Method and device for network security management

Abstract

The invention provides a network security management method and device. The method comprises the following steps: analyzing a received online request message, and obtaining a user ID carried by the online request message; determining a first object matched with the user ID from locally saved authentication information; according to an accumulative counting result of the first object, determining a penalty value corresponding to the first object; and according to a comparison result of the penalty value and a first set threshold, determining whether to refuse the online request message or not. The method and device provided by the invention has the advantages that the business processing amount of an authentication server during the AAA authentication process is reduced, so that the pressure on the authentication server is lessened, and normal user authentication of the authentication server is guaranteed.

Description

technical field [0001] The present application relates to the technical field of communications, and in particular to a network security management method and device. Background technique [0002] AAA (Authentication, Authorization, Accounting, Authentication, Authorization, Accounting) is a network security management mechanism that provides three security functions of authentication, authorization, and accounting. Among them, authentication: used to confirm the identity of the remote user accessing the network, and judge whether the visitor is a legitimate network user. Authorization: It is used to grant different permissions to different users and limit the services that users can use. For example, the administrator authorizes office users to access and print files in the server, while other temporary visitors do not have this permission. Billing: It is used to record all operations of users in the process of using network services, including the type of service used, s...

AI Technical Summary

Problems solved by technology

[0004] However, there are currently a large number of attacks against the authentication server. The attacker continuously sends authentication request packets to the authentication server, and the authentication server needs to judge and authenticate all authentication request packets one by one, which will inevitably increase the workload of the server. As a result, the server business is so busy that it cannot handle the online business of normal users in time, resulting in the inability of normal users to go online

When the server load is too heavy, problems such as abnormal server restart and billing interruption may even occur

Images