Network access control method with system health detection prior to access

Abstract

The present invention discloses a network access control method with system health detection prior to access. The method comprises the steps of: S1: registering a user name, passwords and a handheld device identification code of a user of network terminal; S2: filling the user name of the terminal on a login interface of the network terminal, and emitting a connection request for obtaining dynamicverification codes to an authentication server; S3: sending one dynamic verification code to the handheld device of the terminal user by the authentication server; and S4: performing login authentication by employing the user name and the passwords of the terminal and the dynamic verification codes, and issuing corresponding access control policies to an access device by a policy server accordingto a system health report of the terminal. The network terminal requests one dynamic verification code to the authentication server, the dynamic verification code is employed to determine a legal identity of a user, a system health report is submitted to the policy server prior to access of a terminal, and therefore virus or hacker attack from the network terminal is effectively avoided and network access safety is comprehensively guaranteed.

Description

technical field [0001] The invention relates to the field of communication control, in particular to a network access control method that performs system health detection before access. Background technique [0002] Due to the consideration of enterprise network service types and security, users at different levels have very different requirements for network services and network security during the process of terminal access to the network. At present, the following two technical solutions are mainly used to implement differentiated processing for different users. [0003] (A) The scheme uses VLAN (Virtual Local Area Network) technology to logically isolate different networks; for example, assign switch ports 1 to 10 to VLAN1, ports 11 to 23 to VLAN2, and terminals of the finance department with higher security requirements can only be connected to Access to VLAN1, while other terminals such as the production department access to VLAN2, achieving logical isolation at the n...

AI Technical Summary

Problems solved by technology

[0009] The deployment of the above (B) scheme is more flexible than the (A) scheme and the security is also improved, but the (B) scheme cannot really verify the legal identity of the terminal user. Once the user name and password of the terminal are leaked, those with ulterior motives can Use the leaked user information to log in on any computer in the corporate network, and the security is still not guaranteed

Images