Network access control method, device, terminal and storage medium

Abstract

The embodiments of the present invention are applicable to the field of computer security technology and provide a network access control method, device, terminal and storage medium, wherein the network access control method includes: judging whether a data packet captured in the network protocol stack of the terminal is sent by the terminal, and obtaining a judgment result; when the judgment result indicates that the data packet is sent by the terminal, adding a preset identifier to the data packet, and putting the data packet with the preset identifier added back into the network protocol stack to send the data packet to the opposite device; when the judgment result indicates that the data packet is not sent by the terminal, determining whether to put the data packet back into the network protocol stack based on whether the preset identifier exists in the data packet, so as to send it to the application corresponding to the data packet in the terminal.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a network access control method, device, terminal and storage medium. Background Art

[0002] Network access control prevents data security threats from hacking techniques such as viruses and worms. In related technologies, network access control is implemented through switches. Devices connected to the switches are authenticated and only after successful authentication are the switch ports released. Otherwise, only specific authenticated traffic is allowed through. Implementing network access through switches in related technologies requires extensive switch configuration modifications, making deployment difficult. Summary of the Invention

[0003] To solve the above problems, embodiments of the present invention provide a network admission control method, apparatus, terminal, and storage medium to at least solve the problem in related technologies that network admission is difficult to deploy through switches.

[0004] The technical solution of the present invention is achieved as follows:

[0005] In a first aspect, an embodiment of the present invention provides a network admission control method, which is applied to a client installed in a terminal, and the method includes:

[0006] Determining whether a data packet captured in a network protocol stack of the terminal is sent by the terminal, and obtaining a determination result;

[0007] If the judgment result indicates that the data packet is sent by the terminal, adding a preset identifier to the data packet, and returning the data packet with the preset identifier to the network protocol stack to send the data packet to the peer device;

[0008] When the judgment result indicates that the data packet is not sent by the terminal, based on whether a preset identifier exists in the data packet, it is determined whether to put the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal.

[0009] In the above solution, when the judgment result indicates that the data packet is sent by the terminal, the method further includes:

[0010] If a session corresponding to the data packet does not exist, create a session corresponding to the data packet;

[0011] Accordingly, when the judgment result indicates that the data packet is not sent by the terminal, determining whether to put the data packet back into the network protocol stack based on whether a preset identifier exists in the data packet to send it to the application corresponding to the data packet in the terminal includes:

[0012] If the judgment result indicates that the data packet is not sent by the terminal, judging whether a session corresponding to the received data packet exists;

[0013] If a corresponding session exists, placing the data packet back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal;

[0014] If there is no corresponding session, it is determined whether there is a preset identifier in the data packet. When it is determined that the preset identifier exists, a session is created and the data packet is put back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal.

[0015] In the above solution, when a session corresponding to the data packet does not exist, creating a session corresponding to the data packet includes:

[0016] If a session corresponding to the data packet does not exist, create a session corresponding to the data packet and mark the session as active;

[0017] If the corresponding session does not exist, determining whether a preset identifier exists in the data packet; when it is determined that the preset identifier exists, creating a session, and placing the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal, including:

[0018] If no corresponding session exists, determining whether a preset identifier exists in the data packet; if it is determined that the preset identifier exists, creating a session, marking the session as passive, and returning the data packet to the network protocol stack to be sent to the application corresponding to the data packet in the terminal;

[0019] Correspondingly, if a corresponding session exists, placing the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal includes:

[0020] If there is a corresponding session, further determine whether the session is actively initiated or passively responded to;

[0021] If initiated actively, the data packet is put back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal;

[0022] If it is a passive response, it is determined whether there is a preset identifier in the data packet, and whether to put the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal.

[0023] In the above solution, the step of adding a preset identifier to the data packet includes:

[0024] Determining a value of a setting field in an Internet Protocol (IP) message of the data packet;

[0025] The value of the setting field is modified based on the setting rule to obtain the preset identifier.

[0026] In the above solution, before determining whether the data packet captured in the network protocol stack of the terminal is sent by the terminal, the method further includes:

[0027] Connect to the gateway settings;

[0028] In the case where the authentication page pushed by the set gateway is successfully authenticated, the client is enabled to capture data packets and add a preset identifier to the data packets.

[0029] In the above solution, putting the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal includes:

[0030] Deleting the preset identifier in the data packet;

[0031] The data packet with the preset identifier deleted is put back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal.

[0032] In the above solution, the client implements data packet capture and modification operations on the terminal based on the WinDivert framework.

[0033] In a second aspect, an embodiment of the present invention provides a network admission control method, which is applied to a client installed in a terminal, and the method includes:

[0034] Determining whether an address of a data packet captured in a network protocol stack of the terminal is a preset address;

[0035] If it is the preset address, the data packet is put back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal.

[0036] In the above solution, the preset address includes a Media Access Control (MAC) address and an IP address.

[0037] In the above solution, determining whether the address of the data packet captured in the network protocol stack of the terminal is a preset address includes:

[0038] Obtaining a preset address list from a set gateway, and determining whether an address of a data packet captured in a network protocol stack of the terminal is in the preset address list;

[0039] If the address of the data packet captured in the network protocol stack of the terminal is in the preset address list, it is determined that the address is the preset address.

[0040] In the above solution, the method further includes:

[0041] Connecting to the set gateway;

[0042] In the case that the authentication based on the authentication page pushed by the setting gateway is successful, the preset address of the terminal is sent to the setting gateway, so that the setting gateway records the preset address of the terminal in the preset address list.

[0043] In a third aspect, an embodiment of the present invention provides a network admission control device, the device comprising:

[0044] A first judgment module is used to judge whether the data packet captured in the network protocol stack of the terminal is sent by the terminal, and obtain a judgment result;

[0045] an adding module, configured to, when the judgment result indicates that the data packet is sent by the terminal, add a preset identifier to the data packet, and put the data packet with the preset identifier added back into the network protocol stack, so as to send the data packet to the opposite device;

[0046] A determination module is used to determine whether to put the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal based on whether there is a preset identifier in the data packet when the judgment result indicates that the data packet is not sent by the terminal.

[0047] In a fourth aspect, an embodiment of the present invention provides a network admission control device, the device comprising:

[0048] A second judgment module is used to judge whether the address of the received data packet captured in the network protocol stack of the terminal is a preset address;

[0049] The sending module is configured to put the received data packet back into the network protocol stack if the address is the preset address, so as to send the received data packet to the application corresponding to the data packet in the terminal.

[0050] In a fifth aspect, an embodiment of the present invention provides a terminal comprising a processor and a memory, wherein the processor and the memory are connected to each other, wherein the memory is used to store a computer program, the computer program comprises program instructions, and the processor is configured to call the program instructions to execute the steps of the network access control method provided in the first aspect or the second aspect of the embodiment of the present invention.

[0051] In a sixth aspect, an embodiment of the present invention provides a computer-readable storage medium, comprising: the computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the computer program implements the steps of the network admission control method provided in the first or second aspect of the embodiment of the present invention.

[0052] The embodiment of the present invention determines whether a data packet captured in the terminal's network protocol stack was sent by the terminal, obtaining a determination result. If the determination result indicates that the data packet was sent by the terminal, a preset identifier is added to the data packet, and the data packet with the preset identifier is returned to the network protocol stack to transmit the data packet to the peer device. If the determination result indicates that the data packet was not sent by the terminal, the determination is made based on whether the preset identifier is present in the data packet whether the data packet should be returned to the network protocol stack for transmission to the application corresponding to the data packet in the terminal. The embodiment of the present invention allows data packets sent by the terminal to pass; for data packets not sent by the terminal, the determination is made based on whether the preset identifier is present in the data packet whether the data packet should be passed, thereby achieving the effect of network access control. Compared to related technologies that require switches to implement network access control, the embodiment of the present invention does not require switches, has low deployment costs, is lightweight and easy to deploy, and only requires client push (currently there are many client push methods, such as AD domain, which are simple and easy to implement). There is no need to purchase and deploy switches that implement network access control. Clearly, the present invention is simpler and easier to deploy than traditional methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a schematic diagram of an implementation flow of a network admission control method provided by an embodiment of the present invention;

[0054] Figure 2 This is a schematic diagram of an implementation flow of another network admission control method provided by an embodiment of the present invention;

[0055] Figure 3 This is a schematic diagram of an implementation flow of another network admission control method provided by an embodiment of the present invention;

[0056] Figure 4 This is a schematic diagram of an implementation flow of another network admission control method provided by an embodiment of the present invention;

[0057] Figure 5 This is a schematic diagram of an implementation flow of another network admission control method provided by an embodiment of the present invention;

[0058] Figure 6 This is a schematic diagram of an implementation flow of another network admission control method provided by an embodiment of the present invention;

[0059] Figure 7This is a schematic diagram of an implementation flow of another network admission control method provided by an embodiment of the present invention;

[0060] Figure 8 This is a schematic diagram of a push-end page provided by an application embodiment of the present invention;

[0061] Figure 9 This is a network topology diagram of a local area network provided by an application embodiment of the present invention;

[0062] Figure 10 This is a flow chart of a network admission control process provided by an application embodiment of the present invention;

[0063] Figure 11 is a schematic diagram of a network admission control device provided by an embodiment of the present invention;

[0064] Figure 12 is a schematic diagram of a network admission control device provided by an embodiment of the present invention;

[0065] Figure 13 FIG. 4 is a schematic diagram of a terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0066] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0067] Large enterprises often use the Dynamic Host Configuration Protocol (DHCP) to distribute Internet Protocol (IP) addresses. Users don't need to configure IP addresses on their computers; upon accessing the network, the DHCP server automatically assigns an available IP address to each computer's network card. Layer 2 access is the authentication that users must pass before obtaining a Layer 3 IP address. When users first access the network, they must exchange authentication data with the network over a Layer 2 connection. Only after successful authentication can they request an IP address from the DHCP server and, therefore, send and receive data.

[0068] The 802.1X protocol is a representative implementation of Layer 2 access control. 802.1X is a port-based network access control protocol. Port-based network access control involves authenticating and controlling user devices at the LAN access device port level. If a user device connected to a port passes authentication, it can access LAN resources; if it fails authentication, it is denied access. The 802.1X protocol supports multiple network vendors and can be implemented on network switches.

[0069] Existing Layer 2 access is typically implemented through switches. For example, in 802.1X authentication, a switch port is unlocked only after successful user identity verification. Otherwise, only specific authentication traffic is allowed through. Deploying network access through switches is complex and expensive, requiring the purchase of switches that support the required features.

[0070] In view of the shortcomings of the above-mentioned related technologies, the embodiments of the present invention provide a network access control method, which can at least reduce the difficulty of deploying network access. In order to illustrate the technical solution of the present invention, a specific embodiment is provided below.

[0071] Figure 1 This is a schematic diagram of the implementation flow of a network admission control method provided by an embodiment of the present invention. The execution subject of the network admission control method is a terminal, which can be a desktop computer, a laptop computer, a server, etc. A client is installed in the terminal, and the client implements the network admission control method. Figure 1 ,Network admission control methods include:

[0072] S101, determining whether a data packet captured in a network protocol stack of the terminal is sent by the terminal, and obtaining a determination result.

[0073] Here, the data packet may refer to a data packet sent by a terminal to a peer device, or a data packet sent by a peer device to a terminal.

[0074] The client captures data packets from the terminal's network protocol stack, which is divided into five layers: application layer (HTTP), transport layer (TCP), network layer (IP), data link layer (network-specific link interface), and physical layer (physical network hardware). The network protocol stack processes all data packets that the terminal needs to send to or receive from the peer device.

[0075] In one embodiment, the client implements data packet capture and modification operations on the terminal based on the WinDivert framework.

[0076] Packet Diverter (WinDivert) is a user-mode packet capture and diversion tool for Windows Vista, Windows 2008, Windows 7, Windows 8, and Windows 10. WinDivert allows user-mode applications to capture, modify, and discard network packets sent from the Windows network stack. Here, the client, based on the WinDivert framework, can capture packets in the network protocol stack.

[0077] Because the data packet can be a data packet sent by the terminal to the peer device, or a data packet sent by the peer device to the terminal, it is necessary to determine whether the data packet is sent by the terminal.

[0078] S102 , when the judgment result indicates that the data packet is sent by the terminal, adding a preset identifier to the data packet, and putting the data packet with the preset identifier back into the network protocol stack to send the data packet to the opposite device.

[0079] If the data packet is generated by the terminal itself, such as a data packet generated by communication software in the terminal, the terminal sends it to the communication software in the opposite device.

[0080] Here, the data packets sent by the terminal all carry a special identifier, and the special identifier can be used to determine whether the data packet is sent by the terminal.

[0081] If the result of the determination indicates that the data packet is sent by the terminal, a preset identifier is added to the data packet, and the data packet with the preset identifier is returned to the network protocol stack to transmit the data packet to the peer device. Here, the peer device can be a device in the same local area network, such as a printer, projector, desktop computer, etc.

[0082] refer to Figure 2 In one embodiment, the adding of a preset identifier to the data packet includes:

[0083] S201, determining the value of a setting field in the IP message of the data packet.

[0084] In one embodiment, the setting field may refer to the Identification field in the IP packet header, and the value of the Identification field is a 2-byte (16-bit) number.

[0085] S202: Modify the value of the setting field based on the setting rule to obtain the preset identifier.

[0086] Modify the values of the specified fields according to the specified rules. For example, modify the value of the upper 4 bits of the Identification field to conform to a certain pattern of the lower 12 bits. For example, the specified rule is: the value of the upper 4 bits (15-12) = 11-8th bit ^7-4th bit ^3-0th bit + 1, and then invert it. ^ is exclusive OR, 0^0 = 0, 0^1 = 1, 1^0 = 1, 1^1 = 0. Different values equal 1, and the same value equals 0.

[0087] For example, the value of the Identification field is 0000000100100011. The upper 4 bits are modified according to the setting rule: 0001^0010^0011=0000, 0000+1=0001, and 0001 inverted = 1110. That is, the upper 4 bits of the modified Identification field are 1110, and the modified value of the Identification field is 1110000100100011.

[0088] Modify the value of the Identification field in the IP header of the data packet and send the modified data packet to the peer device.

[0089] S103, when the judgment result indicates that the data packet is not sent by the terminal, based on whether there is a preset identifier in the data packet, determine whether to put the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal.

[0090] If the judgment result indicates that the data packet is not sent by the terminal, then the data packet is sent by the opposite device (the sender of the data packet). Based on whether there is a preset identifier in the data packet, it is determined whether to put the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal.

[0091] For example, if the data packet contains a preset identifier, the data packet is put back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal. If the data packet does not contain a preset identifier, the data packet is deleted from the network protocol stack.

[0092] For devices in the LAN, since the program is easily installed in a centralized manner, access control of each terminal device within the LAN can be achieved by simply installing the client in the terminal. Compared with the existing switch-based LAN internal access control solution, it does not require more complex switch deployment and configuration, and is simple to implement.

[0093] The embodiment of the present invention determines whether a data packet captured in the terminal's network protocol stack was sent by the terminal, obtaining a determination result. If the determination result indicates that the data packet was sent by the terminal, a preset identifier is added to the data packet, and the data packet with the preset identifier is returned to the network protocol stack to transmit the data packet to the peer device. If the determination result indicates that the data packet was not sent by the terminal, the determination is made based on whether the preset identifier is present in the data packet to determine whether the data packet should be returned to the network protocol stack for transmission to the application corresponding to the data packet in the terminal. The embodiment of the present invention allows data packets sent by the terminal to pass; for data packets not sent by the terminal, the determination is made based on whether the preset identifier is present in the data packet, thereby achieving network access control. Compared to related technologies that require switches to implement network access control, the embodiment of the present invention does not require switches, resulting in low deployment costs, lightweight, and easy deployment. This application only requires client push (currently there are many client push methods, such as AD domain, which are simple and easy to implement), eliminating the need to purchase and deploy switches that implement network access control. Clearly, this application is simpler and easier to deploy than traditional methods.

[0094] In one embodiment, when the determination result indicates that the data packet is sent by the terminal, the method further includes:

[0095] If a session corresponding to the data packet does not exist, a session corresponding to the data packet is created.

[0096] For example, when a terminal communicates with a peer device for the first time, since a session with the peer device does not exist, the terminal needs to create a session with the peer device. The session corresponding to the data packet is the session with the peer device.

[0097] Accordingly, reference Figure 3 In one embodiment, when the judgment result indicates that the data packet is not sent by the terminal, determining whether to put the data packet back into the network protocol stack based on whether a preset identifier exists in the data packet to send it to the application corresponding to the data packet in the terminal includes:

[0098] S301 : When the judgment result indicates that the data packet is not sent by the terminal, determine whether there is a session corresponding to the received data packet.

[0099] A session is a communication process between one terminal and another. If a terminal and the peer device have previously exchanged data packets before sending a new packet, a session is considered to exist between the terminal and the sender. You can determine whether a session exists between the terminal and the sender by querying the terminal's historical communication records.

[0100] Sessions include active sessions and passive sessions. Active sessions refer to sessions actively created by the terminal; passive sessions refer to sessions passively created due to active access from the peer device.

[0101] S302: If a corresponding session exists, the data packet is put back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal.

[0102] In the case that the data packet is not sent by the terminal, if a session exists between the terminal and the opposite device, the data packet is put back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal.

[0103] S303: If there is no corresponding session, determine whether there is a preset identifier in the data packet. If it is determined that there is the preset identifier, create a session and put the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal.

[0104] In the case where the data packet is not sent by the terminal, if there is no session between the terminal and the peer device, it is determined whether there is a preset identifier in the data packet. If there is a preset identifier, the terminal creates a session with the peer device and puts the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal.

[0105] In the above embodiment, if a sub-terminal exists in the local area network, the sub-terminal device refers to a device that cannot be installed with a client, such as a printer or projector. Sub-terminals cannot add a preset identifier to data packets. When a terminal actively accesses a sub-terminal, the sub-terminal's reply packet lacks the preset identifier, resulting in the terminal being unable to receive the sub-terminal's reply packet. Therefore, in this embodiment of the present invention, for packets actively sent by a terminal, a session is established with the peer device. Even if the peer device is a sub-terminal, the terminal can still receive the sub-terminal's reply packet.

[0106] In one embodiment, when a session corresponding to the data packet does not exist, creating a session corresponding to the data packet includes:

[0107] When a data packet is sent by a terminal and a session corresponding to the data packet does not exist, a session corresponding to the data packet is created and marked as active.

[0108] If the corresponding session does not exist, determining whether a preset identifier exists in the data packet; when it is determined that the preset identifier exists, creating a session, and placing the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal, including:

[0109] If there is no corresponding session, determine whether there is a preset identifier in the data packet. When it is determined that the preset identifier exists, create a session, mark the session as passive, and put the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal.

[0110] In the case where the data packet is not sent by the terminal and no session exists between the terminal and the peer device, if a preset identifier exists in the data packet, a session between the terminal and the peer device is created and marked as passive.

[0111] Accordingly, refer to Figure 4 In one embodiment, if a corresponding session exists, placing the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal includes:

[0112] S401: If a corresponding session exists, further determine whether the session is actively initiated or passively responded to.

[0113] S402: If it is initiated actively, the data packet is put back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal.

[0114] S403: If it is a passive response, determine whether there is a preset identifier in the data packet, and determine whether to put the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal.

[0115] In the embodiments of the present invention, for actively initiated sessions, since the session is initiated by the terminal, the terminal maintains the session and selects to receive all data packets sent by the peer device. For passively responded sessions, since the peer device may be malicious, after receiving a data packet, the terminal checks whether the packet contains a preset identifier to determine whether to send the packet to the terminal application. For example, if the preset identifier is missing, the packet is discarded. This embodiment of the present invention enhances network access security.

[0116] The purpose of the preset identifier is to identify whether the other device is a malicious terminal and prevent illegal terminals from actively accessing legitimate terminals. If the data packet carries the preset identifier, it indicates that the other device is a safe device with which to communicate.

[0117] refer to Figure 5 In one embodiment, the placing the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal includes:

[0118] S501: Delete the preset identifier in the data packet.

[0119] S502: Put the data packet with the preset identifier deleted back into the network protocol stack to send it to the application corresponding to the data packet in the terminal.

[0120] Some methods of adding preset identifiers to data packets may affect the terminal device's ability to receive the data packet, potentially preventing the terminal device from receiving the data packet. Therefore, in an embodiment of the present invention, the terminal removes the preset identifier from the data packet and restores it to the original data packet, ensuring that the data packet can be sent to the application corresponding to the data packet on the terminal.

[0121] For example, if the preset identifier is obtained by modifying the Identification field in the IP packet header, the Identification field is restored to the original Identification field. For example, the modified Identification field is 1110000100100011, and the original Identification field is 1110000100100011.

[0122] Whether or not the data packet needs to be restored depends on how the preset identifier is generated. If adding the preset identifier to the data packet causes the terminal to be unable to receive the data packet, it needs to be restored. In one embodiment, all data packets can be restored, which can ensure that the data packet can be sent to the application corresponding to the data packet in the terminal.

[0123] refer to Figure 6 In one embodiment, before determining whether the data packet captured in the network protocol stack of the terminal is sent by the terminal, the method further includes:

[0124] S601, connect to and set up a gateway.

[0125] S602 , when the authentication page pushed by the set gateway is successfully authenticated, the client is enabled with the authority to capture data packets and add a preset identifier to the data packets.

[0126] Here, the authentication operation may be performed by the terminal or the gateway.

[0127] In this embodiment of the present invention, a terminal needs to connect to a designated gateway for authentication. The designated gateway pushes an authentication page to the terminal. This authentication is used to determine whether the terminal is malicious. On the authentication page, the user enters the required authentication information, such as their username and password. The terminal sends this authentication information to the designated gateway, which then verifies it by comparing it with information in a backend database. If authentication is successful, the designated gateway grants the client permission to capture data packets and add a pre-defined identifier to them. This prevents unauthorized access by malicious terminals and improves security.

[0128] Here, the gateway may send a permission-enabling flag to the client, thereby enabling the client to capture data packets and add a preset identifier to the data packets.

[0129] In practice, network access can be achieved through a client. Installing the client on a terminal allows the client to capture data packets and add identifiers. Only devices installed with the client can actively access other devices on the LAN; devices without the client cannot. Authentication after client installation prevents malicious terminals from accessing legitimate terminals by illegally installing the client.

[0130] refer to Figure 7 , Figure 7 This is a schematic diagram of the implementation flow of another network admission control method provided by an embodiment of the present invention. The execution subject of the network admission control method is a terminal, which can be a desktop computer, a laptop computer, a server, etc. A client is installed in the terminal, and the client implements the network admission control method. Figure 7 ,Network admission control methods include:

[0131] S701: Determine whether the address of a data packet captured in the network protocol stack of the terminal is a preset address.

[0132] In one embodiment, the preset address includes a Media Access Control Address (MAC) and an IP address.

[0133] S702: If it is the preset address, put the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal.

[0134] In one embodiment, determining whether the address of the data packet captured in the network protocol stack of the terminal is a preset address includes:

[0135] Obtaining a preset address list from a set gateway, and determining whether an address of a data packet captured in a network protocol stack of the terminal is in the preset address list;

[0136] If the address of the data packet captured in the network protocol stack of the terminal is in the preset address list, it is determined that the address is the preset address.

[0137] If the address is not in the preset list, the data packet in the network protocol stack is discarded.

[0138] In this embodiment of the present invention, a preset address list is stored in the gateway, and the preset address list stores the preset addresses of legitimate terminals. If the address of a data packet captured in the terminal's network protocol stack is in the preset address list, the data packet is returned to the network protocol stack to be sent to the application corresponding to the data packet in the terminal.

[0139] Here, the gateway may send the preset address list to each terminal with a client installed in the local area network, and the terminal determines whether the address of the data packet captured in the network protocol stack of the terminal is the preset address based on the preset address list.

[0140] In one embodiment, the method further comprises:

[0141] Connecting to the setting gateway, and when authentication is successful based on the authentication page pushed by the setting gateway, sending the preset address of the terminal to the setting gateway, so that the setting gateway records the preset address of the terminal in the preset address list.

[0142] The terminal initiates authentication to the gateway. After authentication is passed, the gateway records the terminal's preset address in the preset address list. Alternatively, you can manually add a preset address to the gateway's preset address list.

[0143] For MAC addresses, a list of authorized terminal MAC addresses can be manually configured at the gateway. The terminal communicates with the gateway to obtain this list, thereby identifying unauthorized terminals that actively access the network. Alternatively, the terminal can initiate authentication with the gateway. Upon successful authentication, the gateway records the authorized terminal's MAC address. This allows the gateway to proactively obtain the authorized terminal MAC address list, eliminating manual configuration.

[0144] For IP addresses, a list of authorized terminal IP addresses can be manually configured at the gateway. Terminals communicate with the gateway to obtain this list, allowing them to identify unauthorized terminals that actively access the network. Alternatively, a terminal can initiate authentication with the gateway. Upon successful authentication, the gateway records the authorized terminal's IP address. This allows the gateway to proactively obtain the authorized terminal IP address list, eliminating manual configuration.

[0145] This embodiment of the present invention determines whether the address of a captured data packet in the terminal's network protocol stack is a preset address. If so, the data packet is returned to the network protocol stack for delivery to the corresponding application in the terminal. By determining whether a data packet contains a preset address, this embodiment of the present invention prevents unauthorized terminals from accessing authorized terminals, thereby achieving network access control.

[0146] refer to Figure 8 , Figure 8This is a schematic diagram of a push-end page provided by an application embodiment of the present invention. The application embodiment of the present invention implements network access through the client, such as Figure 8 As shown in the figure, after enabling the client push feature, users will be prompted to install the client. This feature is already part of the gateway. When a terminal accesses any network resource, it will be redirected to the client installation page because the push option is enabled. Users must download the client pushed from the installation page and complete authentication before accessing network resources. (There are many ways to install the client, and installing the client is necessary to establish a security boundary.)

[0147] refer to Figure 9 , Figure 9 This is a network topology diagram of a local area network provided by an embodiment of the present invention. The administrator configures push-to-client and authentication policies on the security gateway and requires users to install the client. For example, a router in Network A is connected to installed devices, uninstalled devices, and sub-terminal devices. Installed devices refer to devices with the client installed, uninstalled devices refer to devices without the client installed, and sub-terminal devices refer to devices that cannot install the client.

[0148] For devices that have just been connected to the LAN, or when the push-end option is enabled, when the device in the LAN accesses www.baidu.com or other network resources, it will be redirected to the installation page because the push-end option is enabled. Users can only access after downloading the client and authenticating.

[0149] After installing the client, the device must connect to the AC gateway and authenticate according to the authentication policy before it can access network resources. The packet modification feature is enabled only after the client is installed, the gateway is connected, and authentication is completed. This means that packet modification is not unconditionally enabled after the client is installed; it is only enabled after authentication is completed. This prevents malicious devices from accessing legitimate devices by illegally installing the client.

[0150] Access between devices: When device A1 accesses device A2, the data packets are marked with specific tags, so the clients of devices A1 and A2 will allow each other's traffic to pass.

[0151] Restricting active access from unequipped devices: In a scenario where unequipped device B accesses installed devices A1 and A2, the client on the installed device uses the Windivert framework to obtain traffic. If it detects a session not initiated by itself (the client maintains a session concept and can determine whether it has initiated a session itself) and the IP data does not have a specific tag, it will drop the packet. Therefore, unequipped device B cannot access installed devices A1 and A2.

[0152] Allowing passive access from sub-terminals: This scenario involves devices A1 and A2 accessing sub-terminal device C (e.g., a printer that cannot install a client but is not an attacker). When devices A1 and A2 access sub-terminal device C, sub-terminal device C will respond. However, because the session was initiated by devices A1 and A2, the response packets will not be discarded even though the sub-terminal is not installed.

[0153] In short, the client maintains a session (including its direction) and controls access to unconnected devices by verifying specific flags in packets for inactive sessions. Connected devices can access the network freely, but unconnected devices cannot actively access connected devices. This ultimately achieves network access.

[0154] refer to Figure 10 , Figure 10 This is a flow chart of a network access control process provided by an application embodiment of the present invention. The network access control process includes:

[0155] First, the client captures packets at the terminal's IP layer based on the WinDivert framework.

[0156] The captured data packet is then determined to be locally initiated. Locally initiated data is considered legitimate. If so, the packet is modified, adding a tag to the packet before sending it to the peer device. If a session does not already exist between the terminal and the peer device, the terminal actively creates one and marks it as active.

[0157] If the data packet is not actively sent locally, determine whether there is a session between the terminal and the peer device. If there is a session, continue to determine whether the session is actively initiated by the local device. If it is a session initiated locally, all locally initiated sessions are legal and are directly released. The data packet is modified. Here, modification refers to restoring the mark in the data packet, and then sending the data packet with the restored mark inward (to the terminal application).

[0158] If the session is not initiated locally, or if a session does not already exist between the terminal and the peer device, the non-locally initiated session will verify the data packet sent by the peer device to determine whether it contains a marker. If so, the packet will be repacked, which means restoring the marker in the packet and then sending the restored packet inward (to the terminal application). If a session does not already exist between the terminal and the peer device, the terminal will create a session and mark the session as passive. If the marker is not present, the packet will be discarded.

[0159] The application embodiment of the present invention maintains the session for data packets actively sent by the local machine, allowing data packets to pass through the actively initiated session; for data packets not actively sent by the local machine, for which no session exists and no tag is present, access is denied. The application embodiment of the present invention achieves the effect of network access control with low deployment cost and simple deployment.

[0160] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0161] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0162] It should be noted that the technical solutions described in the embodiments of the present invention can be arbitrarily combined without conflict.

[0163] In addition, in the embodiments of the present invention, “first”, “second”, etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0164] refer to Figure 11 , Figure 11 Schematic diagram of a network admission control device provided by an embodiment of the present invention. Figure 11 As shown, the device includes: a first judgment module, an adding module and a determining module.

[0165] A first judgment module is used to judge whether the data packet captured in the network protocol stack of the terminal is sent by the terminal, and obtain a judgment result;

[0166] an adding module, configured to, when the judgment result indicates that the data packet is sent by the terminal, add a preset identifier to the data packet, and put the data packet with the preset identifier added back into the network protocol stack, so as to send the data packet to the opposite device;

[0167] A determination module is used to determine whether to put the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal based on whether there is a preset identifier in the data packet when the judgment result indicates that the data packet is not sent by the terminal.

[0168] In one embodiment, the apparatus further comprises:

[0169] A creating module, configured to create a session corresponding to the data packet if no session corresponding to the data packet exists;

[0170] Accordingly, when the judgment result indicates that the data packet is not sent by the terminal, the determination module determines, based on whether a preset identifier exists in the data packet, whether to put the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal, for:

[0171] If the judgment result indicates that the data packet is not sent by the terminal, judging whether a session corresponding to the received data packet exists;

[0172] If a corresponding session exists, placing the data packet back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal;

[0173] If there is no corresponding session, it is determined whether there is a preset identifier in the data packet. When it is determined that the preset identifier exists, a session is created and the data packet is put back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal.

[0174] In one embodiment, the creation module creates a session corresponding to the data packet when no session corresponding to the data packet exists, for:

[0175] If a session corresponding to the data packet does not exist, create a session corresponding to the data packet and mark the session as active;

[0176] If no corresponding session exists, the determination module determines whether a preset identifier exists in the data packet; if it is determined that the preset identifier exists, creates a session, and puts the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal, and is configured to:

[0177] If no corresponding session exists, determining whether a preset identifier exists in the data packet; if it is determined that the preset identifier exists, creating a session, marking the session as passive, and returning the data packet to the network protocol stack to be sent to the application corresponding to the data packet in the terminal;

[0178] Accordingly, when the determining module puts the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal if a corresponding session exists, it is configured to:

[0179] If there is a corresponding session, further determine whether the session is actively initiated or passively responded to;

[0180] If initiated actively, the data packet is put back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal;

[0181] If it is a passive response, it is determined whether there is a preset identifier in the data packet, and whether to put the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal.

[0182] In one embodiment, the determining module, when putting the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal, is configured to:

[0183] Deleting the preset identifier in the data packet;

[0184] The data packet with the preset identifier deleted is put back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal.

[0185] In one embodiment, the adding module adds a preset identifier to the data packet, for:

[0186] Determining a value of a setting field in an Internet Protocol (IP) message of the data packet;

[0187] The value of the setting field is modified based on the setting rule to obtain the preset identifier.

[0188] In one embodiment, the apparatus further comprises:

[0189] A first connection module, used for connecting to a set gateway;

[0190] The first authentication module is used to enable the client to capture data packets and add a preset identifier to the data packets when the authentication page pushed by the set gateway is successfully authenticated.

[0191] In one embodiment, the client implements data packet capture and modification operations on the terminal based on the WinDivert framework.

[0192] refer to Figure 12 , Figure 12 Schematic diagram of another network admission control device provided by an embodiment of the present invention, such as Figure 12 As shown, the device includes: a first judgment module, an adding module and a determining module.

[0193] A second judgment module is used to judge whether the address of the received data packet captured in the network protocol stack of the terminal is a preset address;

[0194] The sending module is configured to put the received data packet back into the network protocol stack if the address is the preset address, so as to send the received data packet to the application corresponding to the data packet in the terminal.

[0195] In one embodiment, the preset address includes a Media Access Control (MAC) address and an IP address.

[0196] In one embodiment, when determining whether the address of a data packet captured in the network protocol stack of the terminal is a preset address, the second determination module is configured to:

[0197] Obtaining a preset address list from a set gateway, and determining whether an address of a data packet captured in a network protocol stack of the terminal is in the preset address list;

[0198] If the address of the data packet captured in the network protocol stack of the terminal is in the preset address list, it is determined that the address is the preset address.

[0199] In one embodiment, the apparatus further comprises:

[0200] A first connection module, configured to connect to the set gateway;

[0201] The second authentication module is configured to send the preset address of the terminal to the setting gateway when the authentication page pushed by the setting gateway is successfully authenticated, so that the setting gateway records the preset address of the terminal in the preset address list.

[0202] In actual application, the first judgment module, adding module and determining module can be implemented by a processor in the terminal, such as a central processing unit (CPU), a digital signal processor (DSP), a microcontroller unit (MCU) or a programmable gate array (FPGA).

[0203] It should be noted that the network access control device provided in the above embodiment only uses the division of the above modules as an example to illustrate network access control. In actual applications, the above processing can be assigned to different modules as needed, that is, the internal structure of the device can be divided into different modules to complete all or part of the above-described processing. In addition, the network access control device provided in the above embodiment and the network access control method embodiment are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0204] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a terminal. Figure 13 This is a schematic diagram of the hardware structure of the terminal in the embodiment of the present application. Figure 13 As shown, the terminal includes:

[0205] Communication interface, capable of exchanging information with other devices such as network equipment;

[0206] The processor is connected to the communication interface to implement information exchange with other devices and is used to execute the methods provided by one or more technical solutions on the terminal side when running a computer program. The computer program is stored in the memory.

[0207] Of course, in actual application, the various components in the terminal are coupled together through a bus system. It is understood that the bus system is used to achieve connection and communication between these components. In addition to the data bus, the bus system also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 13 Various buses are labeled as bus systems.

[0208] The memory in the embodiment of the present application is used to store various types of data to support the operation of the terminal. Examples of such data include: any computer program used to operate on the terminal.

[0209] It is understood that the memory can be volatile memory or non-volatile memory, or can include both volatile and non-volatile memory. Among them, non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disk, or compact disc read-only memory (CD-ROM); magnetic surface memory can be magnetic disk memory or tape memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0210] The methods disclosed in the above embodiments of the present application can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, the steps of the above methods can be completed by hardware integrated logic circuits in the processor or instructions in software form. The above processor may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in a memory. The processor reads the program in the memory and completes the steps of the above methods in combination with its hardware.

[0211] Optionally, when the processor executes the program, it implements the corresponding processes implemented by the terminal in each method of the embodiments of the present application, which will not be described here for the sake of brevity.

[0212] In an exemplary embodiment, the present application also provides a storage medium, namely, a computer storage medium, specifically a computer-readable storage medium, including, for example, a first memory storing a computer program. The computer program can be executed by a processor of a terminal to perform the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

[0213] In the several embodiments provided in this application, it should be understood that the disclosed devices, terminals and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0214] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0215] In addition, all functional units in the embodiments of the present application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the above-mentioned integrated units can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0216] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: mobile storage devices, ROM, RAM, disks or optical disks, etc. Various media that can store program codes.

[0217] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0218] It should be noted that the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0219] In addition, in the examples of this application, "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0220] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A network access control method, applied to a client installed in a terminal, characterized in that: The method comprises: Determining whether a data packet captured in a network protocol stack of the terminal is sent by the terminal, and obtaining a determination result; If the judgment result indicates that the data packet is sent by the terminal, adding a preset identifier to the data packet, and returning the data packet with the preset identifier to the network protocol stack to achieve sending the data packet to the peer device; the peer device and the terminal are located in the same local area network; When the judgment result indicates that the data packet is not sent by the terminal, based on whether a preset identifier exists in the data packet, it is determined whether to put the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal.

2. The method according to claim 1, characterized in that In a case where the judgment result indicates that the data packet is sent by the terminal, the method further includes: If a session corresponding to the data packet does not exist, create a session corresponding to the data packet; Accordingly, when the judgment result indicates that the data packet is not sent by the terminal, determining whether to put the data packet back into the network protocol stack based on whether a preset identifier exists in the data packet to send it to the application corresponding to the data packet in the terminal includes: If the judgment result indicates that the data packet is not sent by the terminal, judging whether a session corresponding to the received data packet exists; If a corresponding session exists, placing the data packet back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal; If there is no corresponding session, it is determined whether there is a preset identifier in the data packet. When it is determined that the preset identifier exists, a session is created and the data packet is put back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal.

3. The method according to claim 2, characterized in that The step of creating a session corresponding to the data packet when no session corresponding to the data packet exists includes: If a session corresponding to the data packet does not exist, create a session corresponding to the data packet and mark the session as active; If the corresponding session does not exist, determining whether a preset identifier exists in the data packet; when it is determined that the preset identifier exists, creating a session, and placing the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal, including: If no corresponding session exists, determining whether a preset identifier exists in the data packet; if it is determined that the preset identifier exists, creating a session, marking the session as passive, and returning the data packet to the network protocol stack to be sent to the application corresponding to the data packet in the terminal; Correspondingly, if a corresponding session exists, placing the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal includes: If there is a corresponding session, further determine whether the session is actively initiated or passively responded to; If initiated actively, the data packet is put back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal; If it is a passive response, it is determined whether there is a preset identifier in the data packet, and whether to put the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal.

4. The method according to claim 1, wherein The adding a preset identifier to the data packet includes: Determining a value of a setting field in an Internet Protocol (IP) message of the data packet; The value of the setting field is modified based on the setting rule to obtain the preset identifier.

5. The method according to claim 1, characterized in that Before determining whether the data packet captured in the network protocol stack of the terminal is sent by the terminal, the method further includes: Connect to the gateway settings; In the case where the authentication page pushed by the set gateway is successfully authenticated, the client is enabled to capture data packets and add a preset identifier to the data packets.

6. The method according to any one of claims 1 to 5, characterized in that Putting the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal includes: Deleting the preset identifier in the data packet; The data packet with the preset identifier deleted is put back into the network protocol stack to be sent to the application corresponding to the data packet in the terminal.

7. The method according to any one of claims 1 to 5, characterized in that The client implements data packet capture and modification operations on the terminal based on the WinDivert framework.

8. A network access control device, applied to a client installed in a terminal, characterized in that: include: A first judgment module is used to judge whether the data packet captured in the network protocol stack of the terminal is sent by the terminal, and obtain a judgment result; an adding module, configured to, if the judgment result indicates that the data packet is sent by the terminal, add a preset identifier to the data packet, and return the data packet with the preset identifier to the network protocol stack, so as to send the data packet to a peer device; the peer device and the terminal are located in the same local area network; A determination module is used to determine whether to put the data packet back into the network protocol stack to send it to the application corresponding to the data packet in the terminal based on whether there is a preset identifier in the data packet when the judgment result indicates that the data packet is not sent by the terminal.

9. A terminal comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the network admission control method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions. When the program instructions are executed by a processor, the processor executes the network admission control method according to any one of claims 1 to 7.

Images