Park dynamic network configuration system and network control method applying same

Abstract

The invention discloses a park dynamic network configuration system and a network control method applying the same, and the system comprises a user identity authentication module which obtains the identity information of a network user, carries out the identity authentication of the network user according to the identity information of the network user, and obtains a user authentication result; based on the user authentication result, the network controller determines user management architecture information to which the user belongs, and calculates a network access permission corresponding to the user according to the user management architecture information; the terminal identification module analyzes the equipment feature information of the terminal equipment to obtain detailed information of the terminal equipment; based on the detailed information of the terminal equipment, the policy management module determines service configuration and a security policy; the network controller automatically issues corresponding network configuration according to the network access authority, the service configuration of the terminal equipment and the security policy; according to the invention, the park network deployment efficiency is improved, and a network administrator can carry out network strategy deployment work conveniently.

Description

Technical Field

[0001] The present application relates to the technical field of dynamic network configuration, and in particular to a campus dynamic network configuration system and a network control method using the same. Background Art

[0002] Campus Network refers to a computer network system established in a relatively large area, such as a university campus, an enterprise park, etc. It is mainly used to connect various devices, servers and terminals within the campus to achieve information sharing, transmission and management.

[0003] In the campus network, the traditional wired network construction plans the workstations of each department, divides VLANs according to the access ports of the access switch, hosts in different VLANs use specific IP segments, and business policies are formulated based on IP addresses on switches, routers, and firewall devices. However, the new office model also brings new problems: 1) The prevalence of personnel refinement and outsourcing models often leads to users from different departments or even different companies participating in the same project. Users need to work in the same physical location to improve collaborative work efficiency, but for the sake of information asset security, they cannot simply open up data transmission between each other. Therefore, there is a need to achieve user isolation without physical isolation. At this time, the campus network construction idea based on workstation planning is no longer adaptable. In addition, network upgrades, personnel mobility, and workstation relocation caused by business expansion are also common scenarios. These scenarios require network administrators to speed up policy deployment.

[0004] 2) With the increasing popularization and application of ICT technologies such as WLAN and IoT, the types of access terminals continue to diversify and become more complex. Different types of terminals require different service configurations and policies to be deployed after accessing the network. Administrators need to manually configure different service configurations and policies for different types of terminals, making service deployment complex and cumbersome.

[0005] In summary, the above-mentioned existing campus network configuration solutions have the defects of being inconvenient for network administrators to deploy network policies and having low efficiency in campus network deployment. Summary of the invention

[0006] In order to improve the efficiency of campus network deployment and facilitate network administrators to deploy network policies, the present application provides a campus dynamic network configuration system and a network control method using the system.

[0007] In the first aspect, the invention objective of the present application is achieved by adopting the following technical solutions: A campus dynamic network configuration system, comprising: a user identity authentication module, a terminal identification module, a policy management module and a network controller; The user identity authentication module obtains the identity information of the network user, performs identity authentication on the network user according to the identity information of the network user, and obtains the user authentication result; Based on the user authentication result, the network controller determines the user management architecture information to which the user belongs, and calculates the network access rights corresponding to the user according to the user management architecture information; Obtaining detailed information of the terminal device according to the analysis of the device feature information of the terminal device by the terminal identification module; Based on the detailed information of the terminal device, the policy management module determines the service configuration and security policy applicable to the terminal device; The network controller automatically issues corresponding network configuration according to the network access rights of the network user, the service configuration and security policy of the terminal device.

[0008] By adopting the above technical solution, the user management architecture information includes the user's company information and department information, so that the user's unique identity feature information can be confirmed through the user identity authentication module, providing a data division basis for the subsequent user isolation; the device feature information includes the type and system information of the device, so that different types of terminal devices can be distinguished through the terminal identification module; the detailed information of the terminal device is in a one-to-one correspondence with the terminal device; in order to solve the problem that users of different departments and companies need to work in the same physical location but need to achieve user isolation, and different types of terminals need to deploy different business configurations and policies, and manual configuration is complicated and cumbersome, the present invention first authenticates the network user through the user identity authentication module to obtain the user authentication result, so as to preliminarily screen and check the identity information of the personnel, and at this time it can adapt to users in different scenarios Authentication requirements are conducive to improving the flexibility and security of the user authentication process; the next step is to determine the user's network access rights to facilitate centralized management of the user's network access rights; then, through the detailed information of the terminal device, the business configuration and security policy applicable to the terminal device are determined. Finally, the network controller automatically issues the corresponding network configuration based on the network user's network access rights and the business configuration and security policy of the terminal device, which is conducive to ensuring that specific users can only access business resources and network resources within their authority scope, while realizing differentiated management and automated configuration of different types of terminals, so that network administrators do not need to perform manual configuration in real time, but only need to deploy business configuration and security policies with corresponding permissions in advance according to network user permissions and different types of terminals, which greatly improves the security performance and policy deployment efficiency of the campus network.

[0009] In a preferred example of the present application: the user identity authentication module supports multiple authentication methods, including but not limited to 802.1x authentication and MAC address authentication; the device characteristic information includes the IP address of the device; the authentication methods of the identity authentication module include: Collecting authentication requests from network users, and obtaining identity information of network users based on the authentication requests; Based on the authentication request, select a corresponding authentication method; According to the selected authentication method, the identity information of the network user is authenticated, and the identity authentication result is obtained and sent to the network controller; and / or, The policy management module realizes the decoupling of the policy from the IP address of the terminal device, so that the network access rights of the network user, the service configuration and security policy of the terminal device are consistent.

[0010] By adopting the above technical solution, after the user terminal sends an authentication request to the user identity authentication module, the identity information in the request is parsed to extract the user's username and password and other identity information; then, according to the extracted user identity information and the characteristic information of the terminal device, a suitable authentication method is selected to improve the flexibility and security of the authentication; specifically, if 802.1x authentication is selected, the user identity authentication module communicates with the RADIUS server to verify the user's username and password; if MAC address authentication is selected, the user identity authentication module checks whether the MAC address of the terminal device is in the pre-registered MAC address list; after the verification is passed, an authentication result is generated to ensure that only legitimate users can access the network, thereby improving the security of the network; the network controller further configures the user's network access rights based on the authentication result, and then the policy management module decouples the network access rights, service configuration and security policies to ensure that these policies are not related to the IP address of the terminal device, but are related to the user identity and device type, and the policy management module is used to realize the decoupling of the policy and the IP address of the terminal device, so that the network access rights of the network user, the service configuration and security policies of the terminal device are consistent, thereby improving the flexibility and security of network management.

[0011] In a preferred example of the present application, the detailed information of the terminal device is obtained according to the analysis of the device feature information of the terminal device by the terminal identification module, specifically including: Acquire a protocol message sent by a terminal device, analyze the protocol message, and extract characteristic information of the terminal device, wherein the device characteristic information includes a device type and a device application system; Determine detailed information of the terminal device based on the extracted characteristic information, and send the detailed information of the terminal device to the policy management module; or, The network controller automatically issues network configuration according to the user's network access rights and the service configuration and security policy of the terminal device, including: Based on the user authentication result and detailed information of the terminal device, the network controller generates a specific network configuration for the user; Sending the specific network configuration to the corresponding network device at the next layer, wherein the network configuration sending includes accessing the corresponding switch and wireless AP; The network device adjusts its own network configuration parameters according to the accepted specific network configuration; the network controller monitors the configuration status of the network device and outputs the current network device configuration result.

[0012] By adopting the above technical solution, the terminal identification module is responsible for acquiring and analyzing the protocol messages of the terminal device and determining the detailed information of the terminal device. The terminal device sends the protocol messages through the network, and the terminal identification module helps to ensure that the communication data of the terminal device is accurately captured by identifying these messages, so as to accurately pass them to the policy management module, thereby improving the accuracy of the network configuration; wherein the characteristic information of the terminal device includes the device type, operating system and application system, etc.; the network controller obtains the user's network access rights according to the user authentication result returned by the user identity authentication module, and generates the user's specific network configuration, so as to efficiently ensure that the user's network access rights and the business configuration and security policy of the terminal device are accurately applied to the specific network configuration, thereby improving the security and management efficiency of the network, and at the same time, automatically issuing the network configuration can reduce the workload of manual configuration and improve the efficiency and accuracy of the network configuration.

[0013] In a preferred example of the present application: the policy management module supports dynamic adjustment of network configuration, the steps include: The policy management module performs real-time analysis based on user behavior data and network traffic data to identify potential security threats; When a security threat is detected, the policy management module dynamically adjusts the user's network access rights and the service configuration and security policy of the terminal device; The adjusted network configuration is sent to the network controller, which then re-sends it to the network devices; the network devices adjust according to the new network configuration.

[0014] By adopting the above technical solution, the policy management module can perform real-time analysis based on user behavior data and network traffic to identify potential security threats; user behavior data includes user-side network activity records, access time, access frequency, etc., which is conducive to improving network security and response speed; then by dynamically adjusting the user's network access rights and the business configuration and security policy of the terminal device, it is conducive to ensuring the security of network resources, and finally the adjusted network configuration is sent to the network device through the network controller to ensure that the configuration of the network device is consistent with the new security policy.

[0015] In a preferred example of the present application, the network configuration of the park includes a wired office intranet network, and the network access design of the wired office intranet includes the following steps: Strengthen the 802.1x authentication mechanism, and restrict only legally authorized users to access the wired office intranet through the user identity authentication module; Real-time MAC address authentication, limiting the connection to the intranet to only pre-registered devices; Configure multi-factor authentication mechanisms that combine passwords, hardware tokens, and biometric authentication factors; Use access control lists to restrict access to sensitive resources to specific users or devices.

[0016] By adopting the above technical solutions, the 802.1x authentication mechanism ensures that only legally authorized users can access the wired office intranet, improving the security of the network; MAC address authentication ensures that only pre-registered devices can connect to the intranet, preventing unauthorized devices from accessing; through the multi-factor authentication mechanism, combining multiple authentication factors, the complexity and security of user identity authentication are improved; through the access control list, it is ensured that only authorized users or devices can access sensitive resources, preventing unauthorized access and data leakage.

[0017] In a preferred example of the present application: the local attack prevention of the device in the wired office intranet network includes: Configure a service security protection mechanism, and associate service identifiers with different service types; the service security protection mechanism limits the speed of protocol messages of different services sent to the control plane according to the service identifiers; pre-set a committed information rate and a committed burst size based on each protocol, and determine whether the current protocol message exceeds the corresponding committed information rate, and the device directly discards the protocol message whose rate value exceeds the committed burst size; Configure a dynamic link protection mechanism to disable the rate limit of the message protocol based on the application layer data of the session, and use the dynamic rate range value to limit the rate of protocol messages matching the corresponding application services; Configure blacklists and whitelists, add illegal users identified as attackers to the blacklist, and add legal users or high-priority users to the whitelist. The device preferentially processes packets matching the whitelist features.

[0018] By adopting the above technical solution, the service security protection mechanism is Control Plane Committed Access Rate (CPCAR), which is a technical mechanism for protecting the security of the control plane of network equipment; the committed information rate (CIR) is the committed information rate preset by each protocol, which is used to limit the transmission rate of protocol messages; the committed burst size (CBS) is the committed burst size preset by each protocol, which is used to limit the burst transmission of protocol messages; the service security protection mechanism ensures that different service types can be accurately identified and managed through service identification, and ensures that the transmission rate of each service is within a controllable range by limiting the speed of each protocol message separately, preventing a certain service from occupying too many network resources and ensuring the stability of the network; and the setting of CIR and CBS ensures that the transmission rate of each protocol is within a controllable range, preventing the impact of burst traffic on the network, and the dynamic link protection mechanism ensures the reliability and stability of service sessions; through the black and white list mechanism, it effectively prevents attacks from illegal users, ensures network access for legal users and high-priority users, and improves network security and service quality.

[0019] In the second aspect, the invention objective of the present application is achieved by adopting the following technical solutions: A network control method applied to a campus dynamic network configuration system is applied to the campus dynamic network configuration system as described above.

[0020] In a preferred example of the present application: the method further includes Verifying the user's authority level according to the user identity authentication information; Dynamically generate a network access permission list based on the verified user permission level, the network access permission list including network resources, service permissions and operation permissions accessible to the user; Detect network traffic and user behavior, and evaluate the risk level of user access behavior in real time in combination with preset security policies to obtain risk assessment results; the security policies include access time restrictions, data traffic thresholds, and sensitive operation monitoring; If the risk assessment result shows that the risk level of the user's access behavior exceeds the preset security threshold, a permission adjustment instruction is triggered to dynamically adjust the user's network access rights, including restricting access to specific resources, reducing operating permissions or temporarily freezing the account, and triggering a permission adjustment prompt instruction; Collect and analyze network access logs to identify potential abnormal access patterns or security threats. If there are abnormal access or security threats, output access abnormality prompt information to the preset user management terminal.

[0021] By adopting the above technical solutions, the multi-factor authentication mechanism provides a basis for subsequent permission management; by dynamically generating a list of network access rights, it ensures that the user's access rights match their permission level, and through real-time monitoring and real-time assessment of the risk level of user access behavior, it timely discovers potential security threats and improves the security and response speed of the network; dynamically adjusting the user's network access rights can respond to security threats in a timely manner, and through permission adjustment prompt instructions, the network administrator is notified in a timely manner to ensure that the network administrator can understand and handle security incidents in a timely manner; the administrator is notified in a timely manner through access exception prompt information to ensure that the administrator can understand and handle abnormal access or security threats in a timely manner.

[0022] In a preferred example of the present application: the method further includes: Acquire real-time load information of a target network link and a current transmission rate of a protocol message, and determine whether the target network link is in a congested state based on the real-time load information and a preset load threshold; If the target network link is in a congested state, the rate difference between the current transmission rate and the maximum carrying capacity of the network link is calculated to obtain a rate adjustment interval; Determine the rate adjustment ratio of protocol messages of different priorities according to the rate adjustment interval and the preset whitelist priority strategy; Based on the rate adjustment ratio, the transmission rate of each priority protocol message is dynamically adjusted.

[0023] By adopting the above technical solution, the maximum carrying capacity of the network link is the maximum bandwidth or maximum transmission rate of the network link, and the whitelist priority strategy is used to determine the rate adjustment ratio of protocol messages of different priorities; the transmission rate of each priority protocol message is dynamically adjusted according to the rate adjustment ratio to ensure the stability and fairness of the network link; if the real-time load information exceeds the preset load threshold, the target network link is judged to be in a congested state, and the congestion state of the network link is discovered in time by comparing the load thresholds, thereby improving the response speed and management efficiency of the network; by calculating the rate difference, the rate range that needs to be adjusted is determined to provide a basis for subsequent rate adjustments, and through the whitelist priority strategy, the transmission of high-priority protocol messages is ensured not to be greatly affected, while reducing the transmission rate of low-priority protocol messages to balance the utilization of network resources; and based on the dynamic adjustment of the transmission rate of each priority protocol message, the stability of the network link is ensured, and through the collaborative work of the network controller and the policy management module, the accuracy and consistency of the network configuration are ensured, and the transparency and controllability of network management are improved.

[0024] In a preferred example of the present application: before determining whether the target network link is in a congested state based on the real-time load information and the preset load threshold, the method further includes: Collect device status information in the campus network, and build and update the device status database in real time based on the device status information; wherein the device status information includes the operating status, connection status and performance indicators of the device; Based on the device status database, a network topology diagram is generated to show the connection status and layout status of all network devices in the park; Acquire network traffic data, calculate hot spots and potential bottlenecks of network traffic based on the network traffic data, and obtain traffic parameter distribution information; wherein the network traffic data includes real-time traffic, historical traffic trends and traffic distribution of each network link; The device status information, network topology diagram and traffic parameter distribution information are integrated into a preset visual network management interface.

[0025] By adopting the above technical solutions, the status information of all devices in the campus network can be collected through network management protocols (such as SNMP, NETCONF), and the generated network topology diagram can help administrators intuitively understand the structure of the campus network and the connection relationship of devices; by identifying hot spots and potential bottlenecks of network traffic, a scientific basis is provided for network optimization and troubleshooting. The visual network management interface is a network management tool. By providing intuitive network management tools, it improves network management efficiency and assists network administrators in quickly locating and solving problems.

[0026] In summary, the present application includes at least one of the following beneficial technical effects: 1. User management architecture information includes the user's company information and department information, so that the user's unique identity characteristics can be confirmed through the user identity authentication module, providing a basis for data division for subsequent user isolation; device characteristic information includes the type and system information of the device, so that different types of terminal devices can be distinguished through the terminal identification module; the detailed information of the terminal device is in a one-to-one correspondence with the terminal device; in order to solve the problem that users of different departments and companies need to work in the same physical location but need to achieve user isolation, and that different types of terminals need to deploy different business configurations and policies, and manual configuration is complex and cumbersome, the present invention first authenticates the network user through the user identity authentication module to obtain the user authentication result, so as to preliminarily screen and check the personnel identity information, and at this time it can adapt to the user authentication needs in different scenarios, It is conducive to improving the flexibility and security of the user authentication process; the next step is to determine the user's network access rights, which is convenient for centralized management of the user's network access rights; then, through the detailed information of the terminal device, the service configuration and security policy applicable to the terminal device are determined. Finally, the network controller automatically issues the corresponding network configuration according to the network user's network access rights and the service configuration and security policy of the terminal device, which is conducive to ensuring that specific users can only access the service resources and network resources within their authority scope, and at the same time realizes differentiated management and automatic configuration of different types of terminals, so that network administrators do not need to perform manual configuration in real time, but only need to deploy the service configuration and security policy of the corresponding authority according to the network user's authority and different types of terminals in advance, which greatly improves the security performance and policy deployment efficiency of the campus network; 2. The multi-factor authentication mechanism provides a basis for subsequent permission management; by dynamically generating a list of network access permissions, it ensures that the user's access permissions match their permission levels; through real-time monitoring and real-time assessment of the risk level of user access behavior, it promptly discovers potential security threats and improves network security and response speed; dynamically adjusting the user's network access permissions can respond to security threats in a timely manner, and through permission adjustment prompts, it promptly notifies the network administrator to ensure that the network administrator can understand and handle security incidents in a timely manner; through access exception prompts, it promptly notifies the administrator to ensure that the administrator can understand and handle abnormal access or security threats in a timely manner; 3. The maximum carrying capacity of a network link is the maximum bandwidth or maximum transmission rate of a network link. The whitelist priority strategy is used to determine the rate adjustment ratio of protocol messages of different priorities. The transmission rate of each priority protocol message is dynamically adjusted according to the rate adjustment ratio to ensure the stability and fairness of the network link. If the real-time load information exceeds the preset load threshold, the target network link is judged to be in a congested state. By comparing the load threshold, the congestion state of the network link is discovered in time to improve the response speed and management efficiency of the network. By calculating the rate difference, the rate range that needs to be adjusted is determined to provide a basis for subsequent rate adjustments. Through the whitelist priority strategy, the transmission of high-priority protocol messages is ensured not to be greatly affected, while reducing the transmission rate of low-priority protocol messages to balance the utilization of network resources. Based on the dynamic adjustment of the transmission rate of each priority protocol message, the stability of the network link is ensured. Through the collaborative work of the network controller and the policy management module, the accuracy and consistency of the network configuration are ensured, and the transparency and controllability of network management are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a framework diagram of a campus dynamic network configuration system in one embodiment of the present application; Figure 2 This is a flow chart of a network control method applied to a campus dynamic network configuration system in an embodiment of the present application; Figure 3 This is another flow chart of a network control method applied to a campus dynamic network configuration system in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The present application is further described in detail below in conjunction with the accompanying drawings.

[0029] In one embodiment, if Figure 1 As shown, the present application discloses a campus dynamic network configuration system, which includes a user identity authentication module, a terminal identification module, a policy management module and a network controller.

[0030] The user identity authentication module is used to obtain the identity information of the network user, authenticate the network user based on the identity information of the network user, and obtain the user authentication result; the user terminal sends the identity information to the user identity authentication module, including the user name, password, dynamic password generated by the hardware token, biometric information, etc. The user identity authentication module verifies the user's identity information and compares it with the preset user database. After the verification is passed, the user identity authentication module returns the user authentication result, including the user's identity authentication status and user authority level.

[0031] The user authentication module supports multiple authentication methods, including but not limited to 802.1x authentication and MAC address authentication; the device characteristic information includes the IP address of the device; the authentication methods of the authentication module include: collecting the authentication request of the network user, and obtaining the identity information of the network user based on the authentication request; based on the authentication request, selecting the corresponding authentication method; according to the selected authentication method, authenticating the identity information of the network user, obtaining the authentication result and sending it to the network controller.

[0032] Based on the user authentication result, the network controller determines the user management architecture information to which the user belongs, and calculates the user's corresponding network access rights based on the user management architecture information; the user management architecture information includes the user's company information, department information and role information; based on the user management architecture information, the network access rights corresponding to the user are obtained from the preset permission configuration library, where the network access rights include accessible network resources, service permissions and operation permissions. According to the terminal identification module's analysis of the device feature information of the terminal device, the detailed information of the terminal device is obtained; the terminal device sends protocol messages through the network, and the terminal identification module captures these messages, such as using standard network protocols (such as TCP / IP) and network sniffing tools (such as Wireshark); the terminal identification module parses the protocol messages and extracts the characteristic information of the terminal device, including the device type, operating system and application system.

[0033] In this embodiment, based on the analysis of the device characteristic information of the terminal device by the terminal identification module, detailed information of the terminal device is obtained, specifically including obtaining the protocol message sent by the terminal device, analyzing the protocol message, and extracting the characteristic information of the terminal device, the device characteristic information includes the device type and the device application system; based on the extracted characteristic information, the detailed information of the terminal device is determined, and the detailed information of the terminal device is sent to the policy management module.

[0034] Based on the detailed information of the terminal device, the policy management module determines the business configuration and security policy applicable to the terminal device. The policy management module decouples the policy from the IP address of the terminal device, so that the network access rights of the network user, the business configuration and security policy of the terminal device are consistent; that is, the policy management module selects the applicable business configuration and security policy from the preset business configuration library and security policy library according to the detailed information of the terminal device. The business configuration includes VLAN allocation, IP address allocation, bandwidth limitation, etc.; the network controller automatically issues the corresponding network configuration according to the network access rights of the network user, the business configuration and security policy of the terminal device, including VLAN allocation, IP address allocation, access control list (ACL); the network controller generates the network devices to the next layer, such as access switches and wireless APs; by automatically issuing the network configuration, the workload of manual configuration is reduced, and the accuracy and efficiency of the network configuration are improved.

[0035] The policy management module supports dynamic adjustment of network configuration. The steps include: the policy management module performs real-time analysis based on user behavior data and network traffic data to identify potential security threats; user behavior data includes user network activity records, access time, access frequency, and log management systems (such as ELK The network traffic data includes the size, type, source and destination of the network traffic. The network traffic data is collected by network monitoring tools (such as NetFlow and sFlow). The policy management module uses data analysis and machine learning algorithms (such as anomaly detection algorithms and behavior analysis models) to analyze the collected data in real time and identify potential security threats, such as abnormal traffic and malicious behavior. When a security threat is detected, the policy management module dynamically adjusts the user's network access rights and the business configuration and security policies of the terminal device. The policy management module uses a configuration management library (such as Ansible) to dynamically adjust the user's network access rights and the business configuration and security policies of the terminal device, and the configuration management library supports dynamic updates and applications. The dynamically adjusted configuration parameters include VLAN allocation, ACL rules, bandwidth allocation, and firewall rules. Among them, business configuration adjustment includes restricting the access of certain applications and adjusting bandwidth allocation. Updating the security policy of the terminal device includes enabling stricter firewall rules and increasing the frequency of logging. The adjusted network configuration is sent to the network controller, which is then re-issued to the network device. The network device is adjusted according to the new network configuration.

[0036] In this embodiment, the network controller automatically sends down the network configuration according to the user's network access rights and the service configuration and security policy of the terminal device, including generating the user's specific network configuration based on the user authentication result and the detailed information of the terminal device; sending the specific network configuration to the corresponding network device at the next layer. In actual application, the network controller sends down the specific network configuration through the network management protocol (such as SNMP, NETCONF); the network configuration sending includes access to the corresponding switch and wireless AP; the network device adjusts its own network configuration parameters, such as VLAN configuration and ACL rules, according to the accepted specific network configuration; the network controller monitors the configuration status of the network device and outputs the current network device configuration results.

[0037] In this embodiment, the network configuration of the park includes a wired office intranet network, a wired office extranet network and a wireless network; wherein the network access design of the wired office intranet includes the following steps: Strengthen the 802.1x authentication mechanism, and restrict only legally authorized users to access the wired office intranet through the user identity authentication module; the 802.1x authentication mechanism is a port-based network access control protocol. Real-time MAC address authentication restricts only pre-registered devices to connect to the intranet; for example, the user terminal sends an authentication request to the user identity authentication module through the 802.1x authentication protocol, and the request contains the user's username and password; the user identity authentication module communicates with the RADIUS server to verify the user's username and password; after the verification is passed, the user identity authentication module returns a successful authentication result, allowing the user to access the wired office intranet. MAC authentication is an authentication mechanism based on the device MAC address. Specifically, 802.1x authentication or MAC authentication is enabled at the network access point (such as the switch port). When the user terminal is connected to the network, the switch captures the MAC address of the terminal device; the switch sends the captured MAC address to the user identity authentication module for verification; the user identity authentication module checks whether the MAC address is in the pre-registered MAC address list. If it is in the list, access is allowed, otherwise access is denied.

[0038] Configure a multi-factor authentication mechanism that combines passwords, hardware tokens, and biometric authentication factors; the user terminal sends a multi-factor authentication request to the user identity authentication module, which includes the user's username, password, dynamic password generated by the hardware token, and biometric information (such as fingerprints and facial recognition); after all multi-factor authentications are passed, the user identity authentication module returns a successful authentication result, allowing the user to access the wired office intranet.

[0039] Use access control lists to limit the access rights of specific users or devices to sensitive resources; access control lists define the access rights of specific users or devices, such as allowing or denying access to specific IP addresses, ports, protocols, etc. Switches and routers filter network traffic according to ACL rules to limit the access rights of specific users or devices to sensitive resources.

[0040] The local attack prevention of wired office intranet devices includes: Configure the service security protection mechanism and associate service identifiers with different service types. The service identifier can be a specific protocol type, port number, IP address, etc., to distinguish different services. The service security protection mechanism limits the rate of protocol packets of different services sent to the control plane according to the service identifier. The committed information rate and committed burst size are pre-set for each protocol, and the device determines whether the current protocol packet exceeds the corresponding committed information rate. The device directly discards the protocol packets that exceed the rate value of the committed burst size. The committed information rate (CIR) is the committed information rate pre-set for each protocol. The committed burst size (CBS) is the committed burst size pre-set for each protocol. The device monitors the transmission rate of each protocol in real time, limits the rate of protocol packets of each service using the QoS (Quality of Service) policy, and determines whether the current protocol packet exceeds the corresponding CIR. If the transmission rate of the current protocol packet exceeds the CIR, the device temporarily caches the packets that exceed the CIR. If the transmission rate of the current protocol packet exceeds the CBS, the device directly discards the packets that exceed the CBS.

[0041] Configure a dynamic link protection mechanism to disable the rate limit of the message protocol based on the application layer data of the session, and use the dynamic rate interval value to limit the rate of the protocol messages matching the corresponding application services; use the DPI (Deep Packet Inspection) technology to identify the characteristics of the session and dynamically adjust the rate limit policy of the protocol messages; use the dynamic rate interval value to limit the rate of the protocol messages matching the corresponding application services.

[0042] Configure blacklists and whitelists, set illegal users identified as attackers in the blacklist, and set legal users or high-priority users identified in the whitelist. The device will give priority to processing messages that match the whitelist features. Blacklists and whitelists support dynamic updates and configurations. The network controller and policy management module work together to ensure the accuracy and consistency of network configuration.

[0043] In one embodiment, a network control method applied to a campus dynamic network configuration system is provided. The network control method applied to a campus dynamic network configuration system is applied to the campus dynamic network configuration system as described above.

[0044] like Figure 2 As shown, a network control method applied to a campus dynamic network configuration system specifically includes the following steps: S1: Verify the user's authority level based on the user's identity authentication information.

[0045] In this embodiment, the user terminal sends an authentication request to the user identity authentication module. After the verification is passed, the user identity authentication module returns the user's authority level. The user identity authentication module uses multi-factor authentication client software, and the multi-factor authentication client software supports the input and transmission of multiple authentication factors.

[0046] S2: Dynamically generate a network access permission list based on the verified user permission level. The network access permission list includes network resources, service permissions, and operation permissions that the user can access.

[0047] Specifically, the network controller obtains a corresponding network access permission list from a preset permission configuration library according to the user permission level returned by the user identity authentication module.

[0048] S3: Detect network traffic and user behavior, and evaluate the risk level of user access behavior in real time based on preset security policies to obtain risk assessment results; security policies include access time restrictions, data traffic thresholds, and sensitive operation monitoring.

[0049] In this embodiment, the security policy includes access time limit, data traffic threshold, and sensitive operation monitoring; the risk assessment result includes the risk level of the user's access behavior, such as low risk, medium risk, and high risk; the network monitoring module sends the risk assessment result to the network controller; the network controller determines whether the risk level of the user's access behavior exceeds the preset security threshold based on the risk assessment result.

[0050] S4: If the risk assessment result shows that the risk level of the user's access behavior exceeds the preset security threshold, the permission adjustment instruction is triggered to dynamically adjust the user's network access rights, including restricting access to specific resources, reducing operating permissions or temporarily freezing the account, and triggering the permission adjustment prompt instruction.

[0051] In this embodiment, the permission adjustment instruction is triggered when the risk level of the user's access behavior exceeds the preset security threshold, and the user's network access rights are dynamically adjusted; the permission adjustment prompt instruction is triggered when the risk level of the user's access behavior exceeds the preset security threshold, and the user management terminal is notified.

[0052] S5: Collect and analyze network access logs to identify potential abnormal access patterns or security threats. If there are abnormal access or security threats, output access abnormality prompt information to the preset user management terminal.

[0053] Specifically, the network access log records the user's network access behavior; if there is abnormal access or security threat, the network controller generates access exception prompt information and sends the information to the preset user management terminal; the user management terminal receives the access exception prompt information, displays the abnormal information, and notifies the administrator to take further measures.

[0054] In one embodiment, if Figure 3 As shown, a network control method applied to a campus dynamic network configuration system also includes: S10: Acquire real-time load information of the target network link and the current transmission rate of the protocol message, and determine whether the target network link is in a congested state based on the real-time load information and a preset load threshold.

[0055] In this embodiment, the real-time load information includes current traffic and bandwidth utilization; the load threshold is a threshold used to determine whether a network link is in a congested state.

[0056] Specifically, the network controller monitors the load of the target network link in real time to obtain real-time load information, and monitors the transmission of the protocol message in real time to obtain the current transmission rate of the protocol message.

[0057] S20: If the target network link is in a congested state, the rate difference between the current transmission rate and the maximum carrying capacity of the network link is calculated to obtain a rate adjustment interval.

[0058] In this embodiment, when the load of a network link exceeds a preset load threshold, the network link is considered to be in a congested state; the maximum carrying capacity of the network link is represented by the maximum bandwidth or maximum transmission rate of the network link; the rate difference is equal to the maximum carrying capacity of the network link minus the current transmission rate; the rate adjustment interval is the rate range that needs to be adjusted, and the rate range that needs to be adjusted is determined by calculating the rate difference, providing a basis for subsequent rate adjustment.

[0059] Specifically, the network controller is provided with a network monitoring module for monitoring the network load. The network monitoring module uses network traffic monitoring tools (such as NetFlow, sFlow) to collect real-time load information; uses protocol analysis tools (such as Wireshark) to collect the current transmission rate of protocol packets; and the network monitoring module compares the real-time load information with a preset load threshold.

[0060] S30: Determine the rate adjustment ratio of protocol messages of different priorities according to the rate adjustment interval and the preset whitelist priority strategy.

[0061] In this embodiment, the whitelist priority strategy is used to determine the rate adjustment ratio of protocol messages of different priorities; the preset whitelist priority strategy includes the priority order and adjustment ratio of protocol messages of different priorities; for example, the adjustment ratio of high-priority protocol messages is lower, and the adjustment ratio of low-priority protocol messages is higher.

[0062] Specifically, a preset priority strategy table is used to match according to the priority order and adjustment ratio. The priority strategy table supports the configuration and management of multiple priorities to ensure the diversity and flexibility of the strategy.

[0063] S40: Based on the rate adjustment ratio, dynamically adjust the transmission rate of each priority protocol message.

[0064] In this embodiment, the network controller dynamically adjusts the transmission rate of each priority protocol message according to the determined rate adjustment ratio; the transmission rate of the high priority protocol message is adjusted less, and the transmission rate of the low priority protocol message is adjusted more.

[0065] Specifically, the network device supports dynamic bandwidth adjustment and configuration, and the transmission rate adjustment supports multiple protocols and devices; so that the network controller dynamically adjusts the transmission rate of each priority protocol message according to the determined rate adjustment ratio.

[0066] In one embodiment, before step S10, a network control method applied to a campus dynamic network configuration system further includes: S11: Collect device status information in the campus network, and build and update a device status database in real time based on the device status information; wherein the device status information includes the device's operating status, connection status, and performance indicators.

[0067] Specifically, device status information includes the device's operating status (such as online, offline, and faulty), connection status (such as connected ports, connected devices), and performance indicators (such as CPU utilization, memory utilization, and bandwidth utilization). The device status database is used to store the status information of all devices in the campus network and supports real-time updates. The network monitoring module collects the status information of all devices in the campus network through network management protocols (such as SNMP).

[0068] S12: Based on the device status database, a network topology diagram is generated to display the connection status and layout status of all network devices in the park.

[0069] Specifically, the network topology diagram can display the connection status and layout status of all network devices in the campus; use network topology generation tools (such as Graphviz, NetworkX) to generate a network topology diagram of the connection status and layout status of all network devices in the campus.

[0070] S13: Obtain network traffic data, calculate network traffic hotspots and potential bottlenecks based on the network traffic data, and obtain traffic parameter distribution information; wherein the network traffic data includes real-time traffic, historical traffic trends, and traffic distribution of each network link.

[0071] In this embodiment, the traffic parameter distribution information is information about traffic hot spots and potential bottlenecks calculated based on network traffic data.

[0072] S14: Integrate the device status information, network topology diagram and traffic parameter distribution information into a preset visual network management interface.

[0073] In this embodiment, the visual network management interface is a management interface that integrates device status information, network topology diagrams, and traffic parameter distribution information, providing an intuitive network management tool; the visual network management interface supports multiple display methods, such as tables, charts, maps, etc.

[0074] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0075] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, it should be understood by those skilled in the art that the technical solutions described in the aforementioned embodiments may still be modified, or some of the features thereof may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A campus dynamic network configuration system, characterized in that: include: User identity authentication module, terminal identification module, policy management module and network controller; The user identity authentication module obtains the identity information of the network user, performs identity authentication on the network user according to the identity information of the network user, and obtains the user authentication result; Based on the user authentication result, the network controller determines the user management architecture information to which the user belongs, and calculates the network access rights corresponding to the user according to the user management architecture information; Obtaining detailed information of the terminal device according to the analysis of the device feature information of the terminal device by the terminal identification module; Based on the detailed information of the terminal device, the policy management module determines the service configuration and security policy applicable to the terminal device; The network controller automatically issues corresponding network configuration according to the network access rights of the network user, the service configuration and security policy of the terminal device.

2. A campus dynamic network configuration system according to claim 1, characterized in that: The user identity authentication module supports multiple authentication methods, including but not limited to 802.1x authentication and MAC address authentication; the device characteristic information includes the IP address of the device; The authentication method of the identity authentication module includes: Collecting authentication requests from network users, and obtaining identity information of network users based on the authentication requests; Based on the authentication request, select a corresponding authentication method; According to the selected authentication method, the identity information of the network user is authenticated, and the identity authentication result is obtained and sent to the network controller; and / or, The policy management module realizes the decoupling of the policy from the IP address of the terminal device, so that the network access rights of the network user, the service configuration and security policy of the terminal device are consistent.

3. A campus dynamic network configuration system according to claim 1, characterized in that: The obtaining detailed information of the terminal device according to the analysis of the device feature information of the terminal device by the terminal identification module specifically includes: Acquire a protocol message sent by a terminal device, analyze the protocol message, and extract characteristic information of the terminal device, wherein the device characteristic information includes a device type and a device application system; Determine detailed information of the terminal device based on the extracted characteristic information, and send the detailed information of the terminal device to the policy management module; or, The network controller automatically issues network configuration according to the user's network access rights and the service configuration and security policy of the terminal device, including: Based on the user authentication result and detailed information of the terminal device, the network controller generates a specific network configuration for the user; Sending the specific network configuration to the corresponding network device at the next layer, wherein the network configuration sending includes accessing the corresponding switch and wireless AP; The network device adjusts its own network configuration parameters according to the accepted specific network configuration; the network controller monitors the configuration status of the network device and outputs the current network device configuration result.

4. A campus dynamic network configuration system according to claim 3, characterized in that: The policy management module supports dynamic adjustment of network configuration, and the steps include: The policy management module performs real-time analysis based on user behavior data and network traffic data to identify potential security threats; When a security threat is detected, the policy management module dynamically adjusts the user's network access rights and the service configuration and security policy of the terminal device; The adjusted network configuration is sent to the network controller, which then re-sends it to the network devices; the network devices adjust according to the new network configuration.

5. A campus dynamic network configuration system according to claim 2, characterized in that: The network configuration of the campus includes a wired office intranet network, and the network access design of the wired office intranet includes the following steps: Strengthen the 802.1x authentication mechanism, and restrict only legally authorized users to access the wired office intranet through the user identity authentication module; Real-time MAC address authentication, limiting the connection to the intranet to only pre-registered devices; Configure multi-factor authentication mechanisms that combine passwords, hardware tokens, and biometric authentication factors; Use access control lists to restrict access to sensitive resources to specific users or devices.

6. A campus dynamic network configuration system according to claim 5, characterized in that: The local attack prevention of the equipment in the wired office intranet network includes: Configure a service security protection mechanism, and associate service identifiers with different service types; the service security protection mechanism limits the speed of protocol messages of different services sent to the control plane according to the service identifiers; pre-set a committed information rate and a committed burst size based on each protocol, and determine whether the current protocol message exceeds the corresponding committed information rate, and the device directly discards the protocol message whose rate value exceeds the committed burst size; Configure a dynamic link protection mechanism to disable the rate limit of the message protocol based on the application layer data of the session, and use the dynamic rate range value to limit the rate of protocol messages matching the corresponding application services; Configure blacklists and whitelists, add illegal users identified as attackers to the blacklist, and add legal users or high-priority users to the whitelist. The device preferentially processes packets matching the whitelist features.

7. A network control method applied to a park dynamic network configuration system, characterized in that: Applicable to the campus dynamic network configuration system as described in any one of claims 1-6.

8. A network control method applied to a campus dynamic network configuration system according to claim 7, characterized in that: The method further comprises Verifying the user's authority level according to the user identity authentication information; Dynamically generate a network access permission list based on the verified user permission level, the network access permission list including network resources, service permissions and operation permissions accessible to the user; Detect network traffic and user behavior, and evaluate the risk level of user access behavior in real time in combination with preset security policies to obtain risk assessment results; the security policies include access time restrictions, data traffic thresholds, and sensitive operation monitoring; If the risk assessment result shows that the risk level of the user's access behavior exceeds the preset security threshold, a permission adjustment instruction is triggered to dynamically adjust the user's network access rights, including restricting access to specific resources, reducing operating permissions or temporarily freezing the account, and triggering a permission adjustment prompt instruction; Collect and analyze network access logs to identify potential abnormal access patterns or security threats. If there are abnormal access or security threats, output access abnormality prompt information to the preset user management terminal.

9. A network control method applied to a campus dynamic network configuration system according to claim 8, characterized in that: The method further comprises: Acquire real-time load information of a target network link and a current transmission rate of a protocol message, and determine whether the target network link is in a congested state based on the real-time load information and a preset load threshold; If the target network link is in a congested state, the rate difference between the current transmission rate and the maximum carrying capacity of the network link is calculated to obtain a rate adjustment interval; Determine the rate adjustment ratio of protocol messages of different priorities according to the rate adjustment interval and the preset whitelist priority strategy; Based on the rate adjustment ratio, the transmission rate of each priority protocol message is dynamically adjusted.

10. A network control method applied to a campus dynamic network configuration system according to claim 9, characterized in that: Before determining whether the target network link is in a congested state based on the real-time load information and the preset load threshold, the method further includes: Collect device status information in the campus network, and build and update the device status database in real time based on the device status information; wherein the device status information includes the operating status, connection status and performance indicators of the device; Based on the device status database, a network topology diagram is generated to show the connection status and layout status of all network devices in the park; Acquire network traffic data, calculate the hot spots and potential bottlenecks of network traffic based on the network traffic data, and obtain traffic parameter distribution information; wherein the network traffic data includes the real-time traffic, historical traffic trends and traffic distribution of each network link; The device status information, network topology diagram and traffic parameter distribution information are integrated into a preset visual network management interface.

Images