Access control method, system, device and storage medium based on IPv6 address coloring

Abstract

The present invention provides an access control method, system, device and storage medium based on IPv6 address coloring in the field of network data technology. The access control method includes: a DNS module receives a first network access request sent by a terminal; the first network access request is parsed to obtain the terminal IPv6 address; according to a first preset coloring policy configuration, the first coloring group configuration information of the terminal IPv6 address is obtained; according to the first preset IPv6 address policy table of each application DNS and the first coloring group configuration information of the terminal IPv6 address, the DNS application access policy is obtained; according to the DNS application access policy, the application DNS corresponding to the application IPv6 address allowed to be accessed by the terminal is obtained; the application IPv6 address is fed back to the terminal, so that the terminal generates a second network access request and sends it to the gateway, and the corresponding application access is performed through the gateway. The present invention can effectively realize the control of different resources accessed by different terminals of an enterprise, and ensure the flexibility in the IPv6 scenario.

Description

Technical Field

[0001] The present invention relates to the field of network data technology, and in particular to an access control method, system, device and storage medium based on IPv6 address coloring. Background Art

[0002] As a basic network resource, IPv6 has many advantages, but the promotion of IPv6 also brings many problems, mainly including the change in the length of IPv6 addresses, which leads to changes in the original IPv4 subnet management strategy. In traditional management and control methods, in traditional scenarios, as long as the access terminal complies with the ACL configuration rules, the terminal can be highly secure, which cannot meet the needs of enterprises for targeted resource control of different terminals. Summary of the invention

[0003] In view of this, the present invention provides an access control method, system, device and storage medium based on IPv6 address coloring, which can effectively realize the control of different resource access by different terminals of an enterprise, meet the actual needs of the enterprise, and ensure the flexibility in the IPv6 scenario.

[0004] The present invention provides the following technical solutions:

[0005] An access control method based on IPv6 address coloring is applied to an access control system, the access control system includes a DNS module; the access control method includes:

[0006] The DNS module receives a first network access request sent by the terminal;

[0007] The DNS module parses the first network access request to obtain the IPv6 address of the terminal as the terminal IPv6 address;

[0008] The DNS module obtains first coloring group configuration information of the terminal IPv6 address according to the first preset coloring strategy configuration;

[0009] The DNS module obtains the DNS application access policy of the terminal IPv6 address according to the first preset IPv6 address policy table of each application DNS and the first coloring group configuration information of the terminal IPv6 address;

[0010] The DNS module obtains the application DNS corresponding IPv6 address allowed to be accessed by the terminal as the application IPv6 address according to the DNS application access policy of the terminal IPv6 address;

[0011] The DNS module feeds back the application IPv6 address to the terminal, so that the terminal generates a second network access request and sends it to the gateway, and performs corresponding application access through the gateway.

[0012] Preferably, the access control system further includes a network management and control module; and the access control method further includes:

[0013] The network control module obtains a second network access request sent by the terminal to the gateway;

[0014] The network control module parses the second network access request to obtain the IPv6 address of the terminal as the terminal IPv6 address;

[0015] The network control module obtains the second coloring grouping configuration information of the terminal IPv6 address according to the second preset coloring strategy configuration;

[0016] The network control module obtains the IPv6 application access policy of the terminal IPv6 address according to the second preset IPv6 address policy table of each application IPv6 address and the second coloring group configuration information of the terminal IPv6 address;

[0017] The network control module determines whether to allow the terminal to access the corresponding application based on the IPv6 application access policy of the terminal's IPv6 address;

[0018] When the network control module determines that the terminal is allowed to access the corresponding application, the control gateway executes the access operation of the corresponding application. When it determines that the terminal is not allowed to access the corresponding application, the control gateway blocks the access operation of the corresponding application.

[0019] Preferably, according to the preset coloring strategy configuration, before obtaining the coloring group configuration information of the terminal IPv6 address, it also includes:

[0020] Divide the IPv6 addresses of different enterprise services and / or users into different IPv6 address coloring groups, and perform corresponding address coloring on the IPv6 addresses in different IPv6 address coloring groups to obtain a preset coloring strategy configuration;

[0021] The preset coloring strategy configuration includes a first preset coloring strategy configuration and a second preset coloring strategy configuration, and the coloring group configuration information includes a first coloring group configuration information and a second coloring group configuration information.

[0022] Preferably, performing corresponding address coloring for the IPv6 addresses in different IPv6 address coloring groups respectively includes:

[0023] Determine the type of shading currently set;

[0024] If the coloring type is IPv6 prefix coloring, the prefix of the IPv6 address in each IPv6 address coloring group is colored accordingly;

[0025] If the coloring type is IPv6 code coloring, corresponding address coloring is performed for any segment code of the IPv6 address in each IPv6 address coloring group.

[0026] Preferably, according to the preset IPv6 address policy configuration table of each application DNS / application IPv6 address and the coloring group configuration information of the terminal IPv6 address, obtaining the DNS application access policy / IPv6 application access policy of the terminal IPv6 address includes:

[0027] Obtain a mapping relationship table between each application DNS / application IPv6 address and each IPv6 address color group;

[0028] Based on the mapping relationship table and the color group configuration information of the terminal IPv6 address, the corresponding DNS application access policy / IPv6 application access policy is obtained;

[0029] Among them, the preset IPv6 address policy configuration table includes a first preset IPv6 address policy table and a second preset IPv6 address policy table, and the coloring group configuration information includes first coloring group configuration information and second coloring group configuration information.

[0030] Preferably, before the DNS module obtains the application DNS corresponding IPv6 address allowed to be accessed by the terminal as the application IPv6 address, it also includes:

[0031] The DNS module analyzes DNS application access policies;

[0032] If the analysis determines that the terminal IPv6 address is in the whitelist of the corresponding application DNS, the step of obtaining the application DNS corresponding IPv6 address allowed to be accessed by the terminal as the application IPv6 address is performed based on various DNS functions;

[0033] If the analysis determines that the terminal IPv6 address is in the blacklist of the corresponding application DNS, it is determined that the application IPv6 address cannot be obtained based on the DNS function, and information that the request failed is fed back to the terminal, or, based on the DNS function of only some specified items, the step of obtaining the application DNS corresponding IPv6 address that the terminal is allowed to access as the application IPv6 address is executed;

[0034] Among them, DNS functions include authoritative function, forwarding function and recursive function.

[0035] Preferably, the network control module determines whether to allow the terminal to access the corresponding application according to the IPv6 application access policy of the terminal IPv6 address, including:

[0036] The network control module analyzes IPv6 application access policies;

[0037] If the analysis determines that the terminal IPv6 address is in the whitelist of the corresponding application IPv6 address, then determine to allow the terminal to access the corresponding application;

[0038] If the analysis determines that the terminal IPv6 address is in the blacklist of the corresponding application IPv6 address, it is determined that the terminal is not allowed to access the corresponding application.

[0039] An access control system based on IPv6 address coloring, the access control system includes a DNS module, the DNS module is used for:

[0040] Receiving a first network access request sent by a terminal;

[0041] Parsing the first network access request to obtain the IPv6 address of the terminal as the terminal IPv6 address;

[0042] According to the first preset coloring strategy configuration, obtain first coloring group configuration information of the terminal IPv6 address;

[0043] Obtaining a DNS application access policy for the terminal IPv6 address according to a first preset IPv6 address policy table for each application DNS and first coloring group configuration information for the terminal IPv6 address;

[0044] According to the DNS application access policy of the terminal IPv6 address, the corresponding IPv6 address of the application DNS that the terminal is allowed to access is obtained as the application IPv6 address;

[0045] The application IPv6 address is fed back to the terminal, so that the terminal generates a second network access request and sends it to the gateway, and performs corresponding application access through the gateway.

[0046] An access control device based on IPv6 address coloring, the device includes a memory and a processor, and the program stored in the memory can implement the steps of the above-mentioned access control method when being executed by the processor.

[0047] A storage medium, wherein when a program stored in the storage medium is executed by a processor, the steps of the access control method described above are implemented.

[0048] The present invention provides an access control method, system, device and storage medium based on IPv6 address coloring, and the access control method includes: an access control method based on IPv6 address coloring, which is applied to an access control system, and the access control system includes a DNS module; the access control method includes: the DNS module receives a first network access request sent by a terminal; the DNS module parses the first network access request to obtain the IPv6 address of the terminal as the terminal IPv6 address; the DNS module obtains the first coloring group configuration information of the terminal IPv6 address according to the first preset coloring policy configuration; the DNS module obtains the DNS application access policy of the terminal IPv6 address according to the first preset IPv6 address policy table of each application DNS and the first coloring group configuration information of the terminal IPv6 address; the DNS module obtains the application DNS corresponding IPv6 address allowed to be accessed by the terminal according to the DNS application access policy of the terminal IPv6 address as the application IPv6 address; the DNS module feeds back the application IPv6 address to the terminal, so that the terminal generates a second network access request and sends it to a gateway, and performs corresponding application access through the gateway.

[0049] In the present invention, when a terminal needs to access a network application, the terminal IPv6 address coloring configuration policy is used to determine the terminal IPv6 address coloring group configuration information, and then the terminal is determined to have accessible applications based on the terminal IPv6 address coloring group configuration information and the preset IPv6 address policy configuration table of the application DNS, and the corresponding IPv6 address is fed back to the terminal, so that the terminal can access the application based on this. It can be seen that the present invention realizes the coloring of the corresponding IPv6 address based on different terminals, and then realizes the network application access control based on the coloring result, which can effectively realize the enterprise's different terminals access to different resource management and control, meet the actual enterprise needs, and ensure the flexibility in the IPv6 scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0051] Figure 1 It is a flow chart of an access control method based on IPv6 address coloring provided according to an embodiment of the present invention;

[0052] Figure 2 It is a flowchart of the steps for implementing a network control module in an access control method based on IPv6 address coloring provided in an embodiment of the present invention;

[0053] Figure 3 It is a flow chart of performing corresponding address coloring for IPv6 addresses in different IPv6 address coloring groups in an access control method based on IPv6 address coloring provided by an embodiment of the present invention;

[0054] Figure 4 It is a flow chart of a DNS module performing corresponding operations based on a DNS application access policy in an access control method based on IPv6 address coloring provided in an embodiment of the present invention;

[0055] Figure 5 It is a flow chart of a network control module performing corresponding operations based on an IPv6 application access policy in an access control method based on IPv6 address coloring provided according to an embodiment of the present invention;

[0056] Figure 6 It is an interactive implementation diagram of an access control method based on IPv6 address coloring provided according to an embodiment of the present invention;

[0057] Figure 7 This is a first structural diagram of an access control system based on IPv6 address coloring provided according to an embodiment of the present invention;

[0058] Figure 8 It is a second structural diagram of an access control system based on IPv6 address coloring provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0060] See also Figure 1 , which shows an access control method based on IPv6 address coloring provided by an embodiment of the present invention, which can be applied to an access control system, the access control system includes a DNS module; the access control method includes:

[0061] S11: The DNS module receives a first network access request sent by the terminal.

[0062] When the terminal needs to access a network application (referred to as an application for short), it may send a network access request to the DNS module, and the network access request may carry the domain name (DNS) / IPv6 address of the terminal.

[0063] S12: The DNS module parses the first network access request to obtain the IPv6 address of the terminal as the terminal IPv6 address.

[0064] After receiving the first network access request, the DNS module parses the first network access request, obtains the domain name of the terminal and converts it into a corresponding IPv6 address, or directly obtains the terminal IPv6 address.

[0065] S13: The DNS module obtains first coloring grouping configuration information of the terminal IPv6 address according to the first preset coloring strategy configuration.

[0066] A corresponding IPv6 address coloring group (referred to as a group) is pre-assigned to each IPv6 address, and different groups have different address coloring; the first preset coloring strategy configuration refers to a pre-set specific configuration for address coloring of IPv6 addresses in different groups, and the first coloring group configuration information refers to a pre-set specific configuration of the group to which each IPv6 address belongs, thereby being able to determine the grouping of the terminal's IPv6 address.

[0067] S14: The DNS module obtains the DNS application access policy of the terminal IPv6 address according to the first preset IPv6 address policy table of each application DNS and the first coloring group configuration information of the terminal IPv6 address.

[0068] The first preset IPv6 address policy table contains, for each application DNS, IPv6 address coloring groups that are allowed to access and IPv6 address coloring groups that are not allowed to access, so that based on the first preset IPv6 address policy table, it can be determined which groups can access a certain application DNS and which groups cannot access a certain application DNS.

[0069] Based on the first preset IPv6 address policy table and the first colored group configuration information of the terminal IPv6 address, it is possible to know whether the terminal can access each application DNS, thereby obtaining the DNS application access policy containing the information.

[0070] S15: The DNS module obtains the application DNS corresponding IPv6 address allowed to be accessed by the terminal as the application IPv6 address according to the DNS application access policy of the terminal IPv6 address.

[0071] Specifically, based on the DNS application access policy, it can determine whether the terminal is allowed to access each application DNS, obtain the IPv6 address of the application DNS allowed to be accessed by the terminal, and feed back the IPv6 address to the terminal so that the terminal can access the corresponding application based on this; otherwise, it is considered that the terminal is not allowed to access the application it needs to access.

[0072] S16: The DNS module feeds back the application IPv6 address to the terminal, so that the terminal generates a second network access request and sends it to the gateway, and performs corresponding application access through the gateway.

[0073] In the present invention, when a terminal needs to access a network application, the terminal IPv6 address coloring configuration policy is used to determine the terminal IPv6 address coloring group configuration information, and then the terminal is determined to have accessible applications based on the terminal IPv6 address coloring group configuration information and the preset IPv6 address policy configuration table of the application DNS, and the corresponding IPv6 address is fed back to the terminal, so that the terminal can access the application based on this. It can be seen that the present invention realizes the coloring of the corresponding IPv6 address based on different terminals, and then realizes the network application access control based on the coloring result, which can effectively realize the enterprise's different terminals access to different resource management and control, meet the actual enterprise needs, and ensure the flexibility in the IPv6 scenario.

[0074] An access control method based on IPv6 address coloring provided by an embodiment of the present invention, the access control system also includes a network management and control module, after executing the above steps S11 to S16, as follows Figure 2 As shown, the access control method can also perform the following steps:

[0075] S21: The network management and control module obtains a second network access request sent by the terminal to the gateway;

[0076] S22: The network control module parses the second network access request to obtain the IPv6 address of the terminal as the terminal IPv6 address;

[0077] S23: The network control module obtains second coloring grouping configuration information of the terminal IPv6 address according to the second preset coloring strategy configuration;

[0078] S24: The network control module obtains the IPv6 application access policy of the terminal IPv6 address according to the second preset IPv6 address policy table of each application IPv6 address and the second coloring group configuration information of the terminal IPv6 address;

[0079] S25: The network control module determines whether to allow the terminal to access the corresponding application according to the IPv6 application access policy of the terminal IPv6 address;

[0080] S26: When the network control module determines that the terminal is allowed to access the corresponding application, the network control module controls the gateway to perform the access operation of the corresponding application. When the network control module determines that the terminal is not allowed to access the corresponding application, the network control module controls the gateway to block the access operation of the corresponding application.

[0081] The second network access request may carry the domain name (DNS) / IPv6 address of the terminal and the IPv6 address of the application that the terminal needs to access. After receiving the second network access request, the network management and control module parses the second network access request, obtains the IPv6 address of the application that the terminal needs to access, and the terminal domain name and converts it into the corresponding IPv6 address, or directly obtains the IPv6 address of the terminal and the IPv6 address of the application that the terminal needs to access.

[0082] The second preset coloring strategy configuration has the same principle as the first preset coloring strategy configuration, and the specific contents may be the same or different, and may be set according to actual needs; the same applies to the first coloring group configuration information and the second coloring group configuration information.

[0083] The second preset IPv6 address policy table contains, for each application IPv6 address, IPv6 address coloring groups that are allowed to access and IPv6 address coloring groups that are not allowed to access, so that based on the second preset IPv6 address policy table, it can be determined which groups can access a certain application IPv6 address and which groups cannot access a certain application IPv6 address.

[0084] Based on the second preset IPv6 address policy table and the second colored group configuration information of the terminal IPv6 address, it is possible to know whether the terminal can access the application IPv6 address it wants to access, thereby obtaining the IPv6 application access policy containing this information.

[0085] Based on the IPv6 application access policy, it can be determined whether the terminal is allowed to access the IPv6 address of the application it needs to access. If so, the control gateway performs the access operation of the corresponding application. Otherwise, the control gateway blocks the access operation of the corresponding application. Among them, bypass blocking technology can be used to block the access network and thus block the access operation to the corresponding application. The bypass blocking technology may include: sending TCP Reset packets, linking with the gateway, ARP blocking, etc. TCP Reset implements TCP blocking.

[0086] An access control method based on IPv6 address coloring provided by an embodiment of the present invention may further include:

[0087] Divide the IPv6 addresses of different enterprise services and / or users into different IPv6 address coloring groups, and perform corresponding address coloring on the IPv6 addresses in different IPv6 address coloring groups to obtain a preset coloring strategy configuration;

[0088] The preset coloring strategy configuration includes a first preset coloring strategy configuration and a second preset coloring strategy configuration, and the coloring group configuration information includes a first coloring group configuration information and a second coloring group configuration information.

[0089] It should be noted that enterprise services and users can be set according to actual needs. For example, the actual business of the enterprise may include video services, terminal office, business production, etc., and the users of the enterprise may include visitors, business personnel, branch personnel, department personnel, managers, etc., and then the IPv6 address coloring group corresponding to each enterprise business and / or user is different. For example, the IPv6 address of each enterprise business is placed in the same IPv6 address coloring group, and the IPv6 address of each user is placed in the same IPv6 address coloring group, and the IPv6 addresses of different enterprise services and user combinations are placed in the same IPv6 address coloring group. The specific settings can be made according to actual needs.

[0090] After the IPv6 address coloring groups are divided, the IPv6 addresses in each IPv6 address coloring group are colored accordingly, so that the specific positions in the IPv6 addresses in the same IPv6 address coloring group have the same coding, and the specific positions in the IPv6 addresses in different IPv6 address coloring groups have different coding, so that the IPv6 address coloring group to which the IPv6 address belongs can be known based on the coding of the specific position.

[0091] An access control method based on IPv6 address coloring is provided in an embodiment of the present invention, such as Figure 3 As shown, performing corresponding address coloring for the IPv6 addresses in different IPv6 address coloring groups may include:

[0092] S31: Determine the currently set coloring type;

[0093] S32: If the coloring type is IPv6 prefix coloring, then perform corresponding address coloring on the prefixes of the IPv6 addresses in each IPv6 address coloring group;

[0094] S33: If the coloring type is IPv6 code coloring, corresponding address coloring is performed for any segment code of the IPv6 address in each IPv6 address coloring group.

[0095] It should be noted that when performing IPv6 address coloring configuration, first divide the enterprise business and users into different IPv6 address coloring groups, and establish corresponding IPv6 coloring policy configurations to set specific coloring configuration information for different businesses and users.

[0096] In this solution, after the IPv6 address coloring groups are divided, the enterprise business and user range that require access control can be defined. At the same time, combined with the enterprise IPv6 address planning, the attributes of each coloring business are configured, including the IPv6 coloring type and range, where the coloring type can include IPv6 prefix coloring and IPv6 code coloring.

[0097] IPv6 prefix coloring mode, input IPv6 address prefix and length, output IPv6 address range, that is, the address range that the coloring address configuration needs to control. Let P be the input IPv6 address prefix, L is the input prefix length, and the IPv6 address start {start address S, end address E} is calculated as:

[0098] S=P

[0099] E=P+(2(128-L)-1)

[0100] So the IPv6 colored address range = {S, S+1, S+2,…, E}.

[0101] IPv6 encoding coloring mode, input IPv6 bit width range and bit width encoding, purpose and other information. Different from IPv6 prefix coloring mode, IPv6 encoding coloring mode can define coloring according to any segment of the 128-bit IPv6 address, and then perform access control based on only one segment of the encoding.

[0102] It should also be noted that address coloring can be understood as setting the code of a specific location to a value corresponding to the IPv6 address coloring group to which it belongs. For example, in this example, three types of services, namely video service, terminal office, and business production, are used for illustration. "001" can represent "video service"; "0102" can represent "terminal office"; and "0103" can represent "business production".

[0103] An access control method based on IPv6 address coloring provided by an embodiment of the present invention obtains the DNS application access policy / IPv6 application access policy of the terminal IPv6 address according to the preset IPv6 address policy configuration table of each application DNS / application IPv6 address and the coloring group configuration information of the terminal IPv6 address, which may include:

[0104] Obtain a mapping relationship table between each application DNS / application IPv6 address and each IPv6 address color group;

[0105] Based on the mapping relationship table and the color group configuration information of the terminal IPv6 address, the corresponding DNS application access policy / IPv6 application access policy is obtained;

[0106] Among them, the preset IPv6 address policy configuration table includes a first preset IPv6 address policy table and a second preset IPv6 address policy table, and the coloring group configuration information includes first coloring group configuration information and second coloring group configuration information.

[0107] The present invention configures the IPv6 policy for network application access, establishes a mapping between network access and IPv6 address coloring group information in the network control function, and realizes the control policy grouping of different terminals. The mapping mainly refers to the mapping between the IPv6 address coloring group and the application DNS / application IPv6 address, and a mapping relationship table containing the mapping relationship can be generated, and then the corresponding application access policy can be obtained based on the mapping relationship table.

[0108] An access control method based on IPv6 address coloring is provided in an embodiment of the present invention, such as Figure 4 As shown, before the DNS module obtains the application DNS corresponding IPv6 address allowed to be accessed by the terminal as the application IPv6 address, it may also include:

[0109] S41: DNS module analyzes DNS application access policy;

[0110] S42: If the analysis determines that the terminal IPv6 address is in the whitelist of the corresponding application DNS, a step of obtaining an application DNS corresponding IPv6 address that the terminal is allowed to access as the application IPv6 address is performed based on various DNS functions;

[0111] S43: If the analysis determines that the terminal IPv6 address is in the blacklist of the corresponding application DNS, it is determined that the application IPv6 address cannot be obtained based on the DNS function, and information that the request failed is fed back to the terminal, or, based on the DNS function of only some specified items, a step of obtaining the application DNS corresponding IPv6 address allowed to be accessed by the terminal as the application IPv6 address is performed;

[0112] Among them, DNS functions include authoritative function, forwarding function and recursive function.

[0113] In an embodiment of the present invention, the DNS module can set corresponding black and white lists. If the DNS application access policy indicates that the terminal IPv6 address is in the white list of the application DNS to be accessed, the step of obtaining the application IPv6 address can be performed based on the various functions of the DNS. If the DNS application access policy indicates that the terminal IPv6 address is in the black list of the application DNS to be accessed, the authority (i.e., authoritative resolution), forwarding and recursive functions in the DNS are not allowed, so that the application IPv6 address cannot be obtained, and the corresponding application cannot be accessed, or only any one of the authority and forwarding functions in the DNS is allowed to be performed, so that only access to the application in the terminal intranet is allowed.

[0114] It can be seen that the present invention will also perform IPv6 policy configuration of the DNS within the application, realize the mapping of DNS and IPv6 address coloring grouping information in the authority, forwarding, and recursion functions of the DNS, and set the black and white list policy; perform black and white list configuration, perform IPv6 address coloring grouping configuration for authority, domain name, forwarding and other functions, and implement different terminal application access policies for different domain names.

[0115] An access control method based on IPv6 address coloring is provided in an embodiment of the present invention, such as Figure 5 As shown, the network control module determines whether to allow the terminal to access the corresponding application according to the IPv6 application access policy of the terminal IPv6 address, which may include:

[0116] S51: The network control module analyzes IPv6 application access policies;

[0117] S52: If the analysis determines that the terminal IPv6 address is in the whitelist of the corresponding application IPv6 address, determine to allow the terminal to access the corresponding application;

[0118] S53: If the analysis determines that the terminal IPv6 address is in the blacklist of the corresponding application IPv6 address, determine that the terminal is not allowed to access the corresponding application.

[0119] The network control module can also set blacklist and whitelist policies. If the terminal IPv6 address is in the whitelist of the application IPv6 address to be accessed, the terminal is allowed to access the corresponding application. If it is outside the whitelist or in the blacklist, the terminal is not allowed to access the corresponding application.

[0120] In a specific implementation, an access control method based on IPv6 address coloring provided by an embodiment of the present invention can be specifically expressed as follows: Figure 6 Specific examples may include:

[0121] Terminal A and terminal B respectively send a first network access request to the DNS module, and the DNS module performs coloring analysis based on the IPv6 address coloring policy configuration (the IPv6 address coloring policy configuration in the DNS module is the first preset address coloring policy configuration), and feeds back the IPv6 address of the application allowed to be accessed by the terminal to the terminal, and terminal A and terminal B initiate a second network access request to the gateway for the IPv6 address of the application allowed to be accessed, and the network control module responds to the second network access request received by the gateway based on the IPv6 address coloring policy configuration (the IPv6 address coloring policy configuration in the network control module is the second preset address coloring policy configuration), determines whether the terminal can access the corresponding application, and controls each gateway to perform access operations on terminals that can access the corresponding application, and prohibits access operations on terminals that cannot access the corresponding application.

[0122] In the process of IPv6 network construction in an enterprise, the present invention classifies and colors the IPv6 addresses in the network according to the different business and user needs of the enterprise, and establishes corresponding DNS access coloring configurations, thereby forming a set of domain name request rules; the rules can establish multi-level, differentiated domain name access strategies according to different businesses or users. When a terminal attempts to access the network, the system will perform domain name access control according to different domain name access strategies. At the same time, according to the classification and coloring of the IPv6 address, the system will establish a control strategy with IPv6 coloring configuration to perform refined control on the user's access request; after the terminal successfully accesses the network, the system will implement the application access rights and control of the terminal according to the preset IPv6 address coloring rules. The present invention solves the defects existing in the background technology, especially for the new generation of IPv6 Internet environment, which requires a more flexible and flexible network environment. IPv6 address coloring can further enhance the flexibility of the enterprise and the management and control capabilities of the business, and has the following benefits:

[0123] 1. Management and control are decoupled from terminals. Terminals are colored by IPv6 addresses, which directly control the coloring of corporate services and users, meeting actual corporate needs and ensuring flexibility in IPv6 scenarios.

[0124] 2. Reduce operation and maintenance work and improve automation capabilities. After the IPv6-based coloring scenario is built, all policies will no longer need to be configured, which solves the problem of traditional management and control that each terminal must configure policies.

[0125] 3. Enhanced security. Through IPv6 address coloring access control, when a large number of terminals are connected in the IPv6 scenario and security devices can only roughly distinguish them, the combination of DNS and network control configuration can make more detailed distinctions in application access and network access, thereby improving the security of the enterprise network.

[0126] The embodiment of the present invention also provides an access control system based on IPv6 address coloring, such as Figure 7 As shown, the access control system may include a DNS module, and the DNS module is used to:

[0127] Receiving a first network access request sent by a terminal;

[0128] Parsing the first network access request to obtain the IPv6 address of the terminal as the terminal IPv6 address;

[0129] According to the first preset coloring strategy configuration, obtain first coloring group configuration information of the terminal IPv6 address;

[0130] Obtaining a DNS application access policy for the terminal IPv6 address according to a first preset IPv6 address policy table for each application DNS and first coloring group configuration information for the terminal IPv6 address;

[0131] According to the DNS application access policy of the terminal IPv6 address, the corresponding IPv6 address of the application DNS that the terminal is allowed to access is obtained as the application IPv6 address;

[0132] The application IPv6 address is fed back to the terminal, so that the terminal generates a second network access request and sends it to the gateway, and performs corresponding application access through the gateway.

[0133] An access control system based on IPv6 address coloring is provided in an embodiment of the present invention, such as Figure 8 As shown, the access control system may further include a network control module, which is used to:

[0134] Acquire a second network access request sent by the terminal to the gateway;

[0135] Parsing the second network access request to obtain the IPv6 address of the terminal as the terminal IPv6 address;

[0136] According to the second preset coloring strategy configuration, obtain the second coloring group configuration information of the terminal IPv6 address;

[0137] Acquire the IPv6 application access policy of the terminal IPv6 address according to the second preset IPv6 address policy table of each application IPv6 address and the second colored group configuration information of the terminal IPv6 address;

[0138] Determine whether to allow the terminal to access the corresponding application according to the IPv6 application access policy of the terminal IPv6 address;

[0139] When it is determined that the terminal is allowed to access the corresponding application, the control gateway performs the access operation of the corresponding application. When it is determined that the terminal is not allowed to access the corresponding application, the control gateway blocks the access operation of the corresponding application.

[0140] An embodiment of the present invention also provides an access control device based on IPv6 address coloring, the device includes a memory and a processor, and the program stored in the memory can implement the steps of the above-mentioned access control method when executed by the processor.

[0141] An embodiment of the present invention further provides a storage medium, and when a program stored in the storage medium is executed by a processor, the steps of the access control method described above are implemented.

[0142] For a detailed description of the access control system, device and storage medium based on IPv6 address coloring provided by the embodiments of the present invention, please refer to the corresponding part of the access control method embodiment based on IPv6 address coloring. Although the embodiments of the present invention are described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the attached claims.

Claims

1. An access control method based on IPv6 address coloring, characterized in that: Applied to an access control system, the access control system includes a DNS module; the access control method includes: The DNS module receives a first network access request sent by the terminal; The DNS module parses the first network access request to obtain the IPv6 address of the terminal as the terminal IPv6 address; The DNS module obtains first coloring group configuration information of the terminal IPv6 address according to a first preset coloring strategy configuration; The DNS module obtains the DNS application access policy of the terminal IPv6 address according to the first preset IPv6 address policy table of each application DNS and the first coloring group configuration information of the terminal IPv6 address; The DNS module obtains, according to the DNS application access policy of the terminal IPv6 address, an application DNS corresponding IPv6 address that the terminal is allowed to access as the application IPv6 address; The DNS module feeds back the application IPv6 address to the terminal, so that the terminal generates a second network access request and sends it to the gateway, and performs corresponding application access through the gateway.

2. The access control method according to claim 1, characterized in that: The access control system further includes a network management and control module; the access control method further includes: The network management and control module obtains a second network access request sent by the terminal to the gateway; The network control module parses the second network access request to obtain the IPv6 address of the terminal as the terminal IPv6 address; The network control module obtains second coloring grouping configuration information of the terminal IPv6 address according to the second preset coloring strategy configuration; The network control module obtains the IPv6 application access policy of the terminal IPv6 address according to the second preset IPv6 address policy table of each application IPv6 address and the second coloring group configuration information of the terminal IPv6 address; The network control module determines whether to allow the terminal to access the corresponding application according to the IPv6 application access policy of the terminal IPv6 address; When the network control module determines that the terminal is allowed to access the corresponding application, it controls the gateway to perform the access operation of the corresponding application. When the network control module determines that the terminal is not allowed to access the corresponding application, it controls the gateway to block the access operation of the corresponding application.

3. The access control method according to claim 2, characterized in that: According to the preset coloring strategy configuration, before obtaining the coloring group configuration information of the terminal IPv6 address, the method further includes: Dividing IPv6 addresses of different enterprise services and / or users into different IPv6 address coloring groups, and performing corresponding address coloring on the IPv6 addresses in different IPv6 address coloring groups, to obtain the preset coloring strategy configuration; The preset coloring strategy configuration includes the first preset coloring strategy configuration and the second preset coloring strategy configuration, and the coloring group configuration information includes the first coloring group configuration information and the second coloring group configuration information.

4. The access control method according to claim 3, characterized in that: Perform corresponding address coloring for the IPv6 addresses in different IPv6 address coloring groups, including: Determine the type of shading currently set; If the coloring type is IPv6 prefix coloring, then the prefixes of the IPv6 addresses in each IPv6 address coloring group are respectively subjected to corresponding address coloring; If the coloring type is IPv6 code coloring, corresponding address coloring is performed for any segment code of the IPv6 address in each IPv6 address coloring group.

5. The access control method according to claim 4, characterized in that: According to the preset IPv6 address policy configuration table of each application DNS / application IPv6 address and the coloring group configuration information of the terminal IPv6 address, obtaining the DNS application access policy / IPv6 application access policy of the terminal IPv6 address includes: Obtain a mapping relationship table between each application DNS / application IPv6 address and each IPv6 address coloring group; Based on the mapping relationship table and the coloring group configuration information of the terminal IPv6 address, obtain the corresponding DNS application access policy / IPv6 application access policy; Among them, the preset IPv6 address policy configuration table includes the first preset IPv6 address policy table and the second preset IPv6 address policy table, and the coloring group configuration information includes the first coloring group configuration information and the second coloring group configuration information.

6. The access control method according to claim 5, characterized in that: Before the DNS module obtains the application DNS corresponding IPv6 address allowed to be accessed by the terminal as the application IPv6 address, it also includes: The DNS module analyzes the DNS application access policy; If the analysis determines that the terminal IPv6 address is in the whitelist of the corresponding application DNS, the step of obtaining the application DNS corresponding IPv6 address allowed to be accessed by the terminal as the application IPv6 address is performed based on various DNS functions; If the analysis determines that the terminal IPv6 address is in the blacklist of the corresponding application DNS, it is determined that the application IPv6 address cannot be obtained based on the DNS function, and information about the request failure is fed back to the terminal, or, based on the DNS function of only some specified items, the step of obtaining the application DNS corresponding IPv6 address allowed to be accessed by the terminal as the application IPv6 address is performed; The DNS functions include authoritative function, forwarding function and recursive function.

7. The access control method according to claim 6, characterized in that: The network control module determines whether to allow the terminal to access the corresponding application according to the IPv6 application access policy of the terminal IPv6 address, including: The network control module analyzes the IPv6 application access policy; If the analysis determines that the terminal IPv6 address is in the whitelist of the corresponding application IPv6 address, then determine to allow the terminal to access the corresponding application; If the analysis determines that the terminal IPv6 address is in the blacklist of the corresponding application IPv6 address, it is determined that the terminal is not allowed to access the corresponding application.

8. An access control system based on IPv6 address coloring, characterized in that: The access control system includes a DNS module, and the DNS module is used to: receiving a first network access request sent by a terminal; Parsing the first network access request to obtain the IPv6 address of the terminal as the terminal IPv6 address; According to the first preset coloring strategy configuration, obtaining first coloring group configuration information of the terminal IPv6 address; According to the first preset IPv6 address policy table of each application DNS and the first coloring group configuration information of the terminal IPv6 address, obtaining the DNS application access policy of the terminal IPv6 address; According to the DNS application access policy of the terminal IPv6 address, obtain the application DNS corresponding IPv6 address allowed to be accessed by the terminal as the application IPv6 address; The application IPv6 address is fed back to the terminal, so that the terminal generates a second network access request and sends it to the gateway, and performs corresponding application access through the gateway.

9. An access control device based on IPv6 address coloring, characterized in that: The device includes a memory and a processor, and the program stored in the memory can implement the steps of the access control method according to any one of claims 1 to 7 when executed by the processor.

10. A storage medium, characterized in that: When the program stored on the storage medium is executed by the processor, the steps of the access control method according to any one of claims 1 to 7 are implemented.

Images