Terminal network security control method and system

Abstract

The invention belongs to the technical field of network security, and particularly relates to a terminal network security control method and system. The terminal network security management and control method comprises the following steps: monitoring an external connection behavior of a terminal in real time, and judging whether the external connection behavior belongs to an illegal behavior or not; if the behavior belongs to the compliance behavior, releasing; and if the behavior belongs to the illegal behavior, performing corresponding safety protection, and displaying, storing and pushing illegal information corresponding to the illegal behavior to a preset target end. According to the invention, the illegal external connection behavior is managed and controlled, so that the illegal external connection behavior can be blocked before the successful occurrence of the illegal external connection behavior, and related personnel are notified.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a terminal network security management and control method and system. Background Art

[0002] In the current network environment, with the continuous improvement of informatization, the security of internal networks of enterprises and organizations has become a critical issue. Traditional network security measures usually focus on defending against external threats, while ignoring potential risks from within. However, with the increase of internal threats, especially unauthorized external connections from internal networks, network security faces new challenges. Illegal external connections usually refer to unauthorized active connections between internal devices or users and external networks, which may lead to the leakage of sensitive data, the spread of malware and other security risks.

[0003] The network access system is a bypass deployment system. The access host needs to send interference packets to the core switch to block the terminal's illegal behavior. Therefore, it is impossible to effectively prevent and control the terminal computer's illegal behavior in advance, which poses a great security risk and easily leads to illegal external connections, identity theft and leakage. The access system is usually difficult to defend against unauthorized external connections initiated by internal users on authorized devices, and thus cannot effectively prevent data leakage and other security risks.

[0004] Desktop terminal management systems usually rely on controls at the operating system level and lack in-depth monitoring and analysis capabilities for underlying network communications, which allows users to initiate illegal external connections through uncontrolled applications or network tools. Secondly, the policy configuration of desktop terminal management systems is relatively complex and can be easily bypassed by technically proficient users, resulting in limited protection against illegal external connections. Finally, because desktop terminal management systems usually lack the ability to fully monitor real-time network behavior, they are unable to effectively block illegal external connections as soon as they occur, resulting in delayed discovery and response to security incidents. Detection and response can only be made after the violation occurs, which is a post-event remedy and cannot provide pre-emptive defense.

[0005] It can be seen that most of the existing security solutions are passive defenses and cannot effectively prevent or stop such violations. Therefore, there is an urgent need for a technology that can prevent and monitor internal network violations and external connections in real time to improve the overall network security level and ensure the integrity and confidentiality of data and systems. Summary of the invention

[0006] The present invention aims to provide a terminal network security management and control method and system for the technical problem that some security solutions cannot effectively prevent or prevent the occurrence of illegal external connection behaviors.

[0007] In order to solve the aforementioned technical problem, a first aspect of the present invention provides a terminal network security management and control method, the terminal network security management and control method comprising:

[0008] Monitor the external connection behavior of the terminal in real time to determine whether the external connection behavior is a violation of regulations;

[0009] If it is a compliant behavior, it will be released;

[0010] If it is a violation, corresponding security protection will be carried out, and the violation information corresponding to the violation will be displayed, stored and pushed to the preset target end.

[0011] Optionally, in the terminal network security management and control method as described above, the external connection behavior includes modifying the network configuration, and the terminal network security management and control method includes:

[0012] Monitor the terminal network configuration in real time. When the terminal modifies the network configuration, determine whether the terminal has modified the network configuration in violation of regulations.

[0013] If the terminal modifies the network configuration in compliance with regulations, it will be released;

[0014] If the terminal modifies the network configuration in violation of regulations, the network connection will be disabled, and the network configuration before modification will be restored and then enabled. The violation information will be displayed, stored and pushed to the preset target terminal. The violation information includes the device type and the violation category. The device type is the terminal ID that modified the network configuration in violation of regulations, and the violation category is the illegal modification of the network configuration.

[0015] Optionally, in the terminal network security management and control method as described above, the determining whether the terminal has illegally modified the network configuration includes:

[0016] The IP address in the network configuration modified by the terminal is compared with the preset compliant IP address segment range. If it is within the compliant IP address segment range and a preset authorization code is submitted, the terminal is considered to have modified the network configuration in compliance. Otherwise, the terminal is considered to have modified the network configuration in violation of regulations.

[0017] Optionally, in the terminal network security management and control method as described above, the external connection behavior includes accessing a network driver, and the terminal network security management and control method includes:

[0018] Monitor the terminal network device driver loading events in real time. When a driver is loaded, determine whether the terminal is illegally connected to the network device.

[0019] If the terminal is connected to the network device in compliance with regulations, it will be released;

[0020] If the terminal accesses a network device in violation of regulations, the network device will be disabled, and the violation information will be displayed, stored, and pushed to the preset target end. The violation information includes the device type and the violation category. The device type is the terminal ID of the illegally accessed network device and the device type of the illegally accessed network device. The violation category is the illegally accessed network device.

[0021] Optionally, in the terminal network security management and control method as described above, the determining whether the terminal has illegally accessed the network device includes:

[0022] Determine the device type of the accessed network device. If the device type belongs to a preset compliant device, the terminal is considered to have accessed the network device in compliance. If the device type belongs to a preset illegal device, the terminal is considered to have accessed the network device in violation. If the device type belongs to neither the qualified device nor the illegal device, the terminal is considered to have accessed the network device in violation.

[0023] Optionally, in the terminal network security management and control method as described above, the device type includes PCI device, USB device, BTH device, virtual device;

[0024] The PCI wireless network card in the PCI device is a non-compliant device, and the other PCI devices are normal PCI network cards and are compliant devices;

[0025] The USB device and BTH device are illegal devices;

[0026] The virtual device is a compliant device.

[0027] Optionally, in the terminal network security control method as described above, before displaying, storing and pushing the violation information corresponding to the violation behavior to the preset target end, it also includes:

[0028] Analyze the violation and classify the violation into one of several preset risk levels, wherein the violation information includes the risk level;

[0029] The terminal is handled at the security risk level according to the handling method corresponding to the risk level.

[0030] Optionally, in the terminal network security management and control method as described above, displaying, storing and pushing the violation information corresponding to the violation behavior to a preset target terminal includes:

[0031] The violation information corresponding to the violation behavior is displayed to the terminal, the violation information is encrypted and stored, and the violation information is pushed to a preset target terminal.

[0032] Optionally, in the terminal network security management and control method as described above, when encrypting the violation information, character shifting and conversion are used, and random characters are added to achieve the encryption purpose, making the violation information unreadable.

[0033] Optionally, in the terminal network security management and control method as described above, the preset target end includes a network management personnel and a management group;

[0034] When the violation information is pushed to the preset target end, the violation information is pushed to the mobile phone number corresponding to the network administrator in the form of a text message, and the violation information is pushed to the management group.

[0035] In order to solve the above technical problems, the second aspect of the present invention provides a terminal network security management and control system, including:

[0036] The detection and security protection module is deployed on the terminal to monitor the terminal's external connection behavior in real time and determine whether the external connection behavior is a violation of regulations. If it is a compliant behavior, it will be released; if it is a violation of regulations, corresponding security protection will be performed, and the violation information corresponding to the violation will be displayed and sent to the background service system;

[0037] The backend service system is deployed on the backend service host, and is used to receive and store the violation information, and push the violation information to a preset target end.

[0038] The positive and progressive effect of the present invention is that the present invention is a terminal network security control method and system for proactive defense against terminal network security issues such as illegal external connections, emphasizing prior defense. The present invention specifically controls the two major paths of illegal external connections (modifying network configuration and accessing external network drivers), and can block illegal external connections before they successfully occur, and notify relevant personnel. The present invention effectively prevents the occurrence of illegal external connections by strengthening the control of intranet terminal network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The disclosure of the present invention will become more apparent with reference to the accompanying drawings. It should be understood that these drawings are only for illustrative purposes and are not intended to limit the scope of protection of the present invention. In the drawings:

[0040] Figure 1 A schematic diagram of a process of the present invention. DETAILED DESCRIPTION

[0041] The following describes the embodiments of the present invention through specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention.

[0042] It should be noted that the following embodiments and features therein may be combined with each other if there is no conflict.

[0043] In the description of the present invention, it should be noted that directional words such as the terms "outside", "middle", "inside", "outside", etc., which indicate directions and positional relationships, are based on the directions or positional relationships shown in the drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and cannot be understood as limiting the specific protection scope of the present invention.

[0044] In addition, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features. Therefore, the definition of "first" and "second" features can explicitly or implicitly include one or more of the features. In the description of the present invention, "several" and "a number" mean two or more, unless otherwise clearly and specifically defined.

[0045] An embodiment of the present invention provides a terminal network security management and control method, which includes the following specific steps:

[0046] Real-time monitoring of the terminal's external connection behavior to determine whether the external connection behavior is a violation. If it is a compliant behavior, it will be released. If it is a violation, corresponding security protection will be carried out, and the violation information corresponding to the violation will be displayed, stored and pushed to the preset target terminal.

[0047] In some embodiments, reference Figure 1 , external contact behavior includes modifying network configuration, then the terminal network security management and control methods include:

[0048] Monitor the terminal network configuration in real time. When the terminal modifies the network configuration, determine whether the terminal has modified the network configuration in violation of regulations. If the terminal has modified the network configuration in compliance with regulations, release the terminal. If the terminal has modified the network configuration in violation of regulations, disable the network connection, restore the network configuration before modification and enable the network connection. Display, store and push the violation information to the preset target end. The violation information includes the device type and violation category. The device type is the terminal ID that modified the network configuration in violation of regulations, and the violation category is the modification of the network configuration in violation of regulations.

[0049] This embodiment controls the modification of network configuration in external connection behavior, and determines whether the Internet is connected in violation of regulations by real-time monitoring of changes in terminal network configuration. If it is not in compliance with the rules, security protection actions are immediately triggered, including disabling network connection, restoring IP address configuration, and then enabling network connection. This embodiment also displays, stores and pushes violation information to the preset target terminal for alarm.

[0050] Once the static IP address of the terminal in this embodiment changes, it will be monitored and automatically restored immediately, and it is impossible to automatically obtain an IP address through DHCP to connect to external networking devices such as wireless routers. The monitoring method of this embodiment can effectively and reliably prevent the occurrence of illegal external connection events of the terminal network.

[0051] In some embodiments, determining whether a terminal has modified a network configuration in violation of regulations includes: comparing the IP address in the network configuration modified by the terminal with a preset compliant IP address segment range; if it is within the compliant IP address segment range and a preset authorization code is submitted, the terminal is deemed to have modified the network configuration in compliance; otherwise, the terminal is deemed to have modified the network configuration in violation of regulations.

[0052] In this embodiment, a compliant IP address segment range can be pre-configured, and the terminal IP address is not allowed to exceed the IP address segment range. If it exceeds the range, it will be judged as a violation. Secondly, the terminal user is not allowed to modify the IP address configuration privately, that is, even if the modified IP address is within the compliant IP address segment range, it is not allowed to modify it privately. Once it is modified privately, a security protection action will be immediately generated. If the terminal needs to modify the IP address configuration, it must submit an authorization code, and only after obtaining the authorization code can it make legal modifications.

[0053] This embodiment prevents terminal users from modifying IP address configurations privately. The control of terminal IP addresses in the present invention is different from the common network IP address binding. The former is controlled at the terminal level, while the latter is controlled at the network level. The control at the terminal level is effective regardless of the network the terminal is connected to, while the control at the network level becomes ineffective once the terminal leaves the original network and connects to another network.

[0054] In some embodiments, reference Figure 1 , external connection behavior includes access to network drivers, then the terminal network security management and control methods include:

[0055] Monitor terminal network device driver loading events in real time. When a driver is loaded, determine whether the terminal is illegally connected to the network device. If the terminal is compliant with the network device, release it. If the terminal is illegally connected to the network device, disable the illegally connected network device, and display, store and push the violation information to the preset target end. The violation information includes the device type and the violation category. The device type is the terminal ID of the illegally connected network device and the device type of the illegally connected network device. The violation category is the illegally connected network device.

[0056] In this embodiment, the access network driver in the external connection behavior is controlled, and the access of the terminal network device is monitored in real time to determine whether the device access is compliant. If it is not in compliance with the rules, the security protection action is immediately triggered, including disabling the network device. This embodiment also displays, stores and pushes the violation information to the preset target end for alarm.

[0057] In this embodiment, once the illegal network device is connected to the terminal, it will be detected and disabled by the monitoring program of the present invention when loading the driver, and it cannot be loaded and connected to the network normally. The monitoring means of this embodiment can effectively and reliably prevent the occurrence of illegal external connection events of the terminal network.

[0058] In some embodiments, determining whether a terminal has illegally accessed a network device includes: determining the device type of the accessed network device; if the device type belongs to a preset compliant device, the terminal is deemed to have illegally accessed the network device; if the device type belongs to a preset illegal device, the terminal is deemed to have illegally accessed the network device; if the device type is neither a qualified device nor an illegal device, the terminal is deemed to have illegally accessed the network device.

[0059] When a network device is connected to a terminal or enabled, the present invention will perform compliance analysis. First, the device type is analyzed and determined, and then further analyzed based on the device type to determine whether it is a compliant device or an illegal device. The present invention can monitor and protect the access and activation of all illegal network devices, and prevent the terminal from connecting to the Internet through illegal devices.

[0060] In some embodiments, the device type includes PCI device, USB device, BTH device, and virtual device. A PCI wireless network card in a PCI device is a non-compliant device, and other PCI devices are compliant devices as normal PCI network cards. USB devices and BTH devices are non-compliant devices. Virtual devices are compliant devices.

[0061] Among them, common wireless network cards, portable WiFi, smart phones, Bluetooth network devices, etc. are all of the two types of USB devices and BTH devices, and are directly regarded as illegal devices and disabled.

[0062] In some embodiments, reference Figure 1Before displaying, storing and pushing the violation information corresponding to the violation to the preset target terminal, it also includes: analyzing the violation, classifying the violation into one of several preset risk levels, and including the risk level in the violation information. Perform security risk level disposal on the terminal according to the disposal method corresponding to the risk level.

[0063] In this embodiment, the risk levels are divided in advance, for example, into level I high risk level, level II medium risk level, and level III low risk level. There is a mapping relationship between each violation and each risk level, and the risk level can be determined according to the violation. For example, the following mapping relationship is used:

[0064] Level I high risk includes the following situations:

[0065] (1) Connect and enable the wireless network card;

[0066] (2) A smartphone is plugged in and the network is shared;

[0067] (3) There are multiple built-in or integrated network cards;

[0068] Level II medium risk includes the following situations:

[0069] (1) Multiple IP addresses are set in the Ethernet card;

[0070] Level III low risk includes the following situations:

[0071] (1) Modify the IP address and MAC address without permission.

[0072] Of course, during the specific implementation, the mapping relationship between each violation and each risk level can be modified according to the actual situation.

[0073] In this embodiment, the handling method corresponding to the risk level can be pre-set. For example, when a violation of any risk level occurs, the network device will be disabled. When a violation corresponding to level I high risk or level II medium risk occurs, the terminal will be forced to shut down.

[0074] In this embodiment, the risk level is also displayed, stored and pushed to the preset target end as a part of the violation information.

[0075] This embodiment immediately conducts accurate identification and analysis after various violations occur, divides them into risk levels, and handles them according to the risk levels. At the same time, it is displayed through the front end, which greatly reduces the time for information and communication management personnel to search, collect evidence and analyze, and provides a perfect basis for post-analysis, accountability, assessment, etc.

[0076] In some embodiments, reference Figure 1, display, store and push the violation information corresponding to the violation to the preset target end, including:

[0077] The violation information corresponding to the violation behavior will be displayed to the terminal, the violation information will be encrypted and stored, and the violation information will be pushed to the preset target terminal.

[0078] In some embodiments, when encrypting the violation information, character shifting and conversion are used, and random characters are added to achieve the encryption purpose, making the violation information unreadable.

[0079] The above encryption method in this embodiment cannot be decrypted by conventional means when the encryption algorithm is not clear, and the above encryption method has a faster encryption speed, consumes less system resources, and has a higher decryption difficulty.

[0080] In some embodiments, reference Figure 1 The preset target end includes the network administrator and the management group. When the violation information is pushed to the preset target end, the violation information is pushed to the corresponding mobile phone number of the network administrator in the form of a text message, and the violation information is pushed to the management group.

[0081] The management group may be an existing chat group capable of instant messaging, such as a WeChat group, a QQ group or a Fetion group.

[0082] An embodiment of the present invention further provides a terminal network security management and control system, the terminal network security management and control system comprising:

[0083] The detection and security protection module is deployed on the terminal to monitor the terminal's external connection behavior in real time and determine whether the external connection behavior is a violation of regulations. If it is a compliant behavior, it will be released; if it is a violation of regulations, corresponding security protection will be carried out, and the violation information corresponding to the violation will be displayed and sent to the background service system;

[0084] The backend service system is deployed on the backend service host and is used to receive and store violation information and push the violation information to the preset target end.

[0085] The terminal network security management and control system of the present invention consists of two parts: the front-end detection and security protection module and the background service system. The detection and security protection module is deployed in all terminals that need to be monitored, and is mainly responsible for the real-time monitoring and security protection of terminal violations, the display and reporting of violation information, etc. The background service system is deployed on the background service host, and is mainly responsible for the centralized management of organizational structure, terminal information, violation information, log information, system configuration and other data, as well as the sending of violation information SMS and the push of violation information management group.

[0086] Preferably, the background service host operating system is Debian, the database is MySQL, the Web service is Apache, SSH service, ufw firewall, etc. are deployed, with complete security protection rules and backup strategies to provide all-round protection for the system and data.

[0087] The present invention is described in detail above in conjunction with the embodiments of the accompanying drawings. A person skilled in the art can make various variations of the present invention according to the above description. Therefore, some details in the embodiments should not be construed as limiting the present invention, and the present invention shall be protected by the scope defined by the attached claims.

Claims

1. A terminal network security management and control method, characterized in that: The terminal network security management and control method comprises: Monitor the external connection behavior of the terminal in real time to determine whether the external connection behavior is a violation of regulations; If it is a compliant behavior, it will be released; If it is a violation, corresponding security protection will be carried out, and the violation information corresponding to the violation will be displayed, stored and pushed to the preset target end.

2. The terminal network security management and control method according to claim 1, characterized in that: The external connection behavior includes modifying the network configuration, and the terminal network security management and control method includes: Monitor the terminal network configuration in real time. When the terminal modifies the network configuration, determine whether the terminal has modified the network configuration in violation of regulations. If the terminal modifies the network configuration in compliance with regulations, it will be released; If the terminal modifies the network configuration in violation of regulations, the network connection will be disabled, and the network configuration before modification will be restored and then enabled. The violation information will be displayed, stored and pushed to the preset target terminal. The violation information includes the device type and the violation category. The device type is the terminal ID that modified the network configuration in violation of regulations, and the violation category is the illegal modification of the network configuration.

3. The terminal network security management and control method according to claim 2, characterized in that: The determining whether the terminal has illegally modified the network configuration includes: The IP address in the network configuration modified by the terminal is compared with the preset compliant IP address segment range. If it is within the compliant IP address segment range and a preset authorization code is submitted, the terminal is considered to have modified the network configuration in compliance. Otherwise, the terminal is considered to have modified the network configuration in violation of regulations.

4. The terminal network security management and control method according to any one of claims 1 to 3, characterized in that: The external connection behavior includes accessing a network driver, and the terminal network security management and control method includes: Monitor the terminal network device driver loading events in real time. When a driver is loaded, determine whether the terminal is illegally connected to the network device. If the terminal is connected to the network device in compliance with regulations, it will be released; If the terminal accesses a network device in violation of regulations, the network device will be disabled, and the violation information will be displayed, stored, and pushed to the preset target end. The violation information includes the device type and the violation category. The device type is the terminal ID of the illegally accessed network device and the device type of the illegally accessed network device. The violation category is the illegally accessed network device.

5. The terminal network security management and control method according to claim 4, characterized in that: The determining whether the terminal has illegally accessed the network device includes: Determine the device type of the accessed network device. If the device type belongs to a preset compliant device, the terminal is considered to have accessed the network device in compliance. If the device type belongs to a preset illegal device, the terminal is considered to have accessed the network device in violation. If the device type belongs to neither the qualified device nor the illegal device, the terminal is considered to have accessed the network device in violation.

6. The terminal network security management and control method according to claim 5, characterized in that: The device types include PCI devices, USB devices, BTH devices, and virtual devices; The PCI wireless network card in the PCI device is a non-compliant device, and the other PCI devices are normal PCI network cards and are compliant devices; The USB device and BTH device are illegal devices; The virtual device is a compliant device.

7. The terminal network security management and control method according to claim 1, characterized in that: Before displaying, storing and pushing the violation information corresponding to the violation to the preset target end, it also includes: Analyze the violation and classify the violation into one of several preset risk levels, wherein the violation information includes the risk level; The terminal is handled at the security risk level according to the handling method corresponding to the risk level.

8. The terminal network security management and control method according to claim 1, characterized in that: The display, storage and push of the violation information corresponding to the violation to the preset target end include: Displaying the violation information corresponding to the violation behavior to the terminal, encrypting and storing the violation information, and pushing the violation information to a preset target terminal; When encrypting the violation information, it is preferred to use character shifting and conversion, and add random characters to achieve the encryption purpose and make the violation information unreadable.

9. The terminal network security management and control method according to claim 1, 7 or 8, characterized in that: The preset target end includes network management personnel and management group; When the violation information is pushed to the preset target end, the violation information is pushed to the mobile phone number corresponding to the network administrator in the form of a text message, and the violation information is pushed to the management group.

10. A terminal network security management and control system, characterized in that: The terminal network security management and control system includes: The detection and security protection module is deployed on the terminal to monitor the terminal's external connection behavior in real time and determine whether the external connection behavior is a violation of regulations. If it is a compliant behavior, it will be released; if it is a violation of regulations, corresponding security protection will be performed, and the violation information corresponding to the violation will be displayed and sent to the background service system; The backend service system is deployed on the backend service host, and is used to receive and store the violation information, and push the violation information to a preset target end.

Images