Network access control method and system

Abstract

The embodiment of the invention provides a network access control method and system, and aims at a network access scene involving a sensitive area in a process that a terminal accesses through one area in a network and initiates access to another area. In three scenes such as from a sensitive area to a sensitive area, from the sensitive area to a non-sensitive area and from the non-sensitive area to the sensitive area, a forwarding system can mirror a message from a terminal and upload the mirror image message to a detection system, equivalently, actions of mirroring and upload the message are executed in a part of access scenes conditionally; therefore, the terminal can be managed and controlled according to different access areas, different destination areas and different security degrees of the terminal, and the network management and control fineness and flexibility are improved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a network access control method and system. Background Art

[0002] With the development of network security protection technologies, Network Access Control (NAC) technology continues to mature. NAC verifies the network access permissions of terminals based on their identity information. It then controls the terminals' network access based on their network access permissions, allowing only legitimate and secure terminals to access the network while isolating illegitimate and unsafe terminals, or allowing only unsafe terminals to access restricted resources, thereby improving network security protection capabilities.

[0003] Current network access control solutions lack granularity in managing and controlling terminals after they connect to the network. For example, after a terminal passes a compliance check and connects to the network, the controller cannot implement granular authorization control based on the terminal's threat level. If a terminal connected to the network in a sensitive area experiences a security incident such as a virus infection, the risk can easily spread to public service areas. Furthermore, the virus can easily use this terminal as a springboard to spread laterally and infect other terminals in the office area. Summary of the Invention

[0004] This application provides a network access control method and system, which helps to improve the precision of network management and control. The technical solution is as follows.

[0005] In a first aspect, a network access control method is provided, which includes: a forwarding system receiving a first message from a first terminal; if the area accessed by the first terminal is a sensitive area or the destination accessed by the first terminal through the first message is located in a sensitive area, the forwarding system mirrors the first message to obtain a second message; the forwarding system sends the second message to a detection system; the forwarding system receives a management and control policy corresponding to the first terminal sent by the detection system in response to the second message; and the forwarding system manages the first terminal based on the management and control policy.

[0006] Through the method provided in the first aspect, in the process of a terminal accessing through one area in the network and initiating access to another area, for network access scenarios involving sensitive areas, such as from a sensitive area to a sensitive area, from a sensitive area to a non-sensitive area, and from a non-sensitive area to a sensitive area, the forwarding system will mirror the message from the terminal and upload the mirrored message to the detection system, which is equivalent to conditionally performing the actions of mirroring and uploading the message in some access scenarios, so that differentiated management and control strategies can be adopted for terminals according to different access areas, different destination areas and different security levels of terminals, thereby improving the precision and flexibility of network management and control.

[0007] In addition, the access layer forwarding device does not need to perform mirroring and sending message actions in all access scenarios, nor does it need to deploy probes to mirror messages on access layer switches deployed in all areas. Therefore, the cost is relatively low, and to a certain extent, it saves the processing resources required for the detection system to perform security detection on the mirrored messages, and also saves the processing resources and forwarding resources required for the forwarding system to mirror and send mirrored messages. On the other hand, it reduces the security risk caused by omitting security detection when the message sent by the terminal does not need to be sent to the aggregation layer forwarding device or even the core layer forwarding device for further forwarding.

[0008] Furthermore, if the network access scenario changes, the network system can dynamically adjust the control policy used for the terminal as the network access scenario changes. For example, if a terminal moves laterally within the access layer, causing a change in the terminal's access area; if a terminal changes from requesting access to resources in the operation and maintenance area to requesting access to resources in the office area; or if a terminal's security level decreases due to a virus infection, the network system can dynamically adjust the control policy used for the terminal based on changes in the terminal's access area and / or destination area, thereby improving the dynamic and flexible nature of network control and making it more suitable for scenarios where terminals move between different areas within the network.

[0009] In some embodiments, the first message includes an area identifier and an identifier of the destination party, and the area identifier is used to identify the area accessed by the first terminal; if the area accessed by the first terminal is a sensitive area or the destination party accessed by the first terminal through the first message is located in a sensitive area, the forwarding system mirrors the first message to obtain a second message, including: if the area identified by the area identifier is a sensitive area or the destination party identified by the identifier of the destination party is located in a sensitive area, the forwarding system mirrors the first message to obtain a second message.

[0010] Since the second message is triggered and the action of sending the second message is based on whether the area identifier is the identifier of a sensitive area or whether the access area is a sensitive area, different processing methods are adopted for messages from different areas. The part of the message carrying the area identifier of the sensitive area will be mirrored and security checked, while the part of the message that does not carry the area identifier of the sensitive area does not need to be mirrored, so that different granularity management methods can be adopted for messages from sensitive areas and messages from non-sensitive areas.

[0011] In addition, compared with determining the access area based on the source IP address of the first message, the result of determining the access area based on a special area identifier is more accurate and reliable, reducing the risk of inaccurate access area determined based on the source IP address in the Network Address Translation (NAT) scenario. Since the source IP address of the first message has been converted, the source IP address of the second message received by the detection system is no longer the original source IP address of the first message, that is, the source IP address of the second message is no longer the IP address of the first terminal.

[0012] In some implementations, the first message includes a Transmission Control Protocol (TCP) header, the TCP header includes a TCP option, and the TCP option includes the area identifier.

[0013] Since the TCP option in the TCP header is used to carry the area identifier, the terminal supports notifying the forwarding system of the network area where the terminal is located and / or the destination area that the terminal needs to access during the process of establishing a TCP connection with the forwarding system, so that the forwarding system can perceive the network area where the terminal is located and / or the destination area that the terminal needs to access as early as possible, making it easier to determine the management and control strategy adopted for the terminal in advance.

[0014] In some implementations, the first message includes an Internet Protocol version 6 (IPv6) extension header, and the IPv6 extension header includes the zone identifier.

[0015] Since the IPv6 extension header is used to carry the area identifier, it is applicable to various scenarios of accessing network resources based on IPv6 networks and has a wide range of application scenarios.

[0016] In some embodiments, the IPv6 extension header includes an application-aware networking (APN) header, the APN header includes an application-aware network identifier (ID) APN-ID field, and the APN-ID field includes the area identifier.

[0017] Since the regional identifier is carried in the APN message header, the regional identifier is carried through the network layer, which reduces the limitations of applicable scenarios caused by inserting and carrying the regional identifier in the application layer protocol header, and basically does not require targeted adaptation for specific types of applications.

[0018] In some embodiments, the first message also includes operating environment parameter information of the first terminal, and the operating environment parameter information of the first terminal includes at least one of hard disk parameter information in the first terminal, memory parameter information in the first terminal, and operating system parameter information of the first terminal.

[0019] Since the message carries the operating environment parameter information of the first terminal, it is convenient for the detection system to trace the first message based on the operating environment parameter information. If a security risk is found in the second message through detection of the second message, it can be associated with a specific terminal based on the tracing result of the operating environment parameter information in the second message, thereby determining which terminal has the security risk.

[0020] In some embodiments, the method further includes: the forwarding system receives a third message from the second terminal; if the area accessed by the second terminal is a non-sensitive area and the destination accessed by the second terminal through the third message is located in the non-sensitive area, the forwarding system omits the step of mirroring the third message; the forwarding system controls the second terminal based on the control policy corresponding to the second terminal from the detection system.

[0021] Since both the access area of ​​the terminal and the destination area accessed by the terminal are non-sensitive areas, the steps of mirroring the message and sending the mirrored message to the detection system are omitted or skipped. The forwarding system does not need to mirror the message or send the mirrored message to the detection system, thereby saving the processing resources and forwarding resources required for mirroring the message and sending the mirrored message.

[0022] In a second aspect, a network access control method is provided, which includes: a detection system receives a second message from a forwarding system, where the second message is generated by mirroring a first message from a first terminal, where the first message is generated in the process of the first terminal accessing a first area and initiating access to a second area; the detection system performs a security check on the second message to obtain a security score of the first terminal; the detection system determines a management and control policy corresponding to the first terminal based on the security score of the first terminal and the sensitivity of the second area; and the detection system sends the management and control policy corresponding to the first terminal to the forwarding system.

[0023] After a terminal accesses an area in the network, when the terminal initiates access from this area to another area in the network, the detection system determines a security score reflecting the security level of the terminal based on the mirror message of the message initiated by the terminal, and determines and issues a management and control policy for the terminal based on the security score. In this way, differentiated management and control policies can be adopted for terminals with different security levels, thereby improving the precision and flexibility of network management and control.

[0024] In some embodiments, the detection system determines the control policy corresponding to the first terminal based on the security score of the first terminal and the sensitivity of the second area, including: the detection system determines a score threshold based on the sensitivity of the second area; the detection system determines the control policy corresponding to the first terminal based on the security score of the first terminal and the score threshold.

[0025] Since the scoring threshold reflects the system's required security level for terminals allowed access, and the scoring threshold is determined based on the sensitivity of the area, it is equivalent to requiring different security levels for terminals accessing different destination areas, further improving the sophistication and flexibility of network management and control. For example, the scoring threshold corresponding to sensitive areas is higher than that corresponding to non-sensitive areas, which means that the security level required for accessing sensitive areas is relatively higher, while the security level required for accessing non-sensitive areas is relatively lower. This allows for a coarser-grained, or more stringent, control strategy for sensitive areas, and a coarser-grained, or more relaxed, control strategy for non-sensitive areas.

[0026] In some embodiments, if the security level represented by the security score of the first terminal is higher than the security level represented by the score threshold, the control policy determined by the detection system includes allowing the first terminal to access the second area; or, if the security level represented by the security score of the first terminal is lower than the security level represented by the score threshold, the control policy determined by the detection system includes prohibiting the first terminal from accessing the second area or re-authenticating the first terminal.

[0027] In some embodiments, if the second area is a sensitive area, the scoring threshold determined by the detection system is a first scoring threshold; if the second area is a non-sensitive area, the scoring threshold determined by the detection system is a second scoring threshold, and the level of safety represented by the second scoring threshold is lower than the level of safety represented by the first scoring threshold.

[0028] In some embodiments, the first message includes an area identifier, which is used to identify the area accessed by the first terminal. Before the detection system receives the second message from the forwarding system, the method also includes: during the process of authenticating the first terminal, the detection system determines the area in which the forwarding device accessed by the first terminal is located in the forwarding system to obtain the area identifier; the detection system sends the area identifier to the first terminal.

[0029] In some embodiments, the method further includes: the detection system obtains a security score of the second terminal during the process of the second terminal accessing the third area and initiating access to the fourth area, the security score of the second terminal is determined based on the detection results of multiple security detection items of the second terminal, and the third area and the fourth area are both non-sensitive areas; the detection system determines a management and control policy corresponding to the second terminal based on the security score of the second terminal; and the detection system sends the management and control policy corresponding to the second terminal to the forwarding system.

[0030] In some embodiments, obtaining the security score of the second terminal includes: the detection system receiving the security score of the second terminal reported by the environment-aware client running in the second terminal, the security score of the second terminal being determined by the environment-aware client based on detection results of multiple security detection items of the second terminal; or, the detection system receiving the detection results of multiple security detection items reported by the environment-aware client running in the second terminal; the detection system determines the security score of the second terminal based on the detection results of the multiple security detection items.

[0031] Since the terminal's security score is determined based on the test results of multiple security detection items of the terminal, while the control strategy adopted for the terminal can also be determined based on the terminal's own security level during the terminal's access to network resources, there is no need to mirror and transmit the terminal's messages, and the overhead is relatively low.

[0032] In some embodiments, the second message also includes operating environment parameter information of the first terminal. The method further includes: the detection system tracing the source based on the operating environment parameter information of the first terminal to determine that the first message comes from the first terminal.

[0033] In some implementations, the second message includes a TCP header, the TCP header includes a TCP option, and the TCP option includes operating environment parameter information of the first terminal; or,

[0034] The second message includes an IPv6 extension header, and the IPv6 extension header includes operating environment parameter information of the first terminal.

[0035] In some implementations, the IPv6 extension header includes an APN message header, the APN message header includes an application-aware network identifier (APN-ID) field, and the APN-ID field includes operating environment parameter information of the first terminal.

[0036] In some implementations, the detection system sends the control policy corresponding to the first terminal to the forwarding system, including:

[0037] The detection system generates a Change of Authorization (COA) message, where the COA message includes a control policy corresponding to the first terminal;

[0038] The detection system sends the COA message to the forwarding system.

[0039] In some embodiments, the detection system performs a security check on the second message to obtain a security score of the first terminal, including: the detection system performs a network attack detection on the second message to obtain an attack signature of the first terminal; the detection system matches the attack signature of the first terminal with an attack signature library to obtain a security score of the first terminal.

[0040] Since network attack detection is performed on the mirror message of the message initiated by the first terminal, the security score of the first terminal can represent the possibility of the first terminal launching a network attack on the second area when accessing the network resources of the second area after accessing the first area. The management and control policy adopted for the first terminal based on the security score of the first terminal helps to timely defend against network attacks from the first terminal when the first terminal launches a network attack on the second area, thereby improving the network security of the second area.

[0041] In some embodiments, the detection system performs security detection on the second message to obtain a security score of the first terminal, including: the detection system performs abnormal behavior detection on the second message to obtain abnormal behavior characteristics of the first terminal; the detection system compares the abnormal behavior characteristics of the first terminal with a security baseline to obtain a security score of the first terminal.

[0042] Because abnormal behavior detection is performed on the mirrored message of the message initiated by the first terminal, the security score of the first terminal can represent the possibility of the first terminal performing abnormal behavior in the process of accessing network resources in the second area after accessing the first area. The management and control policy adopted for the first terminal based on the security score of the first terminal helps to reduce the security risks caused to the second area when the first terminal performs abnormal behavior.

[0043] In a third aspect, a forwarding system is provided, which includes: a receiving unit for receiving a first message from a first terminal; a processing unit for mirroring the first message to obtain a second message if the area accessed by the first terminal is a sensitive area or the destination accessed by the first terminal through the first message is located in a sensitive area; a sending unit for sending the second message to the detection system; the receiving unit is also used to receive a control policy corresponding to the first terminal sent by the detection system in response to the second message; and the processing unit is also used to control the first terminal based on the control policy.

[0044] In some implementations, the first message includes an area identifier and an identifier of the destination party, where the area identifier is used to identify an area accessed by the first terminal;

[0045] The processing unit is configured to mirror the first message to obtain a second message if the area identified by the area identifier is a sensitive area or the destination party identified by the destination party identifier is located in a sensitive area.

[0046] In some embodiments, the first message includes a Transmission Control Protocol TCP header, the TCP header includes a TCP option, and the TCP option includes the area identifier; or,

[0047] The first message includes an Internet Protocol version 6 (IPv6) extension header, and the IPv6 extension header includes the zone identifier.

[0048] In some implementations, the IPv6 extension header includes an application-aware network (APN) header, the APN header includes an application-aware network identifier (APN-ID) field, and the APN-ID field includes the area identifier.

[0049] In some embodiments, the first message also includes operating environment parameter information of the first terminal, and the operating environment parameter information of the first terminal includes at least one of hard disk parameter information in the first terminal, memory parameter information in the first terminal, and operating system parameter information of the first terminal.

[0050] In some embodiments, the receiving unit is also used to receive a third message from the second terminal; the processing unit is also used to omit the step of mirroring the third message if the area accessed by the second terminal is a non-sensitive area and the destination accessed by the second terminal through the third message is located in the non-sensitive area; and control the second terminal based on the control policy corresponding to the second terminal from the detection system.

[0051] In a fourth aspect, a detection system is provided, the system comprising:

[0052] a receiving unit, configured to receive a second message from the forwarding system, where the second message is generated by mirroring a first message from the first terminal, where the first message is generated when the first terminal accesses the first area and initiates access to the second area;

[0053] a processing unit, configured to perform a security check on the second message to obtain a security score of the first terminal; and determine a control policy corresponding to the first terminal based on the security score of the first terminal and the sensitivity of the second area;

[0054] A sending unit is used to send the management and control policy corresponding to the first terminal to the forwarding system.

[0055] In some embodiments, the processing unit is configured to determine a scoring threshold based on the sensitivity of the second area; and determine a control policy corresponding to the first terminal based on the security score of the first terminal and the scoring threshold.

[0056] In some embodiments, if the security level represented by the security score of the first terminal is higher than the security level represented by the score threshold, the control policy determined by the detection system includes allowing the first terminal to access the second area; or

[0057] If the security level represented by the security score of the first terminal is lower than the security level represented by the score threshold, the control strategy determined by the detection system includes prohibiting the first terminal from accessing the second area or re-authenticating the first terminal.

[0058] In some embodiments, if the second area is a sensitive area, the scoring threshold determined by the detection system is a first scoring threshold;

[0059] If the second area is a non-sensitive area, the scoring threshold determined by the detection system is a second scoring threshold, and the safety level represented by the second scoring threshold is lower than the safety level represented by the first scoring threshold.

[0060] In some embodiments, the first message includes an area identifier, where the area identifier is used to identify an area accessed by the first terminal. The processing unit is further configured to, during authentication of the first terminal, determine an area in the forwarding system where a forwarding device accessed by the first terminal is located, to obtain the area identifier.

[0061] The sending unit is configured to send the area identifier to the first terminal.

[0062] In some embodiments, the processing unit is further configured to obtain a security score of the second terminal during a process in which the second terminal accesses the third area and initiates access to the fourth area, the security score of the second terminal being determined based on detection results of multiple security detection items of the second terminal, the third area and the fourth area being both non-sensitive areas; and determine a control policy corresponding to the second terminal based on the security score of the second terminal;

[0063] The sending unit is further configured to send the control policy corresponding to the second terminal to the forwarding system.

[0064] In some embodiments, the processing unit is used to receive a security score of the second terminal reported by an environment-aware client running in the second terminal, where the security score of the second terminal is determined by the environment-aware client based on detection results of multiple security detection items of the second terminal; or, receive detection results of multiple security detection items reported by the environment-aware client running in the second terminal; and determine the security score of the second terminal based on the detection results of the multiple security detection items.

[0065] In some embodiments, the second message also includes operating environment parameter information of the first terminal, and the processing unit is further used to trace the source based on the operating environment parameter information of the first terminal to determine that the first message comes from the first terminal.

[0066] In some implementations, the second message includes a Transmission Control Protocol TCP header, the TCP header includes a TCP option, and the TCP option includes operating environment parameter information of the first terminal; or,

[0067] The second message includes an Internet Protocol version 6 (IPv6) extension header, and the IPv6 extension header includes operating environment parameter information of the first terminal.

[0068] In some implementations, the IPv6 extension header includes an application-aware network (APN) header, the APN header includes an application-aware network identifier (APN-ID) field, and the APN-ID field includes operating environment parameter information of the first terminal.

[0069] In some implementations, the sending unit is configured to generate a Change of Authorization (COA) message, where the COA message includes a control policy corresponding to the first terminal; and send the COA message to the forwarding system.

[0070] In some embodiments, the processing unit is configured to perform network attack detection on the second message to obtain an attack signature of the first terminal; the detection system matches the attack signature of the first terminal with an attack signature library to obtain a security score of the first terminal.

[0071] In some embodiments, the processing unit is used to perform abnormal behavior detection on the second message to obtain abnormal behavior characteristics of the first terminal; the detection system compares the abnormal behavior characteristics of the first terminal with the security baseline to obtain a security score of the first terminal.

[0072] In a fifth aspect, a forwarding system is provided. The forwarding system includes a processor coupled to a memory, the memory storing at least one computer program instruction, the at least one computer program instruction being loaded and executed by the processor to cause the forwarding system to implement the method provided in the first aspect or any optional embodiment of the first aspect. Specific details of the forwarding system provided in the fifth aspect can be found in the first aspect or any optional embodiment of the first aspect, and are not further described here.

[0073] In a sixth aspect, a detection system is provided. The detection system includes a processor coupled to a memory, the memory storing at least one computer program instruction, the at least one computer program instruction being loaded and executed by the processor to cause the detection system to implement the method provided in the second aspect or any optional embodiment of the second aspect. Specific details of the detection system provided in the sixth aspect can be found in the second aspect or any optional embodiment of the second aspect, and are not further described here.

[0074] In a seventh aspect, a computer-readable storage medium is provided, which stores at least one instruction. When the instruction is executed on a computer, the computer executes the method provided by the first aspect or any optional method of the first aspect.

[0075] In an eighth aspect, a computer-readable storage medium is provided, which stores at least one instruction. When the instruction is executed on a computer, the computer executes the method provided by the second aspect or any optional method of the second aspect.

[0076] In the ninth aspect, a computer program product is provided, which includes one or more computer program instructions. When the computer program instructions are loaded and executed by a computer, the computer executes the method provided in the first aspect or any optional method of the first aspect.

[0077] In the tenth aspect, a computer program product is provided, which includes one or more computer program instructions. When the computer program instructions are loaded and run by a computer, the computer executes the method provided by the second aspect or any optional method of the second aspect.

[0078] In the eleventh aspect, a chip is provided, comprising a memory and a processor, wherein the memory is used to store computer instructions, and the processor is used to call and run the computer instructions from the memory to execute the method in the above-mentioned first aspect and any possible implementation of the first aspect.

[0079] In the twelfth aspect, a chip is provided, comprising a memory and a processor, wherein the memory is used to store computer instructions, and the processor is used to call and run the computer instructions from the memory to execute the method provided in the above-mentioned second aspect or any optional method of the second aspect.

[0080] In a thirteenth aspect, a network system is provided, comprising the forwarding system of the third aspect or any optional embodiment of the third aspect and the detection system of the fourth aspect or any optional embodiment of the fourth aspect. Alternatively, the network system comprises the forwarding system of the fifth aspect or any optional embodiment of the fifth aspect and the detection system of the sixth aspect or any optional embodiment of the sixth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] Figure 1 This is a schematic diagram of the architecture of a network system provided by an embodiment of the present application;

[0082] Figure 2 This is a flow chart of a network access control method provided by an embodiment of the present application;

[0083] Figure 3 This is a flow chart of a network access control method provided by an embodiment of the present application;

[0084] Figure 4 This is a schematic diagram of a scenario for controlling terminals in a scenario where a terminal in an office area accesses a terminal in an operation and maintenance area, provided by an embodiment of the present application;

[0085] Figure 5 This is a schematic diagram of controlling terminals in a scenario where a terminal in an office area accesses a terminal in a low-sensitivity area in a public service area, provided by an embodiment of the present application;

[0086] Figure 6 This is a schematic diagram of a terminal control in a scenario where a terminal in an office area accesses a highly sensitive area in a public service area, provided by an embodiment of the present application;

[0087] Figure 7 This is a schematic diagram of a terminal control in a network scenario where a non-sensitive area accesses a non-sensitive area, provided by an embodiment of the present application;

[0088] Figure 8 This is a schematic diagram of a control terminal in a scenario where a terminal in an operation and maintenance area accesses a server in the operation and maintenance area, provided by an embodiment of the present application;

[0089] Figure 9 This is a schematic diagram of a message format provided in an embodiment of the present application;

[0090] Figure 10 This is a schematic diagram of the structure of a forwarding system provided in an embodiment of the present application;

[0091] Figure 11 Schematic diagram of a detection system provided in an embodiment of the present application;

[0092] Figure 12 It is a structural diagram of a network system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0093] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0094] The following provides exemplary definitions and explanations of some terminology concepts involved in the embodiments of this application.

[0095] (1) Region

[0096] The region in the embodiment of the present application is a part of the protected network. The region can also be called a subnetwork, space or block. The region is generated by dividing the protected network based on factors such as the physical location, functional characteristics, security requirements and / or sensitivity of network resources. The protected network is, for example, a private network (or intranet). For example, the protected network is an enterprise intranet, a school intranet or other types of campus networks. An area is deployed with one or more network resources. Network resources are also called digital assets, access objects or accessed objects. Network resources are, for example, software or hardware that can be accessed by visitors. Network resources are, for example, network applications. Network applications include World Wide Web (web) applications, email applications, file storage and sharing applications, remote desktop applications or instant messaging applications. Network resources are also business data. Network resources are also servers, terminals or storage devices.

[0097] Taking the division of areas based on sensitivity as an example, for example, a protected network includes sensitive areas and non-sensitive areas. For another example, a protected network includes highly sensitive areas, moderately sensitive areas, and low-sensitivity areas.

[0098] Taking the division of areas based on the functional characteristics of network resources as an example, for example, the protected network includes operation and maintenance areas, office areas, or public service areas.

[0099] (2) Sensitive areas

[0100] Sensitive areas are also called critical areas or important areas. They are relatively sensitive areas within a protected network. Examples of sensitive areas include those where critical services are run on the protected network, sensitive data (such as financial data) is stored, or vulnerable network resources are deployed. Compared to non-sensitive areas, sensitive areas have higher security requirements and require stricter control policies, or in other words, require a higher level of security protection. Examples of sensitive areas include operations and maintenance areas or financial areas. Another example of a sensitive area is an internal employee area within a public service area that is exclusively accessible to corporate employees and is prohibited from external network access.

[0101] (3) Non-sensitive areas

[0102] Non-sensitive areas are relatively less sensitive areas within a protected network. These areas are also called ordinary areas. Examples of these areas include office areas, guest areas within public service areas that allow external network access, and areas where ordinary business systems are located. Public service areas are areas where publicly accessible resources are deployed. Non-sensitive areas require a relatively low level of security protection. They typically do not host critical business operations or sensitive data, or they host very little critical business operations and sensitive data.

[0103] (4) Access area

[0104] For example, an access zone is the area within the network that a terminal accesses. In other words, the access zone represents the location at which the terminal accesses the network. For example, if the terminal accesses the office area, the access zone is the office area; if the terminal accesses the operation and maintenance area, the access zone is the operation and maintenance area. For another example, the access zone is the area within the network where the terminal is located.

[0105] (5) Destination area

[0106] The destination zone refers to the zone where the terminal is accessing. For example, if the terminal is accessing a server in the operation and maintenance zone, the destination zone is the operation and maintenance zone. If the terminal is accessing public services in the office zone, the destination zone is the office zone.

[0107] (6) Mirroring and Mirroring Messages

[0108] Mirroring refers to the act of copying a message. A mirrored message is the result of mirroring. A mirrored message typically has the same content as the original message being mirrored. A mirrored message can also be called a copy of the original message or a replica of the original message.

[0109] (7) Management and control strategies

[0110] The control policy is used to control the network access behavior of the terminal. The control policy can also be called a network admission policy, a network access policy, a permission configuration policy, an access control policy, a security policy, or an access control list (ACL). In some embodiments, the control policy includes a correspondence between a device identifier and the permission information of the terminal, thereby identifying that a specific terminal is controlled according to the corresponding permission information. The permission information includes at least one of the terminal's access rights and / or the terminal's access rights.

[0111] Access rights are used to indicate the scope of network resources that a terminal is authorized to access. For example, access rights include the identifiers of one or more areas that the terminal is authorized to access, the identifiers of one or more network resources that the terminal is authorized to access, and / or one or more Internet protocols (IPs) that the terminal is authorized to access. For example, if access rights include the IP address 192.168.1.1, it indicates that the terminal is authorized to access the IP address 192.168.1.1. In another example, if access rights include the area identifier "Office Area," it indicates that the terminal is authorized to access the Office Area.

[0112] Access rights are used to indicate the scope of the area that the terminal is authorized to access. For example, access rights include the identifiers of one or more areas that the terminal is authorized to access. For example, if the access rights include "operation and maintenance area", it means that the terminal is allowed to access the operation and maintenance area.

[0113] In other embodiments, the management and control policy includes a device identifier and an action identifier. The device identifier is used to match the fields in the message sent by the terminal. The action identifier indicates the processing action to be performed on the message sent by the terminal. For example, the action identifier is in the form of a number or a character string. The processing action indicated by the action identifier is, for example, forwarding the message, discarding the message, redirecting the message, mirroring the message or issuing an alarm. For example, the management and control policy includes the device identifier of the first terminal and the identifier of the first processing action. When the address information (source address, destination address, source port or destination port) in the message received by the forwarding system matches the device identifier of the first terminal, or when the operating environment parameter information carried in the message matches the operating environment parameter information of the first terminal, or when the serial number carried in the message matches the serial number of the first terminal, the forwarding system performs the first processing action on the message.

[0114] (8) Safety score

[0115] The security score represents the security level of a terminal. It can also be called a threat score or risk score. The security score can be expressed as a numeric value, a string, or special symbols.

[0116] In some embodiments, a higher security score for a terminal indicates a higher security level for the terminal or a lower threat level for the terminal. For example, the security score ranges from 0 to 100, with a maximum value of 100 indicating the highest security level. A security score in the range of (90, 100) indicates a highly secure terminal, a security score in the range of (60, 90) indicates a moderately secure terminal, and a security score in the range of (0, 60) indicates a low security terminal.

[0117] In other embodiments, a lower security score for a terminal indicates a higher security level for the terminal or a lower threat level for the terminal. For example, the security score ranges from 0 to 100, with a security score of 0 indicating no threat to the terminal or the highest security level, and a security score of 100 indicating the highest threat level for the terminal.

[0118] Alternatively, the security score may be in the form of an enumerated data type. For example, the security score may include three values: high security, medium security, and low security. For example, the letters A, B, and C may be used to represent the three security scores of high security, medium security, and low security, respectively. For another example, the symbols ★★★, ★★, and ★ may be used to represent the three security scores of high security, medium security, and low security, respectively. For another example, the symbols High, Medium, and Low may be used to represent the three security scores of high security, medium security, and low security, respectively.

[0119] (9) Regional identification

[0120] The area identifier is used to identify the corresponding area. For example, the area identifier includes the area identifier of the access area or the identifier of the destination area. The data form of the area identifier is, for example, numbers, letters, or strings. The area identifier is optionally used to uniquely identify the corresponding area, and the area identifiers of any two areas of different types in the protected network are different. For example, the area identifier of the operation and maintenance area is 1, the identifier of the office area is 2, and the identifier of the public service area is 3. Alternatively, the area identifier is used to identify the sensitivity of the corresponding area. For example, the area identifiers of any two areas of different types but the same sensitivity in the protected network are the same. For example, the area identifiers of sensitive areas such as the operation and maintenance area and the financial area are all 1, and the area identifiers of non-sensitive areas such as the office area and the public service area are all 0. Due to the introduction of the area identifier of the access area, it is convenient for the network side to determine whether the message needs to be mirrored based on whether the message carries the identifier of the sensitive area.

[0121] (10) Safety inspection items

[0122] Security detection items can also be called security detection indicators. Security detection items are used to detect the security level of the terminal. For example, security detection items are used to detect the anti-virus capabilities, patch levels or system security settings of the terminal. Security detection items include, for example, the configuration of the operating system, whether high-risk ports are open, port authentication configuration, the activation of anti-virus software, addition, deletion and modification operations on the system registry, vulnerability scanning results, installation of security patches, level of security patches, version update of security patches, malware scanning, whether the hardware has been changed, account security, password strength or file integrity check. At least one of them. For example, if the anti-virus software of the terminal is in the off state, it indicates that the security level of the terminal is relatively low. For another example, if the terminal has not updated the vulnerability patch of the operating system for a long time, it indicates that the security level of the terminal is relatively low.

[0123] (11) Operating environment parameter information

[0124] The operating environment parameter information is used to describe the operating environment of the terminal. The operating environment parameter information includes at least one of the terminal's hardware configuration information and / or the terminal's software configuration information. For example, the operating environment parameter information includes at least one of the terminal's device type, hard disk parameter information, memory parameter information, operating system parameter information, and network configuration information. In some embodiments, the operating environment parameter information is obtained by data fusion of at least two of the hard disk parameter information, memory parameter information, operating system parameter information, and network configuration information. For example, at least two of the hard disk parameter information, memory parameter information, operating system parameter information, and network configuration information are concatenated, and the concatenated result is used as the operating environment parameter information. The operating environment parameter information can uniquely identify the corresponding terminal.

[0125] Device type, such as a mobile phone, computer, or laptop. Hard disk parameter information, such as the hard disk model, hard disk capacity, or hard disk read speed. Memory parameter information, such as the memory type, memory capacity, memory slot, or memory read speed. Operating system parameter information, such as the operating system type, the contents of the operating system configuration file, the contents of the operating system registry, the enabled or disabled status of operating system services, etc. Network configuration information, such as network proxy settings and Domain Name System (DNS) server addresses.

[0126] In some embodiments of the present application, the primary function of the operating environment parameter information is to trace the source, which can also be understood as locating the terminal. For example, a message sent by terminal A carries the operating environment parameter information of terminal A. After the forwarding system mirrors the message and sends the mirrored message to the detection system, the detection system determines that the message originated from terminal A based on the operating environment parameter information carried in the mirrored message. By analogy, the detection system can distinguish messages from different terminals from all received traffic based on the operating environment parameter information carried in each message in the received traffic.

[0127] (12) Equipment identification

[0128] A device identifier uniquely identifies a corresponding terminal device. In some embodiments, the device identifier is used to identify both the access area and the operating environment parameters. For example, the device identifier of a first terminal includes two parts: the area identifier of the area to which the first terminal is connected and the operating environment parameter information of the first terminal. In some embodiments, the device identifier is obtained by concatenating the area identifier and the operating environment parameter information. In other embodiments, the device identifier is obtained by merging the area identifier and the operating environment parameter information. For example, the area identifier occupies the high-order bits of the device identifier, and the operating environment parameter information occupies the low-order bits of the device identifier. For example, the device identifier of a terminal connected through area X and configured with operating environment parameter Y may be in the form of "XY". For example, the area identifier of the operation and maintenance area is 1, and the operating environment parameter information for a terminal with a Windows operating system and a solid-state hard drive is "PC1". The area identifier of the general area is 2, and the operating environment parameter information for a terminal with a Linux operating system and a mechanical hard drive is "PC2". In this example, the device identifier of a terminal connected to the network through the operation and maintenance area, with a Windows operating system and a solid-state hard drive is, for example, 1-PC1. The device identifier of a terminal that accesses the network through a common area, whose operating system is a Linux operating system and whose hard disk is a mechanical hard disk is, for example, 2-PC2. In other embodiments, the device identifier includes operating environment parameter information of the first terminal without including a regional identifier. In still other embodiments, the device identifier is the address information of the terminal (such as the IP address and / or MAC address of the terminal), the port number of the terminal, or the serial number of the terminal.

[0129] (13) Endpoint Detection and Response (EDR) Client

[0130] An environment-aware client is a client application software that runs through a terminal. The environment-aware client is used to collect the detection results of various security detection items of the terminal. In some embodiments, the environment-aware client is also used to report the detection results of various security detection items to the detection system. In some embodiments, the environment-aware client determines the security score of the terminal based on the detection results of various security detection items of the terminal, and reports the security score of the terminal to the detection system. In some embodiments, an environment-aware server is running on the detection system (such as a situational awareness device), and the environment-aware client interacts with the environment-aware server to realize the function of reporting the detection results or security scores to the detection system. In some embodiments, the environment-aware client is also used to generate a device identifier for the terminal. The environment-aware client can also be replaced by general security detection software or dedicated security detection hardware.

[0131] (14) Network system, forwarding system and detection system

[0132] A network system refers to one or more devices on the network side. It provides terminals with access to network resources and manages and controls them during their access. Examples of network systems include gateways and controllers in a zero-trust network architecture. Network systems include forwarding systems and detection systems. The forwarding system communicates with the detection system via the network.

[0133] The forwarding system is equivalent to a communication bridge between the terminal and the network resources. The forwarding system is used to forward messages between the terminal and the network resources that the terminal wants to access. The forwarding system includes one or more forwarding devices. Forwarding devices include switches, routers, firewalls, etc. The forwarding system is deployed at the boundary of the protected network, for example. In some embodiments, the forwarding system also acts as a policy execution node. The forwarding system is used to receive the control policy from the detection system and execute the control policy to perform access control on the terminal accessing the protected network. In some embodiments, the forwarding system also acts as an access authentication node. The forwarding system is used to authenticate the terminal accessing the protected network. For example, the forwarding system's authentication methods for the terminal include various authentication methods such as Media Access Control Authentication (MAC Authentication, MAC) authentication, 802.1X authentication, or Portal authentication.

[0134] The detection system, also known as the analysis system, performs security checks on terminals based on messages received from them or the results of security checks on the terminals. It then issues control policies to the forwarding system based on the security scores of the terminals obtained through security checks.

[0135] The forwarding system and detection system can optionally be independent hardware devices, or a cluster or distributed system including multiple hardware devices, or a virtualized device implemented based on cloud computing and network function virtualization (NFV) technology, such as a virtual machine or container.

[0136] The following is an example of an application scenario of the embodiment of the present application.

[0137] The embodiments of the present application are applicable to scenarios where a network system controls the terminal's access to network resources after the terminal accesses the network.

[0138] Through research and analysis, the inventors discovered that the control policies adopted by network systems for terminals are typically pre-set, fixed policies. After a terminal accesses the network, the network system fails to detect the terminal's security level and does not adjust the terminal's access permissions. Because this fails to account for potential changes in the terminal's security level, potential terminal movement, or the varying security requirements for visitors in different network zones, the network system is unable to adjust its control policies based on changes in the terminal's security level, the terminal's access zone, or the terminal's destination zone. This results in a relatively poor level of sophistication and flexibility in the terminal's control policies. For example, if, during the terminal's access authentication process, the network system determines that the control policy adopted for the terminal is to allow forwarding of traffic initiated by the terminal, then once the terminal passes authentication and accesses the network, the network system typically persists with the control policy determined during the access authentication phase. If, after the terminal accesses the network, a security incident occurs, such as a malicious file infection, or the terminal moves to a sensitive area and re-initiates access, the network system is unable to adjust its control policies for the terminal, resulting in a high risk of spreading risks to sensitive areas through messages sent by the terminal.

[0139] In response to the problem that the precision and flexibility of the terminal's control method after the terminal accesses the network are relatively poor, in some embodiments of the present application, the network system adopts different control strategies for different network access scenarios. For example, in the process of a terminal accessing through one area in the network and initiating access to another area, the network system adopts a corresponding control strategy based on the terminal's access area or / and destination area, so that on the one hand, different control strategies can be adopted for terminals accessing through different areas or / and terminals accessing different destination areas, thereby achieving more refined control. On the other hand, after the terminal accesses the network, when the terminal's access area or / and the destination area visited changes, such as the terminal moves from one area in the network to another (for example, from the operation and maintenance area to the office area), or when the terminal changes from accessing network resources in one area to accessing network resources in another area, the network system can adaptively adjust the control strategy adopted for the terminal as the terminal's access area or / and destination area changes, thereby improving the dynamics and flexibility of network access control, and being more suitable for scenarios where the terminal is mobile.

[0140] In some implementations, the network system assigns control policies with different monitoring granularities to different network access scenarios. Optionally, the difference in monitoring granularity is reflected in whether to mirror messages initiated by the terminal and perform security checks on the mirrored messages.

[0141] For example, network access scenarios include: from a sensitive area to a sensitive area, from a sensitive area to a non-sensitive area, from a non-sensitive area to a sensitive area, and from a non-sensitive area to a non-sensitive area. For network access scenarios involving sensitive areas, such as from a sensitive area to a sensitive area, from a sensitive area to a non-sensitive area, and from a non-sensitive area to a sensitive area, the forwarding system will mirror the traffic initiated by the terminal and send the resulting mirrored packets to the detection system for further security testing. For access scenarios not involving sensitive areas, such as from a non-sensitive area to a non-sensitive area, the forwarding system does not need to mirror the traffic initiated by the terminal or send the packets to the detection system.

[0142] This control approach, on the one hand, implements different control policies for terminals accessing through different areas and / or accessing different destination areas. On the other hand, it provides restrictions on traffic mirroring and security testing. Finer-grained or more stringent control policies are applied to terminals accessing through sensitive areas and accessing sensitive areas, contributing to more comprehensive control of sensitive areas. Coarser-grained or more relaxed control policies are applied to terminals accessing through and accessing non-sensitive areas.

[0143] In some embodiments, considering that if all access layer forwarding devices in the forwarding system are deployed with probes, all access layer forwarding devices in the forwarding system mirror the received messages through the probes deployed on the devices and send the mirrored messages to the detection system, it will result in relatively high costs and consume more forwarding resources and processing resources. If the aggregation layer forwarding device or core layer forwarding device in the forwarding system is responsible for mirroring received packets and sending the mirrored packets to the detection system, not all traffic will be forwarded by the aggregation layer forwarding device or core layer forwarding device in all scenarios. For example, in the scenario of access between different areas connected to the access layer forwarding device, such as access between different terminals connected to the same access switch, or in the scenario where terminal a connected to access switch A initiates an access to terminal b connected to access switch B, and access switch A happens to be interconnected with access switch B, the packets sent by the terminals can be forwarded to the destination through the access layer forwarding device without being sent to the aggregation layer forwarding device or even the core layer forwarding device for further forwarding. Therefore, the aggregation layer forwarding device and the core layer forwarding device do not receive the packets from the terminals. As a result, the aggregation layer forwarding device and the core layer forwarding device are unable to mirror the packets and send the mirrored packets to the detection system. As a result, the detection system cannot perform security detection on the packets, making it difficult to detect risky terminals in these scenarios. This results in coarse-grained management and control, which can easily lead to security risks.

[0144] In view of this, in some embodiments, after receiving the message, the access layer forwarding device determines whether it is necessary to mirror the message and upload the mirrored message to the detection system based on the access area of ​​the terminal and / or the destination area visited by the terminal. When the access area of ​​the terminal and / or the destination area visited by the terminal are sensitive areas, the message is mirrored and the mirrored message is uploaded to the detection system. When the access area of ​​the terminal and the destination area visited by the terminal are both non-sensitive areas, the steps of mirroring the message and uploading the mirrored message to the detection system are omitted, which is equivalent to conditionally performing the action of mirroring and uploading the message in some access scenarios. On the one hand, this makes it unnecessary for the access layer forwarding device to perform mirroring and sending messages in all access scenarios, and it is unnecessary to deploy probes to mirror messages on the access layer switches deployed in all areas. Therefore, the cost is relatively low, and to a certain extent, it saves the processing resources required for the detection system to perform security detection on the mirrored messages, and also saves the processing resources and forwarding resources required for the forwarding system to mirror and send the mirrored messages. On the other hand, it reduces the security risks caused by omitting security detection when the messages sent by the terminal do not need to be sent to the aggregation layer forwarding device or even the core layer forwarding device for further forwarding.

[0145] The following further explains the processing logic of the network system in combination with different scenarios.

[0146] Scenario 1: Terminals in sensitive areas access network resources

[0147] Considering that terminals accessing through sensitive areas can access important services or sensitive data, if the security level of terminals accessing through sensitive areas is insufficient, it will have a significant impact on the security level of the entire network. Based on this, the network system regards terminals accessing through sensitive areas as key detection targets. When the network system receives a message initiated by a terminal accessing through sensitive areas, regardless of whether the destination of the message is in a sensitive area or a non-sensitive area, the network system will mirror the message and perform security detection on the mirrored message. This reduces the security risks caused by terminals accessing sensitive areas performing attacks or abnormal behaviors, realizes more comprehensive or fine-grained control of sensitive areas, and improves the security prevention and control level of sensitive areas.

[0148] In an exemplary scenario, taking the operation and maintenance area as an example, after the terminal is connected to the operation and maintenance area, the terminal accesses the server deployed in the operation and maintenance area, and the terminal can download some sensitive data from the server. Once the terminal is infected with a Trojan horse, the terminal may spread the acquired sensitive data to the office platform or the Internet in the non-operation and maintenance area by sending a message to the non-operation and maintenance area, causing the lateral transmission of sensitive data and affecting data security. In another exemplary scenario, after the terminal is connected to the operation and maintenance area, the terminal is under the control of the attacker and sends a message carrying malicious files such as viruses to the server deployed in the operation and maintenance area, implanting the malicious files into the server deployed in the operation and maintenance area.

[0149] In the two scenarios described above, the forwarding system mirrors all traffic sent from the operation and maintenance area and sends the mirrored messages to the detection system for further security testing. This allows the system to promptly isolate terminals if there are security risks in the messages, thereby reducing the security risks caused by the spread of risky messages to the operation and maintenance area or non-operation and maintenance areas.

[0150] Scenario 2: Terminals in non-sensitive areas access network resources

[0151] In the process of accessing network resources through a terminal accessing a non-sensitive area, the network system will consider the destination area where the network resources to be accessed by the terminal are located to determine whether to mirror the messages from the terminal, thereby achieving hierarchical management and control of non-sensitive areas or on-demand management and control. For example, if the terminal wants to access network resources deployed in a non-sensitive area, the network system omits the step of mirroring the messages from the terminal. For example, the forwarding system does not need to mirror the messages from the terminal, the forwarding system does not need to send the mirrored messages to the detection system, and the detection system does not need to perform security checks on the mirrored messages. If the terminal wants to access network resources deployed in a sensitive area, the network system will perform mirroring on the messages initiated by the terminal and perform security checks on the mirrored messages. For example, the forwarding system will mirror the messages from the terminal and send the mirrored messages to the detection system, and the detection system will perform security checks on the mirrored messages.

[0152] Based on this, mirroring and security detection are implemented based on the access needs of terminals in non-sensitive areas. Specifically, the network system does not need to mirror and security detect all traffic initiated by terminals in non-sensitive areas, but rather mirrors and security detects a specific portion of all traffic initiated by terminals in non-sensitive areas that needs to be sent to sensitive areas. This on-demand traffic mirroring method, on the one hand, saves the processing resources and forwarding resources required for mirroring and security detection on the network side, saves costs, and also saves the number of probes required to be deployed on the access switch to achieve mirroring, simplifying the solution architecture; on the other hand, the more critical traffic initiated by terminals in non-sensitive areas (traffic accessing sensitive areas) will still be mirrored and security detected, thereby still improving network security and flexibility to a certain extent.

[0153] In some embodiments, the control strategy adopted by the network system for the terminal is determined based on the security score of the terminal. The security score of the terminal is used to characterize the security level of the terminal. In some embodiments, the security score of the terminal is determined based on the detection results of security detection of the mirror message of the message sent by the terminal or / and the detection results of multiple security detection items of the terminal. Since the network system determines the control strategy adopted for the terminal based on the security score of the terminal during the process of the terminal initiating access, when the security level of the terminal changes, the security score of the terminal will change accordingly. In response to the change in the security score of the terminal, the network system updates the control strategy adopted for the terminal based on the new security score, so that the control strategy can change adaptively and dynamically as the security level of the terminal changes, thereby improving the flexibility of controlling the terminal. For example, if a terminal becomes infected with malicious files or faces threats due to other factors after accessing the network, and the security level represented by the network system's security score based on the terminal drops to a level lower than the security level represented by the score threshold, the system will adjust the control policy from allowing the terminal to access sensitive areas to prohibiting the terminal from accessing sensitive areas, making it impossible for the terminal to access sensitive areas that it could access before being infected with malicious files. This reduces the risk of malicious files being forwarded to sensitive areas along with messages initiated by the terminal, causing the malicious files to spread in sensitive areas and causing servers deployed in sensitive areas to be infected with malicious files.

[0154] In some embodiments of the present application, the present application is applied to scenarios where a terminal performs cross-regional access after accessing a network. For example, in the process of a terminal accessing through one area and initiating access to another area, the network system determines the control strategy adopted for the terminal based on the sensitivity of the access area of ​​the terminal and / or the sensitivity of the destination area. Taking the sensitive area as the operation and maintenance area and the non-sensitive area as the office area as an example, for example, in the process of a first terminal in the operation and maintenance area initiating access to a second terminal or server in the office area, if a security incident such as infection of a malicious file occurs in the first terminal, the network system can promptly adopt a corresponding control strategy for the first terminal by performing a security detection on the mirror message of the message of the first terminal, thereby reducing the risk of the malicious file using the first terminal as a springboard to further spread to the second terminal or server in the office area. For another example, in the process of a first terminal in the office area initiating access to a second terminal or server in the operation and maintenance area, if a security incident such as infection of a malicious file occurs in the first terminal, the network system can promptly adopt a corresponding control strategy for the first terminal by performing a security detection on the mirror message of the message of the first terminal, thereby reducing the risk of the malicious file using the first terminal as a springboard to further spread to the second terminal or server in the operation and maintenance area.

[0155] In other embodiments of the present application, the present invention is applied to scenarios where a terminal accesses an area in a network and then accesses other devices in the same area. For example, in the process of a terminal accessing from one area and initiating access to another terminal or server in the area, the network system determines the corresponding control strategy based on the sensitivity of the terminal's access area and / or the sensitivity of the destination area. Taking the sensitive area as the operation and maintenance area as an example, for example, in the process of a first terminal in the operation and maintenance area initiating access to a second terminal or server in the operation and maintenance area, if the first terminal has a security incident such as infection with a malicious file, the network system can promptly adopt a corresponding control strategy for the first terminal by performing a security detection on the mirror message of the first terminal's message, thereby reducing the risk of the malicious file using the first terminal as a springboard to further spread to the second terminal or server in the operation and maintenance area. For another example, taking the non-sensitive area as the office area as an example, in the process of a first terminal in the office area initiating access to a second terminal or server in the office area, if the first terminal has a security incident such as infection with a malicious file, the network system can promptly adopt a corresponding control strategy for the first terminal based on the detection results of multiple detection items of the first terminal, thereby reducing the risk of the malicious file using the first terminal as a springboard to further spread to the second terminal or server in the office area.

[0156] In some implementations, the network system combines the zero-trust mechanism with network access control to resolve the issues in the zero-trust mechanism that it fails to differentiate between terminals in different regions and fails to flexibly adjust the management and control policies adopted for terminals.

[0157] The Zero Trust mechanism is a technology that controls terminal access to resources based on the concept of "continuous verification, never trust." Continuous verification means not only authenticating the terminal before it accesses the network, but also performing security management and control on the terminal while it accesses network resources. Security management and control are even performed every time the terminal accesses network resources, thereby improving the security of network resources during access. Never trust means assuming that attackers may exist both inside and outside the protected network. Therefore, regardless of whether the visitor is a device deployed outside or inside the protected network, the visitor's permissions are usually verified, and access to network resources is only allowed after the visitor has obtained permission to do so.

[0158] However, zero-trust mechanisms typically fail to differentiate between different network zones and do not apply different levels of control to terminals in different zones. Furthermore, zero-trust mechanisms, and even general network access control solutions, typically only determine whether to allow a terminal to access the network based on its security level before it connects. After a terminal connects to the network, its security level is typically not checked, nor is the control strategy for the terminal flexibly adjusted based on changes in its security level and / or location.

[0159] In view of this, in some embodiments of the present application, on the basis of the zero-trust mechanism, a method of adopting different control granularity for terminals in different areas is introduced. For example, comprehensive control is carried out on terminals in sensitive areas (such as by the above-mentioned method of mirroring all traffic from sensitive areas and sending mirror messages), and hierarchical control is carried out on terminals in ordinary areas (such as by the above-mentioned method of judging whether to mirror traffic and sending mirror messages based on whether the destination area is a sensitive area). After the terminal is connected to the network, if a security threat occurs to the terminal, such as the terminal is poisoned or the terminal is controlled by an attacker and becomes a zombie, the network access rights of the terminal are dynamically adjusted according to the area where the terminal accesses the network or the destination area visited by the terminal, so as to implement network isolation and other operations. In addition, a method of adjusting the control strategy adopted for the terminal based on changes in the security level of the terminal and / or changes in the area where the terminal is located is introduced. For example, before the terminal accesses the network, the network system first performs identity authentication on the terminal. After the terminal passes the access authentication and accesses the network, the network system will still perform security control on the terminal during the process of the terminal accessing network resources. For example, when a terminal accesses network resources, the network system monitors the terminal's security level in real time (e.g., by determining a security score) and dynamically adjusts the terminal's network access rights based on changes in the terminal's security level. For example, for terminals with decreased security, the network system may downgrade the terminal's network access rights and then perform network isolation operations on the terminal.

[0160] The following is an example of the system architecture of the embodiment of the present application.

[0161] refer to Figure 1 , Figure 1 FIG2 is a schematic diagram showing an architecture of a network system 20 provided in an embodiment of the present application. The network system 20 includes a forwarding system 220 and a detection system 240 .

[0162] The forwarding system 220 is used to forward messages. When the message received by the forwarding system 220 meets the predetermined conditions, the forwarding system 220 will mirror the message and send the mirrored message to the detection system 240. The forwarding system 220 is connected to multiple areas. For example, Figure 1 In the illustrated scenario, the forwarding system 220 is communicatively connected to the operation and maintenance area 13 , the office area 11 , and the public service area 14 , respectively.

[0163] Figure 1 In the figure, a rectangular dotted box is used to represent an area, and the color filled in the rectangular dotted box indicates the sensitivity of the corresponding area. For example, a rectangular dotted box filled with red represents a highly sensitive area (sensitive area), a rectangular dotted box filled with blue represents a low-sensitivity area (non-sensitive area), and a rectangular dotted box filled with green represents a moderately sensitive area. For example, the operation and maintenance area 13 is a sensitive area. Figure 1 The operation and maintenance area 13 is represented by a red dotted rectangle. The operation and maintenance area 13 is deployed with terminals 131, servers 132 and storage devices 133. For another example, the office area 11 is a non-sensitive area. Figure 1 The blue dotted rectangle represents the office area 11. The office area 11 is deployed with terminals 111 and 112. For another example, the public service area 14 includes a high-sensitivity area 142, a medium-sensitivity area 141, and a low-sensitivity area 143. The high-sensitivity area 142, the medium-sensitivity area 141, and the low-sensitivity area 143 are located in the office area. Figure 1 The red, green and blue areas are used to represent them respectively.

[0164] Figure 1 The types of terminals in the area are, for example, mobile terminals, IoT terminals, or personal computers (PCs), etc. The terminals, for example, have an environment awareness client 180 installed and running.

[0165] The detection system 240 is used to perform security detection on the mirrored messages sent by the forwarding system 220 , determine a control policy based on the security score obtained from the security detection, and send the determined control policy to the forwarding system 220 .

[0166] In some embodiments, the forwarding system 220 adopts a three-layer architecture including access-aggregation-core, and the forwarding system 220 includes multiple access layer forwarding devices, one or more aggregation layer forwarding devices, and one or more core layer forwarding devices.

[0167] Access layer forwarding devices refer to forwarding devices that operate at the access layer. For example, the access layer forwarding device is Figure 1 The access layer forwarding device is deployed at the edge of the network and is used to connect terminals to the network. Optionally, the access layer forwarding device is also used to execute management and control policies to control access to terminals. Optionally, the access layer forwarding device is an 802.1X gateway. In some embodiments, multiple access layer forwarding devices are respectively connected to different areas. For example, access switch 221a is connected to office area 11, while access switch 221b is connected to operation and maintenance area 13.

[0168] The aggregation layer forwarding device refers to the forwarding device running in the aggregation layer. The aggregation layer forwarding device is connected to the access layer forwarding device and the core layer forwarding device respectively, and plays the role of centrally aggregating the network traffic from each access layer forwarding device. For example, the aggregation layer forwarding device is Figure 1 The aggregation switch 222a and the aggregation switch 222b.

[0169] The core layer forwarding device refers to the forwarding device running on the core layer. For example, the core layer forwarding device is Figure 1 The core switch 223a and the core switch 223b.

[0170] For example, when a terminal accessing area A initiates a message to area B, the message is forwarded sequentially through the source access switch connected to area A, the source aggregation switch, the core switch, the destination aggregation switch, and the destination access switch connected to area B until it reaches the destination. Figure 1 When the terminal 112 in the office area sends a message to the terminal 131 in the operation and maintenance area, the message goes through the forwarding path of access switch 221a → aggregation switch 222a → core switch 223a → aggregation switch 222b → access switch 221b, and is finally forwarded to the terminal 131.

[0171] Forwarding system 220 is in communication with detection system 240. For example, detection system 240 is deployed in the cloud, and forwarding system 220 is in communication with detection system 240 via the Internet. In another example, detection system 240 is deployed within a protected network, and forwarding system 220 is in communication with detection system 240 via the protected network (e.g., an intranet or private network).

[0172] In some implementations, the detection system 240 includes a situational awareness device 242 and a controller 241 .

[0173] The situation awareness device 242 is used to detect the security level of the terminal and obtain a security score. For example, the situation awareness device 242 is used to perform security detection on the mirrored message and send the security score obtained by the security detection to the controller 241. The situation awareness device 242 is, for example, a policy engine (hisecinsight).

[0174] Controller 241 is configured to determine a control policy based on the security score received from situational awareness device 242 and to deliver the determined control policy to forwarding system 220. Controller 241 is, for example, a policy manager (NCE-campus). Optionally, controller 241 is also configured to manage and control each forwarding device in forwarding system 220. Optionally, controller 241 is also configured to manage and control terminals accessing the protected network.

[0175] In some embodiments, the situational awareness device 242 and the controller 241 are implemented by being combined, for example, the situational awareness device 242 and the controller 241 are integrated in the same physical device. For example, software for performing security detection on messages and software for determining management and control policies based on security scores are run on the same computing device, so that the computing device simultaneously realizes the functions of the situational awareness device 242 and the functions of the controller 241. In other embodiments, the situational awareness device 242 and the controller 241 are implemented by being separately provided, for example, the situational awareness device 242 and the controller 241 are different physical devices that are communicatively coupled to each other. The situational awareness device 242 and the controller 241 are communicatively connected. In some embodiments, the situational awareness device 242 and the controller 241 are communicatively connected based on an application layer protocol (such as the hypertext transfer protocol (HTTP)).

[0176] The following is an example of the method flow provided in the embodiments of the present application.

[0177] Considering that the control process executed by the network side in different network access scenarios is different, for the sake of clarity, the following is a Figure 2 The method embodiment shown describes the control process in the network access scenario involving sensitive areas. Figure 3 The method embodiment shown describes the control process in a network access scenario that does not involve sensitive areas. Figure 2 The method embodiment shown is applicable to three network access scenarios: from a sensitive area to a sensitive area, from a sensitive area to a non-sensitive area, and from a non-sensitive area to a sensitive area. Figure 3 The illustrated method embodiment is applicable to a network access scenario from a non-sensitive area to a non-sensitive area.

[0178] In order to distinguish terminals in different network access scenarios, the embodiment of the present application uses "first terminal" to describe terminals that access sensitive areas or visit sensitive areas, and uses "second terminal" to describe terminals that access non-sensitive areas and visit non-sensitive areas.

[0179] In order to distinguish and describe different areas, the embodiment of the present application uses "first area" to describe the area accessed by the first terminal, "second area" to describe the destination area visited by the first terminal, "third area" to describe the area accessed by the second terminal, and "fourth area" to describe the destination area visited by the second terminal.

[0180] Reference Attachment Figure 2 , attached Figure 2 This is a flow chart of a network access control method provided by an embodiment of the present application. Optionally, Figure 2 The method shown is applied to Figure 1 In the system architecture shown, Figure 2The method shown is Figure 1 The network system shown interacts with the terminal. For example, Figure 2 The forwarding system in the method shown is Figure 1 Forwarding system 220 in. Figure 2 The detection system in the method shown is Figure 1 Detection system 240 in. Figure 2 The execution subjects of each step in the method shown include various situations. Figure 1 right Figure 2 The execution subjects of some steps in the method shown are illustrated by way of example.

[0181] In some embodiments, Figure 1 A single forwarding device in the forwarding system executes independently Figure 2 All the steps that need to be performed by the forwarding system. For example, a forwarding device that passes through the forwarding path of a data message sent by a terminal independently performs Figure 2 For example, the access switch (such as access switch 221a), aggregation switch or core switch through which the data message sent by the terminal passes independently executes all the steps required by the forwarding system. Figure 2 All steps performed by the forwarding system.

[0182] In other embodiments, Figure 1 Different forwarding devices in the forwarding system respectively execute different steps required by the forwarding system. For example, a forwarding device that the forwarding path of the data message sent by the terminal passes through is used to execute the steps of the second message and sending the second message, and another forwarding device that the forwarding path of the data message sent by the terminal passes through executes the steps of the control policy. Figure 1 The access switch 221a executes S320, S322, S324 and S326, and Figure 1 The middle access switch 221b executes S340 and S342.

[0183] In some embodiments, Figure 1 The situation awareness device 242 and the controller 241 cooperate to execute Figure 2 All steps required to be performed by the detection system in the method shown are, for example, performed by the situation awareness device 242 in steps S330 and S332 , and performed by the controller 241 in steps S336 .

[0184] In other embodiments, Figure 1 The situation awareness device 242 or the controller 241 executes the Figure 2 All steps required to be performed by the detection system in the method shown are, for example, performed by the controller 241 in steps S330 , S332 and S336 .

[0185] For example, in the scenario of accessing a sensitive area from a non-sensitive area, Figure 2 The first terminal in the method shown is Figure 1 The first terminal accesses the office area 11, and the destination accessed by the first terminal is Figure 1 In the server 132, the destination area accessed by the first terminal is Figure 1 Central Operation and Maintenance Area 13.

[0186] For example, in the scenario of accessing a non-sensitive area from a sensitive area, Figure 2 The first terminal in the method shown is Figure 1 The first terminal accesses the first area of ​​the operation and maintenance area 13, and the destination of the first terminal is Figure 1 In the terminal 111, the destination area visited by the first terminal is Figure 1 Middle office area 11.

[0187] For example, in the scenario of accessing a sensitive area from a sensitive area, Figure 2 The first terminal in the method shown is Figure 1 The first terminal accesses the first area of ​​the operation and maintenance area 13, and the destination of the first terminal is Figure 1 The destination area visited by the first terminal is Figure 1 A highly sensitive area 142 in the public service area 14 is indicated by a red zone.

[0188] Attachment Figure 2 The method shown includes the following steps S310 to S342.

[0189] Step S310: The first terminal generates a first message.

[0190] The first message is used to access network resources deployed in the second area. Optionally, the first message is a data message. For example, the first message includes business data of the first terminal. For example, when the first terminal is transmitting business data to the second area, step S310 is executed to transmit the business data of the local terminal to the second area. As another example, the first message includes the address of the business data in the network resources deployed in the second area and an instruction to request the acquisition of the business data. For example, when the first terminal is acquiring the business data of the second area, step S310 is executed to request the network resources in the second area to transmit the business data of the local terminal to the first terminal. Alternatively, the first message is a control message, and the first message is used to establish a communication connection between the first terminal and the network resources in the second area. For example, the first message is a message used for a three-way handshake in the TCP protocol. The first terminal executes step S310 when establishing a communication connection with the network resources in the second area.

[0191] In an exemplary scenario triggering step S310, the first terminal displays a resource list that includes identifiers of multiple network resources within the protected network that the first terminal is authorized to access. When a user wishes to access a network resource in the resource list, the user clicks the identifier of the network resource, thereby triggering an access instruction for the network resource. In response to the access instruction for the network resource, the first terminal executes step S310.

[0192] In some embodiments, the first message includes a region identifier, which is used to identify the region accessed by the first terminal. The inclusion of the region identifier in the first message facilitates the network's determination of whether to mirror the first message based on the region identifier. Furthermore, messages sent by terminals accessing the network from different regions will carry different region identifiers, facilitating the network's ability to distinguish between messages originating from different regions based on the different region identifiers.

[0193] In some embodiments, the first message also includes operating environment parameter information of the first terminal. The operating environment parameters of the first terminal include at least one of the hard disk parameter information in the first terminal, the memory parameter information in the first terminal, and the operating system parameter information of the first terminal. For example, the environment-aware client performs a comprehensive calculation on the hard disk parameter information in the first terminal, the memory parameter information in the first terminal, and the operating system parameter information of the first terminal to obtain the operating environment parameter information of the first terminal. Since the first message includes the operating environment parameter information of the first terminal, it is convenient for the network side to trace the source based on the operating environment parameter information and thereby determine that the first message comes from the first terminal.

[0194] In some embodiments, the first message also includes a device identifier of the first terminal. The device identifier is used to identify the access area of ​​the first terminal and the operating environment parameters of the first terminal. In some embodiments, the device identifier of the first terminal includes two parts: a region identifier and the operating environment parameter information of the first terminal. Because the device identifier includes both the region identifier and the operating environment parameter information, the device identifier can simultaneously determine whether to mirror and trace the source back to the first terminal.

[0195] In some embodiments, the first message also includes an identifier of the destination. The identifier of the destination is, for example, an identifier of the network resource that the first terminal is accessing. For example, the identifier of the destination includes at least one of an IP address of the network resource, a domain name of the network resource, a uniform resource locator (URL) of the network resource, a port number of the network resource, or a name of the network resource. Because the first message also includes the identifier of the destination, the network side can determine the destination area accessed by the first terminal based on the identifier of the destination, thereby determining whether to mirror the area and making control policies.

[0196] Step S312: The first terminal sends a first message.

[0197] Step S320: The forwarding system receives a first message from the first terminal.

[0198] After receiving the first message, the forwarding system executes the mirroring action in step S322 when a certain condition is met.

[0199] Step S322: If the area accessed by the first terminal is a sensitive area or the destination accessed by the first terminal through the first message is located in a sensitive area, the forwarding system mirrors the first message to obtain a second message.

[0200] The forwarding system can obtain two copies of the same message by mirroring the first message, one of which is the mirrored original message (the first message) and the other is a mirrored message of the first message or a copy of the first message.

[0201] The second message is, for example, a mirror image of the first message or the first message itself. In some embodiments, the forwarding system sends the mirror image message to the detection system for security detection, and forwards the mirror imaged original message along the forwarding path of the original message to the destination in the second area. In this case, the second message sent by the forwarding system is a mirror image of the first message. In some embodiments, the forwarding system sends the mirror imaged original message to the detection system for security detection, and after the security detection, forwards the mirror image message along the forwarding path of the original message to the destination in the second area. In this case, the second message sent by the forwarding system is the first message itself. Since the original message and the mirror image message have the same content, the security detection results of the original message and the mirror image message are the same. Therefore, whether the original message or the mirror image message is sent, the purpose of performing security detection on the message sent by the first terminal to the second area can be achieved.

[0202] Since the first message for the terminal accessing the network in the sensitive area and the first message for the terminal visiting the sensitive area are mirrored, and the second message is sent to the detection system for security detection, stricter control of the messages related to the sensitive area is achieved.

[0203] In some embodiments of triggering the generation of the second message, the forwarding system performs the mirroring action in step S322 based on the area accessed by the first terminal being a sensitive area. For example, the forwarding system determines whether the first message carries the area identifier of the sensitive area. If the first message carries the area identifier of the sensitive area, the forwarding system executes step S322 to further send the second message to the detection system for security detection. If the first message does not carry the area identifier of the sensitive area, the forwarding system omits step S322 and directly forwards the first message to the destination in the second area.

[0204] As a specific example, the area identifier of the operation and maintenance area is 1, and the area identifier of the office area is 2. When the forwarding system receives the first message, if it finds that the area identifier carried in the first message is 1, the forwarding system determines that the first message comes from a terminal accessing the network in the operation and maintenance area, and then mirrors the first message and sends the second message upstream. If it finds that the area identifier carried in the first message is 2, the forwarding system determines that the first message comes from a terminal accessing the network in the office area, and then skips the steps of mirroring the first message and sending the second message upstream.

[0205] Since the second message is triggered and the action of sending the second message is based on whether the area identifier is the identifier of a sensitive area or whether the access area is a sensitive area, different processing methods are adopted for messages from different areas. The part of the message carrying the area identifier of the sensitive area will be mirrored and security checked, while the part of the message that does not carry the area identifier of the sensitive area does not need to be mirrored, so that different granularity management methods can be adopted for messages from sensitive areas and messages from non-sensitive areas.

[0206] In addition, compared with determining the access area based on the source IP address of the first message, the result of determining the access area based on a special area identifier is more accurate and reliable, reducing the risk of inaccurate access area determined based on the source IP address in the Network Address Translation (NAT) scenario. Since the source IP address of the first message has been converted, the source IP address of the second message received by the detection system is no longer the original source IP address of the first message, that is, the source IP address of the second message is no longer the IP address of the first terminal.

[0207] In some embodiments, the region identifier is part of the device identifier. The forwarding system obtains the device identifier carried in the first message, and the forwarding system reads the region identifier from the device identifier. For example, the forwarding system reads the first predetermined number of digits of the character string in the device identifier as the region identifier. Since the region identifier is part of the device identifier, in a scenario where it is not only necessary to use the region identifier to determine whether the first message needs to be mirrored, but also to use other parts of the device identifier other than the region identifier (such as optionally operating environment parameter information) for traceability, the first message can carry the region identifier and the information for traceability at the same time through the same field (the field carrying the device identifier), without the need to expand two independent fields in the first message to carry the region identifier and the device identifier respectively. Therefore, the overall overhead of the first message is relatively small, and the implementation complexity is relatively low.

[0208] Alternatively, the area accessed by the first terminal is determined based on the IP address of the first terminal. For example, a correspondence between an IP address segment and an access area is pre-configured, and the correspondence includes a first correspondence between the first IP address segment and an identifier of a sensitive area and a second correspondence between the second IP address segment and an identifier of a non-sensitive area. The first IP address segment includes the IP addresses of devices deployed in sensitive areas, and the second IP address segment includes the IP addresses of devices deployed in non-sensitive areas. After the forwarding system receives the first message, the forwarding system obtains the source IP address carried in the source IP address field in the IP message header of the first message, and matches the source IP address with the IP address segment in the correspondence. If the source IP address of the first message matches the first IP address segment in the first correspondence, then based on the identifier of the sensitive area in the first correspondence, it is determined that the first message comes from a terminal in a sensitive area (the access area is a sensitive area). If the source IP address of the first message matches the second IP address segment in the second correspondence, then based on the identifier of the sensitive area in the second correspondence, it is determined that the first message comes from a terminal in a non-sensitive area (the access area is a non-sensitive area).

[0209] In other embodiments of triggering the generation of the second message, after the forwarding system receives the first message, the forwarding system obtains the destination IP address carried in the destination IP address field in the IP message header of the first message, and matches the destination IP address of the first message with the IP address segment in the corresponding relationship. If the destination IP address of the first message matches the first IP address segment in the first corresponding relationship, the forwarding system determines that the destination area where the access party of the first terminal is located is a sensitive area based on the identifier of the sensitive area in the first corresponding relationship. If the destination IP address of the first message matches the second IP address segment in the second corresponding relationship, the forwarding system determines that the destination area where the access party of the first terminal of the first message is located is a non-sensitive area based on the identifier of the non-sensitive area in the second corresponding relationship.

[0210] Since the second message is triggered and the action of sending the second message is based on whether the identifier of the destination party matches the identifier of the sensitive area or whether the destination area is a sensitive area, different processing methods are adopted for messages sent to different areas. The part of the message sent from the non-sensitive area to the sensitive area will be mirrored and security checked, and the part of the message sent from the non-sensitive area to the non-sensitive area does not need to be mirrored and security checked. Therefore, different control methods can be adopted for messages from non-sensitive areas based on different destination areas, thereby realizing hierarchical control.

[0211] In other embodiments of determining the destination area, similar to the method of determining the access area based on the area identifier, the area where the destination party accessed by the first terminal is located is also determined based on the area identifier carried in the first message. For example, the first message carries a first area identifier and a second area identifier, the first area identifier is used to identify the area accessed by the first terminal, and the second area identifier is used to identify the area where the destination party accessed by the first terminal is located. Based on the first area identifier being an identifier of a sensitive area, the forwarding system can determine that the area accessed by the first terminal is a sensitive area. Based on the second area identifier being an identifier of a sensitive area, the forwarding system can determine that the destination party accessed by the first terminal is located in a sensitive area.

[0212] In some embodiments, the forwarding system executes steps S322 to S324 based on the redirection policy. The redirection policy is used to indicate that the first message carrying the regional identifier of the sensitive area is mirrored and the second message is redirected to the detection system. For example, the redirection policy includes the regional identifier of the sensitive area, an action identifier indicating mirroring, and an action identifier indicating redirection. Among them, the regional identifier of the sensitive area is equivalent to the matching item in the redirection policy, and the regional identifier of the sensitive area is used to match the first message. The action identifier indicating mirroring and the action identifier indicating redirection are equivalent to the actions that need to be performed to meet the matching item in the redirection policy. The forwarding system obtains and saves the redirection policy. When the forwarding system receives the first message, the forwarding system uses the regional identifier carried in the first message to match the regional identifier in the redirection policy; if the regional identifier carried in the first message matches the regional identifier in the redirection policy, indicating that the first message comes from a sensitive area or needs to be sent to a sensitive area, the forwarding system mirrors the first message based on the action identifier indicating mirroring, and the forwarding system sends the second message to the detection system based on the action identifier indicating redirection. Alternatively, if the area identifier carried in the first message does not match the area identifier in the redirection policy, indicating that the first message comes from a non-sensitive area and needs to be sent to a non-sensitive area, the forwarding system omits the action performed based on the action identifier indicating the mirror and the action identifier indicating the redirection, and directly forwards the first message.

[0213] With respect to the source of the redirection policy on the forwarding system, the detection system (such as a controller) may optionally send a redirection policy to the forwarding system (such as each access layer forwarding device). For example, the detection system obtains the security score of the first terminal. If the security level represented by the security score of the first terminal is less than the security level represented by the score threshold, the detection system obtains the redirection policy and sends the redirection policy to the forwarding system, so as to strengthen security detection for the terminal with insufficient security by detecting the second message. For example, the detection system includes a situational awareness device and a controller. If the situational awareness device determines that the security score of the first terminal is less than 80 points, the situational awareness device sends a policy issuance instruction to the controller, and the policy issuance instruction instructs the controller to send a redirection policy to the access switch. The controller executes the policy issuance instruction to send the redirection policy to the access switch. Based on the redirection policy from the controller, the access switch mirrors the first message of the first terminal and then sends the second message to the situational awareness device for security detection.

[0214] In step S324, the forwarding system forwards the first message to the second area based on the destination address in the first message.

[0215] The forwarding system forwards the first message, so that the first terminal can access network resources deployed in the second area.

[0216] In some implementations, the forwarding system directly forwards the first message without waiting to receive the control policy issued by the detection system based on the second message, thereby avoiding affecting the service of the first terminal accessing network resources through the first message.

[0217] In other embodiments, the second message sent by the forwarding system to the detection system is the first message itself, and the forwarding system forwards the mirror message to the destination in the second area based on the destination address in the mirror message. Since the mirror message and the first message have the same content, forwarding the mirror message to the second area can achieve the same effect as forwarding the first message to the second area, thereby realizing the service of the first terminal accessing network resources.

[0218] In some further embodiments, step S326 is an optional step. For example, after the forwarding system mirrors the first message, the forwarding system caches the first message itself locally, and sends the mirror message of the first message to the detection system so that the detection system can perform security detection on the mirror message. After the forwarding system receives the control policy issued by the detection system, if the control policy indicates that the first terminal has the authority to access the second area, the forwarding system forwards the first message again. If the control policy issued by the detection system indicates that the first terminal does not have the authority to access the second area, the forwarding system discards the first message. In this way, since the first message is forwarded to the second area after confirming that the first terminal has the authority to access the second area, although it will cause a certain delay in forwarding the service of the first terminal to access network resources, it is more secure and reduces the security risk of transmitting the risky first message to the second area.

[0219] Step S326: The forwarding system sends a second message to the detection system.

[0220] For example, the forwarding system determines, based on the destination address in the first message, whether the destination of the first message is located within the network to which the local end is communicating. If the destination of the first message is not located within the network to which the local end is communicating, the forwarding system forwards the first message to the next hop required to reach the destination address. If the destination of the first message is located within the network to which the local end is communicating, the forwarding system sends the first message via the outbound interface of the local end communicating with the destination.

[0221] This embodiment does not limit the sequence of steps S324 and S326. In some embodiments, the forwarding system executes step S324 first and then step S326. In other embodiments, the forwarding system executes step S326 first and then step S324. In still other embodiments, the forwarding system executes steps S324 and S326 in parallel.

[0222] In step S316, the first terminal collects the detection results of multiple security detection items; the first terminal determines the security score of the first terminal based on the detection results of the multiple security detection items of the first terminal; the first terminal reports the security score of the first terminal to the detection system; or, the first terminal collects the detection results of multiple security detection items, and the first terminal sends the detection results of multiple security detection items to the detection system.

[0223] The first terminal sends the security score of the first terminal or the detection results of multiple security detection items of the first terminal through the detection system, so that the detection system determines the control strategy adopted for the first terminal in combination with the detection result of the mirror message and the security score or detection result received from the first terminal. This is equivalent to providing the detection system with two data sources for determining the control strategy. One data source is the message sent by the terminal in the process of accessing network resources, and the other data source is the detection result of the terminal's own security detection items. This enables the detection system to comprehensively consider the two data sources to determine the control strategy, thereby further improving the accuracy of the control strategy.

[0224] In some embodiments, an environment awareness client is executed in the first terminal. An environment awareness server is executed in the detection system. The first terminal, through the environment awareness client, collects test results of multiple security detection items and / or determines a security score of the first terminal based on the test results of the multiple security detection items of the first terminal, and reports the security score of the first terminal to the environment awareness server executed in the detection system.

[0225] In some embodiments of a first terminal determining its own security score, a context-aware client determines a security baseline for the first terminal. The context-aware client determines the security score for the first terminal based on the deviation between the test results of various security detection items of the first terminal and the security baseline of the first terminal. The security baseline of the first terminal serves as a benchmark or reference value for the test results of various security detection items of the first terminal. For example, the security baseline of the first terminal is determined based on the test results of various security detection items of the first terminal over multiple historical time periods.

[0226] Regarding the execution timing of step S316, in some embodiments, the context-aware client executes step S316 when detecting a predetermined security event on the first terminal. In other embodiments, the context-aware client executes step S316 every predetermined time period.

[0227] This embodiment does not limit the sequence of steps S312 and S316. In some embodiments, the forwarding system executes step S312 first and then step S316. In other embodiments, the forwarding system executes step S316 first and then step S312. In other embodiments, the forwarding system executes steps S312 and S316 in parallel.

[0228] Step S316 is optional. In other embodiments, the first terminal omits step S316, and the detection system determines a security score based on the detection results of the mirrored message, and then determines the control policy for the first terminal based on the security score. This approach does not rely on the first terminal's ability to collect the detection results of security detection items or determine the security score based on the detection results of security detection items, thus reducing the processing power requirements of the terminal. However, it can still achieve the function of determining the control policy for the first terminal based on the security level of the first terminal.

[0229] Step S330: The detection system receives a second message from the forwarding system.

[0230] Step S332: The detection system obtains a security score of the first terminal based on the second message.

[0231] The detection system obtains the security score of the first terminal so as to issue a control policy based on the security score of the first terminal, and further controls the behavior of the first terminal initiating access to the second area based on the control policy.

[0232] Furthermore, if the security level of the first terminal changes after the first terminal accesses the network, for example, the security level is reduced because the first terminal is implanted with malicious files (such as poisoning) or the first terminal is controlled by an attacker to become an attack host (also known as a bot or zombie computer), the security level of the first terminal can be reflected through the detection results of the second message. The detection system can adjust the management and control strategy adopted for the first terminal based on the change in the security score obtained this time compared to the security score obtained last time, thereby achieving dynamic network access for the first terminal.

[0233] In the three scenarios of a sensitive area accessing a non-sensitive area, a sensitive area accessing a non-sensitive area, and a sensitive area accessing a sensitive area, the terminal's security score is determined based solely on the security test results of the second message, or based on a combination of the security test results of the second message and the test results of multiple security test items of the terminal. The following examples illustrate how to determine the security score of the first terminal through the following implementation methods 1 and 2.

[0234] Implementation method 1 of determining the security score of the first terminal: determining the security score of the terminal based on the detection result of the message.

[0235] For example, the detection system performs a security check on the second message and obtains a test result. The detection system determines the security score of the first terminal based on the test result of the second message. Because the security check is performed on the message initiated by the first terminal during the access process, the detection is more real-time, which helps to promptly discover and prevent potential security threats and improve security. In addition, even if the first terminal is unable to obtain the test results of its own security test items (for example, the first terminal is a dumb terminal), the security level of the terminal can be detected, which has a wider range of applicable scenarios.

[0236] Security detection includes at least one dimension, such as network attack detection or abnormal behavior detection. The following examples illustrate how to determine the security score based on specific security detection dimensions.

[0237] In some embodiments of performing network attack detection on the second message to determine a security score, the detection system performs network attack detection on the second message to obtain an attack signature of the first terminal; the detection system matches the attack signature of the first terminal with an attack signature library to obtain an attack detection result for the second message. The detection system determines the security score of the first terminal based on the attack detection result of the second message.

[0238] For example, if the attack signature of the first terminal matches the attack signature library, the detection system determines that the first terminal is attacked. If the attack signature of the first terminal does not match the attack signature library, the detection system determines that the first terminal is not attacked.

[0239] In some embodiments, if the attack detection result shows that the first terminal has been attacked, the detection system determines a security score that is less than a scoring threshold as the security score of the first terminal; if the attack detection result shows that the first terminal has not been attacked, the detection system determines a security score that is greater than the scoring threshold as the security score of the first terminal.

[0240] Among them, the attack feature library stores the features or fingerprints of known attacks. For example, the attack feature library includes features of network attack behaviors (such as port scanning, structured query language (SQL) injection, cross-site scripting attacks, etc.), features of malicious files (including fingerprints and behavioral features of malware such as viruses, worms, and Trojans), and features of abnormal traffic patterns (such as features of distributed denial of service attacks (DDoS) attacks).

[0241] Alternatively, the detection system performs network attack detection on the second message through an artificial intelligence (AI) model to obtain a security score for the first terminal. The AI ​​model includes a feature extraction layer, a classification layer, and a mapping layer. The feature extraction layer is used to extract features from the content of the second message to obtain features of the second message; the classification layer is used to determine whether there is a network attack in the second message based on the features of the second message to obtain a probability value of the presence of a network attack in the second message; and the mapping layer is used to convert the probability value output by the classification layer into a security score. For example, the detection system extracts the content carried in the message header and / or payload of the second message, and the detection system inputs the content of the second message into a trained AI model. The second message is processed separately through the feature extraction layer, classification layer, and mapping layer in the AI ​​model to output a security score. Each sample in the training set based on which the AI ​​model is trained includes a first message containing a known network attack, a label indicating whether there is an attack in the first message, and a security score corresponding to the first message.

[0242] In some embodiments of performing abnormal behavior detection on the second message to determine a security score, the detection system performs abnormal behavior detection on the second message to obtain abnormal behavior characteristics of the first terminal; the detection system compares the abnormal behavior characteristics of the first terminal with a security baseline to obtain an abnormality detection result for the second message. The detection system determines the security score of the first terminal based on the abnormality detection result of the second message.

[0243] Abnormal behavior refers to behaviors that are not network attacks but pose security risks. Examples include accessing from remote locations, accessing for extended periods of time, or accessing late at night. A security baseline describes the normal network activity patterns of a first terminal. For example, a security baseline describes the normal access time, access frequency, access area, access destination, accessed network resources, and / or accessed ports of a first terminal.

[0244] In some embodiments, if the deviation between the abnormal behavior characteristics of the first terminal and the security baseline is greater than a deviation threshold, the detection system determines that the abnormality detection result is that the first terminal is attacked. If the deviation between the attack characteristics of the first terminal and the security baseline is less than the deviation threshold, the detection system determines that the abnormality detection result is that the first terminal is not attacked.

[0245] In some embodiments, if the anomaly detection result indicates that the first terminal's behavior is abnormal, the detection system determines a security score less than a scoring threshold as the first terminal's security score; if the anomaly detection result indicates that the first terminal's behavior is not abnormal, the detection system determines a security score greater than the scoring threshold as the first terminal's security score. Alternatively, if the anomaly detection result indicates that the first terminal's behavior is abnormal, the detection system decrements a predetermined score from the first terminal's historical security score and determines the resulting security score as the first terminal's security score; or, if the anomaly detection results for multiple consecutive second messages initiated to the first terminal all indicate that the first terminal's behavior is abnormal, the detection system determines a security score less than the scoring threshold as the first terminal's security score.

[0246] In some embodiments, when various types of terminals access the network, the situational awareness device extracts features and performs security checks on each type of network traffic, establishing a security baseline based on the features of each type of network traffic and the security check results. The situational awareness device compares the features of the second message with the security baseline. If the features of the second message exceed the security baseline, the security score of the first terminal is lowered.

[0247] Alternatively, the detection system uses an AI model to detect abnormal behavior in the second message to obtain a security score for the first terminal. The AI ​​model includes a feature extraction layer, a classification layer, and a mapping layer. The feature extraction layer is used to extract features from the content of the second message to obtain features of the second message; the classification layer is used to determine whether abnormal behavior exists in the second message based on the features of the second message to obtain a probability value of the presence of abnormal behavior in the second message; and the mapping layer is used to convert the probability value output by the classification layer into a security score. For example, the detection system extracts the content carried in the message header and / or payload of the second message, inputs the content of the second message into a trained AI model, and processes the second message through the feature extraction layer, classification layer, and mapping layer in the AI ​​model to output a security score. Each sample in the training set based on which the AI ​​model is trained includes a first message with known abnormal behavior, a label indicating whether abnormal behavior exists in the first message, and a security score corresponding to the first message.

[0248] Method 2 for determining the security score of the first terminal: Determine the security score of the terminal by combining the detection result of the message and the detection result of the security detection item.

[0249] The detection system performs a security check on the second message to obtain a first security score for the first terminal. The detection system also obtains a second security score for the first terminal, which is determined based on the test results of multiple security check items of the first terminal. The detection system combines the first security score of the first terminal with the second security score of the first terminal to obtain a security score for the first terminal.

[0250] By obtaining the security score in the above manner, since the security score is determined by taking into account the detection results of multiple security detection items of the terminal itself and the security risks existing in the first message initiated by the terminal, it helps to achieve more granular control.

[0251] This embodiment does not limit the temporal order of determining the second security score based on the test results of the multiple security detection items of the first terminal and determining the first security score based on the second message. In some embodiments, the second security score is determined first and then the first security score. In other embodiments, the first security score is determined first and then the second security score. In still other embodiments, determining the second security score and determining the first security score are performed in parallel.

[0252] In step S334 , the detection system determines a control policy corresponding to the first terminal based on the security score of the first terminal.

[0253] In some embodiments, the control policy includes access rights for the first terminal. In some embodiments, the access rights in the control policy are determined based on a security score of the first terminal. For example, the access rights in the control policy are determined based on whether the security score of the first terminal meets security requirements.

[0254] In some embodiments of determining a control strategy based on the security score of the first terminal, the detection system compares the security score of the first terminal with a score threshold. If the security level represented by the security score of the first terminal is higher than the security level represented by the score threshold, the control strategy determined by the detection system includes allowing the first terminal to access the second area (i.e., forwarding messages from the first terminal and whose destination address is located in the second area). For another example, if the security level represented by the security score of the first terminal is lower than the security level represented by the score threshold, the control strategy determined by the detection system includes isolating the terminal from the protected network, prohibiting the first terminal from accessing the first area, prohibiting the first terminal from accessing the second area (i.e., discarding messages from the first terminal and whose destination address is located in the second area), notifying the first terminal to re-access the network, or re-authenticating the first terminal.

[0255] Regarding the method of obtaining the scoring threshold, the scoring threshold is, for example, preset, and the scoring threshold is, for example, determined based on the distribution of security scores of multiple terminals.

[0256] The following example illustrates the process of determining the control strategy by combining two expressions of safety scores.

[0257] In the case where the security score is represented by a numerical value, optionally, if the security score is higher, the security level is higher, and the security score satisfies the security requirements by being defined as the security score being greater than a score threshold. For example, when the security score of the first terminal is greater than the score threshold, the control policy determined by the detection system includes allowing the first terminal to access the second area. When the security score of the first terminal is less than the score threshold, the control policy determined by the detection system includes prohibiting the first terminal from accessing the first area, prohibiting the first terminal from accessing the second area, notifying the first terminal to reconnect to the network, or reauthenticating the first terminal. Conversely, if the security score is higher, the security level is lower, and the security score satisfies the security requirements by being defined as the security score being less than the score threshold. For example, when the security score of the first terminal is less than the score threshold, the control policy determined by the detection system includes allowing the first terminal to access the second area. When the security score of the first terminal is greater than the score threshold, the control policy determined by the detection system includes prohibiting the first terminal from accessing the first area, prohibiting the first terminal from accessing the second area, notifying the first terminal to reconnect to the network, or reauthenticating the first terminal.

[0258] In the case where the security score is represented by an enumerated value, the score threshold, for example, includes a security score set that needs to be met to allow access to the second area, and the security score meets the security requirements defined by the security score belonging to the security score set. In the process of determining the control policy, when the security score of the first terminal belongs to the security score set, the detection system will allow the first terminal to access the second area as the access right in the control policy. When the security score of the first terminal does not belong to the security score set, the detection system will prohibit the first terminal from accessing the second area or re-authenticate the first terminal. For example, the security score is represented by an enumerated value (A, B, C), A represents high security, B represents medium security, and C represents low security. The score threshold includes (A, B), which means that high-security or medium-security terminals are allowed to access the office area, and low-security terminals are not allowed to access the office area. If the security score of the first terminal is A, and the detection system determines that the security score of the first terminal belongs to the score threshold (A, B), the detection system will allow the first terminal to access the second area as the access right in the control policy. For example, if the security score of the first terminal is C, and the detection system determines that the security score of the first terminal does not fall within the score threshold (A, B), the detection system will prohibit the first terminal from accessing the second area or re-authenticate the first terminal to determine the access rights in the management and control policy.

[0259] The number of scoring thresholds may optionally be one, or there may be multiple different scoring thresholds. Taking the determination of a security policy based on two scoring thresholds as an example, for example, if the security level represented by the security score of the first terminal is higher than the security level represented by the first scoring threshold, the control policy determined by the detection system includes allowing the first terminal to access the first area and allowing the first terminal to access the second area. For another example, if the security level represented by the security score of the first terminal is lower than the security level represented by the first scoring threshold but higher than the security level represented by the second scoring threshold, the control policy determined by the detection system includes allowing the first terminal to access the first area but prohibiting the first terminal from accessing the second area. If the security level represented by the security score of the first terminal is lower than the security level represented by the second scoring threshold, the control policy determined by the detection system includes prohibiting the first terminal from accessing the first area and notifying the first terminal to re-access the network. In this case, the security level represented by the first scoring threshold is higher than the security level represented by the second scoring threshold.

[0260] Taking a first scoring threshold of 80 and a second scoring threshold of 60 as an example, in one exemplary scenario, the detection system performs a security check on the second message and discovers that the second message carries a virus, indicating that the first terminal is infected with the virus. The detection system then determines that the security score of the first terminal is 30. Based on the fact that the security score of 30 is less than the second scoring threshold of 60, the detection system determines that the control policy includes prohibiting the first terminal from accessing the network, which is equivalent to using the most stringent control policy to deal with the terminal that has been infected with the virus. In another exemplary scenario, the detection system determines that there is no network attack such as a virus in the second message, but the antivirus software is turned off among the terminal's multiple security detection items, and the security patch update status indicates that the operating system vulnerability patch has not been updated for a long time. The detection system then determines that the security score of the first terminal is 65. Based on the fact that the security score of 65 is greater than the second scoring threshold of 60 but less than the first scoring threshold of 80, the detection system determines that the control policy includes allowing the first terminal to access non-sensitive areas but prohibiting the first terminal from accessing sensitive areas. This is equivalent to using a more relaxed control policy to deal with the terminal that poses a risk but has not yet been infected with the virus.

[0261] In other embodiments of determining a control policy based on the security score of a first terminal, a detection system stores a permission relationship table, which includes a correspondence between one or more security score ranges and access rights. The detection system queries the permission relationship table based on the security score of the first terminal. If the security score of the first terminal falls within a security score range in the permission relationship table, the access right corresponding to the security score range is determined to be the access right of the first terminal.

[0262] The permission relationship table is, for example, pre-configured on the detection system. For example, the permission relationship table includes a correspondence between one or more security score ranges and identifiers of areas permitted for access. For example, the permission relationship table is shown in Table 1 below. As can be seen from Table 1, the security score required for accessing the operation and maintenance area is the highest, the security score required for accessing the office area is the second highest, and the security score required for accessing the visitor area is the lowest. If the security score of the first terminal is 90 points, the detection system queries Table 1 below based on the 90 points and determines that the security score of the first terminal is (90, 100), then it is determined that the first terminal has the right to access the operation and maintenance area, office area and visitor area; if the security score of the first terminal is 80 points, the detection system queries Table 1 below based on the 80 points and determines that the security score of the first terminal is (70, 90), then it is determined that the first terminal has the right to access the office area and visitor area, but does not have the right to access the operation and maintenance area; if the security score of the first terminal is 65 points, the detection system queries Table 1 below based on the 65 points and determines that the security score of the first terminal is (60, 70), then it is determined that the first terminal has the right to access the visitor area, but does not have the right to access the office area and operation and maintenance area.

[0263] Table 1

[0264] Safety Score Access rights (area identifiers that are allowed to be accessed) (90，100) Operation and maintenance area, office area and visitor area (70，90) Office and visitor areas (60，70) Visitor Area

[0265] In some embodiments, the detection system also considers the type of destination area accessed by the terminal when determining the control policy. For example, the detection system determines the control policy corresponding to the first terminal based on the security score of the first terminal and the sensitivity of the second area. In some embodiments, the scoring threshold used in determining the control policy is determined based on the type of the second area. For example, the detection system determines the scoring threshold based on the sensitivity of the second area. The detection system determines the control policy corresponding to the first terminal based on the security score of the first terminal and the scoring threshold.

[0266] In some implementations, the network system requires different security levels for terminals accessing different areas. The network system may require a higher security level for terminals accessing sensitive areas than for terminals accessing non-sensitive areas. Optionally, the different security levels required by the network system for terminals are reflected through different scoring thresholds. For example, the network system may require a higher security score threshold for terminals accessing sensitive areas than for terminals accessing non-sensitive areas. The following examples illustrate these two scenarios.

[0267] Because the network system uses different scoring thresholds when determining control strategies for different areas, to distinguish between these different scoring thresholds, the "first scoring threshold" is used to describe the scoring threshold used for sensitive areas, and the "second scoring threshold" is used to describe the scoring threshold used for non-sensitive areas. The second scoring threshold represents a lower level of security than the first scoring threshold.

[0268] For example, if a higher security score indicates a higher level of security, the second scoring threshold is lower than the first scoring threshold. If a lower security score indicates a higher level of security, the second scoring threshold is higher than the first scoring threshold. The following examples illustrate the application of the two scoring thresholds in two scenarios.

[0269] Case 1: Terminal accesses sensitive areas

[0270] In the event that the first terminal accesses a sensitive area (i.e., the second area is a sensitive area), the scoring threshold determined by the detection system is the first scoring threshold. If the security level represented by the security score of the first terminal is higher than the security level represented by the first scoring threshold, the control policy determined by the detection system includes allowing the first terminal to access the second area. If the security level represented by the security score of the first terminal is lower than the security level represented by the first scoring threshold, the control policy determined by the detection system includes prohibiting the first terminal from accessing the first area, prohibiting the first terminal from accessing the second area, notifying the first terminal to reconnect to the network, or reauthenticating the first terminal.

[0271] Case 2: Terminal accesses non-sensitive areas

[0272] In the case where the first terminal accesses a non-sensitive area (i.e., the second area is a non-sensitive area), the scoring threshold determined by the detection system is the second scoring threshold. If the security level represented by the security score of the first terminal is higher than the security level represented by the second scoring threshold, the control policy determined by the detection system includes allowing the first terminal to access the second area. If the security level represented by the security score of the first terminal is lower than the security level represented by the second scoring threshold, the control policy determined by the detection system includes prohibiting the first terminal from accessing the first area, prohibiting the first terminal from accessing the second area, notifying the first terminal to reconnect to the network, or re-authenticating the first terminal.

[0273] The following uses a specific example to illustrate the application of the two scoring thresholds. Take the example of a scoring threshold represented by a numerical value and the higher the security score, the higher the security level. For example, the highest value of the security score is 100 points, and 100 points represents the highest security level that the terminal can achieve. The first scoring threshold used by the network system for the operation and maintenance area is, for example, 90 points, and the second scoring threshold used by the network system for the office area is, for example, 60 points. If the security score of the first terminal is higher than 90 points, the network system allows the first terminal to access the operation and maintenance area and the office area; if the security score of the first terminal is higher than 60 points but lower than 90 points, the network system prohibits the first terminal from accessing the operation and maintenance area, but allows the first terminal to access the office area. If the security score of the first terminal is lower than 60 points, the network system prohibits the first terminal from accessing the operation and maintenance area and the office area.

[0274] Since the scoring threshold corresponding to sensitive areas is different from the scoring threshold corresponding to non-sensitive areas, the security level required for accessing sensitive areas is different from the security level required for accessing non-sensitive areas. The security level required for accessing sensitive areas is relatively high, while the security level required for accessing non-sensitive areas is relatively low. This makes the security level required for terminals to access sensitive areas higher than the security level required for accessing non-sensitive areas. Through this scoring threshold design method, sensitive areas can be more strictly controlled. For example, if the security level of a terminal decreases slightly, the terminal's security score will not meet the security threshold, triggering the network system to adjust the control policy adopted for the terminal to a stricter control policy. Non-sensitive areas can be more loosely controlled. For example, if the security level of a terminal decreases slightly, the terminal's security score still meets the security threshold, triggering the network system to maintain the control policy adopted for the terminal unchanged, thereby allowing the terminal to operate with the problem, so that the control of the terminal has almost no impact on the process of the terminal accessing network resources.

[0275] Optionally, the trigger condition for determining and issuing the control policy is that the current security score of the terminal changes compared to the historical security score. For example, before step S332, the detection system has determined and issued the first control policy corresponding to the first terminal based on the first security score of the first terminal in the historical time period. By executing step S332, the detection system determines that the security score of the first terminal is the second security score. The detection system determines whether the second security score of the first terminal is the same as the first security score of the first terminal. If the second security score is equal to the first security score or the deviation between the second security score and the first security score is less than the predetermined deviation, indicating that the security level of the first terminal remains almost unchanged, the detection system does not need to redetermine and adjust the control policy adopted for the first terminal. Therefore, the detection system omits the action of determining the control policy corresponding to the first terminal based on the security score of the first terminal, so that the forwarding system still controls the terminal according to the first control policy received in the historical time period. If the deviation between the second security score and the first security score is greater than a predetermined deviation, indicating that the security level of the first terminal has changed significantly, the detection system needs to adjust the control policy used for the first terminal. Therefore, the detection system determines the control policy corresponding to the first terminal based on the security score of the first terminal. The detection system determines and issues the second control policy, causing the forwarding system to update the first control policy used for the first terminal in the historical time period to the second control policy. Based on this approach, since it is not necessary to determine and issue the control policy for each received second message, the control policy only needs to be determined and issued when the terminal's current security score changes compared to the historical security score, that is, when the terminal's security level changes. This reduces the amount of computation and processing overhead caused by determining and issuing the control policy.

[0276] In some implementations of adjusting the control policy, when the security level of the first terminal decreases, the network system will correspondingly reduce the access rights of the first terminal, for example, the number of areas allowed to be accessed by the terminal in the control policy determined by the network system will decrease accordingly; when the security level of the first terminal increases, the network system will correspondingly increase the access rights of the first terminal, for example, the number of areas allowed to be accessed by the terminal in the control policy determined by the network system will increase accordingly. In an exemplary scenario, the first terminal was originally in a relatively healthy state, and the security score of the first terminal was 90 points. Before step S332, the detection system determined and issued a first control policy corresponding to the first terminal based on the security score of the first terminal. The first control policy included allowing the first terminal to access k areas. Later, the security level of the first terminal decreased, and the security score of the first terminal was adjusted to 60 points. The detection system determined and issued a second control policy corresponding to the first terminal based on the security score of the first terminal. The first control policy included allowing the first terminal to access m areas, where m is less than k.

[0277] In some implementations of adjusting the control policy, when the security level of the first terminal decreases, the network system will correspondingly reduce the first terminal's access permissions, for example, the number of areas allowed for the terminal to access in the control policy determined by the network system will be reduced accordingly. When the security level of the first terminal increases, the network system will correspondingly increase the first terminal's access permissions, for example, the number of areas allowed for the terminal to access in the control policy determined by the network system will be increased accordingly. In one exemplary scenario, the first terminal was originally in a relatively healthy state, with a security score of 90. Prior to step S332, the detection system determined and issued a first control policy corresponding to the first terminal based on the first terminal's security score. The first control policy included allowing the first terminal to access sensitive areas and office areas. Later, the first terminal's security level decreased, and its security score was adjusted to 60. The detection system determined and issued a second control policy corresponding to the first terminal based on the first terminal's security score. The first control policy prohibited the first terminal from accessing sensitive areas and internal employee areas within the office area, while allowing the first terminal to access visitor areas within the office area.

[0278] Optionally, the trigger condition for determining and issuing the control policy is that the security level represented by the terminal's current security score is less than the security level represented by the score threshold. For example, after the detection system determines the security score of the first terminal, it first determines whether the security level represented by the security score of the first terminal is less than the security level represented by the score threshold. If the security level represented by the security score of the first terminal is less than the security level represented by the score threshold, the detection system determines the control policy to be adopted for the first terminal based on the security score of the first terminal. If the security level represented by the security score of the first terminal is greater than the security level represented by the score threshold, the detection system cancels the step of determining the control policy based on the security score of the first terminal.

[0279] Regarding how the detection system determines which terminal the security score corresponds to, in some embodiments, the detection system performs tracing based on the second message to determine that the first message comes from the first terminal. Since the detection system identifies the security score and the first terminal through the same second message, it can associate the security score with the first terminal, that is, it determines that the terminal to which the security score belongs is the first terminal. Optionally, the tracing result is in the form of a device identifier of the first terminal, for example, the tracing result is the IP address of the first terminal. Exemplarily, the detection system obtains the device identifier of the first terminal by tracing the source of the first message, and carries the device identifier of the first terminal in the management and control policy so that the forwarding system can determine to control the first terminal.

[0280] In some implementations of source tracing, the first message sent by the first terminal includes the operating environment parameter information of the first terminal. The forwarding system mirrors the first message to obtain a second message. Since the content of the second message and the first message is usually the same, the second message will also include the operating environment parameter information of the first terminal. After the detection system receives the second message, the detection system obtains the operating environment parameter information of the first terminal carried in the second message. The detection system performs source tracing based on the operating environment parameter information of the first terminal to determine that the first message comes from the first terminal. For example, the detection system saves the correspondence between the terminal identifier and the operating environment parameter information, and the detection system searches for the correspondence between the terminal identifier and the operating environment parameter information based on the operating environment parameter information of the first terminal, obtains the device identifier of the first terminal, and determines that the first message comes from the first terminal based on the device identifier of the first terminal.

[0281] Since the first message is traced based on the operating environment parameter information, if a security risk is found in the second message through detection of the second message, it can be associated with a specific terminal based on the tracing result of the operating environment parameter information in the second message, thereby determining which terminal has the security risk.

[0282] Furthermore, if the operating environment of the first terminal changes, the operating environment parameter information carried in the second message sent by the forwarding system will be different from the operating environment parameter information carried in the second message sent previously. After tracing the source based on the new operating environment parameter information of the first terminal, the detection system will treat the first terminal as a new terminal that has not yet been issued a control policy. Therefore, the detection system will update the control policy for the first terminal based on the security score of the first terminal determined by the second message received this time, which is equivalent to re-authorizing the first terminal, thereby increasing the difficulty for attackers to impersonate legitimate terminals and improving network security. For example, when the first terminal is attacked and infected with a virus, the attacker modifies the registry entries and system configuration files of the operating system in the first terminal and changes the network configuration of the first terminal. In this case, even if the security score obtained based on the second message of the first terminal does not change, the detection system can readjust the permissions of the first terminal because the operating environment parameter information of the first terminal has changed.

[0283] Furthermore, compared with the method of tracing the source based on the source IP address of the first message, since the operating environment parameters of the terminal usually do not change within a period of time, compared with the highly dynamic IP address, the operating environment parameter information of the terminal can better realize the role of uniquely identifying the corresponding terminal. Therefore, the detection system can more accurately and reliably locate the terminal at risk by tracing the source based on the operating environment parameter information, reducing the risk of inaccurate terminal determination based on the source IP address in the network address translation (NAT) scenario. Since the source IP address of the first message has been converted, the source IP address of the second message received by the detection system is no longer the original source IP address of the first message, that is, the source IP address of the second message is no longer the IP address of the first terminal, which leads to the risk of inaccurate terminal determination based on the source IP address.

[0284] In other embodiments of tracing the source, the first message sent by the first terminal includes the network address of the first terminal, and the second message obtained by the forwarding system mirroring the first message includes the network address of the first terminal. The detection system performs tracing based on the operating environment parameter information of the first terminal to determine that the first message comes from the first terminal. The network address of the first terminal includes, for example, the IP address of the terminal and / or the Media Access Control (MAC) address of the terminal.

[0285] Step S336: The detection system sends the control policy corresponding to the first terminal to the forwarding system.

[0286] In some implementations of issuing a control policy, the detection system generates a Change of Authorization (COA) message, which includes the control policy corresponding to the first terminal. For example, the COA message includes the device identifier of the first terminal and the permission information of the first terminal. The permission information of the first terminal includes the identifiers of one or more areas that the first terminal is authorized to access and / or the identifiers of one or more areas that the first terminal is authorized to access. The detection system sends the COA message to the forwarding system.

[0287] Step S340: The forwarding system receives the control policy corresponding to the first terminal from the detection system.

[0288] Step S342: The forwarding system controls the first terminal based on the control policy.

[0289] In some embodiments, the control policy includes permission information of the first terminal. Based on the permission information of the first terminal, the forwarding system allows the first terminal to perform the network access behavior indicated by the permission information and prohibits the first terminal from performing other network access behaviors other than the network access behavior indicated by the permission information.

[0290] For example, the permission information of the first terminal includes the access rights of the first terminal, and the access rights include the identifier of the network resource that the first terminal is authorized to access or the identifier of the area that the first terminal is allowed to access. For example, if the access rights include the identifier of the first network resource that the first terminal is allowed to access, the forwarding system allows the first terminal to access the first network resource based on the access rights. For another example, if the access rights include authorization to allow the first terminal to access a sensitive area, the forwarding system allows the first terminal to access the sensitive area based on the access rights of the first terminal. For another example, if the access rights indicate authorization to allow the first terminal to prohibit access to a sensitive area, the forwarding system discards the first message received from the first terminal that accesses the sensitive area based on the access rights. For another example, if the access rights indicate isolation of the terminal from the protected network, the forwarding system disconnects the port connecting the forwarding system to the first terminal, which is equivalent to taking the first terminal offline or isolating the first terminal, thereby preventing the first message subsequently initiated by the first terminal from being transmitted to the second area through the forwarding system, thereby reducing the probability of the first terminal infecting other terminals deployed in the second area.

[0291] By executing step S332, the detection system determines that the security score of the first terminal is the second security score. The detection system then determines whether the second security score of the first terminal is the same as the first security score of the first terminal. If the second security score is equal to the first security score, or the deviation between the second security score and the first security score is less than a predetermined deviation, indicating that the security level of the first terminal remains largely unchanged, there is no need to adjust the control policy applied to the first terminal. Therefore, the detection system omits the action of determining the control policy corresponding to the first terminal based on the security score of the first terminal, so that the forwarding system continues to control the terminal according to the first control policy received during the historical time period. If the deviation between the second security score and the first security score is greater than the predetermined deviation, indicating that the security level of the first terminal has significantly changed, it is necessary to adjust the control policy applied to the first terminal. Therefore, the detection system determines the control policy corresponding to the first terminal based on the security score of the first terminal, determines and issues the second control policy, and causes the forwarding system to update the first control policy applied to the first terminal during the historical time period to the second control policy. This approach eliminates the need to determine and issue the control policy for each received second message, thereby reducing computational complexity and processing overhead.

[0292] In some embodiments, the management and control policy includes a device identifier of the first terminal and a first action identifier. After the forwarding system subsequently receives the first message, the forwarding system determines that the first message comes from the first terminal based on the device identifier of the first terminal, and performs the processing action identified by the first action identifier on the first message, thereby managing and controlling the behavior of the first terminal accessing the second area. For example, in a case where the first action identifier is a character string that identifies the discarding of the first message (such as deny), the forwarding system discards the first message subsequently received from the first terminal, so that the first message received by the first terminal is interrupted in transmission at the forwarding system, thereby blocking the first terminal from further accessing the network through the forwarding system. For another example, in a case where the first action identifier is a character string that identifies the forwarding of the first message (such as pemit), the forwarding system forwards the first message subsequently received from the first terminal, so that the first message received by the first terminal can be transmitted to the destination through the forwarding system.

[0293] In some embodiments, when the forwarding system receives the subsequent first message in step S320, the forwarding system first determines that the first message comes from the first terminal based on the device identifier of the first terminal, and based on the area identifier carried in the first message and the identifier of the destination party, determines that the first message comes from the first area and needs to be forwarded to the second area. That is, when the current network access scenario of the first terminal is consistent with the network access scenario on which the control policy is based, the forwarding system performs the processing action identified by the first action identifier on the first message.

[0294] The method provided in this embodiment determines, after a terminal accesses an area in a network, the control policy to be adopted for the terminal based on the terminal's access area, the destination area requested by the terminal, and the terminal's security level during the process of the terminal initiating access from the area to another area in the network. This allows the network side to adopt differentiated control policies for the terminal according to different access areas, different destination areas, and different security levels of the terminal, thereby improving the precision and flexibility of network control.

[0295] Furthermore, if the network access scenario changes, the network system can dynamically adjust the control policy adopted for the terminal as the network access scenario changes. For example, if the terminal moves horizontally at the access layer, causing the terminal's access area to change, or if the terminal changes from requesting access to resources in the operation and maintenance area to requesting access to resources in the office area, or if the terminal's security level decreases due to virus infection, the network system can dynamically adjust the control policy adopted for the terminal based on the change in the terminal's access area, the change in the destination area, and / or the change in the terminal's security level, thereby improving the dynamic and flexible nature of network control and making it more suitable for scenarios with mobile terminals.

[0296] The above is attached Figure 2The embodiment illustrates the control process in the network access scenario involving sensitive areas. Figure 3 The embodiment illustrates the control process in a network access scenario that does not involve sensitive areas (for example, a scenario where a terminal in a non-sensitive area initiates access to a network resource in a non-sensitive area). Figure 3 Examples and Appendix Figure 2 The main differences between the embodiments are whether the forwarding system mirrors and sends the data message from the terminal (see step S422) and the way the detection system determines the security score (see step S432). Figure 3 Examples and Appendix Figure 2 The same and similar technical implementation details between the embodiments can be found in the attached Figure 2 Description of embodiments.

[0297] Reference Attachment Figure 3 , attached Figure 3 This is a flow chart of a network access control method provided by an embodiment of the present application. Figure 3 The method shown focuses on how to control access from non-sensitive areas to non-sensitive areas. Figure 3 The method shown includes the following steps S410 to S442.

[0298] Step S410: The second terminal generates a third message.

[0299] Step S412: The second terminal sends a third message.

[0300] Step S420: The forwarding system receives a third message from the second terminal.

[0301] In step S422, if the area accessed by the second terminal is a non-sensitive area and the destination accessed by the second terminal through the third message is located in the non-sensitive area, the forwarding system omits the step of mirroring the third message.

[0302] When a terminal in a non-sensitive area initiates an access to a non-sensitive area, the probability that the third message sent by the terminal poses a security threat to the network is smaller than when a terminal in a sensitive area initiates an access and when a terminal initiates an access to a sensitive area. Therefore, the forwarding system omits (skips) the step of mirroring the received third message. In other words, it skips the step of mirroring the received third message and directly executes step S424.

[0303] Step S424: The forwarding system forwards the third message to the fourth area based on the destination address in the third message.

[0304] In step S416, the second terminal collects test results for various security detection items; the second terminal determines a security score for the second terminal based on the test results for the various security detection items; and the second terminal reports the security score for the second terminal to the detection system. Alternatively, the second terminal collects test results for various security detection items and sends the test results for the various security detection items to the detection system.

[0305] The second terminal sends the security score of the second terminal or the detection results of multiple security detection items of the second terminal through the detection system, so that the detection system determines the control strategy adopted for the second terminal based on the received security score or detection results.

[0306] In some embodiments, an environment awareness client is executed in the second terminal. An environment awareness server is executed in the detection system. The second terminal, through the environment awareness client, collects test results of multiple security detection items and / or determines a security score of the second terminal based on the test results of the multiple security detection items of the second terminal, and reports the security score of the second terminal to the environment awareness server executed in the detection system.

[0307] Regarding the timing of executing step S416, in some embodiments, the context-aware client executes step S416 when detecting a predetermined security event on the second terminal. In other embodiments, the context-aware client executes step S416 every predetermined time period.

[0308] In step S432, the detection system obtains a security score of the second terminal when the second terminal accesses the third area and initiates access to the fourth area. The security score of the second terminal is determined based on the detection results of multiple security detection items of the second terminal.

[0309] The detection system obtains the security score of the second terminal so as to issue a control policy based on the security score of the second terminal, thereby controlling the behavior of the second terminal initiating access to the fourth area.

[0310] The execution entity for determining the security score based on the detection results of multiple security detection items of the second terminal is, for example, the environment perception client or the detection system. The following describes how to determine the security score by combining two implementation methods.

[0311] Implementation method 1 of determining a security score based on security detection items: a detection system receives a security score of a second terminal reported by the second terminal.

[0312] Method 2 for implementing the method of determining a security score based on security detection items: the detection system receives detection results of multiple security detection items reported by the second terminal, and determines the security score of the second terminal based on the detection results of the multiple security detection items.

[0313] In step S434, the detection system determines a control policy corresponding to the second terminal based on the security score of the second terminal.

[0314] Step S436: The detection system sends the control policy corresponding to the second terminal to the forwarding system.

[0315] Step S440: The forwarding system receives the control policy corresponding to the second terminal from the detection system.

[0316] Step S442: The forwarding system controls the second terminal based on the control policy.

[0317] The method provided in this embodiment omits the steps of mirroring data packets, sending mirrored packets, and performing security detection on mirrored packets when a terminal accessing a non-sensitive area initiates access to the non-sensitive area. The network side determines the management and control strategy adopted for the terminal based on the security score obtained from the detection results of various security detection items of the terminal, thereby saving the processing resources and forwarding resources required for mirroring packets and sending mirrored packets.

[0318] Furthermore, by comparing Figure 3 In the embodiment, step S432 and Figure 2 It can be seen from step S332 in the embodiment that due to the different sensitivities of the access areas based on the network side, different security detection methods are used to determine the security score of the terminal. For example, the security score of the terminal in the sensitive area is determined based on the mirror message and the detection results of multiple security detection items. The security score of the terminal in the non-sensitive area is determined based on the detection results of multiple security detection items of the terminal when the terminal accesses the non-sensitive area. The network access rights and network access rights are dynamically changed according to the changes in the security score, so that the network access control is more refined and the network security is improved.

[0319] The following is attached Figure 2 The method embodiment shown and the attached Figure 3 The source of the area identifier in the illustrated method embodiment is illustrated by way of example. The method described below is applicable to both a network access scenario in which a first terminal participates and a network access scenario in which a second terminal participates.

[0320] In some implementations, the network system sends the region identifier to the terminal. The terminal receives the region identifier from the network system. During step S310, the terminal adds the region identifier to the first message, so that the first message includes the region identifier.

[0321] There are many situations in which the entity in the network system is responsible for issuing the area identifier to the terminal. The following two situations are used as examples to illustrate.

[0322] In a case where the controller in the network system is responsible for issuing a region identifier to the terminal, for example, during the process of performing access authentication on the terminal, the controller determines the region in which the forwarding device to which the terminal is connected is located in the forwarding system to obtain the region identifier. The controller sends the region identifier to the terminal. For example, when performing 802.1X authentication on the terminal, the controller determines the region in which the 802.1X access switch that performs access authentication on the terminal is located to obtain the region identifier corresponding to the region. Exemplarily, an environment-aware server runs in the controller, and the controller sends the region identifier to the environment-aware client running in the terminal through the environment-aware server. The environment-aware client receives the region identifier from the controller.

[0323] In a case where a forwarding device in a network system is responsible for delivering a region identifier to a terminal, for example, a forwarding device connected to a terminal in the network system is responsible for delivering the region identifier to the terminal. For example, the forwarding device determines the region in which the terminal is located to obtain the region identifier. The forwarding device sends the region identifier to the first terminal.

[0324] Regarding the timing of the network system issuing the region identifier to the terminal, in some embodiments, the network system issues the region identifier to the terminal during the process of authenticating the terminal. Optionally, the network system executes the step of issuing the region identifier upon being triggered by a request from the terminal.

[0325] For example, during the access authentication process, the terminal sends a query request to the network system, and the query request instructs to obtain the identifier of the area to which the terminal is accessing. In response to the query request, the network system queries the area where the forwarding device accessed by the terminal is located to obtain the area identifier; the network system generates and sends a query response based on the area identifier to the terminal, and the query response carries the identifier of the area to which the terminal is accessing. The terminal receives the query response and obtains the area identifier from the query response. Alternatively, the network system actively executes the step of issuing the area identifier without the need for the terminal's request to trigger. In other embodiments, the network system issues the area identifier to the terminal after completing the authentication of the terminal. In still other embodiments, after determining that the terminal authentication has passed, the network system carries the area identifier in the authentication response message sent to the terminal when sending the authentication response message to the terminal, thereby being able to simultaneously notify the terminal of the successful authentication and the identifier of the access area, saving the forwarding resources consumed by transmitting the area identifier.

[0326] Regarding the source of the device identifier, in some embodiments, the terminal's device identifier is generated by the terminal itself. For example, the terminal's device identifier is generated by an environment-aware client running on the terminal. For example, the terminal receives a region identifier from the network and collects local operating environment parameters to obtain operating environment parameter information. The terminal generates the terminal's device identifier based on the region identifier and the operating environment parameter information.

[0327] The following is a summary of the above Figure 2 Example or Figure 3 The examples illustrate.

[0328] Example 1: A terminal in the office area accesses a terminal in the operation and maintenance area

[0329] Example 1 is a specific example of the control process in a network scenario where a non-sensitive area accesses a sensitive area. The control process in Example 1 is Figure 2 Specific examples of the methods shown. Figure 4 , Figure 4 A schematic diagram of a scenario in which a terminal in an office area accesses a terminal in an operation and maintenance area is shown for controlling terminals.

[0330] Figure 4 In the application scenario shown, the access switch 221b is Figure 2 In the embodiment of the specific example of the forwarding system, the terminal 111 is Figure 2 A specific example of the first terminal in the embodiment, terminal 131 is Figure 2 In the embodiment, the second terminal is a specific example, the office area 11 is Figure 2 In the embodiment, the specific example of the first area is the operation and maintenance area 13. Figure 2 A specific example of the second region in the embodiment. Figure 4 The control process of the scenario shown includes, for example, the following steps S510 to S542.

[0331] Step S510: The terminal 111 in the office area generates a first message.

[0332] In step S512 , the terminal 111 in the office area sends a first message to the terminal 131 in the operation and maintenance area 13 .

[0333] In an exemplary scenario that triggers step S512, attacker 19 implants virus 191 into terminal 111, and terminal 111 is infected by virus 191 and becomes an attacking terminal. Terminal 111 adds virus 191 to a first message and sends a first message carrying virus 191 to terminal 131, expecting to spread virus 191 to terminal 131.

[0334] In step S514 , the environment awareness client 180 running in the terminal 111 in the office area reports the security score of the terminal 111 or the detection results of multiple security detection items of the terminal 111 to the situation awareness device 242 in response to detecting a predetermined security event occurring in the terminal 111 .

[0335] For example, in response to detecting that the virus 191 has been implanted on the terminal 111, the environment perception client 180 re-collects the detection results of multiple security detection items, determines the latest security score of the terminal 111 when the virus 191 is running based on the detection results of the multiple security detection items, and reports the security score to the situational awareness device 242.

[0336] In step S520 , the access switch 221 b receives a first message from the terminal 111 .

[0337] In step S522 , the access switch 221 b mirrors the first message to obtain a second message based on the fact that the destination area accessed by the first message is a sensitive area.

[0338] In step S526 , the access switch 221 b sends the second message to the situation awareness device 242 .

[0339] Step S524: The access switch 221b forwards the first message.

[0340] In step S530 , the situation awareness device 242 receives a second message from the access switch 221 b .

[0341] In step S532, situation awareness device 242 performs a security check on the second message to obtain a first security score for terminal 111. Situation awareness device 242 obtains a second security score based on the test results of various security check items for terminal 111. Situation awareness device 242 combines the first security score for the first terminal with the second security score for the first terminal to obtain a security score for the first terminal.

[0342] For example, the situation awareness device 242 detects whether the second message contains attack features or abnormal features, and adjusts the first security score of the terminal 111 if the second message contains attack features or abnormal features.

[0343] In step S533 , if the security score of the terminal 111 is less than 80, the situation awareness device 242 sends the security score of the terminal 111 to the controller 241 , thereby synchronizing the security score of the terminal 111 to the controller 241 .

[0344] In some embodiments, situational awareness device 242 obtains the operating environment parameter information of the first terminal carried in the second message. Situational awareness device 242 performs source tracing based on the operating environment parameter information of the first terminal to obtain the device identifier of the first terminal. Situational awareness device 242 sends the device identifier of the first terminal and the security score of terminal 111 to controller 241.

[0345] In step S534 , the controller 241 determines a control policy corresponding to the terminal 111 based on the security score of the terminal 111 .

[0346] The controller 241 determines the latest access rights and access rights of the terminal 111 based on the security score of the terminal 111. If the security score of the terminal 111 changes, the controller 241 adjusts the access rights of the terminal 111 and adjusts the access rights of the terminal 111.

[0347] For example, because the destination area accessed by terminal 111 is operation and maintenance area 13, which requires stronger control and a higher level of security for access to operation and maintenance area 13, controller 241 determines that terminal 111 does not have permission to access operation and maintenance area 13 based on the fact that the security level of terminal 111 does not meet the security level required for access to operation and maintenance area 13. For example, controller 241 determines that terminal 111 does not have permission to access operation and maintenance area 13 based on the fact that the security score of terminal 111 is less than the score threshold corresponding to operation and maintenance area 13.

[0348] For another example, the controller 241 determines that the terminal 111 does not have permission to access the office area 11 based on the fact that the security level of the terminal 111 does not meet the security level required for accessing the office area 11 (for example, the security score of the terminal 111 is less than the score threshold corresponding to the office area 11).

[0349] In step S536 , the controller 241 sends the management and control policy corresponding to the terminal 111 to the access switch 221 b .

[0350] For example, the controller 241 sends a permission change message to the access switch 221b, where the permission change message includes the management and control policy corresponding to the terminal 111. The permission change message is, for example, a COA message.

[0351] In step S540 , the access switch 221 b receives the management and control policy corresponding to the terminal 111 from the controller 241 .

[0352] In step S542 , the access switch 221 b manages the terminal 111 based on the management and control policy.

[0353] For example, if the access permission for terminal 111 in the control policy indicates that the terminal does not have permission to access the operation and maintenance area, when access switch 221b subsequently receives an access request from terminal 111 to the operation and maintenance area, access switch 221b discards the access request, thereby blocking further transmission of the access request from terminal 111. If the access permission for terminal 111 in the control policy indicates that the terminal does not have permission to access office area 11, access switch 221b disconnects the interface communicating with terminal 111, thereby isolating terminal 111 from office area 11.

[0354] Example 2: Terminals in the operation and maintenance area access low-sensitivity areas in the public service area

[0355] Example 2 is a specific example of the control process in a network scenario where a non-sensitive area accesses a non-sensitive area. The control process in Example 2 is Figure 3 Specific examples of the methods shown. Figure 5 , Figure 5 A schematic diagram of a scenario of controlling terminals in a scenario where a terminal in an office area accesses a terminal in a low-sensitivity area 143 is shown. Figure 5 In the application scenario shown, the access switch 221a is Figure 3 In the embodiment of the specific example of the forwarding system, the terminal 111 is Figure 3 A specific example of the first terminal in the embodiment, terminal 141a is Figure 3 In the embodiment, the second terminal is a specific example, the office area 11 is Figure 3 In the embodiment, a specific example of the first area is the low sensitivity area 143 in the public service area 14. Figure 3 A specific example of the second region in the embodiment. Figure 5 The control process of the scenario shown includes, for example, the following steps.

[0356] Step S610: The terminal 111 in the office area generates a first message.

[0357] Step S612: The terminal 111 in the office area initiates a first message to the terminal 141a in the public service area.

[0358] In step S614 , the environment awareness client 180 running in the terminal 111 in the office area reports the security score of the terminal 111 or the detection results of various security detection items of the terminal 111 to the situation awareness device 242 .

[0359] In step S620 , the access switch 221 a receives a first message from the terminal 111 .

[0360] In step S622 , the access switch 221 a omits the step of mirroring the first message based on the fact that the destination area accessed by the first message is the public service area.

[0361] In step S632, the situation awareness device 242 receives the security score of the terminal 111 reported by the environment awareness client. Alternatively, the situation awareness device 242 receives the detection results of multiple security detection items reported by the environment awareness client and obtains the security score of the terminal 111 based on the detection results of the multiple security detection items.

[0362] For example, the situation awareness device 242 detects whether there are attack features or abnormal features in the mirrored message, and adjusts the first security score of the terminal 111 if there are attack features or abnormal features in the mirrored message.

[0363] In step S633 , if the security score of the terminal 111 is less than 80, the situation awareness device 242 sends the security score of the terminal 111 to the controller 241 , thereby synchronizing the security score of the terminal 111 to the controller 241 .

[0364] Optionally, if the security score of terminal 111 is less than 80, situational awareness device 242 issues a policy issuance instruction to controller 241, instructing controller 241 to issue a redirection policy. In response to the policy issuance instruction, controller 241 issues a redirection policy to access switch 221a, causing access switch 221a to mirror traffic from terminals with insufficient security (scores less than 80) and send it to situational awareness device 242 for security testing.

[0365] In some embodiments, situational awareness device 242 obtains the operating environment parameter information of the first terminal carried in the mirrored message. Situational awareness device 242 performs source tracing based on the operating environment parameter information of the first terminal to obtain the device identifier of the first terminal. Situational awareness device 242 sends the device identifier of the first terminal and the security score of terminal 111 to controller 241.

[0366] In step S634 , the controller 241 determines a control policy corresponding to the terminal 111 based on the security score of the terminal 111 .

[0367] For example, the controller 241 determines the latest access rights and access rights of the terminal 111 based on the security score of the terminal 111. If the security score of the terminal 111 changes, the controller 241 adjusts the access rights of the terminal 111 and adjusts the access rights of the terminal 111.

[0368] Because the destination area accessed by terminal 111 is low-sensitivity area 143 (blue zone) in public service area 14, the control intensity required for area 143 is relatively weak, and the security level required for accessing area 143 is relatively low. Based on the fact that the security level of terminal 111 meets the security level required for accessing area 143, controller 241241 determines that terminal 111 has permission to access area 143. For example, controller 241241 determines that terminal 111 has permission to access area 143 based on the fact that the security score of terminal 111 is greater than the score threshold corresponding to area 143.

[0369] Optionally, the scoring threshold corresponding to area 143 is smaller than the scoring threshold corresponding to operation and maintenance area 13. For example, the scoring threshold corresponding to area 143 is 60 points, while the scoring threshold corresponding to operation and maintenance area 13 is 90 points. Therefore, when the security score is 80 points, terminal 111 has the authority to access area 143 but does not have the authority to access operation and maintenance area 13.

[0370] In step S636 , the controller 241 sends the management and control policy corresponding to the terminal 111 to the access switch 221 a .

[0371] For example, the controller 241 sends a permission change message to the access switch 221a, where the permission change message includes the management and control policy corresponding to the terminal 111. The permission change message is, for example, a COA message.

[0372] In step S640 , the access switch 221 a receives the management and control policy corresponding to the terminal 111 from the controller 241 .

[0373] In step S642 , the access switch 221 a manages and controls the terminal 111 based on the management and control policy.

[0374] For example, if the access permission of terminal 111 in the management policy indicates that the terminal has the authority to access area 143 in the public service area, when access switch 221b subsequently receives an access request from terminal 111 to area 143, access switch 221b forwards the access request to area 143, so that terminal 111 can access area 143.

[0375] Figure 5 The scenario shown is described by taking the case where a terminal in the office area accesses a low-sensitivity area 143 in the public service area 14 as an example. In the scenario where a terminal in the office area accesses a high-sensitivity area 142 in the public service area 14, Figure 6 As shown, although the high-sensitivity area 142 and the low-sensitivity area 143 both belong to the public service area 14, the high-sensitivity area 142 stores more important business data. Therefore, the security level required for visitors in the high-sensitivity area 142 is higher than the security level required for visitors in the low-sensitivity area 143. Therefore, the scoring threshold corresponding to the high-sensitivity area 142 is higher than the scoring threshold corresponding to the low-sensitivity area 143. Since the scoring thresholds corresponding to areas of different sensitivity are different, the access rights of two terminals with the same security level but different destination areas may be different. For example, when the controller 241 determines the security policy for the terminal 111, because the security score of the terminal 111 is less than the scoring threshold of the high-sensitivity area 142, the controller 241 determines that the terminal 111 does not have the permission to access the high-sensitivity area 142. The access switch 221a discards the message sent by the terminal 111 to the high-sensitivity area 142 based on the access permission issued by the controller 241.

[0376] Figure 4 、 Figure 5 as well as Figure 6 The control process in three cross-region access scenarios is shown. In the scenario of access in the same region, the method provided in the embodiment of the present application can also be used for control. Figure 7 and Figure 8 This section provides examples of control methods for two access scenarios within the same region.

[0377] Please refer to Figure 7 , Figure 7 A scenario is shown in which the terminal 111 in the office area 11 accesses the terminal 112 in the office area 11 . Figure 7 The scenario shown is a specific example of the control process in a network scenario where a non-sensitive area accesses a non-sensitive area. Figure 7 The scene shown is similar to Figure 5 The main commonality of the illustrated scenarios is that the terminals 111 initiating access are all located in the office area, and the access objects of the terminals 111 are all located in non-sensitive areas. Figure 7 The scene shown is similar to Figure 5 The main difference between the scenarios shown is that Figure 5 In the scenario shown, the access object of the terminal 111 and the terminal 111 are in different areas with the same sensitivity. Figure 7 In the scenario shown, the access object of terminal 111 is in the same area (office area 11) as terminal 111. Figure 5 In the scenario shown, when the access switch 221a determines that the terminal 111 has the right to access the area 143 in the public service area 14 based on the access permission issued by the controller 241, the access switch 221a forwards the message of the terminal 111 to the aggregation switch 222a, and the aggregation switch 222a forwards the message of the terminal 111 to the area 143 in the public service area 14. Figure 7 In the illustrated scenario, when access switch 221a determines, based on the access permission issued by controller 241, that terminal 111 has permission to access terminal 112 in office area 11, access switch 221a can forward the packet to terminal 112 via the local interface connected to terminal 112. Access switch 221a does not need to send the packet to aggregation switch 222a for further forwarding. If access switch 221a determines, based on the access permission issued by controller 241, that terminal 111 does not have permission to access terminal 112 in office area 11, access switch 221a can discard the packet from terminal 112, thereby preventing the packet from spreading to other terminals in the same office area.

[0378] Please refer to Figure 8 , Figure 8 The diagram shows a scenario where a terminal 131 in the operation and maintenance area 13 accesses a server 132 in the operation and maintenance area 13 . Figure 8 The scenario shown is a specific example of the control process in a network scenario where access to sensitive areas occurs. Figure 8 The scene shown is similar to Figure 4 The execution process in the scenario is similar, except that Figure 8In the illustrated scenario, the forwarding device responsible for mirroring messages and executing control policies is access switch 221c. When access switch 221c confirms that terminal 131 has permission to access server 132 in operation and maintenance area 13 based on the access permission issued by controller 241, access switch 221c can forward the message to terminal 131 through the interface connected to terminal 131 on its local side, without having to send the message to the aggregation switch for further forwarding. When access switch 221c confirms that terminal 131 does not have permission to access server 132 in operation and maintenance area 13 based on the access permission issued by controller 241, access switch 221c can disconnect the interface connected to terminal 131 on its local side, preventing terminal 131 from continuing to access the operation and maintenance area network.

[0379] The following is an example of the message format provided in the embodiment of the present application.

[0380] The message format described below is an example of an original message sent by a terminal (for example Figure 2 The format of the first message in the embodiment or Figure 3 The format of the third message in the embodiment), and the format of the mirror message (for example Figure 2 The format of the second message in the embodiment).

[0381] In some embodiments, the extended information of this embodiment, such as the area identifier and / or the operating environment parameter information, is carried through a transport layer protocol message header such as a transmission control protocol (TCP) header. For example, a first message includes a TCP header, the TCP header includes TCP options, and the TCP options include the area identifier of the first area and the operating environment parameter information of the first terminal. For example, the TCP options include a device identification field, and the device identification field carries the identifier of the first area and the operating environment parameter information of the first terminal. Similarly, a second message includes a TCP header, and the TCP header includes TCP options. The TCP options include the area identifier of the first area and the operating environment parameter information of the first terminal. A third message includes a TCP header, and the TCP header includes TCP options. The TCP options include the identifier of the third area and the operating environment parameter information of the second terminal.

[0382] In other embodiments, the newly extended information of this embodiment, such as the region identifier or operating environment parameter information, is carried via a network layer protocol packet header, such as an IPv6 extension header. For example, a first packet includes an IPv6 extension header, which includes the identifier of the first region and the operating environment parameter information of the first terminal. For example, the IPv6 extension header includes a device identification field, which carries the identifier of the first region and the operating environment parameter information of the first terminal.

[0383] For example, in the scenario of application-aware IPv6 networking (APN6), the extended information of this embodiment such as the area identifier and / or operating environment parameter information is carried in the APN header. For example, please refer to Figure 9 , Figure 9 This is a diagram of a message format provided in an embodiment of the present application. Figure 9 The message shown is, for example, the first message. The first message includes an IPv6 header, an APN header encapsulated inside the IPv6 header, and a payload field encapsulated in the inner layer of the APN header. The APN header includes an area identifier (such as an identifier of the first area or an identifier of the second area) and operating environment parameter information of the first terminal. In some embodiments, the APN header includes an APN-ID field and an APN parameter field. The APN-ID field includes APP-group-ID, user-group-ID, and a reserved field. In some embodiments, the reserved field in the extended APN-ID field carries information extended by this embodiment, such as area identifier and / or operating environment parameter information.

[0384] Similarly, the third message includes an IPv6 extension header, which includes the identifier of the third region and the operating environment parameter information of the second terminal. For example, the IPv6 extension header includes a device identification field, which carries the identifier of the third region and the operating environment parameter information of the second terminal. Exemplarily, the IPv6 extension header in the third message includes an APN header, which includes the identifier of the third region and the operating environment parameter information of the second terminal. For example, a reserved field in the APN-ID field is used to carry the identifier of the third region and the operating environment parameter information of the second terminal.

[0385] Alternatively, other IP layer message headers such as a hop-by-hop options header (HBH), a segment routing header (SRH), or a destination options header (DOH) are used to carry the extended information of this embodiment, such as the area identifier and / or the operating environment parameter information.

[0386] Alternatively, other transport layer protocol headers such as quick user datagram protocol internet connection (QUIC) or user datagram protocol (UDP) headers are used to carry the extended information of this embodiment, such as the area identifier and / or operating environment parameter information.

[0387] Alternatively, an application layer message header such as an HTTP header, an HTTPS header, or an FTP header is used to carry the extended information of this embodiment, such as the area identifier and / or the operating environment parameter information.

[0388] Attachment Figure 10 6 is a schematic diagram of the structure of a forwarding system 600 provided in an embodiment of the present application. The forwarding system 600 includes a receiving unit 601, a processing unit 602 and a sending unit 603.

[0389] Optionally, in combination with Figure 1 From the system architecture shown in the Figure 10 The forwarding system 600 shown is attached Figure 1 The forwarding system 220 in the appendix Figure 10 The forwarding system 600 shown includes the following Figure 1 The access switch 221a, the access switch 221b, the aggregation switch 221a, the aggregation switch 222b, the core switch 223a and the core switch 223b.

[0390] Optionally, in combination with Figure 2 According to the method flow shown in the attached Figure 10 The forwarding system 600 shown is attached Figure 2 The forwarding system in the embodiment of the present invention comprises a receiving unit 601 for executing S320 and S340, a processing unit 602 for executing S322 and S342, and a sending unit 603 for executing S324 and S326.

[0391] Optionally, in combination with Figure 3 According to the method flow shown in the attached Figure 10 The forwarding system 600 shown is attached Figure 3 The forwarding system in the embodiment of the present invention comprises a receiving unit 601 configured to execute S420 and S440, a processing unit 602 configured to execute S422 and S442, and a sending unit 603 configured to execute S424.

[0392] Optionally, in combination with Figure 4 From the system architecture shown in the Figure 10 The forwarding system 600 shown includes the following Figure 4 In the access switch 221b, the receiving unit 601 is used to execute step S520 and step S540, the processing unit 602 is used to execute step S522 and step S542; and the sending unit 603 is used to execute step S526 and step S524.

[0393] Optionally, in combination with Figure 5 From the system architecture shown in the Figure 10 The forwarding system 600 shown includes the following Figure 5In the access switch 221a, the receiving unit 601 is configured to execute step S620 and step S640, and the processing unit 602 is configured to execute step S622 and step S642.

[0394] Attachment Figure 10 The device embodiments described are merely illustrative. For example, the division of the above units is merely a logical functional division. In actual implementation, there may be other division methods, such as multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. The functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit.

[0395] Each unit in the forwarding system 600 is implemented in whole or in part by software, hardware, firmware, or any combination thereof.

[0396] In the case of software implementation, for example, the processing unit 602 is provided by an attached Figure 12 At least one processor 801 reads the program code stored in the memory 802 and generates a software function unit to implement it.

[0397] In the case of hardware implementation, for example, Figure 10 The above-mentioned units are implemented by different hardware in the network system. For example, the processing unit 602 is implemented by the attached Figure 12 The receiving unit 601 and the sending unit 603 are implemented by a portion of the processing resources of at least one processor 801 (for example, one or two cores of a multi-core processor), or by using a field-programmable gate array (FPGA) or a programmable device such as a coprocessor. Figure 12 The network interface 803 is implemented in .

[0398] Attachment Figure 11 7 is a schematic diagram of a detection system 700 provided in an embodiment of the present application. The detection system 700 includes a receiving unit 701, a processing unit 702 and a sending unit 703.

[0399] Optionally, in combination with Figure 1 From the system architecture shown in the Figure 11 The detection system 700 shown is attached Figure 1 Detection system 240. Figure 11 The detection system 700 shown includes the following Figure 1 The controller 241 and the situational awareness device 242.

[0400] Optionally, in combination with Figure 2According to the method flow shown in the attached Figure 11 The detection system 700 shown is attached Figure 2 The detection system includes a receiving unit 701 configured to execute S330, a processing unit 702 configured to execute S332 and S334, and a sending unit 703 configured to execute S336.

[0401] Optionally, in combination with Figure 3 According to the method flow shown in the attached Figure 11 The detection system 700 shown is attached Figure 3 The receiving unit 701 is used to execute S432. The processing unit 702 is used to execute S434. The sending unit 703 is used to execute S436.

[0402] Optionally, in combination with Figure 4 From the system architecture shown in the Figure 11 The detection system 700 shown includes the following Figure 4 In the situation awareness device 242 and the controller 241, the receiving unit 701 is used to execute step S530 and step S540, the processing unit 702 is used to execute step S532 and step S534; and the sending unit 703 is used to execute step S533 and step S536.

[0403] Optionally, in combination with Figure 5 From the system architecture shown in the Figure 11 The detection system 700 shown includes the following Figure 5 In the situation awareness device 242 and the controller 241, the receiving unit 701 is used to execute steps S632 and S640, the processing unit 702 is used to execute steps S622, S634 and S642, and the sending unit 703 is used to execute steps S633 and S636.

[0404] Attachment Figure 11 The device embodiments described are merely illustrative. For example, the division of the above units is merely a logical functional division. In actual implementation, there may be other division methods, such as multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. The functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit.

[0405] Each unit in the detection system 700 is implemented in whole or in part by software, hardware, firmware, or any combination thereof.

[0406] In the case of software implementation, for example, the processing unit 702 is provided by an attached Figure 12At least one processor 801 reads the program code stored in the memory 802 and generates a software function unit to implement it.

[0407] In the case of hardware implementation, for example, Figure 11 The above-mentioned units are implemented by different hardware in the network system. For example, the processing unit 702 is implemented by the attached Figure 12 The receiving unit 701 and the sending unit 703 are implemented by a portion of the processing resources of at least one processor 801 (for example, one or two cores of a multi-core processor), or by a programmable device such as a field-programmable gate array (FPGA) or a coprocessor. Figure 12 The network interface 803 is implemented in .

[0408] The following is an example of the basic hardware structure of the network system. Figure 12 The hardware structure of the network system shown is, for example, the hardware structure of the forwarding system in each of the above embodiments, or the hardware structure of the detection system in each of the above embodiments, or the hardware structure of a device integrating the forwarding system and the detection system.

[0409] See attached Figure 12 , attached Figure 12 It is a structural diagram of a network system 800 provided in an embodiment of the present application.

[0410] The network system 800 includes at least one processor 801 , a memory 802 , and at least one network interface 803 .

[0411] Optionally, in combination with Figure 1 From the system architecture shown in the Figure 12 The network system 800 shown includes, for example, Figure 1 The forwarding system 220 or attached Figure 1 The detection system 240 in the embodiment, the network system 800 is further shown in FIG. Figure 1 The network system 20 in.

[0412] Optionally, in combination with Figure 2 According to the method flow shown in the attached Figure 12 The network system 800 shown includes the following Figure 2 The network interface 803 is used to execute S330 and S336. The processor 801 is used to execute S332 and S334. Alternatively, Figure 12 The network system 800 shown includes the following Figure 2 The forwarding system in the embodiment of the present invention. The processor 801 is configured to execute S322 and S342. The network interface 803 is configured to execute S320, S340, S324, and S326.

[0413] Optionally, in combination with Figure 3 According to the method flow shown in the attached Figure 12 The network system 800 shown includes the following Figure 3 The processor 801 is used to execute S432 and S434. The network interface 803 is used to execute S436. Alternatively, Figure 12 The network system 800 shown includes the following Figure 3 The network interface 803 is configured to execute S420, S440, and S424. The processor 801 is configured to execute S422 and S442.

[0414] Optionally, in combination with Figure 4 From the system architecture shown in the Figure 12 The network system 800 shown includes the following Figure 4 The situation awareness device 242 and the controller 241 in the embodiment of the present invention are configured to: the network interface 803 is configured to execute steps S530, S533, and S536; and the processor 801 is configured to execute steps S532 and S534. Figure 12 The network system 800 shown includes the following Figure 4 In the access switch 221b, the network interface 803 is configured to execute step S520, step S540, step S526, and step S524, and the processor 801 is configured to execute step S522 and step S542.

[0415] Optionally, in combination with Figure 5 From the system architecture shown in the Figure 12 The network system 800 shown includes the following Figure 5 The access switch 221a in the embodiment of the present invention is configured to: the network interface 803 is configured to execute steps S620 and S640; the processor 801 is configured to execute steps S622 and S642. Figure 12 The network system 800 shown includes the following Figure 5 In the situation awareness device 242 and the controller 241, the network interface 803 is used to execute step S632, step S633, step S636 and step S640, and the processor 801 is used to execute step S622 and step S634.

[0416] The processor 801 is, for example, a general-purpose central processing unit (CPU), a network processor (NP), a graphics processing unit (GPU), a neural-network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the solution of the present application. For example, the processor 801 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0417] The memory 802 is, for example, a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including a compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. Optionally, the memory 802 exists independently and is connected to the processor 801 via an internal connection 804. Alternatively, the memory 802 and the processor 801 are optionally integrated together.

[0418] The network interface 803 uses any transceiver-like device for communicating with other devices or communication networks. For example, the network interface 803 includes at least one of a wired network interface and a wireless network interface. For example, the wired network interface is an Ethernet interface. For example, the Ethernet interface is an optical interface, an electrical interface, or a combination thereof. For example, the wireless network interface is a wireless local area network (WLAN) interface, a cellular network interface, or a combination thereof.

[0419] In some embodiments, the processor 801 includes one or more CPUs, such as the Figure 12 CPU0 and CPU1 are shown in the figure.

[0420] In some embodiments, the network system 800 optionally includes multiple processors, such as the attached Figure 12 801 and processor 805 are shown in FIG. Each of these processors is, for example, a single-CPU or a multi-CPU. A processor herein optionally refers to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0421] In some embodiments, network system 800 further includes internal connections 804. Processor 801, memory 802, and at least one network interface 803 are connected via internal connections 804. Internal connections 804 include pathways that transmit information between the aforementioned components. Optionally, internal connections 804 are boards or buses. Optionally, internal connections 804 are divided into address buses, data buses, control buses, and the like.

[0422] In some embodiments, the network system 800 further includes an input / output interface 806 , which is connected to the internal connection 804 .

[0423] Optionally, the processor 801 implements the method in the above embodiment by reading the program code stored in the memory 802, or the processor 801 implements the method in the above embodiment by using the program code stored internally. In the case where the processor 801 implements the method in the above embodiment by reading the program code stored in the memory 802, the memory 802 stores the program code 810 that implements the method provided in the embodiment of the present application. For more details on how the processor 801 implements the above functions, please refer to the description of each method embodiment above, which will not be repeated here.

[0424] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0425] A refers to B, which means that A is the same as B or A is a simple variant of B.

[0426] The terms "first" and "second" in the description and claims of the embodiments of this application are used to distinguish different objects, not to describe a specific order of objects, and should not be understood to indicate or imply relative importance. For example, the terms "first region" and "second region" are used to distinguish different regions, not to describe a specific order of regions, and should not be understood to mean that the first region is more important than the second region.

[0427] In the embodiments of the present application, unless otherwise specified, "at least one" means one or more, and "a plurality" means two or more. For example, a plurality of regions means two or more regions.

[0428] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in accordance with the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0429] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A network access control method, characterized in that: The method comprises: The forwarding system receives a first message from a first terminal; If the area accessed by the first terminal is a sensitive area or the destination accessed by the first terminal through the first message is located in a sensitive area, the forwarding system mirrors the first message to obtain a second message; The forwarding system sends the second message to the detection system; The forwarding system receives the control policy corresponding to the first terminal sent by the detection system in response to the second message; The forwarding system manages and controls the first terminal based on the management and control policy.

2. The method according to claim 1, characterized in that The first message includes an area identifier and an identifier of the destination party, where the area identifier is used to identify an area accessed by the first terminal; If the area accessed by the first terminal is a sensitive area or the destination accessed by the first terminal through the first message is located in a sensitive area, the forwarding system mirrors the first message to obtain a second message, including: If the area identified by the area identifier is a sensitive area or the destination identified by the destination identifier is located in a sensitive area, the forwarding system mirrors the first message to obtain a second message.

3. The method according to claim 2, characterized in that The first message includes a Transmission Control Protocol TCP header, the TCP header includes a TCP option, and the TCP option includes the area identifier; or The first message includes an Internet Protocol version 6 (IPv6) extension header, and the IPv6 extension header includes the area identifier.

4. The method according to claim 3, characterized in that The IPv6 extension header includes an application-aware network APN message header, the APN message header includes an application-aware network identifier APN-ID field, and the APN-ID field includes the area identifier.

5. The method according to any one of claims 1 to 4, characterized in that The first message also includes operating environment parameter information of the first terminal, and the operating environment parameter information of the first terminal includes at least one of hard disk parameter information in the first terminal, memory parameter information in the first terminal, and operating system parameter information of the first terminal.

6. The method according to claim 1, wherein The method further comprises: The forwarding system receives a third message from the second terminal; If the area accessed by the second terminal is a non-sensitive area and the destination accessed by the second terminal through the third message is located in a non-sensitive area, the forwarding system omits the step of mirroring the third message; The forwarding system controls the second terminal based on the control policy corresponding to the second terminal from the detection system.

7. A network access control method, characterized in that: The method comprises: The detection system receives a second message from the forwarding system, where the second message is generated by mirroring a first message from the first terminal, where the first message is generated when the first terminal accesses the first area and initiates access to the second area. The detection system performs a security detection on the second message to obtain a security score of the first terminal; The detection system determines a control policy corresponding to the first terminal based on the security score of the first terminal and the sensitivity of the second area; The detection system sends the management and control policy corresponding to the first terminal to the forwarding system.

8. The method according to claim 7, characterized in that The detection system determines a control policy corresponding to the first terminal based on the security score of the first terminal and the sensitivity of the second area, including: The detection system determines a scoring threshold based on the sensitivity of the second area; The detection system determines a management and control policy corresponding to the first terminal based on the security score of the first terminal and the score threshold.

9. The method according to claim 8, characterized in that If the security level represented by the security score of the first terminal is higher than the security level represented by the score threshold, the control policy determined by the detection system includes allowing the first terminal to access the second area; or, If the security level represented by the security score of the first terminal is lower than the security level represented by the score threshold, the control policy determined by the detection system includes prohibiting the first terminal from accessing the second area or re-authenticating the first terminal.

10. The method according to claim 8, characterized in that If the second area is a sensitive area, the scoring threshold determined by the detection system is a first scoring threshold; If the second area is a non-sensitive area, the scoring threshold determined by the detection system is a second scoring threshold, and the safety level represented by the second scoring threshold is lower than the safety level represented by the first scoring threshold.

11. The method according to claim 7, characterized in that The first message includes an area identifier, where the area identifier is used to identify an area accessed by the first terminal. Before the detection system receives the second message from the forwarding system, the method further includes: During authentication of the first terminal, the detection system determines a region in the forwarding system where the forwarding device connected to the first terminal is located, to obtain the region identifier; The detection system sends the area identifier to the first terminal.

12. The method according to claim 7, characterized in that The method further comprises: The detection system obtains a security score of the second terminal during a process in which the second terminal accesses the third area and initiates access to the fourth area. The security score of the second terminal is determined based on detection results of multiple security detection items of the second terminal. The third area and the fourth area are both non-sensitive areas. The detection system determines a control policy corresponding to the second terminal based on the security score of the second terminal; The detection system sends the control policy corresponding to the second terminal to the forwarding system.

13. The method according to claim 12, characterized in that Obtaining the security score of the second terminal includes: The detection system receives a security score of the second terminal reported by an environment-aware client running in the second terminal, where the security score of the second terminal is determined by the environment-aware client based on detection results of multiple security detection items of the second terminal; or The detection system receives detection results of multiple security detection items reported by the environment perception client running in the second terminal; the detection system determines a security score of the second terminal based on the detection results of the multiple security detection items.

14. The method according to claim 7, wherein: The second message also includes operating environment parameter information of the first terminal, and the method further includes: The detection system performs source tracing based on the operating environment parameter information of the first terminal to determine that the first message comes from the first terminal.

15. The method according to claim 14, characterized in that The second message includes a Transmission Control Protocol TCP header, the TCP header includes a TCP option, and the TCP option includes operating environment parameter information of the first terminal; or The second message includes an Internet Protocol version 6 (IPv6) extension header, and the IPv6 extension header includes operating environment parameter information of the first terminal.

16. The method according to claim 15, characterized in that The IPv6 extension header includes an application-aware network APN message header, the APN message header includes an application-aware network identifier APN-ID field, and the APN-ID field includes operating environment parameter information of the first terminal.

17. The method according to claim 7, characterized in that The detection system sends the control policy corresponding to the first terminal to the forwarding system, including: The detection system generates a COA message for authorization change, wherein the COA message includes a control policy corresponding to the first terminal; The detection system sends the COA message to the forwarding system.

18. A forwarding system, characterized in that: The system comprises: A receiving unit, configured to receive a first message from a first terminal; a processing unit, configured to, if the area accessed by the first terminal is a sensitive area or the destination accessed by the first terminal through the first message is located in a sensitive area, mirror the first message by the forwarding system to obtain a second message; A sending unit, configured to send the second message to the detection system; The receiving unit is further configured to receive a control policy corresponding to the first terminal sent by the detection system in response to the second message; The processing unit is further configured to manage and control the first terminal based on the management and control policy.

19. The system according to claim 18, wherein: The first message includes an area identifier and an identifier of the destination party, where the area identifier is used to identify an area accessed by the first terminal; The processing unit is configured to mirror the first message to obtain a second message if the area identified by the area identifier is a sensitive area or the destination identified by the destination identifier is located in a sensitive area.

20. The system according to claim 18, wherein The system further comprises: The receiving unit is further configured to receive a third message from the second terminal; The processing unit is also used to omit the step of mirroring the third message if the area accessed by the second terminal is a non-sensitive area and the destination accessed by the second terminal through the third message is located in a non-sensitive area; and to control the second terminal based on the control policy corresponding to the second terminal from the detection system.

21. A detection system, characterized in that: The system comprises: a receiving unit, configured to receive a second message from the forwarding system, where the second message is generated by mirroring a first message from the first terminal, where the first message is generated when the first terminal accesses the first area and initiates access to the second area; a processing unit, configured to perform a security check on the second message to obtain a security score of the first terminal; and determine a control policy corresponding to the first terminal based on the security score of the first terminal and the sensitivity of the second area; A sending unit is used to send the management and control policy corresponding to the first terminal to the forwarding system.

22. The system according to claim 21, wherein: The first message includes an area identifier, where the area identifier is used to identify an area accessed by the first terminal. The processing unit is further configured to, during authentication of the first terminal, determine an area in the forwarding system where a forwarding device accessed by the first terminal is located, so as to obtain the area identifier. The sending unit is configured to send the area identifier to the first terminal.

23. The system according to claim 21, wherein: The processing unit is further configured to obtain a security score of the second terminal during a process in which the second terminal accesses the third area and initiates access to the fourth area, the security score of the second terminal being determined based on detection results of multiple security detection items of the second terminal, wherein both the third area and the fourth area are non-sensitive areas; Determining a control policy corresponding to the second terminal based on the security score of the second terminal; The sending unit is further configured to send the management and control policy corresponding to the second terminal to the forwarding system.

24. A forwarding system, characterized in that: The forwarding system includes: a processor, the processor is coupled to a memory, the memory stores at least one computer program instruction, and the at least one computer program instruction is loaded and executed by the processor, so that the forwarding system implements the method according to any one of claims 1 to 6.

25. A detection system, characterized in that: The detection system includes: a processor, the processor is coupled to a memory, the memory stores at least one computer program instruction, and the at least one computer program instruction is loaded and executed by the processor to enable the detection system to implement the method according to any one of claims 7 to 17.

26. A network system, characterized in that: The network system includes the forwarding system according to any one of claims 18 to 20 and the detection system according to any one of claims 21 to 23, or the network system includes the forwarding system according to claim 24 and the detection system according to claim 25.

27. A computer-readable storage medium, characterized in that The storage medium stores at least one instruction, and when the instruction is executed on a computer, the computer executes the method according to any one of claims 1 to 6 or any one of claims 7 to 17.

28. A computer program product, characterized in that The computer program product comprises one or more computer program instructions, and when the computer program instructions are loaded and executed by a computer, the computer is caused to perform the method according to any one of claims 1 to 6 or any one of claims 7 to 17.

Images