Device access control method and system

Abstract

The present application discloses a device access control method and system. The method includes: obtaining application information sent by a dynamic host configuration protocol server, the application information including a first IP address applied by a first access device to the dynamic host configuration protocol server; when the first access device is legal, canceling the address spoofer's spoofing of the first IP address, and feeding back the device's legal access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server allocates the first IP address to the first access device; when the first access device is illegal, maintaining the address spoofer's spoofing of the first IP address, and feeding back the device's illegal access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server refuses to allocate the first IP address to the first access device. The present application solves the technical problem in the related art that when the address is automatically allocated through the dynamic host configuration protocol, there is a lack of access control for the device, which is prone to illegal device access.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a device access control method and system. Background Art

[0002] The Dynamic Host Configuration Protocol (DHCP) protocol is widely used in large local area network environments. Its main function is to centrally manage and allocate IP addresses so that hosts in the network environment can dynamically obtain IP addresses, Gateway addresses, DNS server addresses and other information, and effectively improve the utilization rate of addresses.

[0003] The DHCP protocol uses a client / server model, where the network host drives the task of allocating host addresses. When the DHCP server receives a request for an address from a network host, it sends the network host relevant address configuration information to achieve dynamic configuration of the network host address information. However, when allocating host addresses through the DHCP protocol, there is still a lack of control over device access, making it impossible to restrict access to devices that illegally access the network.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a device access control method and system to at least solve the technical problem in the related art that when the address is automatically allocated through the dynamic host configuration protocol, there is a lack of access control for the device, which easily leads to illegal access of the device.

[0006] According to one aspect of an embodiment of the present application, a device access control method is provided, which is applied to a dynamic host configuration protocol management platform, including: obtaining application information sent by a dynamic host configuration protocol server, wherein the application information includes a first IP address applied for by a first access device to the dynamic host configuration protocol server; when the first access device is legal, canceling the address spoofer's spoofing of the first IP address, and feeding back the device's legal access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server allocates the first IP address to the first access device, wherein the address spoofer is used to spoof an unallocated IP address; when the first access device is illegal, maintaining the address spoofer's spoofing of the first IP address, and feeding back the device's illegal access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server refuses to allocate the first IP address to the first access device.

[0007] Optionally, before obtaining the application information sent by the dynamic host configuration protocol server, it also includes: receiving and saving the first device information of all legitimate devices registered by the target object, wherein the first device information includes the media access control address information of the legitimate device; and sending the first device information to the address spoofer.

[0008] Optionally, the application information also includes second device information of the first access device. After obtaining the application information sent by the dynamic host configuration protocol server, it also includes: searching for the second device information from the saved first device information; when the second device information is found, determining that the first access device is legal; when the second device information is not found, determining that the first access device is illegal.

[0009] Optionally, before obtaining the application information sent by the dynamic host configuration protocol server, it also includes: sending an address list to the address spoofer, wherein the address list includes all unassigned IP addresses, the address spoofer is used to initialize itself and spoofer all unassigned IP addresses; receiving the initialization result returned by the address spoofer.

[0010] Optionally, canceling the spoofing of the first IP address by the address spoofer includes: sending a first control instruction for canceling the spoofing of the first IP address to the address spoofer, wherein the address spoofer is used to determine whether the first IP address has been spoofed, and if the first IP address has been spoofed, canceling the spoofing of the first IP address according to the first control instruction, and if the first IP address has not been spoofed, not performing any operation; and receiving the operation result returned by the address spoofer.

[0011] Optionally, maintaining the address spoofer's spoofing of the first IP address includes: sending a second control instruction for maintaining the spoofing of the first IP address to the address spoofer, wherein the address spoofer is configured to determine whether the first IP address has been spoofed, and when the first IP address has not been spoofed, spoofing the first IP address according to the second control instruction, and when the first IP address has been spoofed, not performing any operation; and receiving an operation result returned by the address spoofer.

[0012] Optionally, when the first access device is illegal, a first alarm message is issued, wherein the first alarm message is used to prompt that there is illegal device access that needs to be processed.

[0013] According to another aspect of an embodiment of the present application, a device access control method is also provided, which is applied to an address spoofer, including: obtaining message information broadcast by a second access device, wherein the message information includes a second IP address to be allocated to the second access device; sending confirmation information to a dynamic host configuration protocol management platform for confirming whether the second access device is legal, and receiving a confirmation result returned by the dynamic host configuration protocol management platform; when the confirmation result indicates that the second access device is legal, canceling the spoofing of the second IP address, and sending first update information for updating the address spoofing record information to the dynamic host configuration protocol management platform; when the confirmation result indicates that the second access device is illegal, spoofing the second IP address, and sending second update information for updating the address spoofing record information to the dynamic host configuration protocol management platform.

[0014] Optionally, canceling the spoofing of the second IP address includes: determining whether the second IP address has been spoofed; when the second IP address has been spoofed, canceling the spoofing of the second IP address; and when the second IP address has not been spoofed, not performing any operation.

[0015] Optionally, spoofing the second IP address includes: determining whether the second IP address has been spoofed; spoofing the second IP address when the second IP address has not been spoofed; and performing no operation when the second IP address has been spoofed.

[0016] Optionally, when the confirmation result indicates that the second access device is illegal, a second alarm message is issued, wherein the second alarm message is used to prompt that there is illegal device access that needs to be processed.

[0017] According to another aspect of an embodiment of the present application, a device access control system is also provided, including: a dynamic host configuration protocol server, a dynamic host configuration protocol management platform and an address spoofer, wherein the address spoofer is used to spoof an unassigned IP address; the dynamic host configuration protocol server is used to receive application information for applying for a first IP address sent by a first access device, and send the application information to the dynamic host configuration protocol management platform; the dynamic host configuration protocol management platform is used to determine whether the first access device is legal; when the first access device is legal, cancel the address spoofer's spoofing of the first IP address, and feedback the device's legal access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server allocates the first IP address to the first access device; when the first access device is illegal, keep the address spoofer's spoofing of the first IP address, and feedback the device's illegal access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server refuses to allocate the first IP address to the first access device.

[0018] According to another aspect of an embodiment of the present application, a device access control system is also provided, including: a dynamic host configuration protocol management platform and an address spoofer, wherein the address spoofer is used to obtain message information broadcast by a second access device, the message information including a second IP address to be allocated to the second access device; send confirmation information for confirming whether the second access device is legal to the dynamic host configuration protocol management platform, and receive a confirmation result returned by the dynamic host configuration protocol management platform; when the confirmation result indicates that the second access device is legal, cancel the spoofing of the second IP address, and send first update information for updating the address spoofing record information to the dynamic host configuration protocol management platform; when the confirmation result indicates that the second access device is illegal, spoof the second IP address, and send second update information for updating the address spoofing record information to the dynamic host configuration protocol management platform; the dynamic host configuration protocol management platform is used to confirm whether the second access device is legal.

[0019] According to another aspect of an embodiment of the present application, a non-volatile storage medium is further provided, the non-volatile storage medium including a stored program, wherein the device where the non-volatile storage medium is located executes the above-mentioned device access control method by running the program.

[0020] According to another aspect of an embodiment of the present application, an electronic device is further provided, comprising: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned device access control method through the computer program.

[0021] In an embodiment of the present application, the application information sent by the dynamic host configuration protocol server is obtained, wherein the application information includes the first IP address applied by the first access device to the dynamic host configuration protocol server; when the first access device is legal, the address spoofer cancels the spoofing of the first IP address, and the device legal access information is fed back to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server allocates the first IP address to the first access device, wherein the address spoofer is used to spoof unassigned IP addresses; when the first access device is illegal, the address spoofer keeps spoofing the first IP address, and the device illegal access information is fed back to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server refuses to allocate the first IP address to the first access device. Among them, by automatically allocating the address of the first access device, access restrictions on illegal devices are implemented, thereby preventing illegal devices from accessing the network, snooping on data transmitted in the network or attacking other devices in the network, ensuring the operation safety and data security of devices in the network, and thus solving the technical problem of lack of access control of devices when the address is automatically allocated by the dynamic host configuration protocol in the related technology, and easy occurrence of illegal access of devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0023] Figure 1 is a flow chart of an optional device admission control method according to an embodiment of the present application;

[0024] Figure 2 is a schematic diagram of an optional process of legal device registration according to an embodiment of the present application;

[0025] Figure 3 is a flowchart of an optional host configuration protocol management platform initialization according to an embodiment of the present application;

[0026] Figure 4 It is a flowchart of an optional device admission control method for automatically allocating addresses according to an embodiment of the present application;

[0027] Figure 5 is a flowchart of another optional device admission control method according to an embodiment of the present application;

[0028] Figure 6 is a flow chart of an optional device admission control method based on manually allocated addresses according to an embodiment of the present application;

[0029] Figure 7 is a schematic diagram of the structure of an optional device access control system according to an embodiment of the present application;

[0030] Figure 8 It is a structural diagram of another optional device access control system according to an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0032] It should be noted that the terms "first", "second", etc. in the specification, claims and drawings of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] In order to better understand the embodiments of the present application, some nouns or terms that appear in the description of the embodiments of the present application are first translated and explained as follows:

[0034] Address spoofer: Connected to the core switch, it can communicate and detect addresses with all switches and downstream devices in the network.

[0035] Example 1

[0036] Currently, when the dynamic host configuration server automatically assigns addresses, it lacks access control for devices, and thus cannot prevent illegal devices from accessing the network and snooping on data transmitted in the network or attacking other devices in the network, thus affecting the safe operation of devices in the network.

[0037] In order to solve the above problems, an embodiment of the present application provides a device access control method, which is applied to a dynamic host configuration protocol management platform. The specific process of the method will be described in detail below.

[0038] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0039] Figure 1 is a flow chart of an optional device admission control method according to an embodiment of the present application, such as Figure 1 As shown, the method at least includes steps S102-S106, wherein:

[0040] Step S102: Acquire application information sent by a dynamic host configuration protocol server, wherein the application information includes a first IP address applied by the first access device to the dynamic host configuration protocol server.

[0041] As an optional implementation, before obtaining the application information sent by the dynamic host configuration protocol server, the first device information of all legal devices registered by the target object can also be received and saved, wherein the first device information includes the media access control address information of the legal device; and then the first device information is sent to the address decoy to complete the registration of the legal device that has been connected.

[0042] Specifically, Figure 2 An optional legal device registration flow chart is shown, such as Figure 2 As shown in the figure, the administrator registers all legal device MAC addresses to the host configuration protocol management platform. After the host configuration protocol management platform completes the registration, the MAC addresses of all legal devices are sent to the address decoy device.

[0043] As an optional implementation, before obtaining the application information sent by the dynamic host configuration protocol server, an address list can also be sent to the address spoofer, wherein the address list includes all unassigned IP addresses, and the address spoofer is used to initialize itself and spoofer all unassigned IP addresses; the initialization result returned by the address spoofer is received to complete the initialization of the dynamic host configuration protocol server.

[0044] Specifically, Figure 3 A flowchart of an optional host configuration protocol management platform initialization is shown, such as Figure 3 As shown. According to the address information that needs to be spoofed recorded by the host configuration protocol management platform, the address list is first sent to the address spoofer; then the address spoofer initializes itself and publishes all unassigned IP addresses; finally, the host configuration protocol management platform receives the initialization result returned by the address spoofer.

[0045] In addition, the application information also includes the second device information of the first access device. Therefore, after obtaining the application information sent by the dynamic host configuration protocol server, the second device information can also be searched from the first device information of all saved legal devices; when the second device information is found, it is determined that the first access device is legal; when the second device information is not found, it is determined that the first access device is illegal.

[0046] Step S104, when the first access device is legitimate, cancel the address spoofer's spoofing of the first IP address, and feedback the device's legitimate access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server allocates the first IP address to the first access device, wherein the address spoofer is used to spoof unallocated IP addresses.

[0047] Specifically, the spoofing of the first IP address by the address spoofer can be canceled in the following manner: a first control instruction for canceling the spoofing of the first IP address is sent to the address spoofer, wherein the address spoofer is used to determine whether the first IP address has been spoofed, and when the first IP address has been spoofed, canceling the spoofing of the first IP address according to the first control instruction, and when the first IP address has not been spoofed, not performing any operation; and receiving the operation result returned by the address spoofer.

[0048] Step S106, when the first access device is illegal, the address spoofer keeps spoofing the first IP address, and feeds back the device illegal access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server refuses to allocate the first IP address to the first access device.

[0049] Specifically, the address spoofer can maintain the spoofing of the first IP address in the following manner: sending a second control instruction for maintaining the spoofing of the first IP address to the address spoofer, wherein the address spoofer is used to determine whether the first IP address has been spoofed, and when the first IP address has not been spoofed, spoofing the first IP address according to the second control instruction, and when the first IP address has been spoofed, not performing any operation; and receiving the operation result returned by the address spoofer.

[0050] Furthermore, the host configuration protocol management platform is also linked with the alarm system or network equipment to issue a first alarm message when the first access device is illegal, wherein the first alarm message is used to prompt that there is illegal device access that needs to be processed.

[0051] Specifically, Figure 4 A schematic diagram of an optional device access control process based on automatic address allocation is shown. Figure 4 The completion process of the device access control method in the embodiment of the present application is described.

[0052] When the first access device is legal, the first access device first initiates application information for the first IP address to the dynamic host configuration protocol server; then, the dynamic host configuration protocol server sends the application information carrying the first IP address to the host configuration protocol management platform to confirm the legitimacy of the first access device, and when the first access device is confirmed to be a legal device, a first control instruction for canceling the spoofing of the first IP address is sent to the address spoofer; then, the host configuration protocol management platform receives the operation result returned by the address spoofer, and replies to the dynamic host configuration protocol server that the first IP address can be allocated; finally, the dynamic host configuration protocol server allocates the first IP address X to the access device.

[0053] When the first access device is illegal, the first access device first initiates application information for the first IP address to the dynamic host configuration protocol server; then, the dynamic host configuration protocol server sends the application information carrying the first IP address to the host configuration protocol management platform to confirm the legitimacy of the first access device. When it is confirmed that the first access device is an illegal device, a second control instruction for maintaining the deception of the first IP address is sent to the address spoofer; then, the host configuration protocol management platform address spoofer returns the operation result and replies to the dynamic host configuration protocol server that the first IP address cannot be allocated. At the same time, the host configuration protocol management platform also issues a first alarm message to prompt illegal device access; finally, the dynamic host configuration protocol server refuses to allocate the first IP address to the access device.

[0054] In an embodiment of the present application, the application information sent by the dynamic host configuration protocol server is obtained, wherein the application information includes the first IP address applied by the first access device to the dynamic host configuration protocol server; when the first access device is legal, the address spoofer cancels the spoofing of the first IP address, and the device legal access information is fed back to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server allocates the first IP address to the first access device, wherein the address spoofer is used to spoof unallocated IP addresses; when the first access device is illegal, the address spoofer keeps spoofing the first IP address, and the device illegal access information is fed back to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server refuses to allocate the first IP address to the first access device. Among them, by automatically allocating the address of the first access device, access restrictions on illegal devices are implemented, thereby preventing illegal devices from accessing the network, snooping on data transmitted in the network, or attacking other devices in the network, ensuring the operation safety and data security of devices in the network, and thus solving the technical problem of lack of access control of devices when the dynamic host configuration protocol is automatically allocated in the related technology, and easy illegal access of devices.

[0055] Example 2

[0056] According to an embodiment of the present application, a device access control method is also provided. The method is applied to an address spoofer. The specific process of the method will be described in detail below.

[0057] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0058] Figure 5 is a flow chart of another optional device admission control method according to an embodiment of the present application, such as Figure 5 As shown, the method at least includes steps S502-S508, wherein:

[0059] Step S502: Acquire message information broadcast by the second access device, wherein the message information includes a second IP address to be allocated to the second access device.

[0060] Step S504: Send confirmation information for confirming whether the second access device is legal to the dynamic host configuration protocol management platform, and receive a confirmation result returned by the dynamic host configuration protocol management platform.

[0061] Step S506: when the confirmation result indicates that the second access device is legitimate, cancel the spoofing of the second IP address, and send first update information for updating the address spoofing record information to the dynamic host configuration protocol management platform.

[0062] Specifically, the spoofing of the second IP address can be canceled in the following manner: determine whether the second IP address has been spoofed; if the second IP address has been spoofed, cancel the spoofing of the second IP address; if the second IP address has not been spoofed, do not perform any operation.

[0063] Step S508: When the confirmation result indicates that the second access device is illegal, the second IP address is spoofed, and second update information for updating the address spoofing record information is sent to the dynamic host configuration protocol management platform.

[0064] Specifically, the second IP address may be spoofed in the following manner: determining whether the second IP address has been spoofed; spoofing the second IP address when the second IP address has not been spoofed; and not performing any operation when the second IP address has been spoofed.

[0065] Furthermore, when the confirmation result indicates that the second access device is illegal, a second alarm message is issued, wherein the second alarm message is used to prompt that there is illegal device access that needs to be processed.

[0066] Specifically, Figure 6 A schematic diagram of an optional device access control method based on manually allocated addresses is shown. Figure 6 The completion process of the device access control method in the embodiment of the present application is described.

[0067] When the second access device is legal, first, the second access device sends a message to the address spoofer, declaring the second IP address to be allocated to the second access device; then, the address spoofer sends confirmation information to the dynamic host configuration protocol management platform to confirm whether the second access device is legal, and the dynamic host configuration protocol management platform returns a confirmation result; then, when the confirmation result indicates that the second access device is legal, if the address spoofer has modified the second IP address, the spoofing of the second IP address is canceled; otherwise, no operation is performed; finally, the first update information for updating the address spoofing record information is sent to the dynamic host configuration protocol management platform.

[0068] When the second access device is illegal, first, the second access device sends a message to the address spoofer, declaring the second IP address to be allocated to the second access device; then, the address spoofer sends confirmation information to the dynamic host configuration protocol management platform to confirm whether the second access device is legal, and the dynamic host configuration protocol management platform returns the confirmation result; then, when the confirmation result indicates that the second access device is illegal, if the address spoofer has not spoofed the second IP address, it increases the spoofing of the second IP address; otherwise, no operation is performed, and at the same time, the address spoofer issues a second alarm message to prompt the existence of illegal device access; finally, second update information for updating the address spoofing record information is sent to the dynamic host configuration protocol management platform.

[0069] In an embodiment of the present application, the message information broadcast by the second access device is obtained, wherein the message information includes the second IP address to be allocated to the second access device; confirmation information for confirming whether the second access device is legal is sent to the dynamic host configuration protocol management platform, and the confirmation result returned by the dynamic host configuration protocol management platform is received; when the confirmation result indicates that the second access device is legal, the deception of the second IP address is canceled, and the first update information for updating the address deception record information is sent to the dynamic host configuration protocol management platform; when the confirmation result indicates that the second access device is illegal, the second IP address is decoyed, and the second update information for updating the address deception record information is sent to the dynamic host configuration protocol management platform. Among them, by manually assigning the address of the second access device, access restrictions on illegal devices are implemented, thereby preventing illegal devices from accessing the network, snooping on data transmitted in the network, or attacking other devices in the network, ensuring the operation safety and data security of devices in the network, and thus solving the technical problem of lack of access control of devices when the address is automatically assigned by the dynamic host configuration protocol in the related technology, and easy illegal access of devices.

[0070] Example 3

[0071] According to an embodiment of the present application, a device access control system for implementing the device access control method in Embodiment 1 is also provided. Figure 7 As shown, the device access control system 70 at least includes: an address spoofer 72, a dynamic host configuration protocol server 74 and a dynamic host configuration protocol management platform 76, wherein:

[0072] The address spoofer 72 is used to spoof unassigned IP addresses.

[0073] The dynamic host configuration protocol server 72 is used to receive application information for applying for a first IP address sent by the first access device, and send the application information to the dynamic host configuration protocol management platform 76.

[0074] The dynamic host configuration protocol management platform 76 is used to determine whether the first access device is legal; when the first access device is legal, cancel the address spoofer 72's spoofing of the first IP address, and feedback the device's legal access information to the dynamic host configuration protocol server 74, so that the dynamic host configuration protocol server 74 allocates the first IP address to the first access device; when the first access device is illegal, keep the address spoofer 72's spoofing of the first IP address, and feedback the device's illegal access information to the dynamic host configuration protocol server 74, so that the dynamic host configuration protocol server 74 refuses to allocate the first IP address to the first access device.

[0075] As an optional implementation, before the dynamic host configuration protocol management platform 76 receives the application information from the dynamic host configuration protocol server 72, the dynamic host configuration protocol management platform 76 can also receive and save the first device information of all legitimate devices registered with the target object, wherein the first device information includes the media access control address information of the legitimate device; and send the first device information to the address decoy 72 to complete the registration of all legitimate devices.

[0076] As another optional implementation, before the dynamic host configuration protocol management platform 76 receives the application information from the dynamic host configuration protocol server 72, the dynamic host configuration protocol management platform 76 can also send an address list to the address spoofer 72, wherein the address list includes all unassigned IP addresses, and the address spoofer is used to initialize itself and spoofer all unassigned IP addresses; receive the initialization result returned by the address spoofer 72 to complete the initialization of the dynamic host configuration protocol management platform 76.

[0077] Optionally, when the first access device is legitimate, the dynamic host configuration protocol management platform 76 may cancel the spoofing of the first IP address by the address spoofer 72 in the following manner: the dynamic host configuration protocol management platform 76 sends a first control instruction for canceling the spoofing of the first IP address to the address spoofer 72, wherein the address spoofer 72 is used to determine whether the first IP address has been spoofed, and when the first IP address has been spoofed, cancel the spoofing of the first IP address according to the first control instruction, and when the first IP address has not been spoofed, do not perform any operation; and receive the operation result returned by the address spoofer 72.

[0078] Optionally, when the first access device is illegal, the dynamic host configuration protocol management platform 76 may keep the address spoofer 72 spoofing the first IP address in the following manner: the dynamic host configuration protocol management platform 76 sends a second control instruction for keeping the first IP address spoofed to the address spoofer 72, wherein the address spoofer 72 is used to determine whether the first IP address has been spoofed, and when the first IP address has not been spoofed, spoof the first IP address according to the second control instruction, and when the first IP address has been spoofed, no operation is performed; and the operation result returned by the address spoofer 72 is received.

[0079] Furthermore, when the first access device is illegal, the dynamic host configuration protocol management platform 76 may also issue a first alarm message, wherein the first alarm message is used to prompt that there is an illegal device access that needs to be processed.

[0080] Example 4

[0081] According to an embodiment of the present application, a device access control system for implementing the device access control method in Embodiment 2 is also provided. Figure 8 As shown, the device access control system 80 at least includes: an address spoofer 82 and a dynamic host configuration protocol management platform 84, wherein:

[0082] The address spoofer 82 is used to obtain the message information broadcast by the second access device, the message information includes the second IP address to be allocated to the second access device; send confirmation information to the dynamic host configuration protocol management platform 82 to confirm whether the second access device is legal, and receive the confirmation result returned by the dynamic host configuration protocol management platform 82; when the confirmation result indicates that the second access device is legal, cancel the spoofing of the second IP address, and send the first update information for updating the address spoofing record information to the dynamic host configuration protocol management platform 82; when the confirmation result indicates that the second access device is illegal, spoof the second IP address, and send the second update information for updating the address spoofing record information to the dynamic host configuration protocol management platform 82.

[0083] Optionally, when the confirmation result indicates that the second access device is legitimate, the address spoofer 82 can cancel the spoofing of the second IP address in the following manner: determine whether the second IP address has been spoofed; when the second IP address has been spoofed, cancel the spoofing of the second IP address; when the second IP address has not been spoofed, do not perform any operation.

[0084] Optionally, when the confirmation result indicates that the second access device is illegal, the address spoofer 82 may spoof the second IP address in the following manner: determine whether the second IP address has been spoofed; spoof the second IP address when the second IP address has not been spoofed; and do not perform any operation when the second IP address has been spoofed.

[0085] Furthermore, when the confirmation result indicates that the second access device is illegal, the address spoofer 82 issues a second alarm message, wherein the second alarm message is used to prompt that there is an illegal device access that needs to be processed.

[0086] The dynamic host configuration protocol management platform 82 is used to confirm whether the second access device is legal.

[0087] Example 5

[0088] According to an embodiment of the present application, a non-volatile storage medium is also provided, which includes a stored program, wherein the device where the non-volatile storage medium is located executes the device access control method in Example 1 and Example 2 by running the program.

[0089] Optionally, the device where the non-volatile storage medium is located implements the following steps by running the program: obtaining application information sent by a dynamic host configuration protocol server, wherein the application information includes a first IP address applied for by a first access device to the dynamic host configuration protocol server; when the first access device is legal, canceling the address spoofer's spoofing of the first IP address, and feeding back the device's legal access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server allocates the first IP address to the first access device, wherein the address spoofer is used to spoof unallocated IP addresses; when the first access device is illegal, maintaining the address spoofer's spoofing of the first IP address, and feeding back the device's illegal access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server refuses to allocate the first IP address to the first access device.

[0090] Optionally, the device where the non-volatile storage medium is located can also implement the following steps by running the program: obtaining message information broadcast by the second access device, wherein the message information includes a second IP address to be allocated to the second access device; sending confirmation information to the dynamic host configuration protocol management platform to confirm whether the second access device is legal, and receiving a confirmation result returned by the dynamic host configuration protocol management platform; when the confirmation result indicates that the second access device is legal, canceling the spoofing of the second IP address, and sending first update information for updating the address spoofing record information to the dynamic host configuration protocol management platform; when the confirmation result indicates that the second access device is illegal, spoofing the second IP address, and sending second update information for updating the address spoofing record information to the dynamic host configuration protocol management platform.

[0091] According to an embodiment of the present application, a processor is also provided, which is used to run a program, wherein the device access control method in Example 1 and Example 2 is executed when the program is running.

[0092] Optionally, when the program is running, the following steps are executed: obtaining application information sent by a dynamic host configuration protocol server, wherein the application information includes a first IP address applied for by a first access device to the dynamic host configuration protocol server; when the first access device is legal, canceling the address spoofer's spoofing of the first IP address, and feeding back the device's legal access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server allocates the first IP address to the first access device, wherein the address spoofer is used to spoof unallocated IP addresses; when the first access device is illegal, maintaining the address spoofer's spoofing of the first IP address, and feeding back the device's illegal access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server refuses to allocate the first IP address to the first access device.

[0093] Optionally, the following steps can also be implemented when the program is executed: obtaining message information broadcast by the second access device, wherein the message information includes a second IP address to be allocated to the second access device; sending confirmation information to the dynamic host configuration protocol management platform to confirm whether the second access device is legal, and receiving a confirmation result returned by the dynamic host configuration protocol management platform; when the confirmation result indicates that the second access device is legal, canceling the spoofing of the second IP address, and sending first update information for updating the address spoofing record information to the dynamic host configuration protocol management platform; when the confirmation result indicates that the second access device is illegal, spoofing the second IP address, and sending second update information for updating the address spoofing record information to the dynamic host configuration protocol management platform.

[0094] According to an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the device access control method in Example 1 and Example 2 through the computer program.

[0095] Optionally, the processor is configured to execute the following steps through a computer program: obtaining application information sent by a dynamic host configuration protocol server, wherein the application information includes a first IP address applied for by a first access device to the dynamic host configuration protocol server; when the first access device is legal, canceling the address spoofer's spoofing of the first IP address, and feeding back the device's legal access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server allocates the first IP address to the first access device, wherein the address spoofer is used to spoof unallocated IP addresses; when the first access device is illegal, maintaining the address spoofer's spoofing of the first IP address, and feeding back the device's illegal access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server refuses to allocate the first IP address to the first access device.

[0096] Optionally, the processor is configured to execute the following steps through a computer program: obtaining message information broadcast by the second access device, wherein the message information includes a second IP address to be allocated to the second access device; sending confirmation information to the dynamic host configuration protocol management platform for confirming whether the second access device is legal, and receiving a confirmation result returned by the dynamic host configuration protocol management platform; when the confirmation result indicates that the second access device is legal, canceling the spoofing of the second IP address, and sending first update information for updating the address spoofing record information to the dynamic host configuration protocol management platform; when the confirmation result indicates that the second access device is illegal, spoofing the second IP address, and sending second update information for updating the address spoofing record information to the dynamic host configuration protocol management platform.

[0097] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0098] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0099] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0100] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0101] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0102] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0103] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A device access control method, applied to a dynamic host configuration protocol management platform, characterized in that: include: Acquire application information sent by a dynamic host configuration protocol server, wherein the application information includes a first IP address applied by the first access device to the dynamic host configuration protocol server; When the first access device is legitimate, cancel the address spoofer's spoofing of the first IP address, and feed back the device legitimate access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server allocates the first IP address to the first access device, wherein the address spoofer is used to spoof an unallocated IP address; When the first access device is illegal, keep the address spoofer spoofing the first IP address, and feedback the device illegal access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server refuses to allocate the first IP address to the first access device; The method of cancelling the spoofing of the first IP address by the address spoofer comprises: sending a first control instruction for cancelling the spoofing of the first IP address to the address spoofer, wherein the address spoofer is used to determine whether the first IP address has been spoofed, and cancelling the spoofing of the first IP address according to the first control instruction when the first IP address has been spoofed, and not performing any operation when the first IP address has not been spoofed; and receiving an operation result returned by the address spoofer; Among them, maintaining the address spoofer's spoofing of the first IP address includes: sending a second control instruction for maintaining the spoofing of the first IP address to the address spoofer, wherein the address spoofer is used to determine whether the first IP address has been spoofed, and when the first IP address has not been spoofed, spoofing the first IP address according to the second control instruction, and when the first IP address has been spoofed, not performing any operation; and receiving the operation result returned by the address spoofer.

2. The method according to claim 1, characterized in that Before obtaining the application information sent by the dynamic host configuration protocol server, the method further includes: Receive and save first device information of all legitimate devices registered by the target object, wherein the first device information includes media access control address information of the legitimate devices; The first device information is sent to the address spoofer.

3. The method according to claim 2, characterized in that The application information also includes second device information of the first access device. After obtaining the application information sent by the dynamic host configuration protocol server, the method further includes: Searching for the second device information from the saved first device information; When the second device information is found, determining that the first access device is legitimate; When the second device information is not found, it is determined that the first access device is illegal.

4. The method according to claim 1, characterized in that: Before obtaining the application information sent by the dynamic host configuration protocol server, the method further includes: Sending an address list to the address decoy, wherein the address list includes all unassigned IP addresses, and the address decoy is used to initialize itself and decoy all the unassigned IP addresses; Receive the initialization result returned by the address spoofer.

5. The method according to claim 1, characterized in that The method further comprises: When the first access device is illegal, a first alarm message is issued, wherein the first alarm message is used to prompt that there is illegal device access that needs to be processed.

6. A device access control method, applied to an address spoofer, characterized in that: include: Acquire message information broadcast by the second access device, wherein the message information includes a second IP address to be allocated to the second access device; Sending confirmation information for confirming whether the second access device is legal to a dynamic host configuration protocol management platform, and receiving a confirmation result returned by the dynamic host configuration protocol management platform; When the confirmation result indicates that the second access device is legitimate, canceling the deception of the second IP address, and sending first update information for updating the address deception record information to the dynamic host configuration protocol management platform; When the confirmation result indicates that the second access device is illegal, spoofing the second IP address, and sending second update information for updating the address spoofing record information to the dynamic host configuration protocol management platform; Wherein, cancelling the deception of the second IP address includes: determining whether the second IP address has been deceptive; when the second IP address has been deceptive, cancelling the deception of the second IP address; when the second IP address has not been deceptive, not performing an operation; Among them, spoofing the second IP address includes: determining whether the second IP address has been spoofed; spoofing the second IP address when the second IP address has not been spoofed; and not performing any operation when the second IP address has been spoofed.

7. The method according to claim 6, characterized in that The method further comprises: When the confirmation result indicates that the second access device is illegal, a second alarm message is issued, wherein the second alarm message is used to prompt that there is illegal device access that needs to be processed.

8. A device access control system, characterized in that: include: Dynamic host configuration protocol server, dynamic host configuration protocol management platform and address decoy, wherein, The address decoy is used to decoy unassigned IP addresses; The dynamic host configuration protocol server is used to receive application information for applying for a first IP address sent by the first access device, and send the application information to the dynamic host configuration protocol management platform; The dynamic host configuration protocol management platform is used to determine whether the first access device is legal; when the first access device is legal, cancel the address decoy device's decoy of the first IP address, and feedback the device's legal access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server allocates the first IP address to the first access device; when the first access device is illegal, keep the address decoy device's decoy of the first IP address, and feedback the device's illegal access information to the dynamic host configuration protocol server, so that the dynamic host configuration protocol server refuses to allocate the first IP address to the first access device; The method of cancelling the spoofing of the first IP address by the address spoofer comprises: sending a first control instruction for cancelling the spoofing of the first IP address to the address spoofer, wherein the address spoofer is used to determine whether the first IP address has been spoofed, and cancelling the spoofing of the first IP address according to the first control instruction when the first IP address has been spoofed, and not performing any operation when the first IP address has not been spoofed; and receiving an operation result returned by the address spoofer; Among them, maintaining the address spoofer's spoofing of the first IP address includes: sending a second control instruction for maintaining the spoofing of the first IP address to the address spoofer, wherein the address spoofer is used to determine whether the first IP address has been spoofed, and when the first IP address has not been spoofed, spoofing the first IP address according to the second control instruction, and when the first IP address has been spoofed, not performing any operation; and receiving the operation result returned by the address spoofer.

9. A device access control system, characterized in that: include: Dynamic Host Configuration Protocol management platform and address decoy, among which, The address spoofer is used to obtain message information broadcast by the second access device, wherein the message information includes a second IP address to be allocated to the second access device; send confirmation information to a dynamic host configuration protocol management platform for confirming whether the second access device is legal, and receive a confirmation result returned by the dynamic host configuration protocol management platform; when the confirmation result indicates that the second access device is legal, cancel the spoofing of the second IP address, and send first update information for updating the address spoofing record information to the dynamic host configuration protocol management platform; when the confirmation result indicates that the second access device is illegal, spoof the second IP address, and send second update information for updating the address spoofing record information to the dynamic host configuration protocol management platform; The dynamic host configuration protocol management platform is used to confirm whether the second access device is legal; Wherein, cancelling the deception of the second IP address includes: determining whether the second IP address has been deceptive; when the second IP address has been deceptive, cancelling the deception of the second IP address; when the second IP address has not been deceptive, not performing an operation; Among them, spoofing the second IP address includes: determining whether the second IP address has been spoofed; spoofing the second IP address when the second IP address has not been spoofed; and not performing any operation when the second IP address has been spoofed.

10. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored program, wherein the device where the non-volatile storage medium is located executes the device access control method described in any one of claims 1 to 5 or claims 6 to 7 by running the program.

11. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the device access control method described in any one of claims 1 to 5 or claims 6 to 7 through the computer program.

Images