Device access method, device, computer device, and storage medium

Abstract

The present application relates to a device access method, a network request access method, a device access device, a network request access device, a computer device, a computer-readable storage medium, and a computer program product, and relates to the field of information security technology. By receiving the hardware feature code of the target device requesting network access and security software information, a random key is generated. If it is determined based on the hardware feature code that the target device belongs to an organizational asset, a random number is generated, and then the control terminal encrypts the received random number according to the random key to obtain first encrypted data. The authentication server encrypts the locally generated random number with the received random key to obtain second encrypted data. If the second encrypted data is the same as the first encrypted data, the security score is determined based on the security software information and the hardware feature code, and the network access of the target device is controlled according to the security score. The use of this method can improve the reliability of controlling the access of external devices to the internal network of the enterprise.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a device access method, a network request access method, a device access apparatus, a network request access apparatus, a computer device, and a storage medium. Background Art

[0002] With the development of Internet technology, the Internet security situation is becoming increasingly severe. Enterprises have taken some preventive measures to prevent external devices from accessing the internal network.

[0003] Traditionally, external device access to the enterprise network has been controlled by determining whether the enterprise's internal terminal security software has been installed. However, terminal security software is often developed by third parties and easily obtained and installed by users outside the enterprise. This makes controlling external device access based on the installation of terminal security software unreliable.

[0004] Therefore, how to improve the reliability of controlling external devices accessing the enterprise's internal network is an issue that needs to be addressed urgently. Summary of the Invention

[0005] Based on this, it is necessary to provide a device access method, network request access method, device access device, network request access device, computer equipment, computer-readable storage medium and computer program product that can improve the reliability of controlling external devices accessing the enterprise's internal network in response to the above technical problems.

[0006] In a first aspect, the present application provides a device access method. The method comprises:

[0007] Receive device information sent by the control terminal, the device information including a random key, security software information, and a hardware feature code of a target device requesting network access;

[0008] If it is determined based on the hardware feature code that the target device belongs to an organizational asset, generating a random number and feeding the random number back to the control terminal;

[0009] Receiving first encrypted data sent by the control terminal; the first encrypted data is obtained by encrypting a random number fed back by the control terminal using the random key;

[0010] Encrypting the locally generated random number using the received random key to obtain second encrypted data;

[0011] If the second encrypted data is the same as the first encrypted data, a security score is determined based on the security software information and the hardware feature code, and network access of the target device is controlled according to the security score.

[0012] In one embodiment, if it is determined based on the hardware signature that the target device is an organizational asset, before generating the random number, the method further includes:

[0013] Access to a pre-built library of equipment assets;

[0014] The device asset library is queried based on the hardware feature code. If the hardware feature code is found in the device asset library, it is determined that the target device belongs to an organizational asset.

[0015] In one embodiment, feeding back the random number to the control terminal includes:

[0016] Obtain the server signature, and feed back the random number and the server signature to the control terminal to instruct the control terminal to verify the server signature, and if the verification is successful, instruct the control terminal to encrypt the random number according to the random key to obtain the first encrypted data.

[0017] In one embodiment, determining the security score based on the security software information and the hardware feature code includes:

[0018] determining an asset assessment score based on the hardware feature code;

[0019] Determining a security control software score based on whether the security protection software information includes security control software installation information;

[0020] If the security software information includes security control software installation information, determining a version compliance score based on the security control software version information in the security control software installation information;

[0021] determining an antivirus software score based on whether the security software information includes antivirus software installation information;

[0022] A security score is determined based on the asset assessment score, the security control software score, the version compliance score, and the antivirus software score.

[0023] In one embodiment, controlling the network access of the target device according to the security score includes:

[0024] If the security score is less than a first threshold, denying the target device access to the network;

[0025] If the security score is greater than or equal to the first threshold and less than the second threshold, the target device is allowed to access the network and an alarm message is sent to the control terminal; wherein the second threshold is greater than the first threshold;

[0026] If the security score is greater than or equal to the second threshold, the target device is allowed to access the network.

[0027] In a second aspect, the present application further provides a device access apparatus. The apparatus comprises:

[0028] A first receiving module is configured to receive device information sent by a control terminal, wherein the device information includes a random key, security software information, and a hardware feature code of a target device requesting to access the network;

[0029] a feedback module, configured to generate a random number and feed back the random number to the control terminal if it is determined based on the hardware feature code that the target device belongs to an organizational asset;

[0030] The first receiving module is further configured to receive first encrypted data sent by the control terminal; the first encrypted data is obtained by encrypting a random number fed back by the control terminal using the random key;

[0031] A first encryption module is used to encrypt a locally generated random number using a received random key to obtain second encrypted data;

[0032] A control module is configured to determine a security score based on the security software information and the hardware feature code if the second encrypted data is the same as the first encrypted data, and control network access of the target device according to the security score.

[0033] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are performed:

[0034] Receive device information sent by the control terminal, the device information including a random key, security software information, and a hardware feature code of a target device requesting network access;

[0035] If it is determined based on the hardware feature code that the target device belongs to an organizational asset, generating a random number and feeding the random number back to the control terminal;

[0036] Receiving first encrypted data sent by the control terminal; the first encrypted data is obtained by encrypting a random number fed back by the control terminal using the random key;

[0037] Encrypting the locally generated random number using the received random key to obtain second encrypted data;

[0038] If the second encrypted data is the same as the first encrypted data, a security score is determined based on the security software information and the hardware feature code, and network access of the target device is controlled according to the security score.

[0039] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the following steps:

[0040] Receive device information sent by the control terminal, the device information including a random key, security software information, and a hardware feature code of a target device requesting network access;

[0041] If it is determined based on the hardware feature code that the target device belongs to an organizational asset, generating a random number and feeding the random number back to the control terminal;

[0042] Receiving first encrypted data sent by the control terminal; the first encrypted data is obtained by encrypting a random number fed back by the control terminal using the random key;

[0043] Encrypting the locally generated random number using the received random key to obtain second encrypted data;

[0044] If the second encrypted data is the same as the first encrypted data, a security score is determined based on the security software information and the hardware feature code, and network access of the target device is controlled according to the security score.

[0045] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the following steps:

[0046] Receive device information sent by the control terminal, the device information including a random key, security software information, and a hardware feature code of a target device requesting network access;

[0047] If it is determined based on the hardware feature code that the target device belongs to an organizational asset, generating a random number and feeding the random number back to the control terminal;

[0048] Receiving first encrypted data sent by the control terminal; the first encrypted data is obtained by encrypting a random number fed back by the control terminal using the random key;

[0049] Encrypting the locally generated random number using the received random key to obtain second encrypted data;

[0050] If the second encrypted data is the same as the first encrypted data, a security score is determined based on the security software information and the hardware feature code, and network access of the target device is controlled according to the security score.

[0051] The above-mentioned device access method, device access apparatus, computer device, computer-readable storage medium, and computer program product receive a random key, a hardware feature code of the target device, and security software information sent by a requesting control terminal. If the target device is determined to be an organizational asset based on the hardware feature code, a random number is generated. The receiving control terminal then encrypts the received random number using the random key to obtain first encrypted data, and encrypts the locally generated random number using the received random key to obtain second encrypted data. If the second encrypted data is the same as the first encrypted data, it is determined that the control terminal has completed authentication. A security score is then determined based on the security software information and hardware feature code, and the network access of the target device is controlled based on the security score. In this way, the risk of non-organizational assets accessing the organization's internal network can be reduced, the legitimacy of the organization's assets can be ensured, and the security risk of data packets being stolen and counterfeited can be reduced, thereby improving the reliability of controlling external device access to the enterprise's internal network.

[0052] In a sixth aspect, the present application further provides a network access request method, the method comprising:

[0053] Receive a hardware signature code of a target device requesting network access and security software information of the target device, and generate a random key;

[0054] Sending the hardware feature code, the security software information, and the random key to an authentication server to instruct the authentication server to determine whether the target device is an organizational asset based on the hardware feature code;

[0055] If yes, then receive the random number fed back by the authentication server;

[0056] encrypting the received random number using the random key to obtain first encrypted data, and sending the first encrypted data to the authentication server to instruct the authentication server to verify the first encrypted data, and instructing the authentication server to determine a security score based on the security software information and the hardware feature code if the verification passes;

[0057] An authentication result from the authentication server is received, where the authentication result is determined based on the security score, and the authentication result indicates whether network access is allowed or denied.

[0058] In one embodiment, the receiving of the hardware feature code of the target device requesting to access the network and the security software information of the target device includes:

[0059] receiving an access request initiated by a target device requesting to access the network;

[0060] generating an authentication start data packet according to the access request, and sending the authentication start data packet to the network switch;

[0061] If an authentication request data packet fed back by the network switch in response to the authentication start data packet is received, the hardware feature code and security software information are obtained from the target device.

[0062] In a seventh aspect, the present application further provides a network access request device. The device includes:

[0063] A second receiving module is used to receive a hardware feature code of a target device requesting to access the network and security software information of the target device, and generate a random key;

[0064] a sending module, configured to send the hardware feature code, the security software information, and the random key to an authentication server, so as to instruct the authentication server to determine whether the target device is an organizational asset based on the hardware feature code;

[0065] The second receiving module is further configured to receive a random number fed back by the authentication server if the authentication server is true;

[0066] a second encryption module, configured to encrypt a received random number using the random key to obtain first encrypted data, and send the first encrypted data to an authentication server to instruct the authentication server to verify the first encrypted data, and instruct the authentication server to determine a security score based on the security software information and the hardware feature code if the verification passes;

[0067] The second receiving module is further configured to receive an authentication result from the authentication server, where the authentication result is determined based on the security score, and the authentication result indicates whether network access is allowed or denied.

[0068] In an eighth aspect, the present application further provides a computer device. The computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0069] Receive a hardware signature code of a target device requesting network access and security software information of the target device, and generate a random key;

[0070] Sending the hardware feature code, the security software information, and the random key to an authentication server to instruct the authentication server to determine whether the target device is an organizational asset based on the hardware feature code;

[0071] If yes, then receive the random number fed back by the authentication server;

[0072] encrypting the received random number using the random key to obtain first encrypted data, and sending the first encrypted data to the authentication server to instruct the authentication server to verify the first encrypted data, and instructing the authentication server to determine a security score based on the security software information and the hardware feature code if the verification passes;

[0073] An authentication result from the authentication server is received, where the authentication result is determined based on the security score, and the authentication result indicates whether network access is allowed or denied.

[0074] In a ninth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the following steps:

[0075] Receive a hardware signature code of a target device requesting network access and security software information of the target device, and generate a random key;

[0076] Sending the hardware feature code, the security software information, and the random key to an authentication server to instruct the authentication server to determine whether the target device is an organizational asset based on the hardware feature code;

[0077] If yes, then receive the random number fed back by the authentication server;

[0078] encrypting the received random number using the random key to obtain first encrypted data, and sending the first encrypted data to the authentication server to instruct the authentication server to verify the first encrypted data, and instructing the authentication server to determine a security score based on the security software information and the hardware feature code if the verification passes;

[0079] An authentication result from the authentication server is received, where the authentication result is determined based on the security score, and the authentication result indicates whether network access is allowed or denied.

[0080] In a tenth aspect, the present application further provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the following steps:

[0081] Receive a hardware signature code of a target device requesting network access and security software information of the target device, and generate a random key;

[0082] Sending the hardware feature code, the security software information, and the random key to an authentication server to instruct the authentication server to determine whether the target device is an organizational asset based on the hardware feature code;

[0083] If yes, then receive the random number fed back by the authentication server;

[0084] encrypting the received random number using the random key to obtain first encrypted data, and sending the first encrypted data to the authentication server to instruct the authentication server to verify the first encrypted data, and instructing the authentication server to determine a security score based on the security software information and the hardware feature code if the verification passes;

[0085] An authentication result from the authentication server is received, where the authentication result is determined based on the security score, and the authentication result indicates whether network access is allowed or denied.

[0086] The above-mentioned network access request method, network access request device, computer device, computer-readable storage medium, and computer program product generate a random key by receiving the hardware feature code and security software information of the target device requesting network access, and then send the hardware feature code, security software information, and random key to the authentication server to instruct the authentication server to determine whether the target device is an organizational asset based on the hardware feature code. If so, the authentication server receives a random number fed back by the authentication server and encrypts the received random number using the random key to obtain first encrypted data. The first encrypted data is then sent to the authentication server to instruct the authentication server to verify the first encrypted data. If the verification passes, the authentication server is instructed to determine a security score based on the security software information and hardware feature code. Finally, the authentication server receives an authentication result determined based on the security score and, based on the authentication result, allows the target device to access the network or denies the target device access to the network. In this way, the risk of non-organizational assets accessing the organization's internal network can be reduced, the legitimacy of the organization's assets can be ensured, and the security risk of data packets being stolen and counterfeited can be reduced, thereby improving the reliability of controlling external device access to the enterprise's internal network. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] Figure 1 This is an application environment diagram of a device access method and a network request access method in one embodiment;

[0088] Figure 2 1 is a flow chart of a device access method in one embodiment;

[0089] Figure 3 A schematic diagram of a process for determining a security score in one embodiment;

[0090] Figure 4Schematic diagram of a flow chart of a network access request method in one embodiment;

[0091] Figure 5 A data flow diagram of a device access method and a network request access method in another embodiment;

[0092] Figure 6 This is a structural block diagram of a device access apparatus in one embodiment;

[0093] Figure 7 A structural block diagram of a network request access device in one embodiment;

[0094] Figure 8 This is a diagram of the internal structure of a server in one embodiment;

[0095] Figure 9 FIG. 4 is a diagram showing the internal structure of a terminal in an embodiment. DETAILED DESCRIPTION

[0096] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0097] It should be noted that the terms "comprises," "includes," "having," and any variations thereof, as used herein, are intended to cover non-exclusive inclusions. For example, a process, method, product, or apparatus that includes a series of steps or devices is not necessarily limited to the steps explicitly listed, but may also include other steps or devices that are not explicitly listed or that are inherent to the process, method, product, or apparatus. The term "and / or" as used herein includes any and all combinations of one or more of the relevant listed items.

[0098] Furthermore, the terms "first," "second," and so forth, used in this application are used to distinguish similar objects in terms of naming, but these objects themselves are not limited by these terms. It should be understood that these terms are interchangeable where appropriate without departing from the scope of this application. For example, "first encrypted data" could be described as "second encrypted data," and similarly, "second encrypted data" could be described as "first encrypted data."

[0099] The device access method and network request access method provided in the embodiments of the present application can be applied to Figure 1In the application environment shown, the control terminal 102 communicates with the network switch 104 via the network, and the network switch 104 communicates with the authentication server 106 via the network. The data storage system can store data that the authentication server 106 needs to process. The data storage system can be integrated with the authentication server 106, or it can be placed on the cloud or other network servers. The control terminal 102 has a terminal security control software agent installed. When a target device attempts to access the organization's internal network, the control terminal 102 receives the target device's network access request through the installed terminal security control software agent and initiates an authentication start packet to the network switch 104. After receiving the authentication start packet, the network switch 104 sends an authentication request packet to the control terminal 102. After receiving the authentication request packet sent by the network switch 104, the control terminal 102 receives the target device's hardware feature code and security software information through the installed terminal security control software agent, generates a random key, and then sends the hardware feature code, security software information, and random key to the authentication server 106 via the network switch 104. After receiving the device information from the control terminal 102, the authentication server 106 determines whether the target device is an organizational asset based on the hardware signature. If the authentication server 106 determines that the target device is an organizational asset based on the hardware signature, it generates a random number and transmits the random number back to the control terminal 102 via the network switch 104. After receiving the random number from the authentication server 106, the control terminal encrypts the received random number using a random key to generate first encrypted data, and then transmits the first encrypted data to the authentication server 106 via the network switch 104. After receiving the first encrypted data from the control terminal 102, the authentication server 106 encrypts the locally generated random number using the received random key to generate second encrypted data. If the second encrypted data matches the first encrypted data, the authentication server 106 determines a security score based on the security software information and the hardware signature. Based on the security score, it transmits an authentication result to the control terminal 102 via the network switch 104. The control terminal 102 then controls the network access of the target device based on the authentication result. The control terminal 102 may be, but is not limited to, various personal computers, laptops, smartphones, tablets, etc. The authentication server 106 may be implemented as an independent server or a server cluster consisting of multiple servers. It should be noted that the authentication server 106 may be a RADIUS server (Remote Authentication Dial In User Service, a type of authentication server).

[0100] In one embodiment, Figure 2 As shown, a device method is provided, which is applied to Figure 1 The following steps are used as an example to illustrate the authentication server in the example:

[0101] Step 202: Receive device information sent by the control terminal, where the device information includes a random key, security software information, and a hardware feature code of the target device requesting to access the network.

[0102] Among them, the random key is a randomly generated tool for encryption and decryption; security software information includes terminal security software information and antivirus software information; the target device is the device attempting to access the organization's internal network; the hardware feature code is a serial number generated according to a certain algorithm based on the hardware characteristics of the device. The hardware feature code is unique and cannot be forged. The device can be verified based on the hardware feature code.

[0103] Specifically, the control terminal receives the hardware feature code and security software information of the target device attempting to access the organization's internal network through the installed terminal security control software agent, generates a random key, and then sends the target device's hardware feature code, the target device's security software information, and the random key to the authentication server via a network switch. The authentication server receives the target device's hardware feature code, the target device's security software information, and the random key sent by the control terminal. It should be noted that the control terminal can communicate with the authentication server directly through the network or through information forwarding by the network switch, and this embodiment of the application is not limited to this.

[0104] Step 204: If it is determined based on the hardware feature code that the target device belongs to an organizational asset, a random number is generated and fed back to the control terminal.

[0105] Organizational assets are assets that belong to an organization, specifically, assets within an enterprise. Random numbers are strings of numbers generated by the authentication server.

[0106] Specifically, after receiving the target device's hardware signature, security software information, and random key from the control terminal, the authentication server searches a pre-established device asset database based on the target device's hardware signature to determine whether the target device is an organizational asset. If the target device's hardware signature is found in the pre-established device asset database, the target device is determined to be an organizational asset. The authentication server then generates a random number and transmits it back to the control terminal via the network switch.

[0107] It's important to note that the device asset library is a database built based on the device assets owned by an organization. It contains all the device assets belonging to the organization. When an organization's device assets arrive, they are first registered through scanning or manual verification. The device's hardware signature code serves as its unique identifier and is then used to establish the device asset library.

[0108] In one embodiment, after obtaining the relevant information of the device owned by the organization through scanning or manual input, the hardware feature code of the device owned by the organization can be calculated by a hash algorithm, and the hash value of the hardware feature code of the device owned by the organization can be stored in the device asset library. Therefore, after the control terminal receives the hardware feature code of the target device attempting to access the internal network of the organization and the security software information through the installed terminal security control software agent, the hardware feature code of the target device can be calculated by a hash algorithm to obtain the hash value of the hardware feature code of the target device. The hash value of the hardware feature code of the target device is then sent to the authentication server. After the authentication server receives the hash value of the hardware feature code of the target device, it queries the pre-established device asset library based on the hash value of the hardware feature code of the target device to determine whether the target device belongs to the organization's assets.

[0109] Step 206: Receive first encrypted data sent by the control terminal; the first encrypted data is obtained by encrypting the random number fed back by the control terminal using a random key.

[0110] Specifically, after the authentication server feeds the random number back to the control terminal via the network switch, the control terminal encrypts the random number fed back by the authentication server using the random key to obtain first encrypted data. The control terminal then sends the first encrypted data to the authentication server via the network switch, and the authentication server receives the first encrypted data sent by the control terminal.

[0111] Step 208: Encrypt the locally generated random number using the received random key to obtain second encrypted data.

[0112] The second encrypted data is encrypted data obtained by encrypting a locally generated random number using a received random key by the authentication server.

[0113] Specifically, after receiving the first encrypted data sent by the control terminal, the authentication server encrypts the locally generated random number using the received random key to obtain the second encrypted data.

[0114] Step 210: If the second encrypted data is the same as the first encrypted data, a security score is determined based on the security software information and the hardware feature code, and network access of the target device is controlled according to the security score.

[0115] Among them, the security score is a score determined based on security software information, hardware feature codes and the corresponding scoring mechanism. The security score is used to control whether the target device can access the organization's internal network.

[0116] Specifically, the authentication server encrypts a locally generated random number using the received random key to generate a second encrypted value. The server then compares the second encrypted value with the received first encrypted value to verify the identity of the second encrypted value. If the second encrypted value is identical to the first encrypted value, the server determines the target device's security score based on the security software information, hardware signature, and a corresponding scoring mechanism. This score is then used to control whether the target device can access the organization's internal network.

[0117] In the above-mentioned device access method, the authentication server receives the device information sent by the control terminal and determines whether the target device is an organizational asset based on the hardware feature code of the target device in the device information. If so, a random number is generated and fed back to the control terminal. The authentication server then receives the first encrypted data sent by the control terminal and encrypts the locally generated random number using the received random key to obtain the second encrypted data. The first encrypted data and the second encrypted data are verified. If the second encrypted data is the same as the first encrypted data, the security score is determined based on the security software information and the hardware feature code. Finally, the network access of the target device is controlled based on the security score. In this way, the risk of non-organizational assets accessing the internal network of the organization can be reduced, the legitimacy of the organizational assets can be ensured, and at the same time, the security risk of data packets being stolen and counterfeited can be reduced, thereby improving the reliability of controlling external device access to the enterprise internal network.

[0118] In one embodiment, if the target device is determined to be an organizational asset based on the hardware feature code, before generating the random number, it also includes: obtaining a pre-established device asset library; querying the device asset library based on the hardware feature code, and if the hardware feature code is found in the device asset library, determining that the target device is an organizational asset.

[0119] Specifically, after receiving the target device's hardware signature, security software information, and random key from the control terminal, the authentication server retrieves a pre-established device asset library and then searches the library based on the target device's hardware signature to determine whether the target device is an organizational asset. If the target device's hardware signature is found in the library, the target device is determined to be an organizational asset. After determining that the target device is an organizational asset, the authentication server generates a random number.

[0120] In this embodiment, a pre-established device asset library is retrieved and queried based on the hardware signature. If the hardware signature is found in the library, the target device is determined to be an organizational asset. This query based on the device's hardware signature ensures that the device attempting to access the organization's internal network is owned by the organization, thereby improving the reliability of controlling external device access to the enterprise's internal network.

[0121] In one embodiment, feeding back the random number to the control terminal includes: obtaining a server signature, and feeding back the random number and the server signature to the control terminal to instruct the control terminal to verify the server signature, and if the verification passes, instructing the control terminal to encrypt the random number according to the random key to obtain the first encrypted data.

[0122] The server signature is information indicating the server's identity.

[0123] Specifically, after the authentication server generates a random number, it obtains a server signature and then feeds the random number and server signature back to the control terminal via the network switch. After receiving the random number and server signature from the authentication server, the control terminal verifies the server signature. If the verified signature is the server signature information, the control terminal encrypts the received random number using the random key to obtain the first encrypted data.

[0124] In one embodiment, the control terminal obtains the device signature information and the hardware feature code of the target device and generates a random key. The device signature information includes the user identification and the security software information of the target device. After the authentication server receives the device signature information, hardware feature code and random key of the target device sent by the control terminal, it determines that the target device belongs to the organizational asset based on the hardware feature code of the target device. Then, a random number is generated and the device signature information is modified to the server signature information. The modified information is then encrypted with MD5 (Message-Digest 5, a message digest algorithm) using the public key information configured by the console and sent to the network switch via an authentication challenge data packet. If it does not belong to the organizational asset, a rejection authentication data packet is sent to the network switch. The network switch forwards the authentication challenge data packet or the rejection authentication data packet to the control terminal.

[0125] In this embodiment, the server signature is obtained and the random number and server signature are fed back to the control terminal, instructing the control terminal to verify the server signature. If the verification is successful, the control terminal is instructed to encrypt the random number using the random key to obtain the first encrypted data. In this way, the control terminal's verification of the server signature enables mutual authentication between the authentication server and the control terminal, thereby reducing the risk of data packets being stolen and counterfeited, and improving the reliability of controlling external devices accessing the enterprise's internal network.

[0126] In one embodiment, Figure 3 As shown, the security score is determined based on security software information and hardware signatures, including:

[0127] Step 302: Determine an asset evaluation score based on the hardware feature code.

[0128] Specifically, the authentication server queries a pre-established device asset library based on the hardware signature to determine whether the target device is an organizational asset. If the target device is an organizational asset, the asset assessment score is determined to be a first value (e.g., 100 points). If the target device is not an organizational asset, the asset assessment score is determined to be a second value (e.g., 0 points). The first and second values ​​can be any different pre-set values.

[0129] Step 304: Determine the security control software score based on whether the security protection software information includes security control software installation information.

[0130] Among them, the security control software installation information represents whether the target device has terminal security control software installed.

[0131] Specifically, the authentication server verifies the security software information to determine whether the target device has the terminal security software installed. If the target device has the terminal security software installed, the security software score is determined to be a third value (e.g., 100 points). If the target device does not have the terminal security software installed, the security software score is determined to be a fourth value (e.g., 0 points). The third and fourth values ​​can be any different pre-set values.

[0132] Step 306: If the security software information includes security control software installation information, determine the version compliance score based on the security control software version information in the security control software installation information.

[0133] Among them, the security control software version information represents the version of the terminal security control software installed on the target device.

[0134] Specifically, when the authentication server verifies that the target device has terminal security control software installed, it further verifies the security control software version information to determine whether the version of the terminal security control software installed on the target device is lower than the preset baseline version. If the version of the terminal security control software installed on the target device is not lower than the preset baseline version, the version compliance score is determined to be a fifth value (e.g., 100 points). If the version of the terminal security control software installed on the target device is lower than the preset baseline version, the version compliance score is determined to be a sixth value (e.g., 0 points). The fifth value and the sixth value can be any different preset values.

[0135] Step 308: Determine the antivirus software score based on whether the security software information includes antivirus software installation information.

[0136] The anti-virus software installation information indicates whether the target device has anti-virus software installed.

[0137] Specifically, the authentication server verifies the security software information and also determines whether the target device has antivirus software installed. If the target device has antivirus software installed, the antivirus software score is determined to be a seventh value (e.g., 100 points). If the target device does not have antivirus software installed, the antivirus software score is determined to be an eighth value (e.g., 0 points). The seventh and eighth values ​​can be any different pre-set values.

[0138] Step 310: Determine the security score based on the asset assessment score, the security control software score, the version compliance score, and the antivirus software score.

[0139] Specifically, after the authentication server determines the asset evaluation score, security control software score, version compliance score, and antivirus software score according to the above steps, it performs a weighted sum of the asset evaluation score, security control software score, version compliance score, and antivirus software score according to their corresponding weights to obtain a security score. In one embodiment, the weight of the asset evaluation score can be 100%, the weight of the security control software score can be 100%, the weight of the version compliance score can be 50%, and the weight of the antivirus software score can be 100%. The security score can then be obtained by formula (1):

[0140] Security score = asset assessment score * 100% + security control software score * 100% + version compliance score * 50% + antivirus software score * 100% (1)

[0141] In this embodiment, an asset assessment score is determined based on the hardware signature. A security control software score is determined based on whether the security software information includes security control software installation information. If the security software information includes security control software installation information, a version compliance score is determined based on the security control software version information in the security control software installation information. An antivirus software score is determined based on whether the security software information includes antivirus software installation information. A security score is determined based on the asset assessment score, the security control software score, the version compliance score, and the antivirus software score. In this way, a security score can be determined based on the asset assessment score, the security control software score, the version compliance score, and the antivirus software score. The security score can then be used to control the target device's network access, thereby improving the reliability of controlling external device access to the enterprise's internal network.

[0142] In one embodiment, the network access of the target device is controlled according to the security score, including: if the security score is less than a first threshold, denying the target device access to the network; if the security score is greater than or equal to the first threshold and less than a second threshold, allowing the target device to access the network and sending an alarm message to the control terminal; wherein the second threshold is greater than the first threshold; if the security score is greater than or equal to the second threshold, allowing the target device to access the network.

[0143] Specifically, after the authentication server determines the security score, it compares the security score with a pre-set security score threshold, determines the authentication result of the target device through the comparison result of the security score and the security score threshold, and then controls the authentication result of the target device access according to the authentication result of the target device. It should be noted that the security score threshold is divided into a first threshold and a second threshold, the second threshold is greater than the first threshold, and the first threshold and the second threshold need to be determined by comprehensively considering the asset assessment score, the security control software score, the version compliance score, the antivirus software score and their respective corresponding weights and the total security score. If the security score is less than the first threshold, the target device is denied access to the network; if the security score is greater than or equal to the first threshold and less than the second threshold, the target device is allowed to access the network and an alarm message is sent to the control terminal; if the security score is greater than or equal to the second threshold, the target device is allowed to access the network.

[0144] In one embodiment, the first value of the asset assessment score can be set to 100 points, the second value to 0 points, and the weight to 100%; the third value of the security software score can be set to 100 points, the fourth value to 0 points, and the weight to 100%; the fifth value of the version compliance score can be set to 100 points, the sixth value to 0 points, and the weight to 50%; the seventh value of the antivirus software score can be set to 100 points, the eighth value to 0 points, and the weight to 100%, and the total security score can be 350 points. Considering that the organization's requirements for devices to access the organization's internal network are that they must be organizational assets and that terminal security software and antivirus software must be installed, and at the same time, to ensure the security of the terminal security software itself, it is necessary to ensure that the terminal security software version is not lower than the baseline version. Based on this, the first threshold can be set to 300 points and the second threshold to 350 points. Then according to the above rules:

[0145] When the authentication server verifies that the target device belongs to the organizational asset and has installed terminal security control software and antivirus software, and the version of the terminal security control software is not lower than the preset baseline version, it can be determined that the asset assessment score is 100 points, the security control software score is 100 points, the version compliance score is 100 points, and the antivirus software score is 100 points. At this time, according to formula (1), it can be determined that the security score is 350 points, the security score is equal to the second threshold, and the target device is allowed to access the network.

[0146] When the authentication server verifies that the target device belongs to the organizational asset and has installed terminal security control software and antivirus software, but the version of the terminal security control software is lower than the preset baseline version, it can be determined that the asset assessment score is 100 points, the security control software score is 100 points, the version compliance score is 0 points, and the antivirus software score is 100 points. At this time, according to formula (1), it can be determined that the security score is 300 points, and the security score is equal to the first threshold. The target device is allowed to access the network, but an alarm message needs to be sent to the control terminal.

[0147] When the authentication server verifies that the target device does not belong to the organizational assets, or does not install the terminal security control software, or does not install the antivirus software, it can be determined that the asset assessment score is 0, or the security control software score is 0, or the antivirus software score is 0. At this time, according to formula (1), it can be determined that the maximum security score is 250 points, which is less than the first threshold, and the target device is denied access to the network.

[0148] In this embodiment, if the security score is less than a first threshold, the target device is denied network access. If the security score is greater than or equal to the first threshold and less than a second threshold, the target device is allowed network access and an alarm is sent to the control terminal. The second threshold is greater than the first threshold. If the security score is greater than or equal to the second threshold, the target device is allowed network access. In this way, the target device's authentication result can be determined based on the security score, the first threshold, and the second threshold. Furthermore, the target device's network access status can be determined based on the target device's authentication result, thereby improving the reliability of controlling external device access to the enterprise's internal network.

[0149] In one embodiment, Figure 4 As shown, the present application also provides a network request access method, which is applied to Figure 1 The control terminal shown in the figure is used as an example to illustrate the following steps:

[0150] Step 402: Receive the hardware signature code of the target device requesting to access the network and the security software information of the target device, and generate a random key.

[0151] Specifically, when a target device attempts to access the organization's internal network, the control terminal receives the target device's hardware feature code and the target device's security software information through the installed terminal security control software agent, and generates a random key.

[0152] In one embodiment, receiving a hardware feature code of a target device requesting to access a network and security software information of the target device includes: receiving an access request initiated by the target device requesting to access the network; generating an authentication start data packet based on the access request, and sending the authentication start data packet to a network switch; if an authentication request data packet is received that is fed back by the network switch in response to the authentication start data packet, obtaining the hardware feature code and security software information from the target device.

[0153] The authentication start data packet refers to a data packet that starts verifying the target device, and the authentication request data packet refers to a data packet that authenticates the target device that requests access.

[0154] Specifically, when a target device attempts to access the organization's internal network, the control terminal receives the target device's network access request through the installed terminal security control software agent. It then sends an authentication start packet to the network switch. Upon receiving the authentication start packet, the network switch sends an authentication request packet to the control terminal. After receiving the authentication request packet from the network switch, the control terminal receives the target device's hardware signature code and security software information through the installed terminal security control software agent.

[0155] In this embodiment, an access request is received from a target device seeking network access, and an authentication start packet is generated based on the access request. This authentication start packet is then sent to a network switch. Upon receiving an authentication request packet in response to the authentication start packet, the network switch retrieves the hardware signature and security software information from the target device. This allows the hardware signature and security software information of the target device attempting to access the organization's internal network to be obtained, providing a basis for determining whether the device is an organizational asset. Furthermore, a security score is determined based on the security software information and hardware signature, improving the reliability of controlling external device access to the enterprise's internal network.

[0156] Step 404: Send the hardware signature code, security software information, and random key to the authentication server to instruct the authentication server to determine whether the target device is an organizational asset based on the hardware signature code.

[0157] Specifically, the control terminal receives the target device's hardware signature code and security software information, generates a random key, and then sends the hardware signature code, security software information, and random key to the authentication server. After receiving the target device's hardware signature code, security software information, and random key from the control terminal, the authentication server searches a pre-established device asset database based on the target device's hardware signature code to determine whether the target device is an organizational asset.

[0158] Step 406: If yes, receive the random number fed back by the authentication server.

[0159] Specifically, the authentication server searches a pre-established device asset database for the target device's hardware signature. After confirming that the target device is an organizational asset, it generates a random number as a challenge and sends it back to the control terminal via a network switch. The control terminal receives the random number from the authentication server.

[0160] Step 408: Encrypt the received random number according to the random key to obtain first encrypted data, and send the first encrypted data to the authentication server to instruct the authentication server to verify the first encrypted data. If the verification is successful, instruct the authentication server to determine the security score based on the security software information and the hardware feature code.

[0161] Specifically, after receiving the random number from the authentication server, the control terminal encrypts it using the random key to generate first encrypted data. The first encrypted data is then sent to the authentication server via the network switch. After receiving the first encrypted data from the control terminal, the authentication server encrypts the locally generated random number using the random key to generate second encrypted data. The authentication server then compares the second encrypted data with the first encrypted data to verify whether it is identical. If the second encrypted data is identical to the first encrypted data, the authentication succeeds. The authentication server then determines the target device's security score based on the security software information, hardware signature, and a corresponding scoring mechanism.

[0162] Step 410: Receive an authentication result from the authentication server. The authentication result is determined based on the security score, and the authentication result indicates whether network access is allowed or denied.

[0163] Specifically, after determining the target device's security score, the authentication server determines the target device's authentication result based on the security score. This result is then sent to the control terminal via the network switch. After receiving the authentication result from the authentication server, the control terminal controls whether the target device can access the organization's internal network based on the authentication result.

[0164] In the above-mentioned network access request method, the control terminal receives the hardware feature code of the target device requesting network access and the security software information of the target device, generates a random key, and then sends the hardware feature code, security software information, and random key to the authentication server, instructing the authentication server to determine whether the target device is an organizational asset based on the hardware feature code. If the authentication server verifies that the target device is an organizational asset, it receives a random number fed back by the authentication server and encrypts the received random number using the random key to obtain first encrypted data. The first encrypted data is then sent to the authentication server, instructing the authentication server to verify the first encrypted data. If the verification is successful, the authentication server is instructed to determine a security score based on the security software information and the hardware feature code. Finally, the authentication result is received from the authentication server. The authentication result is determined based on the security score and indicates whether access to the network is allowed or denied. In this way, the risk of non-organizational assets accessing the organization's internal network can be reduced, the legitimacy of the organization's assets can be ensured, and the security risk of data packets being stolen and counterfeited can be reduced, thereby improving the reliability of controlling external device access to the enterprise's internal network.

[0165] Reference below Figure 5 , and then use a specific embodiment to explain in detail the device access method and network request access method of the present application:

[0166] It should be noted that, in this embodiment, the authentication server takes a RADIUS server as an example.

[0167] When a target device attempts to access the organization's internal network, the control terminal receives the target device's network access request through the installed terminal security control software agent. The control terminal then sends an Extensible Authentication Protocol Over LAN (EAPOL-Start) packet to the network switch. Upon receiving the EAPOL-Start packet, the network switch sends an EAPRequest / Identity packet to the control terminal. After receiving the EAPRequest packet from the network switch, the control terminal uses the installed terminal security control software agent to obtain the target device's device signature and hardware signature code. The device signature includes the user ID and the target device's security software information. The control terminal then performs a hash operation on the target device's hardware signature code to obtain a hash value and generates a random key. The control terminal then sends the target device's device signature, the hash value of the target device's hardware signature code, and the random key to the network switch in the form of an EAP-Response / Identity packet. The network switch encapsulates the EAPResponse packet sent by the control terminal and sends it to the RADIUS server.

[0168] After receiving the authentication response packet, the RADIUS server searches the pre-established device asset database based on the hash value of the target device's hardware signature code to determine whether the target device is an organizational asset.

[0169] It should be noted that the device asset library is a database established based on the device assets owned by the organization. After the organization's device assets enter the site, the device-related information (including device name, device type, hardware feature code, etc.) is first registered by scanning or manually, and the hardware feature code of the device is used as the unique identifier of the device to establish a device asset library. In one embodiment, the RADIUS server is also connected to the cache system through a network. The cache system is connected to the device asset library through the terminal security software server. The terminal security software server regularly reads the device asset information from the device asset library, parses it, and stores it in the cache system to establish a complete organization device asset library. The RADIUS server can then query the hardware feature code of the target device in the cache system to determine whether the target device belongs to the organization's assets.

[0170] If the RADIUS server finds the target device's hardware signature in the device asset database and determines that the target device is an organizational asset, it generates a random number and modifies the device's signature to the server's signature. It then uses the public key configured on the console to encrypt the modified signature using MD5 encryption and sends it to the network switch via an authentication challenge packet (RADIUS Access-Challenge). If the target device is not an organizational asset, it sends a RADIUS Access-Reject packet to the network switch. The network switch forwards the authentication challenge or authentication rejection packet to the control terminal.

[0171] If the control terminal receives an authentication challenge packet (EAP Request / MD5 Challenge message), it verifies that the signature is the server signature. If the verification is successful, it uses the generated random key to perform MD5 encryption on the random number sent by the RADIUS server, generates encrypted data, and responds through an authentication response packet (EAP Response / MD5 Challenge message). The authentication response packet is forwarded by the network switch to the RADIUS server.

[0172] After receiving the authentication response packet from the control terminal, the RADIUS server parses the packet signature. If the packet is from the control terminal, it encrypts the locally generated random number using the cached random key. It then verifies that the encrypted packet is identical to the packet sent by the control terminal. Based on the security score, it then sends either a passing or a rejection packet to the control terminal.

[0173] Considering that organizations require devices to be connected to their internal networks, they must be considered organizational assets and must have terminal security and antivirus software installed. Furthermore, to ensure the security of the terminal security software itself, the terminal security software version must be at least the baseline version. Therefore, four scoring items are set, and the security score calculation rules are designed as follows:

[0174] Security score = asset assessment score * 100% + security control software score * 100% + version compliance score * 50% + antivirus software score * 100% (1)

[0175] Each item will be scored 100 points if it meets the requirements, and 0 points if it does not meet the requirements.

[0176] Then, the security score is evaluated according to the security score calculation rules, which are divided into the following three scenarios:

[0177] If the security score is 350 (i.e., the device is an organizational asset, has terminal security and antivirus software installed, and the terminal security software version is no lower than the baseline version), the device is allowed to enter the organization's internal network and sends an authentication packet (RADIUS Access-Accept message) to the network switch.

[0178] If the security score is 300 (i.e., the device is an organizational asset, has terminal security and antivirus software installed, but the terminal security software version is lower than the baseline version), the user is warned but allowed to enter the organization's internal network, and an authentication packet (RADIUS Access-Accept message) is sent to the network switch.

[0179] When the security score is less than 300 points (i.e., it is not an organizational asset, or the terminal security control software or antivirus software is not installed), it is moved to the isolation and repair area and is temporarily not allowed to enter the organization's internal network. A rejection authentication data packet (RADIUS Access-Reject message) is sent to the network switch.

[0180] If the control terminal receives an authentication packet (EAP-Success message), the device can enter the organization's internal network; if it receives an authentication rejection packet (RADIUS Access-Reject message), the device cannot enter the organization's internal network.

[0181] The above-mentioned device access method and network request access method receive the hardware feature code and security software information of the target device requesting network access through the control terminal, generate a random key, and the authentication server determines whether the target device is an organizational asset based on the hardware feature code. If so, it generates a random number, and then the control terminal encrypts the received random number according to the random key to obtain the first encrypted data. The authentication server encrypts the locally generated random number with the received random key to obtain the second encrypted data. If the second encrypted data is the same as the first encrypted data, the authentication server determines the security score based on the security software information and hardware feature code, and controls the network access of the target device according to the security score. In this way, the risk of non-organizational assets accessing the internal network of the organization can be reduced, the legitimacy of the organizational assets can be ensured, and at the same time, the security risk of data packets being stolen and counterfeited can be reduced, thereby improving the reliability of controlling external device access to the enterprise internal network.

[0182] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0183] Based on the same inventive concept, in one embodiment, Figure 6 As shown, the embodiment of the present application further provides a device access apparatus 600, comprising: a first receiving module 601, a feedback module 602, a second encryption module 603 and a control module 604, wherein:

[0184] The first receiving module is used to receive device information sent by the control terminal, where the device information includes a random key, security software information, and a hardware feature code of a target device requesting to access the network.

[0185] The feedback module is used to generate a random number and feed back the random number to the control terminal if it is determined that the target device belongs to the organization's assets based on the hardware feature code.

[0186] The first receiving module is further used to receive first encrypted data sent by the control terminal; the first encrypted data is obtained by encrypting the random number fed back by the control terminal using a random key.

[0187] The first encryption module is used to encrypt the locally generated random number using the received random key to obtain second encrypted data.

[0188] The control module is configured to determine a security score based on the security software information and the hardware feature code if the second encrypted data is the same as the first encrypted data, and control network access of the target device according to the security score.

[0189] In one embodiment, the feedback module is further configured to obtain a pre-established device asset library; query the device asset library based on the hardware feature code; if the hardware feature code is found in the device asset library, it is determined that the target device belongs to the organizational asset.

[0190] In one embodiment, the feedback module is also used to obtain the server signature and feed back the random number and the server signature to the control terminal to instruct the control terminal to verify the server signature, and if the verification is successful, instruct the control terminal to encrypt the random number according to the random key to obtain the first encrypted data.

[0191] In one embodiment, the control module is also used to determine an asset assessment score based on a hardware feature code; determine a security control software score based on whether the security software information includes security control software installation information; if the security software information includes security control software installation information, determine a version compliance score based on the security control software version information in the security control software installation information; determine an antivirus software score based on whether the security software information includes antivirus software installation information; and determine a security score based on the asset assessment score, the security control software score, the version compliance score, and the antivirus software score.

[0192] In one embodiment, the control module is further used to deny the target device access to the network if the security score is less than a first threshold; if the security score is greater than or equal to the first threshold and less than a second threshold, allow the target device to access the network and send an alarm message to the control terminal; wherein the second threshold is greater than the first threshold; if the security score is greater than or equal to the second threshold, allow the target device to access the network.

[0193] Based on the same inventive concept, in one embodiment, Figure 7 As shown, the embodiment of the present application further provides a network request access device 700, including: a second receiving module 701, a sending module 702 and a first encryption module 703, wherein:

[0194] A second receiving module is used to receive the hardware feature code of the target device requesting to access the network and the security software information of the target device, and generate a random key;

[0195] a sending module, configured to send the hardware feature code, security software information, and a random key to an authentication server, so as to instruct the authentication server to determine whether the target device belongs to an organizational asset based on the hardware feature code;

[0196] The second receiving module is further configured to receive a random number fed back by the authentication server if the authentication result is true;

[0197] a second encryption module, configured to encrypt the received random number according to the random key to obtain first encrypted data, and send the first encrypted data to the authentication server to instruct the authentication server to verify the first encrypted data, and instruct the authentication server to determine a security score based on the security software information and the hardware feature code if the verification passes;

[0198] The second receiving module is further configured to receive an authentication result from the authentication server, where the authentication result is determined based on the security score, and the authentication result indicates whether network access is allowed or denied.

[0199] In one embodiment, the second receiving module is further used to receive an access request initiated by a target device requesting to access the network; generate an authentication start data packet based on the access request, and send the authentication start data packet to the network switch; if an authentication request data packet is received as feedback from the network switch in response to the authentication start data packet, the hardware feature code and security software information are obtained from the target device.

[0200] Each module in the aforementioned device access apparatus and network access device may be implemented in whole or in part through software, hardware, or a combination thereof. Each module may be embedded in or independent of a processor in a computer device in hardware form, or may be stored in a computer device memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0201] In one embodiment, a server is provided, whose internal structure diagram can be as follows: Figure 8 As shown. The server includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the server is used to provide computing and control capabilities. The memory of the server includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the server is used to store data sent by the terminal and locally generated random numbers. The input / output interface of the server is used to exchange information between the processor and an external device. The communication interface of the server is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a device access method is implemented.

[0202] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the server to which the solution of the present application is applied. The specific server may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0203] In one embodiment, a terminal is provided, whose internal structure diagram can be as follows: Figure 9As shown. The terminal includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface, the display unit and the input device are connected to the system bus via the input / output interface. The processor of the terminal is used to provide computing and control capabilities. The memory of the terminal includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the terminal is used to exchange information between the processor and an external device. The communication interface of the terminal is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the terminal is executed by the processor, a network request access method is implemented. The display unit of the terminal is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the terminal can be a touch layer covering the display screen, or a key, trackball or touchpad provided on the terminal housing, or an external keyboard, touchpad or mouse.

[0204] Those skilled in the art will understand that Figure 9 The structure shown in the figure is only a block diagram of a part of the structure related to the scheme of the present application, and does not constitute a limitation on the terminal to which the scheme of the present application is applied. The specific terminal may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0205] In one embodiment, a server is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above-mentioned device access method embodiment when executing the computer program.

[0206] In one embodiment, a terminal is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above-mentioned network access request method embodiment when executing the computer program.

[0207] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0208] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0209] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0210] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0211] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A device access method, characterized in that: The method comprises: Receiving device information sent by the control terminal, the device information including a random key, security software information, and a hardware feature code of a target device requesting network access, the random key being generated after the control terminal receives the hardware feature code of the target device requesting network access and the security software information; If it is determined based on the hardware feature code that the target device belongs to an organizational asset, generating a random number and feeding the random number back to the control terminal; Receiving first encrypted data sent by the control terminal; the first encrypted data is obtained by encrypting a random number fed back by the control terminal using the random key; Encrypting the locally generated random number using the received random key to obtain second encrypted data; If the second encrypted data is identical to the first encrypted data, determining a security score based on the security software information and the hardware feature code, and controlling network access of the target device according to the security score; The determining of the security score based on the security software information and the hardware feature code includes: determining an asset assessment score based on the hardware feature code; Determining a security control software score based on whether the security protection software information includes security control software installation information; If the security software information includes security control software installation information, determining a version compliance score based on the security control software version information in the security control software installation information; determining an antivirus software score based on whether the security software information includes antivirus software installation information; A security score is determined based on the asset assessment score, the security control software score, the version compliance score, and the antivirus software score.

2. The method according to claim 1, characterized in that If it is determined based on the hardware feature code that the target device belongs to an organizational asset, before generating the random number, the method further includes: Access to a pre-built library of equipment assets; The device asset library is queried based on the hardware feature code. If the hardware feature code is found in the device asset library, it is determined that the target device belongs to an organizational asset.

3. The method according to claim 1, characterized in that Feeding back the random number to the control terminal includes: Obtain the server signature, and feed back the random number and the server signature to the control terminal to instruct the control terminal to verify the server signature, and if the verification is successful, instruct the control terminal to encrypt the random number according to the random key to obtain the first encrypted data.

4. The method according to any one of claims 1 to 3, characterized in that The controlling the network access of the target device according to the security score includes: If the security score is less than a first threshold, denying the target device access to the network; If the security score is greater than or equal to the first threshold and less than a second threshold, allowing the target device to access the network and sending an alarm message to the control terminal; wherein the second threshold is greater than the first threshold; If the security score is greater than or equal to the second threshold, the target device is allowed to access the network.

5. A network access request method, characterized in that: The method comprises: Receive a hardware signature code of a target device requesting network access and security software information of the target device, and generate a random key; Sending the hardware feature code, the security software information, and the random key to an authentication server to instruct the authentication server to determine whether the target device is an organizational asset based on the hardware feature code; If yes, then receive the random number fed back by the authentication server; Encrypting the received random number according to the random key to obtain first encrypted data, and sending the first encrypted data to the authentication server to instruct the authentication server to verify the first encrypted data according to the second encrypted data. If the verification passes, instructing the authentication server to determine a security score based on the security software information and the hardware feature code. The second encrypted data is obtained by encrypting a random number generated locally by the authentication server using the random key. The security score is based on an asset assessment score, a security control software score, a version compliance score, and an anti-virus software score. The asset assessment score is determined based on the hardware feature code. The security control software score is determined based on whether the security software information includes security control software installation information. The version compliance score is determined based on the security control software version information in the security control software installation information if the security software information includes security control software installation information. The anti-virus software score is determined based on whether the security software information includes anti-virus software installation information. An authentication result from the authentication server is received, where the authentication result is determined based on the security score, and the authentication result indicates whether network access is allowed or denied.

6. The method according to claim 5, characterized in that The hardware feature code of the target device receiving the request to access the network and the security software information of the target device include: receiving an access request initiated by a target device requesting to access the network; generating an authentication start data packet according to the access request, and sending the authentication start data packet to the network switch; If an authentication request data packet fed back by the network switch in response to the authentication start data packet is received, the hardware feature code and security software information are obtained from the target device.

7. A device access device, characterized in that: The device comprises: A first receiving module is configured to receive device information sent by a control terminal, the device information including a random key, security software information, and a hardware feature code of a target device requesting network access, the random key being generated after the control terminal receives the hardware feature code of the target device requesting network access and the security software information; a feedback module, configured to generate a random number and feed back the random number to the control terminal if it is determined based on the hardware feature code that the target device belongs to an organizational asset; The first receiving module is further configured to receive first encrypted data sent by the control terminal; the first encrypted data is obtained by encrypting a random number fed back by the control terminal using the random key; A first encryption module is used to encrypt a locally generated random number using a received random key to obtain second encrypted data; a control module, configured to determine a security score based on the security software information and the hardware feature code if the second encrypted data is the same as the first encrypted data, and control network access of the target device according to the security score; The control module is specifically used to: determining an asset assessment score based on the hardware feature code; Determining a security control software score based on whether the security protection software information includes security control software installation information; If the security software information includes security control software installation information, determining a version compliance score based on the security control software version information in the security control software installation information; determining an antivirus software score based on whether the security software information includes antivirus software installation information; A security score is determined based on the asset assessment score, the security control software score, the version compliance score, and the antivirus software score.

8. A network access request device, characterized in that: The device comprises: A second receiving module is used to receive a hardware feature code of a target device requesting to access the network and security software information of the target device, and generate a random key; a sending module, configured to send the hardware feature code, the security software information, and the random key to an authentication server, so as to instruct the authentication server to determine whether the target device is an organizational asset based on the hardware feature code; The second receiving module is further configured to receive a random number fed back by the authentication server if the authentication server is true; a second encryption module, configured to encrypt a received random number according to the random key to obtain first encrypted data, and send the first encrypted data to an authentication server, instructing the authentication server to verify the first encrypted data according to the second encrypted data, and instructing the authentication server to determine a security score based on the security software information and the hardware feature code if the verification passes; The second receiving module is further used to receive the authentication result of the authentication server, which is determined based on the security score, and the authentication result represents whether access to the network is allowed or denied. The second encrypted data is obtained by the authentication server encrypting a locally generated random number using the random key. The security score is based on the asset evaluation score, the security control software score, the version compliance score, and the anti-virus software score. The asset evaluation score is determined based on the hardware feature code. The security control software score is determined based on whether the security software information includes security control software installation information. The version compliance score is determined based on the security control software version information in the security control software installation information if the security software information includes security control software installation information. The anti-virus software score is determined based on whether the security software information includes anti-virus software installation information.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

11. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images