CN116074107A - Communication data transmission method and device, electronic equipment and storage medium - Google Patents

Abstract

The application discloses a communication data transmission method, a device, electronic equipment and a storage medium, which can be applied to the field of network security or the field of finance. The client sends a user identity verification request to the authentication server, records a request time stamp, and returns service bill information to the client for decryption based on the user identity verification request and the Kerberos database when the user identity verification is confirmed to pass, so that service grant bill information and a session key are obtained, the client verifies the user identity after the service grant bill information is confirmed to pass, and returns a network service resource access permission to the client when the user identity verification passes, so that the client can access network service resources. The invention verifies the user identity based on the Kerberos security authentication system, and improves the security and reliability of communication data transmission between the client and the server through the bidirectional security authentication strategy between the client and the server.

Description

Communication data transmission method, device, electronic equipment and storage medium

technical field

The present invention relates to the technical field of communication, and more specifically, to a communication data transmission method, device, electronic equipment and storage medium.

Background technique

Traditional application service security authentication mostly adopts one-way security authentication. When the communication data is transmitted between the client and the server, the server only needs to pass the verification of the communication data transmitted by the client, and then return the result to the client. The one-way security authentication process is relatively simple, leading to many security risks in the communication data transmission process, such as SQL (StructuredQuery Language, Structured Query Language) injection, web page tampering, buffer stack information attacks, etc., and even cause service downtime, causing the server to fail. Provide services to users normally.

Therefore, how to improve the security and reliability of communication data transmission has become a technical problem to be solved urgently by those skilled in the art.

Contents of the invention

In view of this, the present invention discloses a communication data transmission method, device, electronic equipment and storage medium, so as to improve the security and reliability of communication data transmission.

A communication data transmission method applied to a client, the transmission method comprising:

Sending a user identity verification request to the authentication server, and recording a request timestamp, wherein the user identity verification request carries first user information;

Obtaining the service ticket information returned when the authentication server determines that the user identity verification is passed based on the user identity verification request and the Kerberos database, wherein the service ticket information includes: service grant ticket information and the client and ticket authentication server An interactive session key, the service granting ticket information includes: second user information, service granting ticket validity time, and a corresponding return time stamp when returning the service ticket information;

Decrypting the service ticket information by using a client key to obtain the service grant ticket information and the session key;

calculating the time difference between the request timestamp and the return timestamp in the service grant ticket information;

When the time difference is less than a preset difference threshold, in a case where it is determined that the first user information is the same as the second user information in the service grant ticket information, determine that the service grant ticket information passes verify;

sending the user identity verification request to the ticket authentication server based on the session key;

Obtaining the network service resource access permission returned when the ticket authentication server determines that the user identity authentication is passed based on the user identity authentication request;

Based on the network service resource access permission, network service resources are accessed within the valid time of the service grant ticket.

Optionally, based on the network service resource access permission, accessing the network service resource within the valid time of the service grant ticket includes:

Based on the network service resource access permission, within the valid time of the service statement and the ticket, the security verification of the set custom access rules is carried out by using the white list protection strategy of the Web firewall;

When the custom access rule passes the security verification, access to the network service resource is allowed.

Optionally, the white list protection policy of the web firewall includes: a user access flow information configuration policy, a user operation behavior information configuration policy, and a core sensitive information configuration policy.

Optionally, also include:

When the time difference is not less than the preset difference threshold, determine that the user identity verification request sent to the authentication server is forged;

Sending prompt information that the user identity verification request is a forged request to the authentication server;

Obtain the user identity authentication failure information returned by the authentication server.

Optionally, also include:

Obtaining network service resource access prohibition information returned when the ticket authentication server determines that user identity authentication fails based on the user identity authentication request.

Optionally, the first user information includes: user name, user login password and client IP address.

A transmission device for communication data, applied to a client, the transmission device includes:

A first request sending unit, configured to send a user identity verification request to the authentication server, and record a request timestamp, wherein the user identity verification request carries first user information;

An obtaining unit, configured to obtain service ticket information returned when the authentication server determines that user identity verification passes based on the user identity verification request and the Kerberos database, wherein the service ticket information includes: service grant ticket information and the client A session key for interacting with the ticket authentication server, the service granting ticket information includes: second user information, service granting ticket validity time, and a corresponding return time stamp when returning the service ticket information;

a decryption unit, configured to use a client key to decrypt the service ticket information to obtain the service grant ticket information and the session key;

a calculation unit, configured to calculate a time difference between the request time stamp and the return time stamp in the service grant ticket information;

a verification determination unit, configured to determine that the first user information is the same as the second user information in the service grant ticket information when the time difference is less than a preset difference threshold; The above service grant ticket information is verified;

a second request sending unit, configured to send the user identity verification request to the ticket authentication server based on the session key;

An access permission acquisition unit, configured to acquire the network service resource access permission returned when the ticket authentication server determines that the user identity verification is passed based on the user identity verification request;

An access unit, configured to access network service resources within the valid time of the service grant ticket based on the network service resource access permission.

Optionally, the access unit is specifically used for:

Based on the network service resource access permission, within the valid time of the service statement and the ticket, the security verification of the set custom access rules is carried out by using the white list protection strategy of the Web firewall;

When the custom access rule passes the security verification, access to the network service resource is allowed.

Optionally, also include:

A request determining unit, configured to determine that the user identity verification request sent to the authentication server is forged when the time difference is not less than the preset difference threshold;

a prompt information sending unit, configured to send prompt information that the user identity verification request is a forged request to the authentication server;

An authentication failure information acquiring unit, configured to acquire user identity authentication failure information returned by the authentication server.

Optionally, also include:

An access prohibition information acquisition unit, configured to acquire network service resource access prohibition information returned when the ticket authentication server determines that user identity verification fails based on the user identity verification request.

An electronic device comprising: a memory and a processor;

the memory is used to store at least one instruction;

The processor is configured to execute the at least one instruction to implement the communication data transmission method described above.

A computer-readable storage medium, where the computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by a processor, the above-mentioned communication data transmission method is implemented.

It can be seen from the above technical solution that the present invention discloses a communication data transmission method, device, electronic equipment and storage medium. The client sends a user identity verification request to the authentication server and records the time stamp of the request. The authentication server based on the user identity verification request And Kerberos database confirms that the user authentication is passed and returns the service ticket information to the client. The client uses the client key to decrypt the service ticket information to obtain the service grant ticket information and session key. When the time stamp between the request time stamp and the return time stamp When the time difference is less than the preset difference threshold, if it is determined that the first user information and the second user information in the service grant ticket information are the same, the client determines that the service grant ticket information has passed the verification, and sends the The ticket authentication server sends a user authentication request, and when the ticket authentication server determines that the user authentication is passed based on the user authentication request, it returns the network service resource access permission to the client, so that the client can access the network service resource within the valid time of the service-granted ticket . The present invention is based on the Kerberos security authentication system. In addition to verifying the validity of the user identity, it also adopts a two-way security authentication strategy between the client and the server. Therefore, the security and reliability of communication data transmission between the client and the server are greatly improved. .

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention. For those skilled in the art, other drawings can also be obtained according to the disclosed drawings without creative work.

FIG. 1 is a flowchart of a communication data transmission method disclosed in an embodiment of the present invention;

FIG. 2 is a schematic structural diagram of a transmission device for communication data disclosed in an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of an electronic device disclosed by an embodiment of the present invention.

Detailed ways

It should be noted that the communication data transmission method, device, electronic equipment and storage medium provided by the present invention can be used in the field of network security or the field of finance. The foregoing is only an example, and does not limit the application fields of the communication data transmission method, device, electronic device, and storage medium provided by the present invention.

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

The embodiment of the present invention discloses a communication data transmission method, device, electronic equipment, and storage medium. The client sends a user identity verification request to the authentication server and records the request time stamp. The authentication server determines the user ID based on the user identity verification request and the Kerberos database. When the identity verification is passed, the service ticket information is returned to the client. The client uses the client key to decrypt the service ticket information to obtain the service grant ticket information and session key. When the time difference between the request timestamp and the returned timestamp is less than When the difference threshold is preset, when it is determined that the first user information is the same as the second user information in the service grant ticket information, the client determines that the service grant ticket information has passed the verification, and sends the user to the ticket authentication server based on the session key. Authentication request, when the ticket authentication server determines that the user authentication is passed based on the user authentication request, return the network service resource access permission to the client, so that the client can access the network service resource within the valid time of the ticket granted by the service. The present invention is based on the Kerberos security authentication system. In addition to verifying the validity of the user identity, it also adopts a two-way security authentication strategy between the client and the server. Therefore, the security and reliability of communication data transmission between the client and the server are greatly improved. .

Referring to Fig. 1, a flow chart of a communication data transmission method disclosed in an embodiment of the present invention, the method is applied to a client, and the transmission method includes:

Step S101 , sending a user identity verification request to the authentication server, and recording the request time stamp.

Wherein, the user identity verification request carries the first user information, and the first user information may include: user name, user login password, client IP address, and the like.

The client verifies whether the user identity is valid by sending a user identity verification request carrying the first user information to the authentication server.

The request timestamp is also the timestamp corresponding to when the client sends the user authentication request to the authentication server.

Step S102, obtaining the service ticket information returned by the authentication server when the authentication server determines that the user authentication is passed based on the user authentication request and the Kerberos database.

Kerberos is a computer network authorization protocol used to authenticate personal communications in a secure manner in a non-secure network. It focuses on identifying the identities of both parties in the communication, helping the client and the server to verify whether the identities are valid, so that the two ends of the communication can fully trust each other's identities.

Standard user information is stored in the Kerberos database. After receiving the user identity verification request, the authentication server compares the first user information with the standard user information stored in the Kerberos database to determine whether the user identity is valid. When the verification is passed, the service ticket information is returned to the client.

Wherein, the service ticket information includes: service grant ticket information and a session key (Session key) for the client to interact with the ticket authentication server.

The service grant ticket information includes: the second user information, the valid time of the service grant ticket, and the corresponding return time stamp when the service ticket information is returned. The second user information includes: user name, user login password, user IP and so on.

Step S103, using the client key to decrypt the service ticket information to obtain the service grant ticket information and the session key.

Step S104, calculating the time difference between the request time stamp and the return time stamp in the service grant ticket information.

Step S105 , when the time difference is less than the preset difference threshold, if it is determined that the first user information is the same as the second user information in the service grant ticket information, determine that the service grant ticket information has passed the verification.

Wherein, the value of the preset difference threshold is determined according to actual needs, such as 5 minutes, which is not limited in the present invention.

In this embodiment, when the time difference between the request timestamp and the returned timestamp is less than the preset difference threshold, it will continue to compare whether the first user information and the second user information are the same to determine the validity of the service grant ticket . When the first user information is the same as the second user information, it is determined that the service grant ticket information passes the verification.

Step S106, sending a user identity verification request to the ticket authentication server based on the session key.

The client obtains the session key for the interaction between the client and the ticket authentication server, and after the service grants the ticket information through verification, the client sends a user identity verification request to the ticket authentication server, and the ticket authentication server verifies the validity of the user identity again , recheck the user and IP address of the service granting the ticket.

Step S107, obtaining the network service resource access permission returned by the ticket authentication server when the user identity authentication is passed based on the user identity authentication request.

When the ticket authentication server determines that the user identity is valid, it will return the network service resource access permission to the client. The client can access the network service resource only after receiving the network service resource access permission.

Step S108, based on the network service resource access permission, access the network service resource within the valid time of the service grant ticket.

In summary, the present invention discloses a communication data transmission method. The client sends a user identity verification request to the authentication server and records the request time stamp. The terminal returns the service ticket information, and the client uses the client key to decrypt the service ticket information to obtain the service grant ticket information and session key. When the time difference between the request timestamp and the returned timestamp is less than the preset difference threshold , when it is determined that the first user information is the same as the second user information in the service granting ticket information, the client determines that the service granting ticket information has passed the verification, and sends a user identity verification request to the ticket authentication server based on the session key, when the ticket When the authentication server determines that the user authentication is passed based on the user authentication request, it returns the network service resource access permission to the client, so that the client can access the network service resource within the valid time of the service-granted ticket. The present invention is based on the Kerberos security authentication system. In addition to verifying the validity of the user identity, it also adopts a two-way security authentication strategy between the client and the server. Therefore, the security and reliability of communication data transmission between the client and the server are greatly improved. .

The Kerberos security authentication system can meet the business scenarios of different trading products, but it cannot avoid replay attacks. In order to further improve the reliability and stability of the Kerberos safety authentication system, the invention adds a white list protection strategy of the Web firewall after the safety authentication.

Therefore, in order to further optimize the above embodiment, step S108 may specifically include:

Based on the network service resource access permission, within the validity period of the service statement and the ticket, the security verification of the set custom access rules is carried out by using the white list protection strategy of the web firewall;

When the custom access rule passes the security check, access to network service resources is allowed.

Wherein, the white list protection policy of the web firewall may include: a user access flow information configuration policy, a user operation behavior information configuration policy, and a core sensitive information configuration policy.

The present invention adopts the white list protection strategy of the Web firewall, and further improves the reliability and stability of security authentication by performing reinforcement operations on aspects such as user access flow monitoring, user operation monitoring, and business core data monitoring.

In summary, by combining the security authentication of the Kerberos protocol and the white list protection strategy of the Web firewall, the present invention can not only verify the validity of the user identity, but also effectively monitor the network service resources, prevent the system from being maliciously attacked, and The security and reliability of the communication data transmission between the client and the server are improved.

In order to further optimize the above embodiment, the transmission method may also include:

When the time difference is not less than the preset difference threshold, it is determined that the user identity verification request sent to the authentication server is forged;

Send a prompt message to the authentication server that the user authentication request is a forged request;

Obtain the user identity authentication failure information returned by the authentication server.

In the present invention, if the client determines that the time difference between the request timestamp and the returned timestamp is not less than the preset difference threshold, it is determined that the authentication server receives the user identity verification request is forged, and at this time it will send the user authentication request to the authentication server. The identity verification request is the prompt information of the forged request, and the authentication server returns user identity authentication failure information to the client after receiving the prompt information of the forged request.

In order to further optimize the above embodiment, the transmission method may also include:

Obtaining the network service resource access prohibition information returned when the ticket authentication server determines that the user authentication fails based on the user authentication request.

In the present invention, the client can only access the network service resource after receiving the access permission of the network service resource. If the client receives the network service resource prohibition information returned by the bill authentication server, the client cannot access the network service resource.

Corresponding to the above method embodiments, the present invention also discloses a communication data transmission device.

Referring to FIG. 2 , it is a schematic structural diagram of a communication data transmission device disclosed in an embodiment of the present invention. The device is applied to a client, and the transmission device includes:

The first request sending unit 201 is configured to send a user identity verification request to the authentication server, and record the request time stamp.

Wherein, the user identity verification request carries the first user information.

The client verifies whether the user identity is valid by sending a user identity verification request carrying the first user information to the authentication server.

The request timestamp is also the timestamp corresponding to when the client sends the user authentication request to the authentication server.

The acquiring unit 202 is configured to acquire the service ticket information returned by the authentication server when the authentication server determines that the user identity authentication is passed based on the user identity authentication request and the Kerberos database.

Wherein, the service ticket information includes: service grant ticket information and a session key for the client to interact with the ticket authentication server, and the service grant ticket information includes: second user information, service grant ticket valid time, and returned The corresponding return timestamp when the service ticket information is described.

The decryption unit 203 is configured to use a client key to decrypt the service ticket information to obtain the service grant ticket information and the session key.

A calculation unit 204, configured to calculate a time difference between the request time stamp and the return time stamp in the service grant ticket information.

a verification determination unit 205, configured to determine that the first user information is the same as the second user information in the service grant ticket information when the time difference is less than a preset difference threshold; The service grant ticket information is verified.

The second request sending unit 206 is configured to send the user identity verification request to the ticket authentication server based on the session key.

The client obtains the session key for the interaction between the client and the ticket authentication server, and after the service grants the ticket information through verification, the client sends a user identity verification request to the ticket authentication server, and the ticket authentication server verifies the validity of the user identity again , recheck the user and IP address of the service granting the ticket.

The access permission obtaining unit 207 is configured to obtain the network service resource access permission returned when the ticket authentication server determines that the user identity verification is passed based on the user identity verification request.

When the ticket authentication server determines that the user identity is valid, it will return the network service resource access permission to the client. The client can access the network service resource only after receiving the network service resource access permission.

The access unit 208 is configured to access the network service resource within the valid time of the service grant ticket based on the network service resource access permission.

In summary, the present invention discloses a transmission device for communication data. The client sends a user identity verification request to the authentication server and records the time stamp of the request. The terminal returns the service ticket information, and the client uses the client key to decrypt the service ticket information to obtain the service grant ticket information and session key. When the time difference between the request timestamp and the returned timestamp is less than the preset difference threshold , when it is determined that the first user information is the same as the second user information in the service granting ticket information, the client determines that the service granting ticket information has passed the verification, and sends a user identity verification request to the ticket authentication server based on the session key, when the ticket When the authentication server determines that the user authentication is passed based on the user authentication request, it returns the network service resource access permission to the client, so that the client can access the network service resource within the valid time of the service-granted ticket. The present invention is based on the Kerberos security authentication system. In addition to verifying the validity of the user identity, it also adopts a two-way security authentication strategy between the client and the server. Therefore, the security and reliability of communication data transmission between the client and the server are greatly improved. .

In order to further optimize the above embodiment, the access unit 208 may specifically be used for:

Based on the network service resource access permission, within the valid time of the service statement and the ticket, the security verification of the set custom access rules is carried out by using the white list protection strategy of the Web firewall;

When the custom access rule passes the security verification, access to the network service resource is allowed.

In order to further optimize the above embodiment, the transmission device may further include:

A request determining unit, configured to determine that the user identity verification request sent to the authentication server is forged when the time difference is not less than the preset difference threshold;

a prompt information sending unit, configured to send prompt information that the user identity verification request is a forged request to the authentication server;

An authentication failure information acquiring unit, configured to acquire user identity authentication failure information returned by the authentication server.

In order to further optimize the above embodiment, the transmission device may further include:

An access prohibition information acquisition unit, configured to acquire network service resource access prohibition information returned when the ticket authentication server determines that user identity verification fails based on the user identity verification request.

It should be noted that, for the specific working principle of each component in the device embodiment, please refer to the corresponding part of the method embodiment, which will not be repeated here.

Corresponding to the above embodiments, as shown in FIG. 3 , the present invention also discloses an electronic device, which may include: a processor 1 and a memory 2;

Wherein, the processor 1 and the memory 2 complete the mutual communication through the communication bus 3;

Processor 1, configured to execute at least one instruction;

memory 2, for storing at least one instruction;

Processor 1 may be a central processing unit CPU, or a specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present invention.

The memory 2 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one magnetic disk memory.

Wherein, the processor executes at least one instruction to realize the following functions:

Sending a user identity verification request to the authentication server, and recording a request timestamp, wherein the user identity verification request carries first user information;

Obtaining the service ticket information returned when the authentication server determines that the user identity verification is passed based on the user identity verification request and the Kerberos database, wherein the service ticket information includes: service grant ticket information and the client and ticket authentication server An interactive session key, the service granting ticket information includes: second user information, service granting ticket validity time, and a corresponding return time stamp when returning the service ticket information;

Decrypting the service ticket information by using a client key to obtain the service grant ticket information and the session key;

calculating the time difference between the request timestamp and the return timestamp in the service grant ticket information;

When the time difference is less than a preset difference threshold, in a case where it is determined that the first user information is the same as the second user information in the service grant ticket information, determine that the service grant ticket information passes verify;

sending the user identity verification request to the ticket authentication server based on the session key;

Obtaining the network service resource access permission returned when the ticket authentication server determines that the user identity authentication is passed based on the user identity authentication request;

Based on the network service resource access permission, network service resources are accessed within the valid time of the service grant ticket.

In summary, the present invention discloses an electronic device. The electronic device sends a user identity verification request to the authentication server and records the request time stamp. The authentication server returns a service to the client when the user identity verification is passed based on the user identity verification request and the Kerberos database. Ticket information, the client uses the client key to decrypt the service ticket information to obtain the service grant ticket information and session key. When the time difference between the request timestamp and the returned timestamp is less than the preset difference threshold, the When the first user information is the same as the second user information in the service grant ticket information, the client determines that the service grant ticket information has passed the verification, and sends a user identity verification request to the ticket authentication server based on the session key. When the user authentication request determines that the user authentication is passed, the network service resource access permission is returned to the client, so that the client can access the network service resource within the valid time of the ticket granted by the service. The present invention is based on the Kerberos security authentication system. In addition to verifying the validity of the user identity, it also adopts a two-way security authentication strategy between the client and the server. Therefore, the security and reliability of communication data transmission between the client and the server are greatly improved. .

Corresponding to the above-mentioned embodiments, the present invention also discloses a computer-readable storage medium. The computer-readable storage medium stores at least one instruction, and the at least one instruction implements the following functions when executed by a processor:

Sending a user identity verification request to the authentication server, and recording a request timestamp, wherein the user identity verification request carries first user information;

Obtaining the service ticket information returned when the authentication server determines that the user identity verification is passed based on the user identity verification request and the Kerberos database, wherein the service ticket information includes: service grant ticket information and the client and ticket authentication server An interactive session key, the service granting ticket information includes: second user information, service granting ticket validity time, and a corresponding return time stamp when returning the service ticket information;

Decrypting the service ticket information by using a client key to obtain the service grant ticket information and the session key;

calculating the time difference between the request timestamp and the return timestamp in the service grant ticket information;

When the time difference is less than a preset difference threshold, in a case where it is determined that the first user information is the same as the second user information in the service grant ticket information, determine that the service grant ticket information passes verify;

sending the user identity verification request to the ticket authentication server based on the session key;

Obtaining the network service resource access permission returned when the ticket authentication server determines that the user identity authentication is passed based on the user identity authentication request;

Based on the network service resource access permission, network service resources are accessed within the valid time of the service grant ticket.

In summary, the present invention discloses a computer-readable storage medium. The computer-readable storage medium sends a user identity verification request to the authentication server and records the request time stamp. The authentication server determines that the user identity verification has passed based on the user identity verification request and the Kerberos database. The service ticket information is returned to the client at the time, and the client uses the client key to decrypt the service ticket information to obtain the service grant ticket information and session key. When the time difference between the request timestamp and the returned timestamp is less than the preset difference value threshold, in the case of determining that the first user information is the same as the second user information in the service granting ticket information, the client determines that the service granting ticket information has passed the verification, and sends a user authentication request to the ticket authentication server based on the session key , when the ticket authentication server determines that the user authentication is passed based on the user authentication request, return the network service resource access permission to the client, so that the client can access the network service resource within the valid time of the service-granted ticket. The present invention is based on the Kerberos security authentication system. In addition to verifying the validity of the user identity, it also adopts a two-way security authentication strategy between the client and the server. Therefore, the security and reliability of communication data transmission between the client and the server are greatly improved. .

Finally, it should also be noted that in this text, relational terms such as first and second etc. are only used to distinguish one entity or operation from another, and do not necessarily require or imply that these entities or operations, any such actual relationship or order exists. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same and similar parts of each embodiment can be referred to each other.

The above description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention will not be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (12)

1. A transmission method for communication data, characterized in that it is applied to a client, and the transmission method comprises: Sending a user identity verification request to the authentication server, and recording a request timestamp, wherein the user identity verification request carries first user information; Obtaining the service ticket information returned when the authentication server determines that the user identity verification is passed based on the user identity verification request and the Kerberos database, wherein the service ticket information includes: service grant ticket information and the client and ticket authentication server An interactive session key, the service granting ticket information includes: second user information, service granting ticket validity time, and a corresponding return time stamp when returning the service ticket information; Decrypting the service ticket information by using a client key to obtain the service grant ticket information and the session key; calculating the time difference between the request timestamp and the return timestamp in the service grant ticket information; When the time difference is less than a preset difference threshold, in a case where it is determined that the first user information is the same as the second user information in the service grant ticket information, determine that the service grant ticket information passes verify; sending the user identity verification request to the ticket authentication server based on the session key; Obtaining the network service resource access permission returned when the ticket authentication server determines that the user identity authentication is passed based on the user identity authentication request; Based on the network service resource access permission, network service resources are accessed within the valid time of the service grant ticket. 2. The transmission method according to claim 1, wherein the accessing the network service resource within the valid time of the service grant ticket based on the network service resource access permission comprises: Based on the network service resource access permission, within the valid time of the service statement and the ticket, the security verification of the set custom access rules is carried out by using the white list protection strategy of the Web firewall; When the custom access rule passes the security check, access to the network service resource is allowed. 3. The transmission method according to claim 2, wherein the white list protection policy of the Web firewall comprises: a user access traffic information configuration policy, a user operation behavior information configuration policy, and a core sensitive information configuration policy. 4. The transmission method according to claim 1, further comprising: When the time difference is not less than the preset difference threshold, determine that the user identity verification request sent to the authentication server is forged; Sending prompt information that the user identity verification request is a forged request to the authentication server; Obtain the user identity authentication failure information returned by the authentication server. 5. The transmission method according to claim 1, further comprising: Obtaining network service resource access prohibition information returned when the ticket authentication server determines that user identity authentication fails based on the user identity authentication request. 6. The transmission method according to claim 1, wherein the first user information includes: user name, user login password and client IP address. 7. A transmission device for communication data, characterized in that it is applied to a client, and the transmission device includes: A first request sending unit, configured to send a user identity verification request to the authentication server, and record a request timestamp, wherein the user identity verification request carries first user information; An obtaining unit, configured to obtain service ticket information returned when the authentication server determines that user identity verification passes based on the user identity verification request and the Kerberos database, wherein the service ticket information includes: service grant ticket information and the client A session key for interacting with the ticket authentication server, the service granting ticket information includes: second user information, service granting ticket validity time, and a corresponding return time stamp when returning the service ticket information; a decryption unit, configured to use a client key to decrypt the service ticket information to obtain the service grant ticket information and the session key; a calculation unit, configured to calculate a time difference between the request time stamp and the return time stamp in the service grant ticket information; a verification determination unit, configured to determine that the first user information is the same as the second user information in the service grant ticket information when the time difference is less than a preset difference threshold; The above service grant ticket information is verified; a second request sending unit, configured to send the user identity verification request to the ticket authentication server based on the session key; An access permission acquisition unit, configured to acquire the network service resource access permission returned when the ticket authentication server determines that the user identity verification is passed based on the user identity verification request; An access unit, configured to access network service resources within the valid time of the service grant ticket based on the network service resource access permission. 8. The transmission device according to claim 7, wherein the access unit is specifically used for: Based on the network service resource access permission, within the valid time of the service statement and the ticket, the security verification of the set custom access rules is carried out by using the white list protection strategy of the Web firewall; When the custom access rule passes the security check, access to the network service resource is allowed. 9. The transmission device according to claim 7, further comprising: A request determining unit, configured to determine that the user identity verification request sent to the authentication server is forged when the time difference is not less than the preset difference threshold; a prompt information sending unit, configured to send prompt information that the user identity verification request is a forged request to the authentication server; An authentication failure information acquiring unit, configured to acquire user identity authentication failure information returned by the authentication server. 10. The transmission device according to claim 7, further comprising: An access prohibition information acquisition unit, configured to acquire network service resource access prohibition information returned when the ticket authentication server determines that user identity verification fails based on the user identity verification request. 11. An electronic device, characterized in that the electronic device comprises: a memory and a processor; the memory is used to store at least one instruction; The processor is configured to execute the at least one instruction to implement the communication data transmission method according to any one of claims 1-6. 12. A computer-readable storage medium, characterized in that the computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by a processor, the communication according to any one of claims 1-6 is realized The method of data transfer.

Images