IPv6 network access control method, system, device and terminal equipment

Abstract

The present application relates to an admission control method, system, apparatus, terminal device and storage medium for an IPv6 network. The admission control method receives a network access request from a terminal through a terminal access device, allocates a corresponding target IPv6 address to the terminal according to the network access request, the target IPv6 address includes identity information of the terminal, sends the target IPv6 address to an admission controller so that the admission controller determines whether the terminal has the right to access the network according to the identity information, receives the admission judgment result of the admission controller, determines whether to send the target IPv6 address to the terminal through the terminal access device according to the admission judgment result, binds each target IPv6 with the identity information of the accessed terminal, can quickly identify the identity information of the user according to the target IPv6 address, completes imperceptible admission control, simplifies terminal user operations, and completes efficient and accurate access control of users and devices as a whole.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to an access control method, system, apparatus, terminal device and storage medium for an IPv6 network. Background Art

[0002] The terminal access control (NAC) technology was first proposed by CISCO in 2002 as an active defense technology. Its core is to ensure that only devices that comply with security policies can access network resources by performing identity authentication and compliance checks before devices access the network. When a terminal accesses the network, it first completes the first information exchange with the terminal access device (such as a switch). The terminal access device sends the terminal authentication information to the access control system for authentication and inspection. The access control system releases, blocks or isolates the terminal based on the authentication results.

[0003] In recent years, with the large-scale deployment and application of IPv6, the business in related fields of various industries has been continuously expanded and technology has been continuously advanced. More and more IPv6 users and terminal devices are connected to the network, which has brought unprecedented pressure to network access control. How to efficiently and accurately control the access of these users and devices has become a problem that needs to be solved urgently. Summary of the invention

[0004] To achieve the above objectives, the present application provides an IPv6 network access control method, system, apparatus, terminal device and storage medium, which can perform efficient and accurate access control on users and devices.

[0005] An admission control method includes:

[0006] receiving a network access request from a terminal through a terminal access device;

[0007] Allocate a corresponding target IPv6 address to the terminal according to the network access request, where the target IPv6 address contains the identity information of the terminal;

[0008] Send the target IPv6 address to the admission controller so that the admission controller determines whether the terminal has the right to access the network based on the identity information;

[0009] Receive the admission judgment result of the admission controller;

[0010] The access judgment result determines whether to send the target IPv6 address to the terminal through the terminal access device.

[0011] In one embodiment, the step of allocating a corresponding target IPv6 address to the terminal according to the network access request, wherein the target IPv6 address includes the identity information of the terminal, comprises:

[0012] According to the network access request, obtain the identity information corresponding to the terminal, the identity information includes the MAC address identification of the terminal;

[0013] Based on the address allocation strategy of the DHCPv6 protocol, the corresponding initial IPv6 address is allocated to the terminal according to the MAC address identifier;

[0014] Get the last 64 bits of the initial IPv6 address;

[0015] The identity information is address-coded and mapped to the last 64 bits of the initial IPv6 address to obtain the target IPv6 address.

[0016] In one embodiment, according to the network access request, the step of obtaining the identity information corresponding to the terminal, wherein the identity information includes the MAC address identification of the terminal includes:

[0017] According to the network access request, obtain the MAC address of the terminal and assign a corresponding MAC address identifier;

[0018] According to the network access request, the corresponding user allocation department identification, user name identification and device identification are allocated to the terminal;

[0019] The identity information corresponding to the terminal is obtained according to the MAC address identifier, department identifier, user name identifier and device identifier of the terminal.

[0020] In one embodiment, the step of performing address coloring coding on the identity information to map it to the last 64 bits of the initial IPv6 address to obtain the target IPv6 address includes:

[0021] Obtain a fixed prefix of the initial IPv6 address as a space coloring encoding plan for the host bit of the address;

[0022] Based on the spatial coloring coding planning of the address host bit, the department identifier, user name identifier, device identifier and terminal MAC address identifier are sequentially address-colored and coded to map to the last 64 bits of the initial IPv6 address to obtain the target IPv6 address.

[0023] In addition, an IPv6 network access control method is provided, comprising:

[0024] Receive a target IPv6 address sent by a DHCPv6 server, where the target IPv6 address includes identity information of the terminal;

[0025] Determine whether the terminal has the right to access the network based on the identity information to generate an access determination result;

[0026] The access judgment result is sent to the DHCPv6 server, so that the DHCPv6 server decides whether to issue the target IPv6 address to the terminal through the terminal access device according to the access judgment result.

[0027] In addition, an admission control system for an IPv6 network is provided, including a DHCPv6 server, an admission controller and a terminal access device, wherein the DHCPv6 server establishes communication connections with the admission controller and the terminal access device respectively;

[0028] The terminal access device is used to obtain the network access request of the terminal and send it to the DHCPv6 server;

[0029] The DHCPv6 server is used to receive the network access request of the terminal through the terminal access device, allocate the corresponding target IPv6 address to the terminal according to the network access request, the target IPv6 address contains the identity information of the terminal, and send the target IPv6 address to the admission controller;

[0030] The admission controller is used to determine whether the terminal has the right to access the network based on the identity information to generate an admission determination result;

[0031] The DHCPv6 server is also used to receive the admission judgment result sent by the admission controller, and decide whether to issue the target IPv6 address to the terminal access device according to the admission judgment result;

[0032] The terminal access device is used to send the target IPv6 address to the terminal when the admission judgment result is yes.

[0033] In addition, an access control device for an IPv6 network is also provided, comprising:

[0034] A request receiving unit, used for receiving a network access request from a terminal through a terminal access device;

[0035] An IPv6 address generation unit is used to allocate a corresponding target IPv6 address to the terminal according to the network access request, and the target IPv6 address includes the identity information of the terminal;

[0036] An IPv6 address sending unit is used to send the target IPv6 address to the admission controller so that the admission controller determines whether the terminal has the right to access the network according to the identity information;

[0037] A receiving unit, used for receiving an admission judgment result of an admission controller;

[0038] The address sending unit is used to decide whether to send the target IPv6 address to the terminal through the terminal access device according to the access judgment result.

[0039] In one embodiment, the IPv6 address generation unit includes:

[0040] The identification information acquisition subunit is used to obtain the identity information corresponding to the terminal according to the network access request, and the identity information includes the MAC address of the terminal;

[0041] The initial address allocation subunit is used to allocate the corresponding initial IPv6 address to the terminal according to the MAC address based on the address allocation strategy of the DHCPv6 protocol;

[0042] An address acquisition subunit is used to acquire the last 64 bits of the initial IPv6 address;

[0043] The target address acquisition subunit is used to perform address coloring encoding on the identity information to map it to the last 64 bits of the initial IPv6 address to obtain the target IPv6 address.

[0044] In addition, a terminal device is also provided, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the computer program is executed by the processor, the steps of the above-mentioned access control method are implemented.

[0045] In addition, a storage medium is also provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned admission control method are implemented.

[0046] The above admission control method receives a network access request from a terminal through a terminal access device, allocates a corresponding target IPv6 address to the terminal according to the network access request, the target IPv6 address contains the identity information of the terminal, sends the target IPv6 address to an admission controller, so that the admission controller determines whether the terminal has the right to access the network according to the identity information, receives the admission judgment result of the admission controller, and determines whether to send the target IPv6 address to the terminal through the terminal access device according to the admission judgment result. Through the mutual cooperation of the DHCPv6 server and the admission controller, each target IPv6 is bound to the identity information of the accessed terminal, and the user's identity information can be quickly identified according to the target IPv6 address, and the non-perceptual admission control is completed, which simplifies the terminal user operation; at the same time, a more refined access control strategy can be implemented to complete efficient and accurate access control of users and devices as a whole. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A schematic diagram of an application environment of an IPv6 network admission control method provided in an embodiment of the present application;

[0048] Figure 2 A schematic diagram of a flow chart of an admission control method for an IPv6 network provided in an embodiment of the present application;

[0049] Figure 3 A schematic diagram of a method for obtaining a target IPv6 address provided in an embodiment of the present application;

[0050] Figure 4 A schematic diagram of a method flow for obtaining identity information corresponding to a terminal provided in an embodiment of the present application;

[0051] Figure 5 This is a schematic diagram of an interface for dividing the initial IPv6 last 64 bits of address space provided in an embodiment of the present application;

[0052] Figure 6 A schematic flow chart of a method for obtaining a target IPv6 address provided in another embodiment of the present application;

[0053] Figure 7 A schematic diagram of a method flow of an IPv6 network admission control method provided in another embodiment of the present application;

[0054] Figure 8 A schematic block diagram of the structure of an IPv6 network admission control system provided in one embodiment of the present application;

[0055] Fig. 9 A schematic block diagram of the structure of an admission control device for an IPv6 network provided in one embodiment of the present application;

[0056] Fig.10 A schematic block diagram of the structure of an IPv6 address generation unit provided in one embodiment of the present application;

[0057] Fig.11 This is a block diagram of the internal structure of a terminal device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0058] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0059] In addition, if the descriptions of "first", "second", etc. are involved in this application, they are only used for descriptive purposes (such as for distinguishing the same or similar elements), and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in this field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0060] IPv6 has an address space of up to 128 bits, providing unlimited innovation capabilities. The last 64 bits of the address space of the IPv6 address have no relevant RFC standard specification to define the structured coding, so it can be used to encode and identify user identity information, so that each IPv6 address is closely associated with the user identity information behind it, forming a binding between identity and address. Based on this, the present application provides an access control method, system, device, terminal device and storage medium for an IPv6 network.

[0061] like Figure 1 As shown, a schematic diagram of an application environment of an admission control method for an IPv6 network is provided. Figure 1 The system comprises a DHCPv6 server 10 , an admission controller 20 and a terminal access device 30 , through which a user accesses the network.

[0062] The terminal access device 30 may be, for example, a switch, and DHCPv6 is a network protocol used to configure an IP address, an IP prefix and / or other configurations required by an IPv6 host operating on an IPv6 network.

[0063] like Figure 2 As shown, the present application provides an admission control method for an IPv6 network, the admission control method comprising:

[0064] Step S110: receiving a network access request from a terminal through a terminal access device.

[0065] The network access request is sent by the terminal user to the terminal access device, and the network access request generally includes the identity information corresponding to the terminal and the network access request information.

[0066] The terminal access device further sends the network access request to the DHCPv6 server.

[0067] Step S120: allocating a corresponding target IPv6 address to the terminal according to the network access request, where the target IPv6 address includes the identity information of the terminal.

[0068] The identity information of the terminal may include the identity information of the user corresponding to the terminal and the MAC address identification of the terminal.

[0069] The DHCPv6 server allocates a corresponding target IPv6 address to the terminal according to the network access request. The target IPv6 address contains the identity information of the terminal.

[0070] Step S130: Send the target IPv6 address to the admission controller, so that the admission controller determines whether the terminal has the right to access the network according to the identity information.

[0071] The DHCPv6 server sends the target IPv6 address to the admission controller. Since the target IPv6 address contains the terminal's identity information, the admission controller accurately identifies the user's identity information based on the preset judgment strategy, completes the non-perceptual admission control judgment, and generates the admission judgment result.

[0072] The admission controller does not directly communicate with the terminal access device. After generating the admission determination result, the admission controller proceeds to step S140.

[0073] Step S140: receiving the admission determination result of the admission controller.

[0074] The DHCPv6 server receives the admission determination result from the admission controller and proceeds to step S150 .

[0075] Step S150, determining whether to send the target IPv6 address to the terminal through the terminal access device according to the access judgment result.

[0076] When the access judgment result is yes, the target IPv6 address is issued to the terminal through the terminal access device; when the access judgment result is no, the target IPv6 address is refused to be issued to the terminal through the terminal access device.

[0077] The above admission control method receives a network access request from a terminal through a terminal access device, allocates a corresponding target IPv6 address to the terminal according to the network access request, the target IPv6 address contains the identity information of the terminal, sends the target IPv6 address to an admission controller, so that the admission controller determines whether the terminal has the right to access the network according to the identity information, receives the admission judgment result of the admission controller, and determines whether to issue the target IPv6 address to the terminal through the terminal access device according to the admission judgment result. Through the mutual cooperation of the DHCPv6 server and the admission controller, each target IPv6 is bound to the identity information of the accessed terminal, and the user's identity information can be quickly identified according to the target IPv6 address, and the non-perceptual admission control is completed, which simplifies the terminal user operation; at the same time, a more refined access control strategy can be implemented to complete efficient and accurate access control of users and devices as a whole, meeting the personalized needs of different terminal users.

[0078] In one embodiment, Figure 3 As shown, step S120 includes:

[0079] Step S121: acquiring identity information corresponding to the terminal according to the network access request, where the identity information includes the MAC address of the terminal.

[0080] Step S122: Based on the address allocation policy of the DHCPv6 protocol, a corresponding initial IPv6 address is allocated to the terminal according to the MAC address identifier.

[0081] Step S123, obtaining the last 64 bits of the initial IPv6 address.

[0082] Step S124, address coloring encoding is performed on the identity information to map it to the last 64 bits of the initial IPv6 address to obtain the target IPv6 address.

[0083] In one embodiment, as shown in Figure 4, step S121 includes:

[0084] Step S121a: According to the network access request, the MAC address of the terminal is obtained and a corresponding MAC address identifier is allocated.

[0085] Step S121b: allocate a corresponding user department identifier, user name identifier and device identifier to the terminal according to the network access request.

[0086] Step S121c, obtaining identity information corresponding to the terminal according to the MAC address identifier, department identifier, user name identifier and device identifier of the terminal.

[0087] In order to maintain a unified coding standard and simplify the coding mapping method, the present invention divides the initial IPv6 last 64 bits of the address space into four fields: department identification, user name identification, device identification and MAC address identification. Figure 5 The specific instructions are as follows:

[0088] Department ID: 4 bits in length, ranging from 0 to F, describing the organizational unit to which the user belongs, such as "Technology Department", "Finance Department", "R&D Department", "Marketing Department", etc.

[0089] User ID: 8 bits in length, ranging from 00 to FF, describing the user name, such as "Zhang San", "Li Si", "Wang Wu", etc.

[0090] Device ID: 4 bits in length, ranging from 0 to F, describing the device type, such as "PC", "printer", "server", "camera", "tablet", "mobile phone" and other terminal devices;

[0091] MAC address identifier: 48 bits in length, describes the MAC address of the device. The device MAC address can be directly filled into the IPv6 address space.

[0092] In one embodiment, as shown in Figure 6, step S124 includes:

[0093] Step S124a, obtaining a fixed prefix of the initial IPv6 address as a spatial coloring coding plan for the host bits of the address.

[0094] First, obtain the initial IPv6 address fixed prefix ( / 64) as the basis for the address host bit space coloring encoding plan. This example uses three network types: "office network", "data center", and "production network" for illustration, as shown in Table 1.

[0095] Among them, "FD00:AAAA:BBBB:0001:: / 64" means "fixed prefix of office network IPv6 address"; "FD00:AAAA:BBBB:0002:: / 64" means "fixed prefix of data center IPv6 address"; "FD00:AAAA:BBBB:0003:: / 64" means "fixed prefix of production network IPv6 address".

[0096]

[0097] Step S124b, based on the spatial coloring coding planning of the address host bit, the department identifier, user name identifier, device identifier and terminal MAC address identifier are address-colored and coded in sequence to map to the last 64 bits of the initial IPv6 address to obtain the target IPv6 address.

[0098] In one embodiment, the last 64 bits of the IPv6 address space are marked with address coloring codes, that is, semantic planning of user identity information is performed.

[0099] The department identification coding plan is shown in Table 2. In the 64-bit space, 1-4 bits are selected as the "department identification". In this example, the "department identification" includes "technical department", "financial department", "R&D department" and "marketing department". Among them, the code of "technical department" is "1", the code of "financial department" is "2", the code of "R&D department" is "3", and the code of "marketing department" is "4".

[0100]

[0101] In one embodiment, the user name identification coding plan is shown in Table 3. In the 64-bit space, 5-12 bits are selected as the "user name identification". In this example, the "user name identification" includes "Zhang San", "Li Si" and "Wang Wu"; among them, the coding of "Zhang San" is "01", the coding of "Li Si" is "02" and the coding of "Wang Wu" is "03".

[0102]

[0103] In one embodiment, the device identification coding plan is shown in Table 4. In the 64-bit space, 13-16 bits are selected as "device identification". In this example, the "device identification" includes "PC", "printer", "server" and "camera", among which the code of "PC" is "1", the code of "printer" is "2", the code of "server" is "3" and the code of "camera" is "4".

[0104]

[0105] In one embodiment, the MAC address identifier coding plan is shown in Table 5. In the 64-bit space, bits 17-64 are selected as the "MAC address identifier". In this example, the "MAC address identifier" is filled with the device MAC address; if the device MAC address is "34-C9-3D-3A-50-E7", the coding plan is "34C9:3D3A:50E7".

[0106]

[0107] In one embodiment, based on Tables 1 to 5, based on the spatial coloring coding planning of the address host bits, the department identifier, user name identifier, device identifier and terminal MAC address identifier are sequentially address-colored and coded to map to the last 64 bits of the initial IPv6 address to obtain the target IPv6 address.

[0108] In this example, a globally unique target IPv6 address of the “PC computer” belonging to “Zhang San” in the “Technical Department” in the “Office Network” is generated, as shown in Table 6.

[0109]

[0110] In addition, if Figure 7 As shown, a method for access control of an IPv6 network is also provided, comprising:

[0111] Step S210: receiving a target IPv6 address sent by a DHCPv6 server, where the target IPv6 address includes the identity information of the terminal.

[0112] Step S220: determining whether the terminal has the right to access the network based on the identity information to generate an access determination result.

[0113] Step S230: Send the access determination result to the DHCPv6 server, so that the DHCPv6 server decides whether to issue the target IPv6 address to the terminal through the terminal access device according to the access determination result.

[0114] In addition, if Figure 8 As shown, there is also provided an admission control system 200 for an IPv6 network, comprising a DHCPv6 server 10, an admission controller 20 and a terminal access device 30, wherein the DHCPv6 server 10 establishes communication connections with the admission controller 20 and the terminal access device 30 respectively;

[0115] The terminal access device 30 is used to obtain the network access request of the terminal and send it to the DHCPv6 server 10;

[0116] The DHCPv6 server 10 is used to receive a network access request from a terminal 40 through a terminal access device 30, allocate a corresponding target IPv6 address to the terminal 40 according to the network access request, the target IPv6 address includes the identity information of the terminal 40, and send the target IPv6 address to the admission controller 20;

[0117] The admission controller 20 is used to determine whether the terminal 40 has the right to access the network according to the identity information to generate an admission determination result;

[0118] The DHCPv6 server 10 is further configured to receive the admission judgment result sent by the admission controller 20, and determine whether to issue the target IPv6 address to the terminal access device 30 according to the admission judgment result;

[0119] The terminal access device 30 is used to send the target IPv6 address to the terminal 40 when the access judgment result is yes.

[0120] In addition, if Fig. 9 As shown, there is also provided an admission control device 300 for an IPv6 network, comprising:

[0121] A request receiving unit 310 is used to receive a network access request from a terminal through a terminal access device;

[0122] An IPv6 address generation unit 320 is used to allocate a corresponding target IPv6 address to the terminal according to the network access request, and the target IPv6 address includes the identity information of the terminal;

[0123] The IPv6 address sending unit 330 is used to send the target IPv6 address to the admission controller so that the admission controller determines whether the terminal has the right to access the network according to the identity information;

[0124] The receiving unit 340 is used to receive the admission judgment result of the admission controller;

[0125] The address sending unit 350 is used to determine whether to send the target IPv6 address to the terminal through the terminal access device according to the access judgment result.

[0126] In one embodiment, Fig.10 As shown, the IPv6 address generation unit 320 includes:

[0127] The identification information acquisition subunit 321 is used to acquire the identity information corresponding to the terminal according to the network access request, and the identity information includes the MAC address of the terminal;

[0128] The initial address allocation subunit 322 is used to allocate a corresponding initial IPv6 address to the terminal according to the MAC address based on the address allocation strategy of the DHCPv6 protocol;

[0129] The address acquisition subunit 323 is used to acquire the last 64 bits of the initial IPv6 address;

[0130] The target address acquisition subunit 324 is used to perform address coloring coding on the identity information to map it to the last 64 bits of the initial IPv6 address to obtain the target IPv6 address.

[0131] In addition, a terminal device is also provided in an embodiment of the present application. The internal structure of the terminal device can be as follows: Fig.11 As shown. The terminal device includes a processor, a memory, a communication interface and a database connected via a system bus. The processor is used to provide computing and control capabilities. The memory of the terminal device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the terminal device is used to store data called by the computer program. The communication interface of the terminal device is used to communicate data with an external terminal. The input device of the terminal device is used to receive a signal input by an external device. When the computer program is executed by the processor, an access control method as described in the above embodiment is implemented.

[0132] Those skilled in the art will understand that Fig.10 The structure shown in is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the terminal device to which the solution of the present application is applied.

[0133] In addition, the present application also proposes a storage medium, the storage medium includes a computer program, and the computer program, when executed by a processor, implements the steps of the admission control method as described in the above embodiment. It can be understood that the storage medium in this embodiment can be a volatile storage medium or a non-volatile storage medium.

[0134] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0135] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.

[0136] The above description is only a preferred embodiment of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly used in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for access control of an IPv6 network, characterized in that: include: receiving a network access request from a terminal through a terminal access device; Allocate a corresponding target IPv6 address for the terminal according to the network access request, wherein the target IPv6 address includes the identity information of the terminal; Sending the target IPv6 address to an admission controller so that the admission controller determines whether the terminal has the right to access the network according to the identity information; receiving an admission determination result of the admission controller; Determine whether to send the target IPv6 address to the terminal through the terminal access device according to the access judgment result; The step of allocating a corresponding target IPv6 address to the terminal according to the network access request, wherein the target IPv6 address includes the identity information of the terminal comprises: According to the network access request, obtaining identity information corresponding to the terminal, the identity information including the MAC address identifier of the terminal; Based on the address allocation strategy of the DHCPv6 protocol, a corresponding initial IPv6 address is allocated to the terminal according to the MAC address identifier; Obtain the last 64 bits of the initial IPv6 address; The identity information is subjected to address coloring coding to map to the last 64 bits of the initial IPv6 address to obtain the target IPv6 address; The step of acquiring the identity information corresponding to the terminal according to the network access request, wherein the identity information includes the MAC address of the terminal, comprises: According to the network access request, obtaining the MAC address of the terminal and assigning a corresponding MAC address identifier; According to the network access request, assign a corresponding user department identifier, user name identifier and device identifier to the terminal; Obtaining identity information corresponding to the terminal according to the MAC address identifier of the terminal, the department identifier, the user name identifier and the device identifier; The step of performing address coloring coding on the identity information to map it to the last 64 bits of the initial IPv6 address to obtain the target IPv6 address comprises: Obtaining a fixed prefix of the initial IPv6 address as a spatial coloring coding plan for the address host bits; Based on the spatial coloring coding planning of the address host bits, the department identifier, the user name identifier, the device identifier and the MAC address identifier of the terminal are sequentially address-colored and coded to map to the last 64 bits of the initial IPv6 address to obtain the target IPv6 address.

2. An access control system for an IPv6 network, characterized in that: It includes a DHCPv6 server, an admission controller and a terminal access device, wherein the DHCPv6 server establishes communication connections with the admission controller and the terminal access device respectively; The terminal access device is used to obtain a network access request from a terminal and send the request to the DHCPv6 server; The DHCPv6 server is used to receive a network access request from a terminal through a terminal access device, obtain the MAC address of the terminal and allocate a corresponding MAC address identifier according to the network access request, allocate a corresponding user allocation department identifier, user name identifier and device identifier to the terminal according to the network access request, obtain the identity identification information corresponding to the terminal according to the MAC address identifier of the terminal, the department identifier, the user name identifier and the device identifier, allocate a corresponding initial IPv6 address to the terminal according to the MAC address identifier based on the address allocation strategy of the DHCPv6 protocol, obtain the last 64 bits of the initial IPv6 address, obtain a fixed prefix of the initial IPv6 address as a space coloring coding plan for the address host bit, and based on the space coloring coding plan for the address host bit, perform address coloring coding identification on the department identifier, the user name identifier, the device identifier and the MAC address identifier of the terminal in sequence to map them to the last 64 bits of the initial IPv6 address to obtain a target IPv6 address, and send the target IPv6 address to the admission controller; The admission controller is used to determine whether the terminal has the right to access the network according to the identity information to generate an admission determination result; The DHCPv6 server is further configured to receive an admission judgment result sent by the admission controller, and determine whether to issue the target IPv6 address to the terminal access device according to the admission judgment result; The terminal access device is used to send the target IPv6 address to the terminal when the admission judgment result is yes.

3. An access control device for an IPv6 network, characterized in that: include: A request receiving unit, used for receiving a network access request from a terminal through a terminal access device; An IPv6 address generating unit, configured to allocate a corresponding target IPv6 address to the terminal according to the network access request, wherein the target IPv6 address includes the identity information of the terminal; An IPv6 address sending unit, configured to send the target IPv6 address to an admission controller, so that the admission controller determines whether the terminal has the right to access the network according to the identity information; A receiving unit, configured to receive an admission judgment result of the admission controller; An address issuing unit, configured to determine whether to issue the target IPv6 address to the terminal through the terminal access device according to the access judgment result; The IPv6 address generation unit comprises: An identification information acquisition subunit, configured to acquire the identity information corresponding to the terminal according to the network access request, wherein the identity information includes the MAC address of the terminal; An initial address allocation subunit, configured to allocate a corresponding initial IPv6 address to the terminal according to the MAC address based on an address allocation strategy of the DHCPv6 protocol; An address acquisition subunit, used to acquire the last 64 bits of the initial IPv6 address; A target address acquisition subunit is used to perform address coloring coding on the identity information to map it to the last 64 bits of the initial IPv6 address to obtain the target IPv6 address; The identification information acquisition subunit includes: A first identifier allocation subunit, configured to obtain the MAC address of the terminal and allocate a corresponding MAC address identifier according to the network access request; A second table identifier allocation subunit is used to allocate a corresponding user allocation department identifier, user name identifier and device identifier to the terminal according to the network access request; An identity generating subunit, configured to obtain identity information corresponding to the terminal according to the MAC address identifier of the terminal, the department identifier, the user name identifier and the device identifier; The target address acquisition subunit comprises: A color coding planning subunit, used for obtaining a fixed prefix of the initial IPv6 address as a spatial color coding plan of the address host bit; The target address generation subunit is used to perform address coloring coding on the department identifier, the user name identifier, the device identifier and the terminal's MAC address identifier in sequence based on the spatial coloring coding plan of the address host bit, so as to map them to the last 64 bits of the initial IPv6 address to obtain the target IPv6 address.

4. A terminal device, characterized in that: The terminal device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the steps of the admission control method according to claim 1 are implemented.

5. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the steps of the admission control method according to claim 1 are implemented.

Images