, wherein the fourth correspondence comprises the second trust level and the second access zone; and

the establishing unit is further configured to establish a second VPN connection between the device and the second access zone.

11. The server according to claim 10, further comprises:

a comparing unit, configured to compare the second trust level with the first trust level,

wherein the establishing unit is further configured to keep the first VPN connection alive if the second trust level is higher than the first trust level, and close the first VPN connection if the second trust level is lower than the first trust level.

12. The server according to claim 9, further comprises:

a monitoring unit, configured to monitor a change of the trust data;

the first determining unit is further configured to determine a second trust level corresponding to the changed trust data according to a third correspondence if the monitoring unit obtains the changed trust data, wherein the third correspondence comprises the changed trust data and the second trust level;

the second determining unit is further configured to determine a second access zone of the first network corresponding to the second trust level according to a fourth correspondence, wherein the fourth correspondence comprises the second trust level and the second access zone; and

the establishing unit is further configured to modify configuration of the first VPN connection so that the first VPN connection is changed into a second VPN connection between the device and the second access zone.

13. The server according to claim 9, wherein the first determining unit is further configured to determine there is a third access zone corresponding to the user, wherein the third trust level is lower than the first trust level;

the second determining unit is further configured to determine a third access zone of the first network corresponding to the third trust level according to a fifth correspondence, wherein the fifth correspondence comprises the third trust level and the third access zone; and

the establishing unit is further configured to establish a third VPN connection between the device and the third access zone.

14. The server according to claim 9, wherein the trust data comprises at least one of a trust data element for determining whether the user is reliable, a trust data element for determining whether the device is reliable, and a trust data element for determining whether a second network which connects the device to the first network is reliable.

15. The server according to claim 14, wherein the trust data further comprises information for indicating that the remote access passes a third network which fails to provide a trust data element for determining whether the third network is reliable, and the first trust level is lower than a trust level of the remote access determined by trust data which does not comprise the information.

16. The server according to claim 14, wherein the trust data element for determining whether the user is reliable comprises an identification of the user, a biometric key, a password, a personal identification number (PIN), a Radio Frequency Identification (RFID) tag, or a Near Field Communication (NFC) Tag;

wherein the trust data element for determining whether the device is reliable comprises a serial number of the device, a Media Access Control (MAC) address of the device, an International Mobile Equipment Identity (IMEI) of the device, a Subscriber Identity Module (SIM) of the device number of the device or a Global Positioning System (GPS) position of the device,

wherein the second network comprises at least one of an access network, a carrier network, and an Internet exchange network.