ACL-based switch secure interconnection method and device, and readable medium

Abstract

The invention discloses an ACL-based switch secure interconnection method and device and a readable medium, and the method comprises the steps: configuring a handshake protocol message Trap to CPU with the highest priority; a specified port of the switch is configured as an interconnection port, a handshake message sending mechanism and a handshake message timeout checking mechanism of the interconnection port are started, and meanwhile, a handshake message receiving mechanism of the switch is kept to be started all the time. According to the method, an authentication server or a client does not need to be additionally deployed, the operation is simple and convenient, the cost is low, equipment of the same manufacturer can be automatically identified, access is allowed, access of equipment data of different manufacturers is rejected, the operation and maintenance safety and convenience of industrial networking are greatly improved, and the method is suitable for management type industrial switch interconnection networking in an industrial scene.

Description

A method, device, and readable medium for secure interconnection of switches based on ACL. Technical Field

[0001] This invention relates to the field of secure interconnection technology for switches, and more specifically, to a method, device, and readable medium for secure interconnection of switches based on ACL. Background Technology

[0002] In industrial networking scenarios, managed industrial switches are core network devices, and multiple devices from the same manufacturer typically need to be interconnected to ensure network stability and compatibility. However, there is a risk of mistakenly connecting switches from other manufacturers to the network during operation and maintenance. Such misconnections often only reveal their faults after the devices have been running for a period of time, seriously affecting the continuity of industrial production.

[0003] In existing technologies, solutions for network device access security mainly include 802.1X authentication and AAA authentication: 802.1X authentication requires the additional installation of client software and the setup of an authentication server, which is cumbersome and increases hardware and maintenance costs, and cannot meet the needs of industrial scenarios for no additional deployment and automatic identification; AAA authentication controls device access permissions through user accounts, and its core function is to manage the operation permissions of maintenance personnel rather than to identify the manufacturer of the access device, and it cannot solve the problem of misconnection of devices from different manufacturers.

[0004] Therefore, there is currently a lack of a secure interconnection solution that does not require additional hardware or software deployment, can automatically identify industrial switches managed by the same manufacturer, and refuses access from devices from different manufacturers, making it difficult to meet the operational security and convenience requirements of industrial networking. Summary of the Invention

[0005] To overcome the problems of existing technologies, such as the inability to automatically identify managed industrial switches from the same manufacturer, the ease with which devices from different manufacturers can be mistakenly connected leading to malfunctions, and the complexity and high cost of existing authentication schemes, this invention provides a method, device, and readable medium for secure interconnection of switches based on ACLs. By using custom handshake protocol messages and leveraging switch ACL (Access Control List) technology, it automatically identifies devices from the same manufacturer and allows access while denying data entry from devices from different manufacturers, achieving intelligent and secure interconnection access. This significantly improves the security and convenience of operation and maintenance in industrial networks and is suitable for interconnection of managed industrial switches in industrial scenarios.

[0006] The technical solution of the present invention is as follows: In a first aspect, the present invention provides a method for secure interconnection of switches based on ACL, including: step S1, configuring the handshake protocol message Trap to CPU to have the highest priority; step S2, configuring a designated port of the switch as an interconnection port, and enabling the handshake message sending mechanism and the handshake message timeout checking mechanism of the interconnection port, while keeping the handshake message receiving mechanism of the switch always enabled.

[0007] As a preferred embodiment of the present invention, the handshake message sending mechanism includes: Step A1: After the port of the switch starts the secure interconnection function, a custom handshake protocol message is generated based on the MAC address of the switch and a custom encryption algorithm; Step A2: Determine whether the current port is an interconnection port; if not, proceed to Step A3; if yes, proceed to Step A7; Step A3: Determine whether the port status is UP; if yes, proceed to Step A4; if no, proceed to Step A6; Step A4: Send the custom handshake protocol message; Step A5: Sleep for a first preset time, then return to Step A3; Step A6: Sleep for a second preset time, then return to Step A3; Step A7: End sending the custom handshake protocol message.

[0008] As a preferred embodiment of the present invention, the custom handshake protocol message includes an Ethernet header and custom fields.

[0009] As a preferred embodiment of the present invention, the first preset time is 500 milliseconds and the second preset time is 100 milliseconds.

[0010] As a preferred embodiment of the present invention, the handshake message receiving mechanism includes: Step B1: After the message receiving thread starts, set the handshake protocol message Trap to CPU; Step B2: Create a socket for receiving handshake protocol messages; Step B3: Initialize an array recording the time of the most recent handshake message, the array is defined according to the maximum number of ports of the switch, and the initial record value of all ports is set to 0; Step B4: Wait to receive handshake protocol messages. If a handshake protocol message is received, proceed to Step B5; otherwise, continue waiting; Step B5: Extract port information and handshake message custom fields from the handshake protocol messages uploaded by the operating system kernel of the switch; Step B6: Perform a validity check on the extracted port information and handshake message custom fields; if valid, proceed to Step B7; if invalid, proceed to Step B8; Step B7: Update the most recent time of the handshake message received by the corresponding port in the array, and then return to Step B4; Step B8: Generate a handshake message invalid alarm, and then return to Step B4.

[0011] As a preferred embodiment of the present invention, the legality check includes port number validity verification and MAC address manufacturer consistency verification after decryption of custom fields.

[0012] As a preferred embodiment of the present invention, the handshake message timeout checking mechanism includes: Step C1, issuing an ACL rejection rule to the interconnect port to reject all packets from entering the switch, and setting the rejection flag of the interconnect port to 1; Step C2, sleeping for a third preset time; Step C3, determining whether the current port is an interconnect port; if yes, proceed to step C4; if no, proceed to step C8; Step C4, querying the record value of the current port in the array recording the most recent handshake message time, calculating the difference between the current system running time and the record value, if the difference is greater than a fourth preset time, determining that the handshake has timed out, and proceeding to step C5; if no timeout, proceeding to step C6; Step C5, checking whether the rejection flag of the current port is 1; if If yes, return to step C2; if no, proceed to step C9; Step C6: Check if the current port's rejection flag is 1; if yes, proceed to step C7; if no, return to step C2; Step C7: Delete the ACL rejection rule, allowing all packets to enter the switch, and change the current port's rejection flag to 0, then return to step C2; Step C8: Delete the ACL rejection rule, allowing all packets to enter the switch, and change the current port's rejection flag to 0, then proceed to step C10; Step C9: Generate a timeout alarm, indicating that the previously allowed interconnect port has stopped access due to handshake timeout, then return to step C1; Step C10: The current port exits the handshake message timeout check mechanism and reverts to a normal port.

[0013] As a preferred embodiment of the present invention, the third preset time is 100 milliseconds, and the fourth preset time is greater than 1600 milliseconds.

[0014] In a second aspect, the present invention provides an electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to execute the above-described ACL-based secure interconnection method for switches.

[0015] Thirdly, the present invention provides a computer-readable medium storing computer-executable instructions for executing the above-described ACL-based secure interconnection method for switches.

[0016] The advantages of this invention based on the above solution are as follows: 1. It eliminates the need to install client software or build an authentication server, relying solely on the switch's own ACL function and custom handshake protocol, significantly reducing hardware procurement and maintenance costs and adapting to the simplified networking requirements of industrial scenarios; 2. It achieves manufacturer identity verification through custom handshake protocol messages generated by MAC address encryption, allowing only switches from the same manufacturer to access, thereby avoiding network failures caused by misconnection of devices from different manufacturers; 3. It rejects all messages in the initial state, only opening access when identity verification is successful and the timeout has not expired. Combined with the handshake message timeout check mechanism, it ensures that the accessed device remains legitimate and avoids the device remaining open after going offline; 4. Only the interconnection port needs to be configured, and subsequent identity recognition, access control, and alarms are all completed automatically, reducing the workload of maintenance personnel and improving maintenance efficiency. Attached Figure Description

[0017] Figure 1 is a flowchart illustrating the ACL-based secure interconnection method for switches in this invention; Figure 2 is a flowchart illustrating the handshake message sending mechanism in this invention; Figure 3 is a flowchart illustrating the handshake message receiving mechanism in this invention; Figure 4 is a flowchart illustrating the handshake message timeout checking mechanism in this invention. Detailed Implementation

[0018] To make the technical problems to be solved, the technical solutions, and the beneficial effects of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0019] It should be noted that the terms "comprising" and "having," and any variations thereof, in the specification and claims of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the steps or units listed, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0020] As shown in Figure 1, this embodiment provides a method for secure interconnection of switches based on ACLs, including: Step S1: Configure the handshake protocol message Trap to CPU to have the highest priority, ensuring that the handshake protocol message is not affected by subsequent ACL rejection rules and can always be received and processed by the CPU. Even if the interconnection port issues an ACL rejection rule that rejects all messages, the identity verification process can still run normally, avoiding the inability of devices from the same manufacturer to complete handshake authentication due to ACL interception. Step S2: Configure a designated port of the switch as an interconnection port and enable the handshake message sending mechanism and handshake message timeout check mechanism of the interconnection port, while keeping the handshake message receiving mechanism of the switch always enabled, that is, the handshake message receiving mechanism is always present regardless of whether the switch has a port with secure interconnection function enabled. This step, by specifying the interconnection port, makes the handshake message sending mechanism and handshake message timeout check mechanism only apply to the port that needs to be interconnected, avoiding interference with the normal services of other ordinary ports of the switch and improving resource utilization efficiency; by simultaneously enabling the handshake message sending mechanism and handshake message timeout check mechanism, combined with the always-on handshake message receiving mechanism, a closed-loop automated process of sending, receiving, verification, and timeout management is constructed, reducing manual intervention by operation and maintenance personnel and improving the convenience of network construction.

[0021] As shown in Figure 2, in this embodiment, the handshake message sending mechanism includes: Step A1: After the switch port starts the secure interconnection function, it generates a custom handshake protocol message based on the switch's own MAC address using a custom encryption algorithm, so that the custom handshake protocol message carries a unique manufacturer identity identifier. Encryption processing prevents the custom handshake protocol message from being tampered with or forged, ensuring the security and uniqueness of identity verification, thereby preventing devices from different manufacturers from forging messages to access the network.

[0022] The custom handshake protocol message includes an Ethernet header and custom fields, including a version field, a payload field, a reserve field, and a checksum field.

[0023] The format of the custom handshake protocol message is shown in the table below:

[0024] The explanations of custom fields are shown in the table below:

[0025] Step A2: Determine if the current port is an interconnect port; if not, proceed to step A3; if yes, proceed to step A7. This step distinguishes between interconnect ports and ordinary ports, executing subsequent transmission logic only on interconnect ports to avoid invalid transmissions from ordinary ports consuming network bandwidth and device resources, ensuring functional targeting and resource utilization efficiency.

[0026] Step A3: Determine if the port status is UP; if yes, proceed to step A4; otherwise, proceed to step A6. This step dynamically adapts to the port's physical connection status, triggering message transmission only when the port is UP (physical connection is normal), avoiding invalid transmissions when the port is DOWN, reducing unnecessary device overhead, and ensuring that handshake messages are transmitted only when the physical link is open, thus improving authentication efficiency.

[0027] Step A4: Send a custom handshake protocol message. This step involves sending a custom handshake protocol message carrying manufacturer identification information to the peer switch. This provides data support for the peer's identity verification and is the core execution step for identifying devices from the same manufacturer, ensuring the effective transmission of identity information.

[0028] Step A5: Sleep for the first preset time (e.g., 500 milliseconds), then return to step A3.

[0029] Step A6: Sleep for the second preset time (e.g., 100 milliseconds), then return to step A3. A 500-millisecond sleep period when the port is UP balances authentication efficiency and resource consumption, ensuring the peer can receive messages promptly while avoiding excessive bandwidth consumption from high-frequency transmissions. A 100-millisecond sleep period when the port is DOWN quickly detects port status changes, ensuring the authentication process can start immediately after the port comes online, improving network flexibility.

[0030] Step A7: End sending custom handshake protocol messages. This step prevents messages from being sent continuously after a port role change (such as from an interconnect port to a regular port), reducing unnecessary resource consumption and ensuring process closure and device operational stability.

[0031] As shown in Figure 3, in this embodiment, the handshake message receiving mechanism includes: Step B1: After the message receiving thread starts, the handshake protocol message Trap to CPU is set to clarify the message processing path of the receiving stage, ensuring that the handshake protocol message can be parsed by the CPU first, avoiding resource occupation by other business messages, and ensuring the real-time performance of identity verification.

[0032] Step B2: Create a socket for receiving handshake protocol messages, allocate a dedicated receiving channel for handshake protocol messages, achieve physical isolation from other messages, avoid message reception conflicts or loss, and improve the stability and reliability of handshake message reception.

[0033] Step B3: Initialize the array that records the time of the most recent handshake message. The array is defined according to the maximum number of ports on the switch (e.g., 28). Establish an independent handshake time record for each port. Set the initial record value of all ports to 0. The time unit is milliseconds. This provides a clear benchmark for subsequent timeout judgment and ensures the operability of the timeout check mechanism.

[0034] Step B4: Wait to receive the handshake protocol message. If the handshake protocol message is received, proceed to step B5; otherwise, continue waiting. This step, by continuously waiting for the handshake protocol message, ensures that the authentication information sent by the other end can be captured in a timely manner, providing the triggering condition for identity verification. It is a key receiving link for realizing automatic device identification.

[0035] Step B5: Extract port information and custom fields of the handshake message from the handshake protocol message uploaded by the switch's operating system kernel. This provides a clear object for subsequent legitimacy verification, ensuring that the verification process is targeted, efficient, and avoids interference from invalid data.

[0036] Step B6: Perform a validity check on the extracted port information and custom fields of the handshake message; if valid, proceed to step B7; if invalid, proceed to step B8. The validity check includes port number validity verification and MAC address manufacturer consistency verification after decryption of the custom fields. Port number validity verification avoids interference from illegal port data, ensuring that the verification object is a valid port of the switch; MAC address manufacturer consistency verification directly identifies the device manufacturer, accurately filtering devices from the same manufacturer, and is the core judgment step for rejecting access from devices from different manufacturers, thus solving the problem of erroneous access.

[0037] Step B7: Update the most recent handshake message time received by the corresponding port in the array. This most recent handshake message time is the current system runtime (in milliseconds), then return to step B4. This step provides dynamic data support for the handshake message timeout check mechanism by updating the most recent handshake message time of the legitimate ports in real time.

[0038] Step B8: Generate an illegal handshake message alarm, then return to step B4. When the verification finds an invalid port or a mismatch between manufacturers, an alarm is triggered in a timely manner, which helps maintenance personnel quickly locate abnormal situations such as the access of devices from different manufacturers or message tampering, improves the efficiency of network fault response, and reduces the risk of fault propagation.

[0039] As shown in Figure 4, in this embodiment, the handshake message timeout check mechanism includes: Step C1, issuing an ACL rejection rule to the interconnect port to reject all packets from entering the switch, and setting the rejection flag of the interconnect port to 1 to provide a clear identifier for subsequent state switching, ensuring that the dynamic management of the ACL rejection rule has a clear basis, and preventing other packets from accessing the switch before identity authentication.

[0040] Step C2: Sleep for the third preset time (e.g., 100 milliseconds). This step balances the accuracy of timeout checks with device resource consumption through short-cycle sleep, ensuring timely detection of device offline status while avoiding excessive CPU resource consumption from high-frequency checks, thus ensuring that normal switch services and security management operate in parallel.

[0041] Step C3: Determine if the current port is an interconnect port; if yes, proceed to step C4; otherwise, proceed to step C8. This step ensures that timeout control logic is only executed on interconnect ports, while ACL restrictions are directly released for ordinary ports, restoring normal business transmission. This avoids unnecessary control over non-interconnect ports, ensuring functional specificity and business compatibility.

[0042] Step C4: Query the record value of the current port in the array recording the time of the most recent handshake message, and calculate the difference between the current system's (e.g., Linux system) running time and this record value. If the difference is greater than the fourth preset time (greater than 1600 milliseconds), it is determined that the handshake has timed out, and proceed to step C5; otherwise, proceed to step C6. This step uses the fourth preset time as the timeout threshold, and calculates the difference between the current system time and the time of the most recent handshake message to accurately determine whether the device is continuously online. The threshold setting of greater than 1600 milliseconds balances stability and real-time performance, avoids false judgments due to network latency, and can promptly detect device offline status.

[0043] Step C5: Check if the current port's rejection flag is 1; if yes, return to step C2, maintain the ACL rejection status and continue checking to prevent unauthenticated devices from accessing due to timeout logic errors; if no, proceed to step C9, trigger an alarm, and ensure that connected devices can be managed in a timely manner after going offline.

[0044] Step C6: Check if the current port's rejection flag is 1; if yes, proceed to step C7, which is the ACL deletion process, allowing service packets to access; if no, return to step C2, maintain the current state, ensure continuous service transmission, and achieve dynamic management and control where authentication is successful and continuous online access is maintained.

[0045] Step C7: Delete the ACL deny rule, allowing all packets to enter the switch, and change the deny flag of the current port to 0. Then return to step C2. This step ensures that the service channel is opened only when the device is legitimate and continuously online. Deleting the ACL deny rule and setting the flag to 0 ensures security without affecting normal service transmission.

[0046] Step C8: Delete the ACL deny rule, allowing all packets to enter the switch, and change the deny flag of the current port to 0. Then proceed to step C10. Since ordinary ports do not require timeout management, directly deleting the ACL deny rule and setting the deny flag to 0 ensures that their normal services are not affected by the secure interconnection function, improving the overall service compatibility of the switch.

[0047] Step C9 generates a timeout alarm, indicating that the previously allowed interconnection port has stopped access due to handshake timeout, and then returns to step C1. This step triggers a timeout alarm on ports that were previously allowed to access but subsequently went offline, promptly notifying maintenance personnel of the equipment connection abnormality, facilitating rapid troubleshooting, and ensuring the continuity of industrial networking.

[0048] Step C10: The current port exits the handshake message timeout check mechanism and reverts to a normal port to escape the timeout control process, avoid ineffective control occupying resources, and ensure flexible switching and normal operation of switch port functions.

[0049] In summary, the ACL-based secure interconnection method for switches provided in this embodiment eliminates the need for client software installation or authentication server setup. Relying solely on the switch's built-in ACL functionality and a custom handshake protocol, it significantly reduces hardware procurement and maintenance costs, adapting to the simplified networking requirements of industrial scenarios. The custom handshake protocol message, generated through MAC address encryption, verifies manufacturer identity, allowing only switches from the same manufacturer to access the network, thus preventing network failures caused by misconnection of devices from different manufacturers. By initially rejecting all packets and only granting access when identity verification is successful and the timeout has not expired, combined with a handshake message timeout check mechanism, it ensures the continued legitimacy of accessing devices, preventing devices from remaining open even after offline. Only the interconnection port needs to be configured; subsequent identity recognition, access control, and alarms are all automatically completed, reducing the workload of maintenance personnel and improving operational efficiency.

[0050] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely hardware implementations, entirely software implementations (including firmware, microcode, etc.), or implementations combining hardware and software aspects, collectively referred to herein as “circuits,” “modules,” or “systems.”

[0051] Any one or more of the modules, submodules, units, and subunits according to this embodiment, or at least part of the functions of any one or more of them, can be implemented in one module. Any one or more of the modules, submodules, units, and subunits according to this embodiment can be implemented by dividing them into multiple modules. Any one or more of the modules, submodules, units, and subunits according to this embodiment can be at least partially implemented as hardware circuits, such as field-programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits (ASICs), or implemented by hardware or firmware in any other reasonable manner by integrating or packaging circuits, or implemented in software, hardware, and firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, one or more of the modules, submodules, units, and subunits according to this embodiment can be at least partially implemented as computer program modules, which, when run, can perform corresponding functions.

[0052] In one embodiment, the present invention provides an ACL-based secure interconnection device for switches, which may include at least one processing unit and at least one storage unit. The storage unit stores program code that, when executed by the processing unit, causes the processing unit to perform the steps described above in the ACL-based secure interconnection method for switches according to various exemplary embodiments of the present invention. For example, the processing unit may execute the flow of the ACL-based secure interconnection method for switches shown in FIG1.

[0053] In one embodiment, the present invention provides a computer-readable medium storing computer-executable instructions for performing the steps in the ACL-based secure interconnection method for switches according to various exemplary embodiments of the present invention described above.

[0054] A readable medium can be a readable signal medium or a readable storage medium. A readable storage medium can be, for example—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. A readable signal medium can include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. A readable signal medium can also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the readable medium can be transmitted using any suitable medium, including—but not limited to—wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0055] Furthermore, although the operations of the method of the present invention are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0056] It should be understood that those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

[0057] The present invention has been described above with reference to the accompanying drawings. Obviously, the implementation of the present invention is not limited to the above-described manner. Any improvements made using the inventive concept and technical solution of the present invention, or the direct application of the inventive concept and technical solution of the present invention to other situations without modification, are all within the protection scope of the present invention.

Claims

1. A method for secure interconnection of switches based on ACL, characterized in that, include: Step S1: Configure the handshake protocol message Trap to CPU to have the highest priority; Step S2: Configure the specified port of the switch as an interconnect port, and enable the handshake message sending mechanism and handshake message timeout check mechanism of the interconnect port, while keeping the handshake message receiving mechanism of the switch always enabled.

2. The ACL-based secure interconnection method for switches according to claim 1, characterized in that, The handshake message sending mechanism includes: Step A1: After the switch port starts the secure interconnection function, it generates a custom handshake protocol message based on the switch's own MAC address using a custom encryption algorithm; Step A2: Determine whether the current port is an interconnection port; if not, proceed to Step A3; if yes, proceed to Step A7; Step A3: Determine whether the port status is UP; if yes, proceed to Step A4; if not, proceed to Step A6; Step A4: Send the custom handshake protocol message; Step A5: Sleep for a first preset time, then return to Step A3; Step A6: Sleep for a second preset time, then return to Step A3; Step A7: End sending the custom handshake protocol message.

3. The ACL-based secure interconnection method for switches according to claim 2, characterized in that, The custom handshake protocol message includes an Ethernet header and custom fields.

4. The ACL-based secure interconnection method for switches according to claim 2, characterized in that, The first preset time is 500 milliseconds, and the second preset time is 100 milliseconds.

5. The ACL-based secure interconnection method for switches according to claim 1, characterized in that, The handshake message receiving mechanism includes: Step B1: After the message receiving thread starts, set the handshake protocol message Trap to CPU; Step B2: Create a socket for receiving handshake protocol messages; Step B3: Initialize an array recording the time of the most recent handshake message. The array is defined according to the maximum number of ports on the switch, and the initial record value of all ports is set to 0; Step B4: Wait to receive handshake protocol messages. If a handshake protocol message is received, proceed to Step B5; otherwise, continue waiting; Step B5: Extract port information and custom fields of the handshake message from the handshake protocol message uploaded by the switch's operating system kernel; Step B6: Perform a validity check on the extracted port information and custom fields of the handshake message. If valid, proceed to Step B7; if invalid, proceed to Step B8; Step B7: Update the most recent time of the handshake message received by the corresponding port in the array, and then return to Step B4; Step B8: Generate an illegal handshake message alarm, and then return to Step B4.

6. The ACL-based secure interconnection method for switches according to claim 5, characterized in that, The legality check includes port number validity verification and manufacturer consistency verification of the MAC address after decryption of the custom field.

7. The ACL-based secure interconnection method for switches according to claim 1, characterized in that, The handshake message timeout check mechanism includes: Step C1, issuing an ACL rejection rule to the interconnect port to reject all packets from entering the switch, and setting the rejection flag of the interconnect port to 1; Step C2, sleeping for a third preset time; Step C3, determining whether the current port is an interconnect port; if yes, proceed to step C4; if no, proceed to step C8; Step C4, querying the record value of the current port in the array recording the most recent handshake message time, calculating the difference between the current system running time and the record value, if the difference is greater than a fourth preset time, determining that the handshake has timed out, and proceeding to step C5; if no timeout, proceeding to step C6; Step C5, checking whether the rejection flag of the current port is 1; if yes, returning to step C6. Step C2; if not, proceed to step C9; Step C6: Check if the current port's rejection flag is 1; if yes, proceed to step C7; if no, return to step C2; Step C7: Delete the ACL rejection rule, allowing all packets to enter the switch, and change the current port's rejection flag to 0, then return to step C2; Step C8: Delete the ACL rejection rule, allowing all packets to enter the switch, and change the current port's rejection flag to 0, then proceed to step C10; Step C9: Generate a timeout alarm, indicating that the previously allowed interconnection port has stopped access due to handshake timeout, then return to step C1; Step C10: The current port exits the handshake message timeout check mechanism and reverts to a normal port.

8. The ACL-based secure interconnection method for switches according to claim 7, characterized in that, The third preset time is 100 milliseconds, and the fourth preset time is greater than 1600 milliseconds.

9. An electronic device, characterized in that, include: At least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the ACL-based secure interconnection method for switches as described in any one of claims 1 to 8.

10. A computer-readable medium storing computer-executable instructions, characterized in that, The computer-executable instructions are used to execute the ACL-based secure interconnection method for switches as described in any one of claims 1 to 8.

Images