A method for constructing a three-dimensional controllable cyberspace early warning framework based on IPv6 address coloring

Abstract

The embodiments of the present application relate to the field of network digital information communication, and in particular, to a method for constructing a three-dimensional controllable cyberspace early warning framework based on IPv6 address coloring. The method includes obtaining the asset attributes of the government and enterprise intranet environment, and classifying the asset attributes of the government and enterprise intranet environment; establishing IPv6 address coloring rules and establishing a government and enterprise intranet environment address library according to the classification of the asset attributes of the government and enterprise intranet environment; accessing the access terminal, assigning IPv6 addresses to the legal access terminal according to the IPv6 address coloring rules to access the network, and blocking and / or warning illegal access terminals; real-time monitoring of the accessed access terminal, and individually blocking and / or warning the access terminal when an abnormality is found, or blocking and / or warning in batches. Through the overall classification and coding of assets, refined management of the cyberspace can be achieved, and batch blocking or warning of the same type of equipment or the same type of services can be achieved, with extremely strong scalability and compatibility.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network digital information communication, and in particular to a method for constructing a controllable cyberspace early warning framework based on IPv6 address coloring. Background Art

[0002] The government and enterprise intranet environment is an autonomous and controllable network environment based on trusted devices and terminals, which can effectively improve network data security and network stability. However, the number of access groups in large government and enterprise intranets is huge, and network management and monitoring are becoming increasingly difficult. In the event of sudden network security, how to finely identify and block illegal access to government and enterprise networks for different terminal types is an urgent problem to be solved.

[0003] At the same time, due to the exhaustion of IPv4 address resources, networks and applications in various industries are currently evolving from IPv4 to IPv6 on a large scale, which has put forward higher requirements on how to utilize the huge amount of IPv6 address resources and the flexible configuration characteristics to coordinate network security governance. Summary of the invention

[0004] The embodiments of the present application provide a method for constructing a three-dimensional controllable cyberspace early warning framework based on IPv6 address coloring to solve the problem that terminal types cannot be finely identified and blocked in the existing government and enterprise network environment.

[0005] The method comprises the steps of:

[0006] Obtain the asset attributes of the government and enterprise intranet environment and classify the asset attributes of the government and enterprise intranet environment;

[0007] Establishing IPv6 address coloring rules according to the classification of asset attributes of the government and enterprise intranet environment, so that the designated host bit in the address encoding of the IPv6 address corresponds to the asset attribute classification of the government and enterprise intranet;

[0008] Establishing a government and enterprise intranet environment address library according to the classification of asset attributes of the government and enterprise intranet environment and IPv6 address coloring rules;

[0009] Access the access terminal, obtain the asset attributes of the access terminal, assign IPv6 addresses to legal access terminals according to IPv6 address coloring rules to access the network, and block and / or warn illegal access terminals;

[0010] The access behavior of the access terminals is monitored in real time. When an abnormality is found, the access terminals are individually blocked and / or warned according to the IPv6 address coloring rules, or access terminals with the same asset attribute classification are blocked and / or warned in batches.

[0011] The method of constructing a three-dimensional controllable cyberspace early warning framework based on IPv6 address coloring in the embodiment of the present application realizes refined management of cyberspace through overall classification and coding of digital assets. Relying on the native IPv6 address coding effect, batch blocking of the same type of equipment or the same type of business can be achieved, which has strong scalability and compatibility.

[0012] In one possible implementation, the classification of asset attributes of the government and enterprise intranet environment includes one or more classifications of MAC address, asset type, asset manufacturer, and asset model.

[0013] In a possible implementation, the establishing of IPv6 address coloring rules according to the classification of asset attributes of the government and enterprise intranet environment further includes:

[0014] Selecting available host bits in the interface ID of the IPv6 address according to the classification of asset attributes of the government and enterprise intranet environment;

[0015] The classification setting of the asset attributes of the government and enterprise intranet environment corresponding to the available host bits in the interface ID of the selected IPv6 address is assigned corresponding values.

[0016] In a possible implementation, the available host bits in the interface ID of the IPv6 address are bits 65-88.

[0017] In one possible implementation, the 65-88 available host bits are divided into a 65-72 bit segment, a 73-80 bit segment, and an 81-88 bit segment, wherein the 65-72 bit segment corresponds to the asset type, the 73-80 bit segment corresponds to the asset manufacturer, and the 81-88 bit segment corresponds to the asset model.

[0018] In a possible implementation manner, the access terminal further includes:

[0019] Obtaining an access request from an access terminal;

[0020] Perform access authentication on the access terminal;

[0021] Access, blocking and / or warning are performed according to the access authentication result.

[0022] In a possible implementation manner, obtaining an access request from an access terminal includes:

[0023] Use the MAC network sniffer to discover newly online access terminals;

[0024] Perform real-time comparison between the newly launched access terminal and the address database of the government and enterprise intranet environment.

[0025] In a possible implementation, the real-time monitoring of the access behavior of the access terminal includes:

[0026] Set the traffic baseline for access terminals;

[0027] Monitor in real time whether the data traffic of the access terminal exceeds the traffic baseline.

[0028] In a possible implementation manner, performing access authentication on the access terminal includes:

[0029] Deploy network access control and enable the switch 802.1x authentication function. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is a flow chart of the first embodiment of the present application;

[0031] Figure 2 A schematic diagram of the network space architecture of the second embodiment of the present application;

[0032] Figure 3 A schematic diagram of a process for establishing IPv6 address coloring rules in the third embodiment of the present application;

[0033] Figure 4 The display result on the network platform after executing the IPv6 coloring rule;

[0034] Figure 5 It is a flowchart of terminal access authentication in the first and third embodiments. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described in detail by way of implementation methods with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, but not all of the embodiments. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0036] In order to facilitate understanding of the technical solution principles in the embodiments of the present application, the specific technical content of the IPv6 address is first introduced.

[0037] IPv6 (Internet Protocol version 6) is the next-generation IP protocol designed by the Internet Engineering Task Force (IETF) to replace IPv4. The main purpose of IPv6 is to solve the problem of IPv4 address space exhaustion while providing other technical improvements such as enhanced security, better auto-configuration, and support for mobile devices. Based on the representation format of IPv6 addresses, IPv6 addresses have a huge capacity space that can cover the current and future extensive IP address requirements.

[0038] An IPv6 address consists of 128 bits (16 bytes) and is usually represented as 8 groups of 4 hexadecimal numbers, separated by colons (:) between each group. A notable feature of IPv6 addresses is their concise notation using colons for separation, and an abbreviated form can be used to further simplify the representation.

[0039] Representation methods of IPv6 addresses

[0040] Full representation:

[0041] For example: 2001:0db8:85a3:0000:0000:8a2e:0370:7334

[0042] Zero compression method:

[0043] If the value of a certain segment in the address is 0, then it can be replaced by a double colon (::), but the double colon can only be used once in the entire address to simplify the representation.

[0044] For example: 2001:db8:85a3::8a2e:370:7334 or 2001:0db8:85a3::8a2e:0370:7334

[0045] Omission of leading zeros:

[0046] In each group of 4 hexadecimal numbers, leading zeros can be omitted.

[0047] For example: 2001:db8:85a3:0:0:8a2e:370:7334 can be abbreviated as 2001:db8:85a3::8a2e:370:7334

[0048] In the above representation methods, the native IPv6 address can be represented as: <IPv6 prefix><IPv6 interface ID> according to the function division.

[0049] Among them:

[0050] IPv6 prefix: Used to identify the network part, consisting of a routing prefix and a subnet prefix, occupying the first 64 host bits.

[0051] IPv6 interface ID: used to identify a specific device on the network, occupying the last 64 host bits.

[0052] The first 64 host bits representing the IPv6 prefix are generally unchangeable, while the last 64 host bits representing the IPv6 interface ID can be specified as needed.

[0053] The first embodiment of the present application realizes the purpose of constructing a three-dimensional controllable network space based on the characteristics of the above-mentioned IPv6 address and combining the coloring rules of terminal attributes.

[0054] The coloration (coloration, dyeing, also refers to the general characteristics or features of something) rules described in the first embodiment of the present application can be understood as feature marking rules, feature classification rules or other rules for distinguishing different types of data.

[0055] Specifically, Figure 1 As shown, the method of the first embodiment includes the steps of:

[0056] S1. Obtain the asset attributes of the government and enterprise intranet environment and classify the asset attributes of the government and enterprise intranet environment;

[0057] The government and enterprise network in this embodiment includes but is not limited to the Internet of Things, data centers, and government and enterprise office networks.

[0058] The asset attribute classification of the government and enterprise intranet environment includes MAC address, asset type, asset manufacturer, asset model, etc.

[0059] MAC address stands for Media Access Control Address, also known as hardware address or physical address. It is a unique identifier of a network device at the physical layer. In a local area network, a MAC address is used to uniquely identify a device so that other devices can send data frames to it. Network communication: MAC address plays a key role in the data link layer. Each network device needs to have a unique MAC address to communicate with each other in a local area network. When a data frame is transmitted in the network, each device will check the target MAC address in the data frame. If the target address is consistent with its own MAC address, the data frame will be received; otherwise, the data frame will be discarded. MAC address can be used for device identity authentication, prevent illegal devices from accessing the network, and improve network security. At the same time, in some countries and regions, MAC address is required before the product is launched to ensure that the product meets local market compliance requirements. MAC address is used at the physical layer and is not affected by network layer protocols such as IP address. In the data link layer, each data frame contains the source MAC address and the destination MAC address. When a data frame is transmitted in the network, each device will determine whether the data frame belongs to itself based on the target MAC address and decide whether to receive it. If the target MAC address is consistent with its own MAC address, the data frame is received; otherwise, the data frame is discarded. This mechanism ensures that the data frame can be accurately transmitted to the target device.

[0060] According to the asset type, the assets in the government and enterprise intranet environment in this embodiment include devices and terminals connected to the government and enterprise intranet environment. The government and enterprise intranet environment equipment is routers, switches, servers, firewalls and other equipment used to build the government and enterprise intranet environment network. The terminals include computers, mobile phones and other network access terminals.

[0061] The asset manufacturer indicates the manufacturer of the device. The asset manufacturer and asset model are generally obtained from the MAC address. The MAC address consists of 6 bytes (48 bits) of hexadecimal numbers. These 6 bytes can be divided into two parts:

[0062] The first three bytes (24 bits): This part is called the Organizationally Unique Identifier (OUI), which is a code assigned to different manufacturers by the IEEE (Institute of Electrical and Electronics Engineers) registration authority. This code is used to uniquely identify network equipment manufacturers worldwide. Therefore, through the first three bytes of the MAC address, we can determine the manufacturer of the device.

[0063] The last three bytes (24 bits): This part is assigned by the manufacturer and is used to identify a specific device or product series produced by the manufacturer.

[0064] From the above asset attribute classification, it can be seen that the MAC address is the unique identifier of the asset. This embodiment implements precise security policies for a specific asset based on the control of the MAC address, while the asset type, asset manufacturer and asset model are batch identifiers. This embodiment implements batch security policies around these asset attributes.

[0065] S2. Establish IPv6 address coloring rules according to the classification of asset attributes of the government and enterprise intranet environment, so that the specified host bit in the address encoding of the IPv6 address corresponds to the asset attribute classification of the government and enterprise intranet;

[0066] After obtaining the asset attributes of the government and enterprise intranet environment, classify the devices and terminals according to the asset attributes of the government and enterprise intranet environment; then establish the IPv6 address coloring rules, and associate an IPv6 address with each government and enterprise intranet environment device and terminal in the government and enterprise intranet environment by corresponding to the classification of the asset attributes of the government and enterprise intranet environment by some bytes in the address encoding of the IPv6 address. From the above introduction to the encoding of the IPv6 address, it can be seen that the last 64 host bits of the IPv6 interface ID can be specified as needed, and in general network environments, they do not need to be fully occupied, and are often represented by 0000. At this time, several parts of the available host bits can be selected to represent the asset attributes of the government and enterprise intranet environment, so that the asset attributes of the government and enterprise intranet environment form a corresponding association with the IPv6 address.

[0067] S3. Establish a government and enterprise intranet environment address library based on the classification of asset attributes and IPv6 address coloring rules of the government and enterprise intranet environment;

[0068] The above-mentioned devices and terminals in the government and enterprise intranet environment and the IPv6 addresses associated therewith are established as an IPv6 address library for the government and enterprise intranet environment.

[0069] S4. Access the access terminal, obtain the asset attributes of the access terminal, assign IPv6 addresses to the legitimate access terminal according to the IPv6 address coloring rules to access the network, and block and / or warn the illegal access terminal;

[0070] When allocating IPv6 addresses, both static and dynamic IP addresses can be allocated based on unified IPv6 coloring rules.

[0071] Among them, a static IP address is an IP address that is assigned to a computer or network device for long-term use. This IP address is fixed unless the network administrator changes it manually. It is usually used in scenarios that require a stable network identity, such as servers.

[0072] A dynamic IP address is an IP address assigned to a device in a network that changes periodically. Dynamic IPs are dynamically assigned by the DHCP service and cannot be manually selected or changed by the user. Dynamic IP addresses are often used in scenarios such as home networks and small business networks to improve the utilization and flexibility of IP addresses.

[0073] Optionally, in this embodiment, static IP addresses are allocated to network devices and trusted terminals in the government and enterprise intranet environment, and dynamic IP addresses are allocated to terminals that have not been registered in advance, including non-trusted terminals.

[0074] When devices and terminals in the government and enterprise intranet environment are connected to the network, the asset information of the devices and terminals connected to the government and enterprise intranet environment can be obtained. The acquisition here can be automatic or manually specified. For example, MAC can be automatically obtained, and the asset manufacturer and asset model based on the MAC address can also be automatically obtained accordingly. The asset type can be entered manually. When the asset model cannot be parsed in the MAC, it can also be manually entered to obtain complete information. After obtaining the information, the corresponding IPv6 address is searched from the IPv6 address library of the government and enterprise intranet environment. If the corresponding IPv6 result can be queried, access to the network is allowed and an IPv6 address is allocated according to the IPv6 address library of the government and enterprise intranet environment; if the query result cannot be matched, access is blocked or other authentication measures are taken to further verify the legitimacy of the access.

[0075] S5. Monitor the access behavior of the access terminals in real time. When an abnormality is found, block and / or warn the access terminals individually according to the IPv6 address coloring rules, or block and / or warn the access terminals with the same asset attribute classification in batches.

[0076] Access terminals include trusted terminals and non-trusted terminals with verified access. In order to prevent trusted terminals and non-trusted terminals from initiating or being used to conduct illegal access and attacks, real-time monitoring of network access should be carried out on a regular basis. When abnormal access is found, individual blocking and group blocking can be performed based on the IPv6 address coloring rules of this embodiment. Individual blocking means that when it is found that the abnormal access terminal is an access terminal with a specific IPv6 address, access can be directly blocked based on its IPv6 address. When a group abnormality is found, the access terminals with the same machine bit identifier in the IPv6 address can be batch blocked according to the IPv6 address coloring rules.

[0077] When there is a sudden security incident, you can use external security hardware such as firewalls to block or release non-trusted terminals or designated classified terminals, and build a controllable, visible and secure network space. For example, if the IPv6 address 80-87 bits of a non-trusted terminal are 0xff, set a matching rule on the external security firewall to discard the source IPv6 address 80-87 bits 0xff, and all non-trusted terminals with IPv6 address 80-87 bits 0xff will be disconnected from the network;

[0078] The method of constructing a three-dimensional controllable cyberspace early warning framework based on IPv6 address coloring in the embodiment of the present application realizes refined management of cyberspace through overall classification and coding of digital assets. Relying on the native IPv6 address coding effect, batch blocking of the same type of equipment or the same type of business can be achieved, with strong scalability and compatibility, suitable for IPv4 / IPv6 dual-stack network environment or IPv6 single-stack network environment, and can be widely used in the construction of IPv6 cyberspace in government, enterprise, finance, education and other industries.

[0079] like Figure 2 As shown, the second embodiment of the present application discloses a deployment of the above method based on a three-dimensional hierarchical network space as shown in the figure, which includes:

[0080] Core Layer: The core layer is the backbone of the network, responsible for high-speed and efficient data transmission between various parts of the network. The core layer is usually composed of some high-speed, high-capacity devices, such as routers and switches.

[0081] At the core layer, the main task is to transfer data from one point to another as quickly as possible without complex processing or decision-making. The core layer connects different network components, such as the aggregation layer and the access layer. It is the main channel for data to flow in the network, so it needs to have high bandwidth and low latency to ensure that data can be transmitted quickly and efficiently. The main task of the core layer is to quickly transmit large amounts of data. Therefore, the core layer should use high-speed switching equipment to support high-speed data transmission in the network. Due to the importance of the core layer, network design should consider redundancy to avoid single points of failure. Use technologies such as redundant links and hot standby devices to ensure that the network can remain available in the event of a failure. In the event of a core layer failure, the network needs to be able to recover quickly. Fast fault detection and switching mechanisms can reduce the impact of network interruptions and ensure business continuity. The core layer should be kept as simple as possible and avoid complex packet operations. This helps improve the efficiency of data transmission and reduce potential points of failure.

[0082] The core layer equipment should have good fault tolerance and be able to handle high loads and abnormal situations to ensure network stability. Although the number of core layer equipment is relatively small, it should still be scalable. By using high-quality equipment, the core layer can be expanded without sacrificing performance.

[0083] Distribution Layer: The aggregation layer is located between the access layer and the core layer, and is responsible for connecting different access layer subnets. At the aggregation layer, traffic is aggregated and filtered, and isolation between departments is performed (through virtual LAN or VLAN technology). The aggregation layer (also called the distribution layer or aggregation layer) is located in the middle layer of the network. It is responsible for processing and distributing data from the access layer and sending it to the core layer. The devices in the aggregation layer usually need to have higher processing capabilities because they need to make more complex decisions, such as routing selection based on network policies. In addition, the aggregation layer is also where security policies and quality of service (QoS) control are implemented.

[0084] The aggregation layer works by aggregating traffic from the access layer and distributing it to other parts of the network, avoiding overloading the core layer while optimizing the performance of the entire network. The aggregation layer usually includes multiple switches and routers (or three-layer switches), each of which is connected to multiple devices in the access layer. The connection between these devices allows traffic to flow between different subnets. The aggregation layer itself acts as the boundary of the network, creating a relatively independent network block. These distribution blocks can route traffic from one block to another through the core layer. The advantage of the distribution block is that problems in one block will not spread to other parts of the network, thereby improving the availability and maintainability of the network. The aggregation layer is where network policies are applied, and access control, traffic restrictions, and other security policies can be implemented at this layer. This helps protect the network from unauthorized access and malicious behavior. The aggregation layer not only connects the access layer and the core layer, but also acts as an additional security layer between the access layer and the entire network. By implementing access control and other security measures, the aggregation layer enhances the overall security of the network.

[0085] In this embodiment, an IP address management system, a DHCP service, and a firewall are deployed at the convergence layer, wherein the IPv6 address management system is responsible for terminal registration and static IP address allocation, and the IPv6 address dynamic allocation system is responsible for dynamic IP address allocation, i.e., DHCP service. For example, the IPv6 address management system registers the terminal's MAC address, asset type, asset manufacturer, asset model, and other information for asset filing, and the DHCP service allocates addresses based on asset-specific attributes through manual coding.

[0086] The access layer is the entrance for terminals to access the network. The access layer is responsible for providing functions such as user access, authentication, and security policies, and also performs local traffic processing. Switches play a key role in this layer, connecting user devices to the network. In this embodiment, the access layer is the outermost layer of the network, which is responsible for connecting trusted terminals and non-trusted terminals. At the access layer, devices typically need to handle a large number of low-speed, low-capacity connections and provide various services such as Dynamic Host Configuration Protocol (DHCP) and Network Address Translation (NAT).

[0087] The access layer in this embodiment includes a layer 2 switching device and a layer 3 switching device.

[0088] In order to deploy IPv6 address rules in a standardized manner, the present application further includes a third embodiment based on the first embodiment. The third embodiment is substantially the same as the first embodiment in terms of network architecture deployment and coloring rule construction, and only further refines the IPv6 address coloring rules, such as Figure 3 As shown, in the third embodiment, the establishment of IPv6 address coloring rules according to the asset attributes of the government and enterprise intranet environment in step S2 of the first embodiment further includes:

[0089] S21. Select the available host bits in the interface ID of the IPv6 address according to the asset attribute classification,

[0090] S22. Assign corresponding values ​​to the asset attribute classification settings corresponding to the available host bits in the interface ID of the selected IPv6 address.

[0091] In this embodiment, the available host bits in the interface ID of the IPv6 address are bits 65-88.

[0092] Among them, combined with the encoding rules of the IPv6 address, the 65-88 available host bits in this embodiment are divided into 65-72 bit segment, 73-80 bit segment, and 81-88 bit segment. The 65-72 bit segment corresponds to the asset type, the 73-80 bit segment corresponds to the asset manufacturer, and the 81-88 bit segment corresponds to the asset model.

[0093] Different asset types can be represented by performing hexadecimal assignment on the 65-72 bit segment according to a preset assignment rule, for example, 11 represents a computer, 22 represents a server, 33 represents a router, 44 represents a switch, 66 represents a firewall, 77 represents a mobile phone, and FF represents a default.

[0094] Different asset manufacturers can be represented by performing hexadecimal assignment on the 73-80 bit segment according to a preset assignment rule, for example, 22 represents Huawei, 33 represents Xiaomi, 44 represents ZTE, 55 represents Cisco, 66 represents H3C, and FF represents default.

[0095] Different asset models can be represented by performing hexadecimal assignment on the 81-88 bit segment according to a preset assignment rule, for example, 11 represents P60, 22 represents matebook pro, 23 represents default, 33 represents macbook pro, 44 ​​represents FW7800, 55 represents ZTE5300, 66 represents MI13, 77 represents default, and ff represents default.

[0096] The default values ​​in the above assignment representations are reserved values ​​to be used when needed.

[0097] like Figure 4 As shown, after the deployment is performed according to the steps in the second embodiment, each device or terminal can be displayed and managed by category according to the IPv6 address in the network management system, and the codes and corresponding representation contents under each category can be displayed intuitively. Since the MAC address is the unique identifier of the device or terminal, it is not included in the above classification representation page.

[0098] like Figure 5 As shown, in the above first embodiment and the third embodiment, the access terminal further includes:

[0099] S41 obtains the access request of the access terminal;

[0100] S42. Perform access authentication on the access terminal;

[0101] S43. Perform access, blocking and / or warning according to the access authentication result.

[0102] In a possible implementation manner, obtaining an access request from an access terminal includes:

[0103] Use the MAC network sniffer to discover newly online access terminals;

[0104] Perform real-time comparison between the newly launched access terminal and the address database of the government and enterprise intranet environment.

[0105] The MAC network sniffer uses the network interface to intercept data packets destined for other computers. In the process of parsing the data packets, the sniffer extracts key information, such as source IP address, target IP address, source MAC address, target MAC address, etc. In the above embodiment, the MAC network sniffer is deployed at the access layer.

[0106] After real-time comparison of the newly launched access terminal with the address database of the government and enterprise intranet environment, the access terminal that complies with the IPv6 address rules can directly access the network.

[0107] In the first embodiment and the third embodiment, the real-time monitoring of the access behavior of the access terminal includes:

[0108] Set the traffic baseline for access terminals;

[0109] Monitor in real time whether the data traffic of the access terminal exceeds the traffic baseline.

[0110] The traffic baseline can be set manually or through baseline learning and warning: surf the Internet normally for one hour, and the IP behavior is normal at this time. The IP traffic baseline is set through data accumulation and calculation. This baseline is the basic traffic data of normal user behavior. When a large number of messages are sent. The IP address management system can effectively issue warnings and detect abnormal IPs in time. The network traffic is monitored through IP traffic probes, and then the original message can be traced back to troubleshoot the problem in conjunction with Kelai or Tiandan full traffic analysis system, or measures such as port blocking can be taken to prevent further expansion of network impact.

[0111] Optionally, performing access authentication on the access terminal includes:

[0112] Deploy network access control and enable the switch 802.1x authentication function.

[0113] The switch 802.1x authentication function is an efficient and secure means of network access control. It effectively protects network resources from unauthorized access threats through strict user identity authentication and port access control.

[0114] When a user / device needs to access the network, the 802.1x client program is started, the user name and password are entered, and a connection request is initiated;

[0115] After receiving the request, the switch will interact with the client of the user / device and ask for the user name information to be uploaded;

[0116] The client sends the user name information to the switch via a data frame, and the switch encapsulates the information and forwards it to the authentication server;

[0117] The authentication server compares the username information with the username list in the database and confirms the user's identity through a series of encrypted verification processes;

[0118] If the authentication is successful, the authentication server will send an instruction to the switch to allow the user's business flow to access the network through the port; if the authentication fails, the port will remain closed and only authentication information data will be allowed to pass.

[0119] The above description is only a preferred embodiment of the embodiment of the present application, and does not limit the patent scope of the embodiment of the present application. Any equivalent structure or equivalent process transformation made using the description and drawings of the embodiment of the present application, or directly or indirectly used in other related technical fields, is also included in the patent protection scope of the embodiment of the present application.

Claims

1. A method for constructing a three-dimensional controllable cyberspace early warning framework based on IPv6 address coloring, characterized in that: Includes steps: Obtain the asset attributes of the government and enterprise intranet environment and classify the asset attributes of the government and enterprise intranet environment; Establish IPv6 address coloring rules based on the asset attribute classification of the government and enterprise intranet environment, so that the specified host bit in the address encoding of the IPv6 address corresponds to the asset attribute classification of the government and enterprise intranet; Establishing a government and enterprise intranet environment address library according to the classification of asset attributes of the government and enterprise intranet environment and IPv6 address coloring rules; Access the access terminal, obtain the asset attributes of the access terminal, assign IPv6 addresses to legal access terminals according to IPv6 address coloring rules to access the network, and block and / or warn illegal access terminals; The access behavior of the access terminals is monitored in real time. When an abnormality is found, the access terminals are blocked and / or warned individually according to the IPv6 address coloring rules, or access terminals with the same asset attribute classification are blocked and / or warned in batches.

2. The method for constructing a three-dimensional controllable cyberspace early warning framework based on IPv6 address coloring as claimed in claim 1, characterized in that: The classification of asset attributes of the government and enterprise intranet environment includes one or more classifications of MAC address, asset type, asset manufacturer, and asset model.

3. The method for constructing a three-dimensional controllable cyberspace early warning framework based on IPv6 address coloring as claimed in claim 1, characterized in that: The establishment of IPv6 address coloring rules according to the classification of asset attributes of the government and enterprise intranet environment further includes: Selecting available host bits in the interface ID of the IPv6 address according to the classification of the asset attributes of the government and enterprise intranet environment; The classification setting of the asset attributes of the government and enterprise intranet environment corresponding to the available host bits in the interface ID of the selected IPv6 address is assigned corresponding values.

4. The method for constructing a three-dimensional controllable cyberspace early warning framework based on IPv6 address coloring as claimed in claim 3, characterized in that: The available host bits in the interface ID of the IPv6 address are bits 65-88.

5. The method for constructing a three-dimensional controllable cyberspace early warning framework based on IPv6 address coloring as claimed in claim 4, characterized in that: The available host bits are divided into 65-72 bit segment, 73-80 bit segment, and 81-88 bit segment. The 65-72 bit segment corresponds to the asset type, the 73-80 bit segment corresponds to the asset manufacturer, and the 81-88 bit segment corresponds to the asset model.

6. The method for constructing a three-dimensional controllable cyberspace early warning framework based on IPv6 address coloring as claimed in claim 1, characterized in that: The access terminal further comprises: Obtaining an access request from an access terminal; Perform access authentication on the access terminal; Access, blocking and / or warning are performed according to the access authentication result.

7. The method for constructing a three-dimensional controllable cyberspace early warning framework based on IPv6 address coloring as claimed in claim 6, characterized in that: The obtaining of the access request of the access terminal comprises: Use the MAC network sniffer to discover newly online access terminals; Perform real-time comparison between the newly launched access terminal and the address database of the government and enterprise intranet environment.

8. The method for constructing a three-dimensional controllable cyberspace early warning framework based on IPv6 address coloring as claimed in claim 7, characterized in that: The real-time monitoring of the access behavior of the access terminal includes: Set the traffic baseline for access terminals; Monitor in real time whether the data traffic of the access terminal exceeds the traffic baseline.

9. The method for constructing a three-dimensional controllable cyberspace early warning framework based on IPv6 address coloring as claimed in claim 6, characterized in that: The access authentication of the access terminal includes: Deploy network access control and enable the switch 802.1x authentication function.

Images