Reverse roll call system, reverse roll call method and computer readable storage medium

Abstract

The present disclosure relates to a reverse roll call system, a reverse roll call method and a computer-readable storage medium. A reverse roll call system is used to perform reverse roll call on a client from a server when the client accesses a network. The reverse roll call system comprises: a roll call port distribution module, which is used to distribute ports to the client according to a redirection request from the client and send a roll call request; a roll call request distribution interface module, which sends the roll call request received from the roll call port distribution module by controlling a roll call request interface; and a roll call verification analysis module, which performs reverse roll call on the client to verify the identity of the client according to the roll call request received from the roll call request distribution interface module and using the distributed port and characteristic information of the client.

Description

Technical Field

[0001] The present disclosure generally relates to a reverse roll call system, a reverse roll call method and a computer-readable storage medium, and more specifically to a reverse roll call system, a reverse roll call method and a computer-readable storage medium in the field of network security. Background Art

[0002] When a client accesses the network, it usually needs to dial up. At this time, the client usually enters the account number, password, etc. to the server, and the server verifies the account number and password and allows the client to access. Then the client can access the network and surf the Internet normally. The process of the client applying for access to the server includes the roll call service process performed by the client. Here, for example, the client is set as a mobile terminal, and this is used as an example to illustrate the roll call service process. The so-called roll call service process in the mobile terminal is usually as follows: the mobile terminal acts as a client, for example, uses the APP installed in the mobile terminal to start a daemon process to complete the relevant work, and then initiates a roll call request to the server. The server analyzes the one-to-one related rules to determine whether it is compliant, and returns the roll call interaction result feedback information to the mobile terminal APP to determine the compliance of the terminal access. The "roll call" service here can be understood as a kind of identity authentication, so "roll call" can also be called "identity authentication." However, the above-described method has certain risks and shortcomings in network security. First, the mobile APP as the client is relatively easy to be decompiled, and the interactive messages are also easy to be intercepted and tampered with, thereby simulating the interaction with the server, resulting in the server being unable to effectively identify the client with abnormal access. Second, its system architecture mode, the daemon process started on the client is easy to be killed by the user, resulting in its inability to interact with the server normally and misjudgment, and unable to access normally. A large number of modified routers and other Internet devices have appeared on the market, which imitate the roll call service by cracking the mobile client, causing network security problems and infringing the rights and interests of legitimate users. Summary of the invention

[0003] The present disclosure is proposed to address the security issues caused by the client being relatively easy to be decompiled, disguised, etc., and the problem that the daemon process started on the client is easy to be killed by the user. Its purpose is to provide a reverse roll call system, reverse roll call method and computer-readable storage medium that can improve network security.

[0004] A brief overview of the disclosure is given below in order to provide a basic understanding of some aspects of the disclosure. However, it should be understood that this overview is not an exhaustive overview of the disclosure. It is not intended to identify the key or important parts of the disclosure, nor is it intended to limit the scope of the disclosure. Its purpose is simply to give some concepts of the disclosure in a simplified form as a prelude to a more detailed description given later.

[0005] According to one aspect of the present disclosure, a reverse roll call system is provided, which is used to perform reverse roll call on a client from a server when the client accesses a network. The reverse roll call system comprises:

[0006] A roll call port distribution module, used for distributing ports to the client according to a redirection request from the client, and sending a roll call request;

[0007] a roll call request distribution interface module, which sends the roll call request received from the roll call port distribution module by controlling the roll call request interface; and

[0008] The roll call verification analysis module performs reverse roll call on the client for verifying the identity of the client by using the distributed port and the characteristic information of the client according to the roll call request received from the roll call request distribution interface module.

[0009] According to another aspect of the present disclosure, a reverse roll call method is provided, which is used to perform reverse roll call on a client from a server when the client accesses a network. The reverse roll call method includes:

[0010] A roll call port distribution step, for distributing ports to the client according to a redirection request from the client, and sending a roll call request;

[0011] a roll call request distribution interface step, sending the roll call request received in the roll call port distribution step by controlling the roll call request interface; and

[0012] The roll call verification analysis step performs reverse roll call on the client to verify the identity of the client based on the roll call request received in the roll call request distribution interface step and utilizing the distributed port and the characteristic information of the client.

[0013] According to another aspect of the present disclosure, a computer-readable storage medium is provided, which includes computer-executable instructions. When the computer-executable instructions are executed by one or more processors, the one or more processors execute the method according to the above aspects of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0015] The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:

[0016] Figure 1It is a schematic diagram of the relationship between the client and the server when the client of the present disclosure accesses the network.

[0017] Figure 2 It is a structural block diagram of the reverse roll call system.

[0018] Figure 3 A schematic diagram showing a reverse roll call system performing a reverse roll call operation.

[0019] Figure 4 Show Figure 2 Flowchart of the reverse roll call method shown.

[0020] Figure 5 It is a flow chart of the roll call port distribution module.

[0021] Figure 6 It is a flow chart of the roll call request distribution interface module.

[0022] Figure 7 It is a flow chart of the roll call verification analysis module.

[0023] Figure 8 It is a flow chart of the blacklist processing module.

[0024] Fig. 9 An exemplary configuration of a computing device that can implement an embodiment according to the present disclosure is shown. DETAILED DESCRIPTION

[0025] The following detailed description is made below with reference to the accompanying drawings, and the following detailed description is provided to assist in a comprehensive understanding of various exemplary embodiments of the present disclosure. The following description includes various details to assist in understanding, but these details are considered to be examples only and not to limit the present disclosure, which is defined by the appended claims and their equivalents. The words and phrases used in the following description are only used to enable a clear and consistent understanding of the present disclosure. In addition, for the sake of clarity and brevity, descriptions of well-known structures, functions, and configurations may be omitted. Those of ordinary skill in the art will recognize that various changes and modifications may be made to the examples described herein without departing from the spirit and scope of the present disclosure.

[0026] In the present disclosure, in combination with the network environment setting of the telecommunications operator, a roll call service is initiated by the client through a WIFI environment released by wired broadband, etc., the existing roll call service system is improved, a design of reverse roll call from the server to the mobile terminal serving as the client is added, and combined with detection means analysis, it is effectively prevented from cracking and imitating the client by counterfeit routers, etc., to enhance the compliance and security of client access.

[0027] Figure 1 It is a schematic diagram of the relationship between the client and the server when the client of the present disclosure accesses the network.

[0028] exist Figure 1 In the example, when the client 101 wants to access the network, it first initiates the previous roll call service to the server through the APP installed on the client. After receiving the roll call service, the server 102 not only performs verification based on the received user ID and password, but also performs a reverse roll call operation on the client 2. When the reverse roll call is successful, the client is allowed to access the network 103.

[0029] The reverse roll call system and reverse roll call method disclosed in the present invention are described in detail below.

[0030] When implementing the reverse roll call system and the reverse roll call method, the network environment is deployed first. Here, the network operated by a telecommunications operator is used as an example for explanation. Of course, the present disclosure is not limited to the network operated by a telecommunications operator, and can be applied to other operated networks. In addition, it is assumed that the client here is set to a mobile terminal, and the roll call service is performed, for example, by an APP installed on the mobile terminal. Of course, the client is not limited to the mobile terminal, and can also be other clients that want to access the network, as long as the client can be used to perform the roll call service.

[0031] On the telecommunications operator network side, for example, servers such as BRAS servers, PORTAL servers, and AAA servers are deployed. The roll-call analysis system disclosed in the present invention can be deployed on a PORTAL (portal) server or separately. One roll-call analysis system corresponds to one BRAS device, and establishes an exclusive VPN (virtual private network) channel with the BRAS device. The binding relationship of the wired broadband account is stored on the AAA server. The mobile APP accesses the WiFi signal released by the telecommunications operator's wired broadband network (it can also be a public WIFI signal released in this area by the telecommunications operator through a dedicated BRAS control) to access the Internet and initiate a roll-call service. Although the example here is "one roll-call analysis system corresponds to one BRAS device", it is not limited to this limiting relationship. The above-mentioned BRAS can of course also have one roll-call analysis system corresponding to multiple BRAS devices, or multiple roll-call analysis systems corresponding to one BRAS device, or even multiple roll-call analysis systems corresponding to multiple BRAS devices, as long as the dynamic IP address of the client can be unique.

[0032] The server is a broadband access server (Broadband Remote Access Server, referred to as BRAS), a new access gateway for broadband network applications. It is located at the edge layer of the backbone network and can complete the data access of the user's bandwidth IP (Internet Protocol) / ATM (Asynchronous Transfer Mode) network (currently the access means are mainly based on xDSL (x Digital Subscriber Line) / Cable Modem (cable modem) / High-speed Ethernet technology (LAN) / Wireless Broadband Data Access (WLAN) etc.), realize broadband Internet access for commercial buildings and community residents, IP VPN services based on IPSec (IP Security Protocol: IP Security Standard), build corporate internal Intranet (intranet), support ISP (Internet Service Provider: Internet Service Provider) to wholesale services to users and other applications. PORTAL server is a server-side system that receives PORTAL client authentication requests, provides free portal services and a Web-based authentication interface, and interacts with access devices to authenticate client authentication information. Users can actively visit known PORTAL authentication websites and enter usernames and passwords for authentication. PORTAL services can provide operators with convenient management functions. AAA server is a server that can process user access requests, provide authentication authorization and account services. Its main purpose is to manage user access to network servers and provide services to users with access rights.

[0033] When the reverse roll call system performs reverse roll call operation, roll call port distribution is performed first. The APP of client 101 sends a redirection request to the PORTAL server (here it is assumed that the roll call analysis system is deployed on the Portal server). At this time, the reverse roll call system allocates a random port to client 101 through the PORTAL server, and the APP of client 101 extracts the port in the message and starts it, and reports the port information to the server 102.

[0034] Next, the reverse roll call system performs reverse roll call analysis. Unlike general roll call services that are only initiated by the client to the server, here the server initiates rapid multiple reverse roll calls to the client based on the roll call port assigned to the client, and combines detection methods to implement client compliance verification. There are many detection methods here. For example, reverse detection, feature detection, etc. Rapid multiple reverse roll calls are to prevent misjudgments and ensure customer experience. Multiple reverse roll calls can prevent situations where legitimate users are mistakenly identified as illegal users and rejected due to occasional factors such as network interference or occasional circuit failures. And because it is carried out quickly, even if reverse roll calls are performed multiple times, the client users will not feel too long waiting time, so the customer experience is good.

[0035] Regarding reverse detection, the server obtains the client's dial-up address, finds the corresponding client through the VPN exclusive channel, and rolls the client multiple times. This reverse interaction process is difficult to imitate and steal, and it can ensure that even if the client process is killed by the user, it will not affect the success rate of roll calling.

[0036] Terminals that fail reverse roll call are deemed to have failed authentication and cannot access the network.

[0037] About feature detection. The reverse roll call system performs compliance verification of the client's APP authentication based on the specific port assigned to the client and the client's feature information. The feature information is, for example, one or more of the client's system version information, the terminal type on which the APP is installed, the MAC address, the timeliness of the interactive message response, multiple roll call results, and the encryption method, and may also be feature information required by a specific application. For example, the server performs compliance verification of the client based on the pre-stored terminal type of the client obtained when the APP is installed. In short, when the server verifies the compliance of the client, it can authenticate the client's identity based on one or more of the feature information obtained by the server for the client.

[0038] For terminals that are judged as non-compliant by feature detection, even if they are successfully connected to the network through reverse naming, the system can apply to blacklist them and kick them offline according to business rules to prevent them from accessing the network. This is also called blacklist processing.

[0039] Figure 22 is a structural block diagram of a reverse roll call system. For ease of explanation, it is assumed here that the reverse roll call system 201 is set in a PORTAL server. The reverse roll call system 201 has a roll call port distribution module 202, a roll call request distribution interface module 203, a roll call verification analysis module 204, and a blacklist processing module 205. The roll call port distribution module 202 is used to distribute roll call ports for the client 101. Specifically, the roll call port distribution module 202 distributes a port to the client 101 through the PORTAL server according to the redirection request initiated by the client 101. The client 101 extracts the port from the message and asynchronously starts the roll call interface. At the same time, the roll call port distribution module 202 allows the PORTAL server to send the roll call request to the roll call request distribution interface module 203 and the roll call request interface. When receiving the roll call request, the roll call request distribution interface module 203 controls the roll call request interface and distributes the request to the roll call verification analysis module 204 according to a certain configuration, such as BRAS configuration. The roll call verification analysis module 204 sends a reverse roll call to the client 101, and uses the distributed port to perform reverse roll call verification on the client 101, and verifies whether the client 101 is a legitimate user based on the feature information. If the user is a legitimate user, the reverse roll call system allows the user to access the network. If the user is not a legitimate user, the blacklist processing module 205 kicks the user offline, that is, takes the user offline. Of course, the blacklist processing module 205 is not necessary here. It is also possible not to kick the user offline but to never allow the user to access the network.

[0040] exist Figure 3 A schematic diagram illustrating the reverse roll call operation performed by the reverse roll call system is shown in FIG.

[0041] The APP of client 101 sends a redirection request to the PORTAL server, and the roll call port distribution module 202 in the PORTAL server assigns a random port to the APP of client 101. The APP of client 101 extracts the port in the redirection message and asynchronously starts the roll call interface. The APP of client 101 initiates dial-up authentication again, and when the authentication is successful, uploads the roll call interface startup result. When the authentication is successful, based on the roll call interface startup result, the roll call port distribution module 202 in the PORTAL server simultaneously sends a roll call request to the roll call request distribution interface module 203. The roll call request distribution interface module 203 controls the roll call request interface and distributes the request to different roll call verification analysis modules according to, for example, the BRAS configuration. The roll call verification analysis module 204 sends a reverse roll call to the APP of client 101, logs in multiple times in reverse roll call once, and obtains the roll call information for analysis. Multiple roll calls fail to be added to the blacklist, and the blacklist user is sent to the blacklist processing module 205 and the blacklist kick-offline interface. The blacklist processing module 205 controls the blacklist kick-off interface to send the blacklist to the PORTAL server, and the PORTAL server kicks the blacklist user off the line, and the access authentication fails.

[0042] Figure 4 It is shown Figure 3 Flowchart of the reverse roll call method shown.

[0043] In step S401, the client's APP initiates a redirection request, and the named port distribution module 202 located in the PORTAL server distributes a random port to the client.

[0044] Next, in step S402, the client APP obtains the port information in the redirection message and asynchronously starts the roll call interface.

[0045] In step S403, the client's APP initiates a login authentication request. In step S404, is the authentication result determined to be a success or a failure? In the case of failure, proceed to step S405, and display the authentication failure in the client. When the authentication is successful, proceed to step S406, the PORTAL server receives the success request, and initiates a roll call (reverse roll call) to the client through the roll call request distribution interface module 203 and the roll call verification analysis module 204. What is performed here is a fast and multiple roll call. As long as there is one success in n roll calls, it is considered to be a successful roll call and legal, so step S407 is entered to allow access to the Internet. In the case that none of the roll calls are successful in n times, it is considered illegal, so step S408 is entered. In step S408, the blacklist processing module 205 initiates a kick-off request to the blacklist interface.

[0046] Regarding the specific steps performed within the roll call port distribution module 202, use Figure 5 The following example briefly explains this.

[0047] exist Figure 5 In the case where the PORTAL server supports roll call, step S501 is entered. In step S501, account password verification is performed to determine whether the authentication is successful. In the case of yes, step S502 is entered, and in the case of no, step S507 is entered without roll call. In step S502, the roll call protection function point configuration of the server is extracted, and then step S503 is entered to verify whether the roll call protection function point status of the server is normal based on the proposed content. In the case of no, step S509 is entered, and roll call is not required. In the case of yes, step S504 is entered. In step S504, it is verified whether the version of the client supports roll call protection. In the case of yes, step S505 is entered, and in the case of no, step S508 is entered, and roll call is not required. In step S505, the result XML message is returned, and the roll call port information is added. Then step S506 is entered to send a roll call request to the roll call request distribution interface module.

[0048] Next, use Figure 6 , briefly explain the specific steps performed by the roll call request distribution interface module 203. The roll call request distribution interface module 203 distributes the roll call request. In step S601, a roll call request is raised from the roll call request cache queue. Then in step S602, a distribution list is obtained according to the parameter wlanacname. Then in step S603, it is determined whether the distribution list is empty. If it is empty, it proceeds to step S604 without processing, and then returns to step S601. If it is not empty, it proceeds to step S605, and the distribution list is iteratively distributed until any one is successful, and then returns to step S601.

[0049] Next, use Figure 7, briefly describe the specific steps of the roll call verification performed by the roll call verification analysis module 204. In step S701, obtain the roll call request from the queue, and then enter step S702, in step S702, check whether the timeliness of the roll call request is successful. If successful, enter step S704, if not, enter step S703, and filter the request. In step S704, check whether the roll call interface startup result of the client is successful, if successful, enter step S705, otherwise enter step S706, and filter the request. In step S705, determine whether the roll call request is sent to the client successfully. If successful, enter step S707, otherwise enter step S708. In step S708, update the data status to called, and then enter step S709 to initiate a blacklist kick request. In step S707, check whether the response result is successful. In the case of success, enter step S712, and then update the data status to called. Otherwise, the process goes to step S710 to update the data status to named, and then goes to step S711 to initiate a blacklist kick-off request.

[0050] Next, use Figure 8 , briefly describe the specific steps of the blacklist processing performed by the blacklist processing module 205. In step S801, extract the blacklist request from the blacklist queue, and then proceed to step S802. In step S802, add or update the blacklist table, and then proceed to step S803 to determine whether the user of the newly added or updated blacklist is to be kicked offline. In the case of no, proceed to step S805 and end the processing. In the case of yes, proceed to step S804 to check whether the user is on the whitelist. In the case of being on the whitelist, proceed to step S806 and end the processing. In the case of no, proceed to step S807 and initiate a kick-offline request to the PORTAL server.

[0051] Fig. 9 An exemplary configuration of a computing device 1200 capable of implementing embodiments according to the present disclosure is shown.

[0052] The computing device 1200 is an example of a hardware device to which the above aspects of the present disclosure can be applied. The computing device 1200 can be any machine configured to perform processing and / or computing. The computing device 1200 can be, but is not limited to, a workstation, a server, a desktop computer, a laptop computer, a tablet computer, a personal data assistant (PDA), a smart phone, a vehicle-mounted computer, or a combination thereof.

[0053] like Fig. 9As shown, the computing device 1200 may include one or more components that may be connected or communicated with the bus 1202 via one or more interfaces. The bus 2102 may include, but is not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus. The computing device 1200 may include, for example, one or more processors 1204, one or more input devices 1206, and one or more output devices 1208. The one or more processors 1204 may be any type of processor and may include, but is not limited to, one or more general-purpose processors or special-purpose processors (such as special-purpose processing chips). The processor 1204 may correspond to, for example, Figure 2 The reverse roll call system 201 in the embodiment is configured to implement a roll call port distribution module 202, a roll call request distribution interface module 203, a roll call verification analysis module 204, and a blacklist processing module 205. The input device 1206 can be any type of input device capable of inputting information to a computing device, and can include but is not limited to a mouse, a keyboard, a touch screen, a microphone, and / or a remote controller. The output device 1208 can be any type of device capable of presenting information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer.

[0054] The computing device 1200 may also include or be connected to a non-transitory storage device 1214, which may be any non-transitory storage device that can implement data storage, and may include, but is not limited to, a disk drive, an optical storage device, a solid-state memory, a floppy disk, a flexible disk, a hard disk, a tape, or any other magnetic medium, a compressed disk or any other optical medium, a cache memory, and / or any other storage chip or module, and / or any other medium from which a computer can read data, instructions, and / or code. The computing device 1200 may also include a random access memory (RAM) 1210 and a read-only memory (ROM) 1212. The ROM 1212 may store programs, utilities, or processes to be executed in a non-volatile manner. The RAM 1210 may provide volatile data storage and store instructions related to the operation of the computing device 1200. The computing device 1200 may also include a network / bus interface 1216 coupled to a data link 1218. The network / bus interface 1216 may be any type of device or system capable of enabling communication with an external device and / or a network, and may include but is not limited to a modem, a network card, an infrared communication device, a wireless communication device, and / or a chipset (such as a Bluetooth TMequipment, 802.11 equipment, WiFi equipment, WiMax equipment, cellular communication facilities, etc.).

[0055] As an application example of the present disclosure, it can be considered to be applied to scenarios such as universities, parks, and office buildings. Specifically, in order to support the broadband Internet access needs of users in environments such as universities, parks, and office buildings, operators generally adopt FTTB (Fiber to the Building: Fiber to the Building) networking, deploy information points to the user side, and users dial up to the Internet by entering the wired broadband account and password through terminals such as PCs or PADs. Operators usually also adopt the development model of "one broadband + one mobile phone", bundle this mobile phone number with the user's broadband account, and store the corresponding relationship in the operator's AAA server. Connect the WiFi signal released by this broadband network through the mobile client (it can also be the public WIFI signal released in this area by the telecom operator through the dedicated BRAS control), run the mobile terminal APP for dial-up Internet authentication, and use simple methods such as one-click login, scan code login, and verification code login to assist the PC terminal to conveniently realize wired broadband login. The reverse roll-call system and reverse roll-call method disclosed in the present disclosure can assist users in the area to realize real-name Internet access with one person and one account, effectively prevent multiple people from sharing, meet network security management requirements, protect the legitimate rights and interests of users, and safeguard the rights and interests of operators.

[0056] In addition, the mobile APP that initiates the roll call service in the WIFI environment released by the wired broadband can apply the technology of the invention to enhance the client access security. It can also be modified and expanded to the roll call service application of other terminal types in the broadband Internet environment.

[0057] The present disclosure may be implemented as any combination of an apparatus, a system, an integrated circuit, and a computer program on a non-transitory computer-readable medium. One or more processors may be implemented as an integrated circuit (IC), an application specific integrated circuit (ASIC), or a large scale integrated circuit (LSI), a system LSI, a super LSI, or a super LSI component that performs some or all of the functions described in the present disclosure.

[0058] The present disclosure includes the use of software, applications, computer programs, or algorithms. The software, applications, computer programs, or algorithms may be stored on a non-transitory computer-readable medium to enable a computer such as one or more processors to perform the above steps and the steps described in the accompanying drawings. For example, one or more memories store the software or algorithm in executable instructions, and one or more processors may associate a set of instructions to execute the software or algorithm to provide various functions according to the embodiments described in the present disclosure.

[0059] Software and computer programs (which may also be referred to as programs, software applications, applications, components or code) include machine instructions for a programmable processor and may be implemented in a high-level procedural language, an object-oriented programming language, a functional programming language, a logic programming language, or an assembly language or a machine language. The term "computer-readable medium" refers to any computer program product, apparatus or device for providing machine instructions or data to a programmable data processor, such as magnetic disks, optical disks, solid-state storage devices, memories and programmable logic devices (PLDs), including computer-readable media that receive machine instructions as computer-readable signals.

[0060] For example, computer readable media may include dynamic random access memory (DRAM), random access memory (RAM), read-only memory (ROM), electrically erasable read-only memory (EEPROM), compact disk read-only memory (CD-ROM) or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, or any other medium that can be used to carry or store the desired computer readable program code in the form of instructions or data structures and can be accessed by a general or special purpose computer or a general or special purpose processor. As used herein, disk or disc includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc, where disks usually reproduce data magnetically, while discs reproduce data optically by laser. Combinations of the above are also included in the scope of computer readable media.

[0061] The subject matter of the present disclosure is provided as an example of devices, systems, methods and programs for performing the features described in the present disclosure. However, in addition to the above-mentioned features, other features or variations may also be expected. It is expected that the implementation of the components and functions of the present disclosure may be completed with any emerging technology that may replace any of the above-mentioned implementation technologies.

[0062] In addition, the above description provides examples without limiting the scope, applicability or configuration set forth in the claims. Without departing from the spirit and scope of the present disclosure, the functions and arrangements of the elements discussed may be changed. Various embodiments may appropriately omit, replace or add various processes or components. For example, features described with respect to certain embodiments may be combined in other embodiments.

[0063] In addition, in the description of the present disclosure, the terms “first”, “second”, “third”, etc. are used for descriptive purposes only and cannot be understood as indicating or implying relative importance and order.

[0064] Similarly, while operations are depicted in a particular order in the drawings, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed to achieve desired results. In certain circumstances, multitasking and parallel processing can be advantageous.

Claims

1. A reverse roll call system, for performing reverse roll call on a client from a server when the client accesses a network, the reverse roll call system comprising: A roll call port distribution module is used to distribute ports to the client according to a redirection request from the client, and after receiving the roll call service initiated by the client, verify the received user ID and password, and send a roll call request when the verification is successful; a roll call request distribution interface module, which sends the roll call request received from the roll call port distribution module by controlling the roll call request interface; and A roll call verification analysis module, which performs the reverse roll call for verifying the identity of the client by using the distributed port and the characteristic information of the client according to the roll call request received from the roll call request distribution interface module; in, The reverse roll call system is also used to: When the reverse roll call verifies that the client is a legitimate user, allowing the client to access the network; When the reverse roll call verification verifies that the client is not a legitimate user, the client is not allowed to access the network.

2. The reverse roll call system according to claim 1, further comprising: The blacklist processing module sets the client to the blacklist when the reverse roll call performed by the roll call verification and analysis module fails for multiple times, and makes the client on the blacklist offline.

3. The reverse roll call system according to claim 1 or 2, wherein: The roll call verification and analysis module performs the reverse roll call for multiple times when performing the reverse roll call on the client.

4. The reverse roll call system according to claim 3, wherein: During the process of performing the reverse roll call multiple times, if at least one reverse roll call is successful, the client is allowed to access the network.

5. The reverse roll call system according to claim 1 or 2, wherein: When distributing ports to the client according to a redirection request from the client, the roll-name port distribution module verifies the status of the roll-name protection function point of the client, and distributes ports to the client if the status of the roll-name protection function point is normal and supports roll-name protection.

6. A reverse roll call method, for performing reverse roll call on a client from a server when the client accesses a network, the reverse roll call method comprising: The roll call port distribution step is used to distribute ports to the client according to the redirection request from the client, and after receiving the roll call service initiated by the client, verify according to the received user ID and password, and send the roll call request when the verification is successful; A roll call request distribution interface step, sending the roll call request received in the roll call port distribution step by controlling the roll call request interface; as well as a roll call verification analysis step, performing the reverse roll call for verifying the identity of the client on the client using the distributed port and the characteristic information of the client according to the roll call request received in the roll call request distribution interface step; Wherein, the reverse roll call method further includes: When the reverse roll call verifies that the client is a legitimate user, allowing the client to access the network; When the reverse roll call verification verifies that the client is not a legitimate user, the client is not allowed to access the network.

7. The reverse roll call method according to claim 6, further comprising: The blacklist processing step sets the client to the blacklist when the reverse roll call performed in the roll call verification and analysis step fails for multiple times, and makes the blacklisted client offline.

8. The reverse roll call method according to claim 6 or 7, wherein: In the roll call verification analysis step, when the reverse roll call is performed on the client, the reverse roll call is performed multiple times.

9. The reverse roll call method according to claim 8, wherein: When the reverse roll call is performed multiple times, the client is allowed to access the network as long as at least one reverse roll call is successful.

10. The reverse roll call method according to claim 6 or 7, wherein: In the roll-name port distribution step, when distributing ports to the client according to a redirection request from the client, the status of the roll-name protection function point of the client is verified, and when the status of the roll-name protection function point is normal and supports roll-name protection, the port is distributed to the client.

11. A computer-readable storage medium comprising computer-executable instructions, which, when executed by one or more processors, cause the one or more processors to perform the method according to any one of claims 6 to 10.

Images