A Terminal Admission Control Method Based on Switch Port Management

Abstract

The invention relates to the technical field of terminal admission control, and specifically discloses a terminal admission control method based on switch port management. After the new terminal is connected to the network, collect the new terminal through the switch, extract the unique identifier of the terminal, and associate the terminal with the port of the switch; compare the unique identifier with the MAC address of the access database to make a judgment; if the unique identifier is found, It is a legal terminal and no action is taken; if the unique identifier cannot be found, it is an illegal terminal or an external terminal, and the corresponding switch port will be closed immediately, and the closing information will be recorded in the access database; when a new terminal accesses the network , added to the window period after processing; return to start processing again; if no new terminal is connected to the network, the closed switch port will be automatically opened after the specified time. The present invention adopts MAC address management for the terminal, prohibits the terminal user from changing the MAC address privately; manages the virtual machine and prevents the HUB from accessing; the terminal access control of the present invention is accurate and strict.

Description

technical field [0001] The invention relates to the technical field of terminal admission control, in particular to a terminal admission control method based on switch port management. Background technique [0002] In the existing technology, due to the diversity of access methods (wired, wireless, virtual private network, dial-up, etc.), and the diversity of terminal devices (desktops, notebooks, PADs, smart phones, etc.), it is difficult to accurately define network boundaries Network management mainly faces the following problems: ① external terminals access the network at will, ② the security of access terminals cannot be confirmed or guaranteed, and ③ legitimate terminals do not comply with the IT internal control system. Preventing external risks from entering the interior is one of the issues that network management must pay attention to. Under this background, a terminal access control system has emerged: access control is the abbreviation of real-name network access...

AI Technical Summary

Problems solved by technology

[0002] In the existing technology, due to the diversity of access methods (wired, wireless, virtual private network, dial-up, etc.), and the diversity of terminal devices (desktops, notebooks, PADs, smart phones, etc.), it is difficult to accurately define network boundaries Network management mainly faces the following problems: ① external terminals access the network at will, ② the security of access terminals cannot be confirmed or guaranteed, ③ legal terminals do not comply with the IT internal control system

[0006] (3) Access control mode based on gateway products and terminals: This control mode is very comprehensive and can basically meet most of the needs of users; however, gateway-type equipment is relatively expensive and needs to change the topology structure, so only 802.1x can be used Access control, but 802.1x cannot solve problems such as HUB access and terminal statistics; access control relies heavily on desktop security, and terminals without Agent installed (or terminals with Agent uninstalled illegally) can still access the LAN, which is impossible Security Access Control of LAN

[0007] (iv) Access control mode based on ARP enforcement and desktop management: This control mode has the advantages of low cost and fast deployment; however, the technical problem is: ARP enforcement is actually ARP spoofing, and the consequences are serious and unimaginable; as long as you know the technology Users can bypass ARP interference and coercion; therefore, it is impossible to isolate unsafe computers

[0009] The disadvantages of the control scheme based on 802.1x admission control emphasizing the switch port are: ①. Poor compatibility, all access layer switches must support the 802.1x protocol; ②. High technical complexity requirements for deployment; ③. Terminal; ④. Unable to manage the access of HUB and virtual machine

[0010] The disadvantages of the admission control mode based on the DHCP server and the terminal are: ①. A DHCP server needs to be deployed on each network segment, which increases hardware and maintenance costs. The terminal can easily bypass DHCP, set the IP access network by itself, and cannot collect terminal information. ;②. Only suitable for small and medium-sized networks

[0011] The disadvantages of the access control mode based on gateway products and terminals are: ①. Gateway-type equipment is relatively expensive and needs to change the topology structure. Only 802.1x access control can be used, but 802.1x cannot solve HUB access and terminal statistics ②. Access control relies heavily on desktop security. Terminals without Agent installed (or terminals with Agent uninstalled illegally) can still access the LAN, and security access control of the LAN cannot be realized.

[0012] The disadvantages of the access control mode based on ARP enforcement and desktop management are: ①. ARP enforcement is actually ARP spoofing, with serious and unimaginable consequences; users can easily bypass ARP interference and enforcement; ②. Cannot isolate unsafe Computer; ③. The management of visitors is a serious problem; ④. The effective range of ARP jammers is small. In a large network, its own management is a problem, especially in the case of a wide area network, it is even more difficult

[0013] At present, there is no effective terminal admission control method based on switch port management to solve the above problems

Images