Network link fixing and access detection method based on terminal identity authentication

Abstract

The invention discloses a network link fixing and access detection method based on terminal identity authentication, which relates to the technical field of communication, and comprises the following steps: S1, blocking and locking a target port based on a physical network port lock, and establishing a binding relationship between the physical network port lock and the corresponding target port; s2, establishing authorized unlocking of the physical network port lock in response to the connection between the management system and the physical network port lock; s3, performing identity verification on target equipment accessed by the unlocking port based on the authorized equipment table, and judging whether the target equipment is authorized equipment or not; s4, performing corresponding access control on the target equipment according to the judgment result of the authorized equipment; the problem that physical identity double isolation is not carried out on the switch port in the prior art, so that the protection effect of the intranet port is poor is solved, even if abnormal equipment is accessed, the access range of the abnormal equipment can be limited to the maximum extent, the security protection effect of the intranet is remarkably improved, and efficient and reliable management of the port is achieved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a network link fixing and access detection method based on terminal identity authentication. Background Art

[0002] With the development of information technology, almost all industries adopt the form of intranet for information security to completely isolate the Internet and achieve network security; however, due to business needs, many network ports will be exposed to the outside, resulting in network security problems. In addition, the wrong network interface will cause illegal external connections, which is also a major pain point when using the intranet. In the prior art, there are certain software protection measures for these exposed ports, such as shutting down unused ports and binding used ports to IP and MAC. However, not all terminals are directly connected to the management switch port, and more often there are multiple devices connected to one port such as hub. In this case, binding will not be possible, and the idle ports are not all on manageable switches, and there is a situation where they cannot be shut down. Regardless of IP, MAC binding or port shutdown, it only works on the set switch. After the switch itself has problems (such as password leakage, being hacked, etc.), the entire network will be open to the accessor. In addition, these measures only increase the difficulty of identity counterfeiting by social engineering intruders, but cannot completely eliminate identity counterfeiting, such as counterfeiting bound IP and MAC for access.

[0003] Chinese patent, publication number: CN114629861B, publication date: January 6, 2024, discloses a method for locking operation of a process control switch, by detecting that one of the multiple ports of the process control switch is connected to a second switch, analyzing the handshake between the process control switch and the second switch to determine whether the second switch is lockable, and when the analysis result indicates that the second switch is lockable, forwarding the message received from the second switch at the process control switch without authenticating the source physical address of the message; when the analysis result indicates that the second switch is not lockable, authenticating the source physical address included in the message received at the port, so as to analyze the message received at the port to determine whether the received message identifies a source physical address included in a list of known physical addresses, i.e., a "known pair"; realizing that the intelligent process control switch detects malicious devices by checking the network address of the malicious device against the expected network address of the "known pair"; the invention is mainly based on the connection remote control port of the communication protocol, if there is a problem with the communication link between the switches, the handshake result will be abnormal, and then the port locking judgment condition will be unreliable. Summary of the invention

[0004] The purpose of the present invention is to solve the problem that the prior art does not perform dual physical identity isolation on the switch port, resulting in poor security protection effect of the intranet port; a network link fixing and access detection method based on terminal identity authentication is proposed, all ports are blocked by a physical network port lock, and the lock is unlocked after the system authorization to perform device management and maintenance; access device information is monitored in real time and matched with the authorized device table to perform identity verification on the access device, access permission control adjustment and port closure for unauthorized devices, and their connection is blocked; the problem that it is difficult for one port to correspond to multiple devices or idle ports are prohibited from access is solved, and the problem that the prior art does not perform dual physical identity isolation on the switch port, resulting in poor protection effect of the intranet port is overcome, and the security protection effect of the intranet and the efficient and reliable management of the port are significantly improved.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: a network link fixing and access detection method based on terminal identity authentication, comprising the following steps: S1. Blocking and locking the target port based on the physical network port lock, and establishing a binding relationship between the physical network port lock and the corresponding target port; S2, in response to the establishment of a connection between the management system and the physical network port lock, authorizing unlocking of the physical network port lock; S3, performing identity verification on the target device accessed by the unlocked port based on the authorized device table to determine whether the target device is an authorized device; S4. Perform corresponding access control on the target device according to the determination result of the authorized device.

[0006] In this solution, all device ports are blocked by physical network port locks to achieve fixed network links, prohibit all intranet ports from being exposed, prevent network mis-plugging and illegal external connections, reduce the human defense costs of exposed ports, and at the same time determine the accessible terminal devices to ensure the security of intranet access devices; the identity of the target device accessed by the unlocked port is verified through the authorized device table to prevent external devices from arbitrarily accessing and accessing the intranet to cause network security problems, and combine with the physical network port lock to achieve dual port protection and security management. In addition, it ensures that unauthorized devices are misconnected or maliciously access the port when the network port lock is unlocked. Devices can no longer access the intranet, and achieve the ability to limit their access range to the greatest extent; solve the problem of one port corresponding to multiple devices or idle ports being prohibited from access that cannot be solved by managing switches, and increase the difficulty of abnormal device access.

[0007] Preferably, the physical network port lock includes an idle lock and a service lock (such as Figure 2 shown); The idle lock indicates that the blocked target port is in an idle state with no device connected; The service lock indicates that the blocked target port is in a state of accessing a service device.

[0008] Preferably, in S1, establishing the binding relationship between the physical network port lock and the corresponding port includes the following sub-steps: A data dictionary is established based on the unique identifier of the physical network port lock and the corresponding target port information, and a data relationship mapping is performed between the unique identifier and the target port information to bind the physical network port lock to the target port.

[0009] In this solution, the unused ports are blocked by using an idle physical network port lock to prevent the network from being accidentally plugged in and unplugged and illegally connected. The ports that can access business equipment are blocked by using a business physical network port lock to ensure that these ports cannot be accessed without authorization. At the same time, the physical network port lock is bound to the port, and the corresponding relationship between the physical network port lock and the port is clarified to facilitate management and tracking. The physical network port lock does not directly connect to the protected internal network and does not affect the use of the original network. It is just a physical mechanical lock.

[0010] Preferably, S2 comprises the following sub-steps: S21, the management system generates an unlocking instruction based on equipment management and maintenance requirements; S22, establishing a connection between the management system and the physical network port lock based on a handshake protocol, and obtaining an unlocking code of the physical network port lock; S23: The physical network port lock completes authorized unlocking based on the unlocking code.

[0011] Preferably, the S22 comprises the following sub-steps: The management system sends the unlocking instruction to the physical network port lock to establish a communication connection with the physical network port lock; the physical network port lock sends a unique identifier to the management system according to the received unlocking instruction; The management system retrieves an unlock code based on the unique identifier, encrypts the retrieved unlock code and sends the encrypted code to the physical network port lock.

[0012] In this solution, the handshake protocol can ensure the reliability and stability of the connection between the management system and the physical network port lock. During the connection establishment process, both parties will send confirmation messages to each other to ensure that both parties can receive each other's messages, thereby avoiding the situation of connection establishment failure or message loss; unlocking with an unlock code can achieve strict control of the access rights of the physical network port lock. Only the management system holding the unlock code can accurately open the physical network port lock, thereby avoiding unauthorized access and operation.

[0013] Preferably, S3 includes the following sub-steps: The device access status of the port where the physical network port lock is unlocked is monitored in real time, and the identity information of the target device is obtained; the identity information is retrieved based on the authorized device table, and if the identity information is not retrieved in the authorized device table, the target device is not an unauthorized device.

[0014] Preferably, the authorized device table includes: Obtain basic feature information of terminal devices that have been connected to the management system, classify the terminal devices, and combine and encrypt the data to obtain unique identity information of the terminal devices; The basic feature information includes at least: processor serial number, BIOS number and hard disk serial number; The types of terminal devices include application terminals and dumb terminals; The authorized device table is established based on the unique identity information.

[0015] In this solution, in order to prevent devices from accessing the port at will, a physical network port lock is used to block the port. However, when a new device needs to be connected or replaced, the network port lock will be unlocked, and the port will be exposed. Unauthorized devices may "take the opportunity to" access the port. Therefore, after the network port lock is unlocked, the port is continuously monitored in real time, and the identity information of the new access is obtained, and this information is retrieved in the authorized device table (which stores the unique identity information of the authorized device). If it is retrieved, it means that the connected device is an authorized device and is allowed to access the intranet. If it is not retrieved, the new device identity is further manually verified to determine whether it is an authorized device. If the manual verification passes, the device is allowed to access, and a binding relationship between the device and the port is established, and the unique identity information of the device is entered into the authorized device table to update the authorized device table.

[0016] Preferably, S4 includes the following sub-steps: If the target device is an authorized device, the target device is bound to the target port, and the network port request of the target device is allowed to access; if the target device is not an authorized device, the corresponding access rights of the target port are adjusted to block the network port request of the target device.

[0017] Preferably, the method further comprises: After the target device and the target port are bound, the physical network port lock corresponding to the target port is locked.

[0018] Preferably, the method further comprises: The access permission is set based on different types of terminal devices and the protocols, network port addresses and flow information of the terminal devices.

[0019] In this solution, the target device is bound to the port to facilitate the management and subsequent maintenance of the device. When the target device is determined to be unauthorized, for the sake of intranet security, since it has occupied the port, it is necessary to adjust the access rights of the port or directly close the port, thereby blocking the access device from accessing the intranet. This ensures that only authorized devices can access the port and access the intranet, improves network security, and enables the ability to limit the access scope of abnormal devices to the greatest extent even if they have already accessed the port.

[0020] Beneficial effects of the present invention: 1. Block all device ports through physical network port locks to achieve fixed network links, prohibit all intranet ports from being exposed, prevent network mis-plugging and illegal external connections, and reduce the human defense costs of exposed ports; at the same time, solve the problem that one port corresponds to multiple devices or idle ports are prohibited from access, which cannot be solved by managing switches, and increase the difficulty of abnormal device access; 2. Prevent external devices from arbitrarily accessing and accessing the intranet to cause network security problems by verifying the identity of the target device accessed by the port, and combine physical network port locks to achieve dual port protection and security management, so that even if abnormal devices have been connected, their access scope can be limited to the greatest extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Other features, objects and advantages of the present invention will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings. The drawings are only for the purpose of illustrating preferred embodiments and are not to be considered as limiting the present invention. Also, the same reference symbols are used throughout the drawings to represent the same parts.

[0022] Figure 1 This is a flow chart of a network link fixing and access detection method based on terminal identity authentication in this embodiment.

[0023] Figure 2 This is a physical picture of a physical network port lock of this embodiment.

[0024] Figure 3 The figure is a schematic diagram of a physical network port lock unlocking process of this embodiment.

[0025] Figure 4 The figure is a schematic diagram of an access device identity verification process of this embodiment. DETAILED DESCRIPTION

[0026] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific implementation method described herein is only an optimal embodiment of the present invention, which is only used to explain the present invention and does not limit the scope of protection of the present invention. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0027] Example 1: Figure 1 As shown, a method for fixing a network link and detecting access based on terminal identity authentication includes steps S1-S4, wherein: S1. Block and lock the target port based on the physical network port lock, and establish a binding relationship between the physical network port lock and the corresponding target port.

[0028] Specifically, Figure 2 As shown, the physical network port lock includes an idle lock and a business lock; Among them, the idle lock indicates that the blocked target port is in an idle state with no device connected; The service lock indicates that the blocked target port is in the state of accessing service equipment.

[0029] Specifically, in S1, a binding relationship between a physical network port lock and a corresponding port is established, including the following sub-steps: A data dictionary is established based on the unique identifier of the physical network port lock and the corresponding target port information, and a data relationship mapping is performed between the unique identifier and the target port information to bind the physical network port lock to the target port.

[0030] In this embodiment, an idle physical network port lock is used to block unused ports to prevent network mis-plugging and illegal external connections. A business-type physical network port lock is used to block ports that can access business devices to ensure that these ports cannot be accessed without authorization. At the same time, the physical network port lock is bound to the port to clarify the corresponding relationship between the physical network port lock and the port for easy management and tracking. The physical network port lock does not directly access the protected internal network and does not affect the use of the original network. It is just a physical mechanical lock.

[0031] S2. In response to the establishment of a connection between the management system and the physical network port lock, the physical network port lock is authorized to be unlocked.

[0032] Specifically, S2 includes the following sub-steps: S21. The management system generates an unlocking instruction based on the equipment management and maintenance requirements; S22. Establish a connection between the management system and the physical network port lock based on the handshake protocol, and obtain an unlocking code of the physical network port lock; S23. The physical network port lock completes authorized unlocking based on the unlocking code.

[0033] In this embodiment, the reliability and stability of the connection between the management system and the physical network port lock can be ensured based on the handshake protocol. During the connection establishment process, both parties will send confirmation messages to each other to ensure that both parties can receive each other's messages, thereby avoiding the situation of connection establishment failure or message loss; unlocking by unlocking code can achieve strict control of the access rights of the physical network port lock. Only the management system holding the unlocking code can accurately open the physical network port lock, thereby avoiding unauthorized access and operation.

[0034] Specifically, S22 includes the following sub-steps: The management system sends an unlocking command to the physical network port lock and establishes a communication connection with the physical network port lock; The physical network port lock sends a unique identifier to the management system according to the received unlocking instruction; The management system retrieves the unlock code based on the unique identifier, encrypts the retrieved unlock code and sends it to the physical network port lock.

[0035] As an implementation method, Figure 3 As shown, according to the three-way handshake communication protocol and the use of a synchronous information mechanism, the management system generates an unlocking instruction based on unlocking requirements such as new device access or device replacement at the port, that is, sends an unlocking request to the physical network port lock. After receiving the unlocking request, the physical network port lock sends its unique identifier (such as a series of information that can symbolize each physical network port lock, such as the network port lock identity code) to the management system. The management system queries and retrieves the unlocking key (unlocking code) corresponding to the physical network port lock in the database based on the received unique identifier. After the retrieval is completed, the data is encrypted and sent to the physical network port lock, which receives and executes the unlocking. After the lock is unlocked accordingly, it is opened after confirmation.

[0036] In this embodiment, unlocking is a management system corresponding to several locks, and unlocking must complete the following things: ① unlocking is initiated by the management system, ② when it is initiated, the management system needs to determine which lock to open, and ③ the lock needs to determine whether it is a system with unlocking authority to open its own lock. Therefore, the unlocking process must be initiated by the management system at least three times of communication, and each communication must be based on the system and the lock completing a communication respectively, and the next communication is started after receiving the information sent by the other party; therefore, the same mechanism needs to be used, and the asynchronous mechanism cannot ensure the correct unlocking code. Since the above at least three communications can be completed with a small amount of data, if more and more complex communication methods are selected, the communication time cost between the management system and the lock will increase, that is, it will take more time, and the more times of communication, the more exposed points of the protocol, and the more risk nodes with errors. For example, it takes five communications to complete the acquisition of the unlocking code, then the data of the above three communications will be divided into five times for transmission, increasing the risk of data interception, data loss or data anomaly. Therefore, the three-way handshake protocol can ensure communication efficiency and significantly improve communication stability and security.

[0037] S3. Perform identity verification on the target device connected to the unlocked port based on the authorized device table to determine whether the target device is an authorized device.

[0038] Specifically, S3 includes the following sub-steps: Monitor the device access status of the physical network port lock and unlock port in real time, and obtain the identity information of the target device; The identity information is retrieved based on the authorized device table. If the identity information is not retrieved in the authorized device table, the target device is not an unauthorized device.

[0039] Specifically, the authorized device table includes: Obtain basic feature information of terminal devices that have been connected to the management system, classify the terminal devices, and combine and encrypt their data to obtain unique identity information of the terminal devices; The basic feature information includes at least: processor serial number, BIOS number and hard disk serial number; The types of terminal devices include application terminals and dumb terminals; Create an authorized device table based on unique identity information.

[0040] In this embodiment, in order to prevent devices from accessing the port at will, a physical network port lock is used to block the port. However, when a new device needs to be connected or replaced, the network port lock will be unlocked, and the port will be exposed. Unauthorized devices may "take the opportunity to" access the port. Therefore, after the network port lock is unlocked, the port is continuously monitored in real time. When a device accesses the port, the identity information of the new access is obtained, and this information is first stored in a temporary list. Then, the information is searched in the authorized device table (which stores the unique identity information of the authorized device). If the information is retrieved, it means that the accessed device is an authorized device, and access to the intranet is allowed. The identity information of the device is added to the authorized device table. If the information is not retrieved, the identity of the new device is further verified manually, such as Figure 4 As shown, to determine whether it is an authorized device, if the manual verification passes, the device is allowed to access, and a binding relationship between the device and the port is established, and the identity information of the device is transferred from the temporary list to the authorized device table, and the authorized device table is updated.

[0041] Furthermore, by analyzing the basic characteristic information of the terminal device and depending on whether the device provides an interface for installing applications on its operating system, the terminal device types are divided into dumb terminals and normal device terminals. Among them, dumb terminals are network-connected terminal devices that cannot normally install applications, such as printers, network-connected sensors, POS machines, etc., which can access the network but cannot install applications in the device. Normal device terminals are authorized devices and terminals that can install applications. Different basic characteristic data are collected according to different types of device terminals. For example, dumb terminals collect device factory serial numbers, IP addresses, etc., while normal device terminals collect CPU serial numbers, BIOS numbers, hard disk serial numbers, etc. The characteristic data of the same device are spliced ​​and encrypted using an encryption algorithm as the device's unique identity mark to ensure data security and prevent arbitrary tampering. At the same time, it helps to improve the efficiency of determining whether a newly connected device is an authorized device, that is, the data in the authorized device table are all processed in a unified encryption format. Although external devices also have unique identity identification information, they do not have the characteristics of the data in the authorized device table, so that when the identification information is decrypted, it can be determined whether the device is an authorized device, and there is no need to even query the authorized device table, saving the overhead of accessing memory and improving data query efficiency.

[0042] Furthermore, the identity information of the newly accessed device is retrieved in the authorized device. First, the obtained identity information is decrypted. If the information is not encrypted, the decryption will fail and a prompt message will be returned, indicating that the device is not an authorized device. If the original identity information is obtained by decryption, the information can be queried and matched in the table through indexing, keyword query, etc., thereby improving the efficiency of identity verification of the newly accessed device.

[0043] S4. Perform corresponding access control on the target device according to the determination result of the authorized device.

[0044] Specifically, S4 includes the following sub-steps: If the target device is an authorized device, the target device is bound to the target port, and the network port request of the target device is allowed to access; if the target device is not an authorized device, the corresponding access rights of the target port are adjusted to block the network port request of the target device.

[0045] In this embodiment, the target device is bound to the port to facilitate the management and subsequent maintenance of the device. When the target device is determined to be unauthorized, for the sake of intranet security, since it has occupied the port, it is necessary to adjust the access rights of the port or directly close the port, thereby blocking the access device from accessing the intranet, ensuring that only authorized devices can access the port and access the intranet, improving network security, and achieving the ability to limit the access scope of abnormal devices to the greatest extent even if they have already accessed the port.

[0046] Specifically, the method further includes: After completing the binding of the target device and the target port, lock the physical network port lock corresponding to the target port.

[0047] Specifically, the method further includes: Set access permissions based on different types of terminal devices and their protocols, network port addresses, and traffic information.

[0048] Furthermore, the management system will read the port traffic information of the terminal devices (such as switches and routers), the MAC addresses of the port-connected devices, etc., so as to identify the devices and corresponding ports that need to be adjusted for ACL access control and port closure based on this information.

[0049] Beneficial effects of the embodiments: All device ports are blocked by a physical network port lock to achieve a fixed network link, prohibit all intranet ports from being exposed, prevent network mis-plugging and illegal external connections, reduce the human defense cost of exposed ports, and at the same time determine the accessible terminal devices to ensure the security of intranet access devices; the physical network port lock does not directly access the protected internal network, does not affect the use of the original network, and is only physically mechanically locked. The target device accessed by the unlocked port is verified for identity through the authorized device table to prevent external devices from arbitrarily accessing and accessing the intranet to cause network security problems. Combined with the physical network port lock, dual port protection and security management are achieved. In addition, it is ensured that unauthorized devices are misconnected or maliciously access the port when the network port lock is unlocked. Devices can no longer access the intranet, and the ability to limit their access range to the greatest extent is achieved; the problem of one port corresponding to multiple devices or idle ports being prohibited from access that cannot be solved by managing switches is solved, and the difficulty of abnormal device access is increased.

[0050] The above specific embodiments are preferred embodiments of the present invention, and are not intended to limit the specific implementation scope of the present invention. The scope of the present invention includes but is not limited to the present specific embodiments. All equivalent changes made in accordance with the shape, structure, and method of the present invention are within the protection scope of the present invention.

Claims

1. A network link fixing and access detection method based on terminal identity authentication, characterized in that: The steps include: S1. Blocking and locking the target port based on the physical network port lock, and establishing a binding relationship between the physical network port lock and the corresponding target port; S2, in response to the establishment of a connection between the management system and the physical network port lock, authorizing unlocking of the physical network port lock; S3, performing identity verification on the target device accessed by the unlocked port based on the authorized device table to determine whether the target device is an authorized device; S4. Perform corresponding access control on the target device according to the determination result of the authorized device.

2. The method for fixing a network link and detecting access based on terminal identity authentication according to claim 1, characterized in that: The physical network port lock includes an idle lock and a service lock; The idle lock indicates that the blocked target port is in an idle state with no device connected; The service lock indicates that the blocked target port is in a state of accessing a service device.

3. The method for fixing a network link and detecting access based on terminal identity authentication according to claim 1, characterized in that: In S1, establishing the binding relationship between the physical network port lock and the corresponding port includes the following sub-steps: A data dictionary is established based on the unique identifier of the physical network port lock and the corresponding target port information, and a data relationship mapping is performed between the unique identifier and the target port information to bind the physical network port lock to the target port.

4. The method for fixing a network link and detecting access based on terminal identity authentication according to claim 1, characterized in that: The S2 comprises the following sub-steps: S21, the management system generates an unlocking instruction based on equipment management and maintenance requirements; S22, establishing a connection between the management system and the physical network port lock based on a handshake protocol, and obtaining an unlocking code of the physical network port lock; S23: The physical network port lock completes authorized unlocking based on the unlocking code.

5. The method for fixing a network link and detecting access based on terminal identity authentication according to claim 4 is characterized in that: The S22 comprises the following sub-steps: The management system sends the unlocking instruction to the physical network port lock to establish a communication connection with the physical network port lock; The physical network port lock sends a unique identifier to the management system according to the received unlocking instruction; The management system retrieves an unlock code based on the unique identifier, encrypts the retrieved unlock code and sends the encrypted code to the physical network port lock.

6. The method for fixing a network link and detecting access based on terminal identity authentication according to claim 1, characterized in that: The S3 comprises the following sub-steps: The device access status of the port where the physical network port lock is unlocked is monitored in real time, and the identity information of the target device is obtained; the identity information is retrieved based on the authorized device table, and if the identity information is not retrieved in the authorized device table, the target device is not an unauthorized device.

7. The method for fixing a network link and detecting access based on terminal identity authentication according to claim 6, characterized in that: The authorized device table includes: Obtain basic feature information of terminal devices that have been connected to the management system, classify the terminal devices, and combine and encrypt the data to obtain unique identity information of the terminal devices; The basic feature information includes at least: processor serial number, BIOS number and hard disk serial number; The types of terminal devices include application terminals and dumb terminals; The authorized device table is established based on the unique identity information.

8. The method for fixing a network link and detecting access based on terminal identity authentication according to claim 1, characterized in that: The S4 comprises the following sub-steps: If the target device is an authorized device, the target device is bound to the target port, and the network port request of the target device is allowed to access; if the target device is not an authorized device, the corresponding access rights of the target port are adjusted to block the network port request of the target device.

9. The method for fixing a network link and detecting access based on terminal identity authentication according to claim 8, characterized in that: The method further comprises: After the target device and the target port are bound, the physical network port lock corresponding to the target port is locked.

10. The method for fixing a network link and detecting access based on terminal identity authentication according to claim 8, characterized in that: The method further comprises: The access permission is set based on different types of terminal devices and the protocols, network port addresses and flow information of the terminal devices.

Images