A network access control method, device and equipment based on honeypot

Abstract

The present application discloses a network access control method, device and equipment based on honeypot, which can use honeypot technology to timely discover abnormal access behavior in network access control scenarios to avoid risks. The method includes: firstly connecting the target Internet device, and using the access control server to verify the target Internet device to obtain the verification result, then, when the verification result shows that the target Internet device is not an internal trusted device, the port connected to the target Internet device is set to be inaccessible to the internal network and accessible to the isolated area resources, then, when the target Internet device accesses the isolated area resources, it is determined whether the target Internet device is connected to the honeypot in the isolated area resources, and if so, the access of the target Internet device is determined as abnormal access, and a honeypot alarm is generated.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a honeypot-based network security access control method, device and equipment. Background Art

[0002] Network access control refers to a control behavior that allows only legitimate and trusted terminal devices to access the network, while other devices are not allowed to access the network. Network security access is the first guarantee for the security of the enterprise intranet. Security managers are more concerned about what devices are connected to the enterprise intranet, what these devices are doing, how secure they are, and whether they pose certain threats. All of these require a network security access control system to keep a close eye on this.

[0003] The existing technical solutions for access control technology are only used to ensure that the identity of the user before accessing the network is trusted by the network. However, when the existing access control is used alone, it is not possible to effectively detect and block illegal access and attempted attacks. Therefore, how to implement network security access control and timely detect illegal access and attempted attacks to prevent confidential information or data from being infringed is an urgent problem to be solved. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to provide a honeypot-based network security access control method, device and equipment, which can use the honeypot to promptly detect abnormal access behavior in a network access control scenario to avoid risks.

[0005] In a first aspect, an embodiment of the present application provides a honeypot-based network access control method, comprising:

[0006] Connecting to a target Internet access device, and verifying the target Internet access device using an access control server to obtain a verification result;

[0007] When the verification result indicates that the target Internet access device is not an internal trusted device, the port to which the target Internet access device is connected is set to be inaccessible to the internal network but accessible to the isolation zone resources;

[0008] When the target Internet access device accesses the isolated area resources, determining whether the target Internet access device is connected to a honeypot in the isolated area resources;

[0009] If so, the access of the target Internet access device is determined to be abnormal access, and a honeypot alarm is generated.

[0010] Optionally, the method further includes:

[0011] When the verification result indicates that the target Internet access device is an internal trusted device, the port to which the target Internet access device is connected is set to be able to access the internal network.

[0012] Optionally, after generating the honeypot alarm, the method further includes:

[0013] According to the information contained in the honeypot alarm, the switch interface corresponding to the target Internet access device is located so as to perform corresponding processing according to the location result.

[0014] Optionally, the abnormal access includes at least one of network segment scanning, port scanning, and vulnerability attack attempts.

[0015] In a second aspect, the embodiment of the present application further provides a network access control device based on a honeypot, comprising:

[0016] A verification unit, used to connect to a target Internet access device and verify the target Internet access device using an access control server to obtain a verification result;

[0017] A first setting unit, configured to, when the verification result indicates that the target Internet access device is not an internal trusted device, set the port to which the target Internet access device is connected to be inaccessible to the internal network and accessible to the isolation zone resources;

[0018] A judging unit, used to judge whether the target Internet access device is connected to a honeypot in the isolated area resources when the target Internet access device accesses the isolated area resources;

[0019] The determination unit is used to determine the access of the target Internet access device as abnormal access and generate a honeypot alarm if it is determined that the target Internet access device is connected to the honeypot in the isolation area resources.

[0020] Optionally, the device further comprises:

[0021] The second setting unit is used to set the port connected to the target Internet access device to access the internal network when the verification result shows that the target Internet access device is an internal trusted device.

[0022] Optionally, the device further comprises:

[0023] The positioning unit is used to locate the switch interface corresponding to the target Internet access device according to the information contained in the honeypot alarm after the honeypot alarm is generated, so as to perform corresponding processing according to the positioning result.

[0024] Optionally, the abnormal access includes at least one of network segment scanning, port scanning, and vulnerability attack attempts.

[0025] The embodiment of the present application also provides a honeypot-based network access control device, including: a processor, a memory, and a system bus;

[0026] The processor and the memory are connected via the system bus;

[0027] The memory is used to store one or more programs, and the one or more programs include instructions. When the instructions are executed by the processor, the processor executes any one of the implementations of the honeypot-based network admission control method.

[0028] An embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a terminal device, the terminal device executes any one of the implementations of the above-mentioned honeypot-based network access control method.

[0029] The embodiment of the present application provides a honeypot-based network access control method, device and equipment, which first connects to a target Internet device, and uses an access control server to verify the target Internet device to obtain a verification result. Then, when the verification result shows that the target Internet device is not an internal trusted device, the port connected to the target Internet device is set to be inaccessible to the internal network and accessible to isolated area resources. Then, when the target Internet device accesses isolated area resources, it is determined whether the target Internet device is connected to a honeypot in the isolated area resources. If so, the access of the target Internet device is determined to be abnormal access, and a honeypot alarm is generated. Therefore, the honeypot can be used to timely discover abnormal access behavior in the network access control scenario to avoid risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0031] Figure 1 A schematic diagram of a flow chart of a honeypot-based network access control method provided in an embodiment of the present application;

[0032] Figure 2 An example diagram of an application scenario of honeypot-based network access control provided in an embodiment of the present application;

[0033] Figure 3 An overall flow chart of the honeypot-based network access control method provided in an embodiment of the present application;

[0034] Figure 4A schematic diagram of the composition of a honeypot-based network access control device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0035] With the continuous development of network technology, the requirements for network controllability, manageability, visualization of network operation status, data security during network operation, network robustness, and security of each network element, i.e., each node device in the network, are increasing day by day under different network environments. Among them, devices accessing the network may bring various security threats to the network. Therefore, it is necessary to perform network access control on devices accessing the network so that only devices that have passed identity authentication can access the network to ensure the safe operation of the network.

[0036] Specifically, sometimes in an enterprise, there are situations where external personnel enter the enterprise and illegally use their own Internet devices to connect to the enterprise network, which brings huge risks to the enterprise's intranet. A large number of enterprises use a security access mechanism to prevent private connections from being connected to the enterprise's internal business network segment through access in the first place. However, illegal external personnel will try various breakthrough methods, putting the enterprise's internal network at risk. Once a weak point is found to bypass the security access and access the intranet, it will inevitably cause a major impact. Therefore, it is particularly important to promptly and effectively discover illegal connection attempts by illegal external personnel so that the enterprise can promptly lock in the illegal personnel and terminate the illegal behavior.

[0037] To solve the above defects, the embodiment of the present application provides a network access control method based on a honeypot. First, the target Internet device is connected, and the target Internet device is verified by using an access control server to obtain a verification result. Then, when the verification result shows that the target Internet device is not an internal trusted device, the port connected to the target Internet device is set to be inaccessible to the internal network and accessible to the isolated area resources. Then, when the target Internet device accesses the isolated area resources, it is determined whether the target Internet device is connected to the honeypot in the isolated area resources. If so, the access of the target Internet device is determined as abnormal access, and a honeypot alarm is generated. In this way, the honeypot can be used to timely discover abnormal access behaviors in the network access control scenario to avoid risks.

[0038] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0039] First embodiment

[0040] See also Figure 1 , is a flow chart of a honeypot-based network access control method provided in this embodiment, the method comprising the following steps:

[0041] S101: Connect to a target Internet access device, and use an access control server to verify the target Internet access device to obtain a verification result.

[0042] It should be noted that, in order to facilitate the explanation of the honeypot-based network access control method provided by this application, this application provides the following Figure 2 The example diagram of the application scenario shown in the figure can be used to deal with illegal external personnel in the enterprise network who privately connect their own devices to the enterprise network. By executing the honeypot-based network access control method provided in this application, the above-mentioned illegal behaviors can be discovered and prevented. Figure 2 It includes access control server, access switch, isolation area resources and honeypot, and the honeypot is located in the isolation area resources.

[0043] Among them, the isolation area resources refer to the services that the terminal is allowed to access when it fails to pass the admission control. This part of the services is independent of the network that can be accessed through the admission control.

[0044] Honeypot refers to a technical means of capturing and analyzing attack behaviors by deploying some hosts, network services or information as bait to lure attackers into carrying out attacks.

[0045] In this embodiment, any Internet access device that needs to use this application to implement access control is defined as a target Internet access device. In order to accurately determine whether the target Internet access device is a normal access behavior when connecting to the network, the target Internet access device (which may be a compliant internal Internet access device or an illegal external Internet access device) is first connected, and the target Internet access device is used as follows: Figure 2 The access control server shown verifies the target Internet access device and obtains a verification result.

[0046] S102: When the verification result indicates that the target Internet access device is not an internal trusted device, the port to which the target Internet access device is connected is set to be inaccessible to the internal network but accessible to the isolation zone resources.

[0047] In this embodiment, the target Internet access device is connected through step S101 and the target Internet access device is verified by using the access control server. After the verification result is obtained, further, when the verification result shows that the target Internet access device is an internal trusted device, the port connected to the target Internet access device can be set to access the internal network. That is to say, at this time, the target Internet access device is a compliant internal Internet access device. When the compliant internal Internet access device is connected to the access switch, the access control server is used to perform an access verification on it. After the verification, the switch can set the interface to which it is connected to access the internal network.

[0048] When the verification result shows that the target Internet access device is not an internal trusted device, the port connected to the target Internet access device can be set to be inaccessible to the internal network but accessible to the isolated area resources. That is to say, at this time, the target Internet access device is an illegal external Internet access device. When the illegal external Internet access device is connected to the access switch, it cannot pass the access control because it is not an internal trusted device. The switch can set the interface to which it is connected to be inaccessible to the internal network but accessible to the isolated area resources, so as to determine whether it is normal access by executing subsequent steps S103-S104.

[0049] S103: When the target Internet access device accesses the isolated area resources, it is determined whether the target Internet access device is connected to a honeypot in the isolated area resources.

[0050] In this embodiment, after setting the port to which the target Internet access device is connected to be inaccessible to the internal network but accessible to the isolated area resources through step S102, it is further possible to determine whether the target Internet access device is connected to the honeypot in the isolated area resources when the target Internet access device accesses the isolated area resources. If so, the subsequent step S104 is executed; if not, it indicates that it is a normal access.

[0051] S104: If yes, the access of the target Internet access device is determined as abnormal access, and a honeypot alarm is generated.

[0052] In this embodiment, if it is determined through step S103 that the target Internet access device has been connected to the honeypot in the isolation area resources, the access of the target Internet access device can be determined as abnormal access (including but not limited to at least one of network segment scanning, port scanning, and attempted vulnerability attack behaviors), and a honeypot alarm is generated. The specific alarm method can be set according to actual conditions, and the embodiment of the present application does not limit this. For example, the alarm method can be set to voice broadcast, text display, or flashing prompt light, etc.

[0053] Specifically, in this embodiment, a honeypot is pre-set up in the isolation area resources outside the normal access resources (honeypot technology is mainly used to allow malicious attackers to invade and attack, thereby collecting evidence to hide the real network service, and at the same time discovering malicious attackers to provide information support for locating attackers). In this way, non-malicious normal access to the isolation area resources will not be connected to the honeypot, and no honeypot alarm will be generated; while malicious and illegal access behaviors, such as network segment scanning, port scanning, attempted vulnerability attacks and other abnormal access behaviors can trigger honeypot alarms.

[0054] Furthermore, an optional implementation method is that after the honeypot alarm is generated, the switch interface corresponding to the target Internet access device can be located according to the information contained in the honeypot alarm, so as to perform corresponding processing according to the obtained positioning result.

[0055] Specifically, in this implementation, after the honeypot alarm is generated, the operation and maintenance personnel can find the alarm information from the background alarm system, and then locate the specific switch interface, and locate the currently connected illegal external personnel to terminate their illegal behavior and avoid the risk of illegal personnel repeatedly trying to attack the isolation area resources.

[0056] In this way, by executing the above steps S101-S104, the following is achieved: Figure 3 The overall process of honeypot-based network access control is shown in the figure. By deploying honeypots in the isolated VLAN of the access switch, when illegal external personnel use their own Internet access devices to privately access the access switch and conduct scanning detection, the honeypot is triggered to generate alarm information, including the illegally accessed switch and port, so that enterprise monitoring personnel can locate illegal external personnel in time to stop illegal behavior and avoid risks.

[0057] In summary, the present embodiment provides a honeypot-based network access control method, which first connects to the target Internet device, and uses the access control server to verify the target Internet device to obtain the verification result. Then, when the verification result shows that the target Internet device is not an internal trusted device, the port connected to the target Internet device is set to be inaccessible to the internal network and accessible to the isolated area resources. Then, when the target Internet device accesses the isolated area resources, it is determined whether the target Internet device is connected to the honeypot in the isolated area resources. If so, the access of the target Internet device is determined as abnormal access, and a honeypot alarm is generated. In this way, the honeypot can be used to timely discover abnormal access behaviors in the network access control scenario to avoid risks.

[0058] Second embodiment

[0059] This embodiment will introduce a network access control device based on honeypot. For related content, please refer to the above method embodiment.

[0060] See also Figure 4 , is a schematic diagram of the composition of a honeypot-based network access control device provided in this embodiment, the device comprising:

[0061] The verification unit 401 is used to connect to the target Internet access device and verify the target Internet access device using the access control server to obtain a verification result;

[0062] The first setting unit 402 is used to set the port connected to the target Internet access device to be inaccessible to the internal network and to be able to access the isolation zone resources when the verification result shows that the target Internet access device is not an internal trusted device;

[0063] The judging unit 403 is used to judge whether the target Internet access device is connected to a honeypot in the isolated area resource when the target Internet access device accesses the isolated area resource;

[0064] The determination unit 404 is configured to determine the access of the target Internet access device as abnormal access and generate a honeypot alarm if it is determined that the target Internet access device is connected to a honeypot in the isolation zone resources.

[0065] In an implementation of this embodiment, the device further includes:

[0066] The second setting unit is used to set the port connected to the target Internet access device to access the internal network when the verification result shows that the target Internet access device is an internal trusted device.

[0067] In an implementation of this embodiment, the device further includes:

[0068] The positioning unit is used to locate the switch interface corresponding to the target Internet access device according to the information contained in the honeypot alarm after the honeypot alarm is generated, so as to perform corresponding processing according to the positioning result.

[0069] In an implementation of this embodiment, the abnormal access includes at least one of network segment scanning, port scanning, and vulnerability attack attempts.

[0070] In summary, the network access control device based on honeypot provided in this embodiment first connects to the target Internet device, and uses the access control server to verify the target Internet device to obtain the verification result. Then, when the verification result shows that the target Internet device is not an internal trusted device, the port connected to the target Internet device is set to be inaccessible to the internal network and accessible to the isolated area resources. Then, when the target Internet device accesses the isolated area resources, it is determined whether the target Internet device is connected to the honeypot in the isolated area resources. If so, the access of the target Internet device is determined as abnormal access, and a honeypot alarm is generated. Therefore, the honeypot can be used to timely discover abnormal access behavior in the network access control scenario to avoid risks.

[0071] Furthermore, the embodiment of the present application also provides a honeypot-based network access control device, including: a processor, a memory, and a system bus;

[0072] The processor and the memory are connected via the system bus;

[0073] The memory is used to store one or more programs, and the one or more programs include instructions. When the instructions are executed by the processor, the processor executes any one of the implementation methods of the above-mentioned honeypot-based network admission control method.

[0074] Furthermore, an embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a terminal device, the terminal device executes any one of the implementation methods of the above-mentioned honeypot-based network access control method.

[0075] It can be known from the description of the above implementation mode that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a storage medium such as ROM / RAM, a disk, an optical disk, etc., including several instructions for enabling a computer device (which can be a personal computer, a server, or a network communication device such as a media gateway, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0076] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0077] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0078] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A network access control method based on honeypot, characterized in that: include: Connecting to a target Internet access device, and verifying the target Internet access device using an access control server to obtain a verification result; When the verification result shows that the target Internet access device is not an internal trusted device, the port to which the target Internet access device is connected is set to be inaccessible to the internal network and accessible to isolated zone resources, where the isolated zone resources are services that the terminal is allowed to access when the access control is not passed, and are independent of the network that can be accessed through the access control; When the target Internet access device accesses the isolated area resource, determining whether the target Internet access device is connected to a honeypot in the isolated area resource, the honeypot being located in the isolated area resource; If so, the access of the target Internet access device is determined to be abnormal access, and a honeypot alarm is generated. The abnormal access includes at least one of network segment scanning, port scanning, and vulnerability attack attempts.

2. The method according to claim 1, characterized in that The method further comprises: When the verification result indicates that the target Internet access device is an internal trusted device, the port to which the target Internet access device is connected is set to be able to access the internal network.

3. The method according to claim 1, characterized in that After generating the honeypot alarm, the method further includes: According to the information contained in the honeypot alarm, the switch interface corresponding to the target Internet access device is located so as to perform corresponding processing according to the location result.

4. A network access control device based on honeypot, characterized in that: include: A verification unit, used to connect to a target Internet access device and verify the target Internet access device using an access control server to obtain a verification result; A first setting unit is used for, when the verification result shows that the target Internet access device is not an internal trusted device, setting the port connected to the target Internet access device to be inaccessible to the internal network and accessible to isolated area resources, wherein the isolated area resources are services that the terminal is allowed to access when the access control is not passed, and are independent of the network that can be accessed through the access control; A judgment unit, used for judging whether the target Internet access device is connected to a honeypot in the isolated area resource when the target Internet access device accesses the isolated area resource, the honeypot being located in the isolated area resource; The determination unit is used to determine the access of the target Internet access device as abnormal access and generate a honeypot alarm if it is determined that the target Internet access device is connected to a honeypot in the isolation area resources. The abnormal access includes at least one of network segment scanning, port scanning, and vulnerability attack attempts.

5. The device according to claim 4, characterized in that The device also includes: The second setting unit is used to set the port connected to the target Internet access device to access the internal network when the verification result shows that the target Internet access device is an internal trusted device.

6. The device according to claim 4, characterized in that The device also includes: The positioning unit is used to locate the switch interface corresponding to the target Internet access device according to the information contained in the honeypot alarm after the honeypot alarm is generated, so as to perform corresponding processing according to the positioning result.

7. A network access control device based on honeypot, characterized in that: include: Processor, memory, system bus; The processor and the memory are connected via the system bus; The memory is used to store one or more programs, wherein the one or more programs include instructions, and when the instructions are executed by the processor, the processor executes the method according to any one of claims 1 to 3.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a terminal device, the terminal device executes the method according to any one of claims 1 to 3.

Images