A network environment detection security access method and control device
Through multi-feature authentication channels, users, equipment and request information are comprehensively authenticated, and dual-channel detection of network environments is used to perform security authentication, which solves the problem that the existing technology cannot guarantee network security and achieves improvement of network access security and reliability Sexual effect.
Patent Information
- Application Number
- CN202411311334.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-20
- Publication Date
- 2024-12-13
- Estimated Expiration
- 2044-09-20
AI Technical Summary
The prior art cannot fully guarantee the security and stability of the network, especially in complex and changeable network environments, and is vulnerable to cyber attacks and security threats.
Through the multi-feature authentication channel, the target user, network requesting equipment and request information are comprehensively authenticated, and the authentication result is generated and whether it meets the constraints. If it is satisfied, a pass signal will be generated, and a security authentication will be performed through the network environment detection dual channels to generate a security Authentication signal, ultimately connecting the device to the target network and dynamically managed.
Improve the security and reliability of network access and ensure the stability and security of the network environment.
Smart Images
Figure CN118843110B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of wireless communications, and in particular to a network environment detection secure access method and control equipment. Background Art
[0002] With the rapid development of information technology and network communications, network environment detection and secure access technologies have been widely used in many fields. However, with the continuous expansion of network scale and the complexity of application scenarios, the monitoring and management of network access processes are also facing increasing challenges. Traditional network access methods often rely on single-factor authentication, which cannot fully guarantee the security and stability of the network, especially in a complex and changing network environment, and are vulnerable to various network attacks and security threats. Summary of the invention
[0003] The embodiments of the present application provide a network environment detection secure access method and control device, which solves the technical problem that the prior art cannot fully guarantee the security and stability of the network.
[0004] In view of the above problems, an embodiment of the present application provides a network environment detection secure access method and control device.
[0005] A first aspect of an embodiment of the present application provides a network environment detection secure access method, the method comprising:
[0006] Obtain a network request instruction of a target user, wherein the network request instruction includes a target network, a network request device and network request purpose information; perform comprehensive authentication on the target user, the network request device and the network request purpose information according to a network request multi-feature authentication channel, and generate a network request comprehensive authentication result; determine whether the network request comprehensive authentication result satisfies a network request comprehensive authentication constraint; if the network request comprehensive authentication result satisfies the network request comprehensive authentication constraint, generate a network request authentication pass signal; based on the network request authentication pass signal, perform security authentication on the target network according to a network environment detection dual channel, and generate a network security authentication signal; based on the network security authentication signal, connect the network request device to the target network, and perform network management on the target network according to the network request purpose information and the network environment detection dual channel.
[0007] A second aspect of an embodiment of the present application provides a control device, including: a memory for storing executable instructions; and a processor for executing the executable instructions stored in the memory to implement a network environment detection security access method provided by the present application.
[0008] One or more technical solutions provided in this application have at least the following technical effects or advantages:
[0009] The present application obtains a network request instruction of a target user, wherein the network request instruction includes a target network, a network request device and a network request purpose information; performs comprehensive authentication on the target user, the network request device and the network request purpose information according to a network request multi-feature authentication channel, and generates a network request comprehensive authentication result; determines whether the network request comprehensive authentication result satisfies the network request comprehensive authentication constraint; if the network request comprehensive authentication result satisfies the network request comprehensive authentication constraint, generates a network request authentication pass signal; based on the network request authentication pass signal, performs security authentication on the target network according to the network environment detection dual channel, and generates a network security authentication signal; based on the network security authentication signal, connects the network request device to the target network, and performs network management on the target network according to the network request purpose information and the network environment detection dual channel. The present invention solves the technical problem that the prior art cannot fully guarantee the security and stability of the network, performs comprehensive authentication on the user, device and request information through a multi-feature authentication channel, generates an authentication result and determines whether it satisfies the constraint condition, if it does, generates a pass signal, and performs security authentication through the network environment detection dual channel, generates a security authentication signal, and finally connects the device to the target network and performs dynamic management, so as to achieve the technical effect of improving the security and reliability of network access. BRIEF DESCRIPTION OF THE DRAWINGS
[0010] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0011] Figure 1 A schematic diagram of a network environment detection secure access method flow provided in an embodiment of the present application;
[0012] Figure 2 A schematic diagram of a process for generating a network security authentication signal in a network environment detection security access method provided in an embodiment of the present application;
[0013] Figure 3 This is a schematic diagram of the structure of an exemplary control device of the present application.
[0014] Description of the reference numerals: bus 300 , receiver 301 , processor 302 , transmitter 303 , memory 304 , bus interface 305 . DETAILED DESCRIPTION
[0015] The embodiment of the present application provides a network environment detection security access method and control device, which solves the technical problem that the existing technology cannot fully guarantee the security and stability of the network. It performs comprehensive authentication on users, devices and request information through a multi-feature authentication channel, generates an authentication result and determines whether it meets the constraint conditions. If so, a pass signal is generated, and security authentication is performed through a dual channel of network environment detection to generate a security authentication signal. Finally, the device is connected to the target network and dynamically managed, thereby achieving the technical effect of improving the security and reliability of network access.
[0016] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.
[0017] It should be noted that the terms "including" and "having" are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or modules that are not explicitly listed or are inherent to these processes, methods, products or devices.
[0018] Embodiment 1, as Figure 1 As shown, the present application provides a network environment detection secure access method, the method comprising:
[0019] Step S100: obtaining a network request instruction of a target user, wherein the network request instruction includes a target network, a network request device and network request purpose information.
[0020] In an embodiment of the present application, when a user initiates a network connection request, the user device will send a connection request signal to the network, and capture the user's network request instruction by monitoring specific data packets in the network traffic. The target user's network request instruction includes the target network, the network request device, and the network request purpose information. The target network is a clear reference to the network environment that the user expects to access or interact with, including any form of network environment such as a local area network, a wide area network, a cloud service platform, etc.; the network request device refers to the specific hardware device or software agent that initiates the request, including but not limited to a personal computer, a smart phone, a server, or an IoT device; the network request purpose information describes the specific goal or operation that the user hopes to achieve through this request, including accessing specific network resources, executing a service, or transmitting a specific type of data.
[0021] Step S200: Perform comprehensive authentication on the target user, the network request device and the network request purpose information according to the network request multi-feature authentication channel to generate a network request comprehensive authentication result.
[0022] In the embodiment of the present application, when comprehensive authentication is performed according to the network request multi-feature authentication channel, the user security authentication result is obtained by verifying the user identity information. The specific hardware device or software agent that initiates the network request is securely authenticated through the request device feature authentication channel to obtain the device security authentication result. The network request purpose information is securely authenticated through the request purpose feature authentication channel to obtain the request purpose security authentication result.
[0023] By integrating the authentication results of the requesting user characteristics, the requesting device characteristics and the requesting purpose characteristics, the system generates a comprehensive authentication result for the network request.
[0024] Furthermore, in the method provided in the embodiment of the application, the target user, the network request device and the network request purpose information are comprehensively authenticated according to the network request multi-feature authentication channel to generate a network request comprehensive authentication result, and further includes:
[0025] The network request multi-feature authentication channel includes a request user feature authentication channel, a request device feature authentication channel and a request purpose feature authentication channel; based on the request user feature authentication channel, the target user is authenticated for identity security to obtain a user security authentication result; based on the request device feature authentication channel, the network request device is authenticated for security to obtain a device security authentication result; based on the network request purpose information, security authentication is performed according to the request purpose feature authentication channel to obtain a request purpose security authentication result; the user security authentication result, the device security authentication result and the request purpose security authentication result are collated to obtain a comprehensive authentication result of the network request.
[0026] In the embodiment of the present application, the network request multi-feature authentication channel includes a request user feature authentication channel, a request device feature authentication channel, and a request destination feature authentication channel. The target user is authenticated for identity security through the request user feature authentication channel. Specifically, the user is required to enter his / her username and password when making a request. After the user enters the correct username and password, a one-time verification code is sent to the user's mobile phone or email address. The user needs to enter the verification code for further verification. Through these steps, the user's security authentication result is obtained to ensure that the user's identity is legal and authentic.
[0027] Next, the network request device is authenticated through the device feature authentication channel. Specifically, the unique identifier of the device, such as the MAC address, device serial number, etc., is obtained, and a valid digital certificate is checked to see if the device has been installed, the operating system version and security patches of the device are up to date, and the security software on the device is verified to be running normally. Through these steps, the security authentication result of the device is obtained.
[0028] Then, security authentication is performed based on the network request purpose information through the request purpose feature authentication channel. Specifically, check whether the user has the authority to access the requested network resources, such as querying the user's authority information in the access control list (ACL), and review the content of the request to ensure that it complies with security policies and business rules, such as checking the requested URL, file path or database query statement. Through this step, the security authentication result of the request purpose is obtained.
[0029] Finally, the user security authentication results, device security authentication results, and request purpose security authentication results are collated and comprehensively analyzed to generate a comprehensive authentication result for the network request. Specifically, each authentication result is standardized to ensure that different authentication results are compared on the same scale, and the results are converted into a unified score or trust index (such as a score between 0 and 1) through standardization. Then, weights are assigned to each authentication result according to preset security policies and business rules. For example, for high security requirements, user identity authentication results account for a larger proportion; for scenarios with high device credibility requirements, the weight of device security authentication results will be higher. Exemplarily, the weight of the user security authentication result is 0.4, the weight of the device security authentication result is 0.3, and the weight of the request purpose security authentication result is 0.3. Finally, the weighted average method is used to calculate the comprehensive score to obtain the comprehensive authentication result of the network request.
[0030] Step S300: Determine whether the network request comprehensive authentication result meets the network request comprehensive authentication constraint.
[0031] In the embodiment of the present application, there is a preset network request comprehensive authentication constraint, that is, a preset security threshold, which is a score representing the minimum security requirement. For example, the security threshold is set to 0.8, indicating that the comprehensive score must reach or exceed 0.8 to pass the authentication.
[0032] The network request comprehensive authentication result is compared with the security threshold, that is, the network request comprehensive authentication constraint, to determine whether the network request comprehensive authentication result meets the network request comprehensive authentication constraint.
[0033] Step S400: If the network request comprehensive authentication result meets the network request comprehensive authentication constraint, a network request authentication pass signal is generated.
[0034] In the embodiment of the present application, if the network request comprehensive authentication result meets the network request comprehensive authentication constraint, that is, it is determined that the target user's network request meets the requirements, and a network request authentication pass signal is generated.
[0035] Step S500: Based on the network request authentication pass signal, detect the dual channels according to the network environment, perform security authentication on the target network, and generate a network security authentication signal.
[0036] Further, such as Figure 2 As shown, in the method provided by the embodiment of the application, based on the network request authentication pass signal, dual channels are detected according to the network environment, the target network is security authenticated, and a network security authentication signal is generated, and further includes:
[0037] The dual-channel network environment detection includes a network environment static security detection channel and a network environment dynamic security detection channel; real-time static monitoring information and real-time dynamic monitoring information of the target network are obtained; based on the real-time static monitoring information, the network environment static security detection coefficient is obtained according to the network environment static security detection channel; based on the real-time dynamic monitoring information, the network environment dynamic security detection coefficient is obtained according to the network environment dynamic security detection channel; based on the network environment static security detection coefficient and the network environment dynamic security detection coefficient, the network security authentication signal is obtained.
[0038] In an embodiment of the present application, the dual-channel network environment detection includes a network environment static security detection channel and a network environment dynamic security detection channel. Then, the real-time static monitoring information of the target network is obtained through the network environment static security detection channel. Static monitoring information includes static features such as network configuration, network topology, known security vulnerabilities and system configuration. Specifically, first collect the configuration files of the target network, including the configuration of routers and switches, network topology diagrams, etc. At the same time, obtain known security vulnerability information, check the system patch update status and vulnerability repair status. Next, use static analysis tools, such as configuration checking tools, to analyze the network configuration to check whether there are configuration errors or unsafe configurations. Use vulnerability scanning tools to scan and confirm whether there are any unfixed known vulnerabilities. Then score the problems found according to the preset static risk assessment table. The static risk scoring table includes scoring criteria for different types of configuration errors and vulnerabilities. According to the configuration check and vulnerability scanning results, a risk score is assigned to each check item. Finally, the total static security detection coefficient is calculated. When calculating, The static safety detection coefficient is calculated.
[0039] Next, the real-time dynamic monitoring information of the target network is obtained through the dynamic security detection channel of the network environment. Dynamic monitoring information includes dynamic features such as network traffic, real-time access behavior, abnormal behavior detection, and real-time threat intelligence. Specifically, dynamic data collection is first performed to monitor network traffic, collect real-time traffic data and access logs. At the same time, intrusion detection systems (IDS) and behavioral analysis tools are used to monitor abnormal behaviors and suspicious activities. After that, dynamic data analysis is performed to analyze network traffic data to detect whether there are abnormal traffic patterns or suspicious access behaviors. Behavioral analysis tools are used to analyze the activities of users and devices to identify potential security threats. After that, the detected abnormal behaviors are scored according to the preset dynamic risk scoring table. The dynamic risk scoring table includes scoring criteria for different types of abnormal behaviors and threats. Finally, based on the dynamic monitoring and analysis results, a risk score is assigned to each detection item, and the total dynamic security detection coefficient is calculated through The dynamic safety detection coefficient is calculated.
[0040] Finally, the static security detection coefficient and the dynamic security detection coefficient are compared with the pre-set coefficient thresholds to determine whether the coefficient thresholds are met. If both are met, a network security authentication signal is generated.
[0041] Furthermore, in the method provided in the embodiment of the application, the network security authentication signal is obtained based on the network environment static security detection coefficient and the network environment dynamic security detection coefficient, and further includes:
[0042] Obtain network security authentication constraint conditions, wherein the network security authentication constraint conditions include a network environment static security tolerance condition and a network environment dynamic security tolerance condition; determine whether the network environment static security detection coefficient satisfies the network environment static security tolerance condition; determine whether the network environment dynamic security detection coefficient satisfies the network environment dynamic security tolerance condition; if the network environment static security detection coefficient satisfies the network environment static security tolerance condition, and the network environment dynamic security detection coefficient satisfies the network environment dynamic security tolerance condition, obtain the network security authentication signal.
[0043] In an embodiment of the present application, first, network security authentication constraints are extracted from a database, including static security tolerance conditions of the network environment and dynamic security tolerance conditions of the network environment. The static security tolerance conditions of the network environment and the dynamic security tolerance conditions of the network environment are pre-set security detection coefficient thresholds. By comparing the static security detection coefficient of the network environment with the static security tolerance conditions of the network environment, it is determined whether the static security detection coefficient of the network environment meets the static security detection coefficient threshold, that is, whether it is higher than the static security detection coefficient threshold. If it is higher, it is considered that the static security detection coefficient of the network environment meets the static security tolerance conditions of the network environment. Similarly, it is determined whether the dynamic security detection coefficient of the network environment meets the dynamic security tolerance conditions of the network environment.
[0044] If the network environment static security detection coefficient meets the network environment static security tolerance condition, and the network environment dynamic security detection coefficient meets the network environment dynamic security tolerance condition, a network security authentication signal is generated.
[0045] Step S600: Based on the network security authentication signal, the network request device is connected to the target network, and network management is performed on the target network according to the dual channels of the network request purpose information and the network environment detection.
[0046] In the embodiment of the present application, based on the network security authentication signal, the network request device is allowed to access the target network. At the same time, according to the network request purpose information, the target network is managed and monitored, and the network status is continuously monitored by using the network environment detection dual channel to ensure that the dynamic changes of the network environment will not affect its security. Through the above steps, the access and use of the network request device are effectively managed under the premise of ensuring safety.
[0047] Furthermore, in the method provided by the embodiment of the application, based on the network security authentication signal, the network request device is connected to the target network, and network management is performed on the target network according to the network request purpose information and the network environment detection dual channel, and also includes:
[0048] Obtain a first monitoring computing power for the target network; predict the security impact of the target network according to the network request device and the network request purpose information to obtain a predicted network security impact coefficient; determine whether the predicted network security impact coefficient is greater than / equal to the network security impact tolerance value; if the predicted network security impact coefficient is greater than / equal to the network security impact tolerance value, incentivize and adjust the first monitoring computing power according to the predicted network security impact coefficient to generate a second monitoring computing power; monitor the target network in real time based on the second monitoring computing power, and perform network management on the target network in combination with the network environment detection dual channel.
[0049] In the embodiment of the present application, the first monitoring computing power of the target network is firstly obtained through the network environment detection dual channel. The first monitoring computing power refers to the computing power used to monitor the security status of the target network in real time, including network configuration, topology, real-time traffic and user behavior.
[0050] Next, based on the network request device and network request purpose information, the target network is predicted for security impact to calculate the predicted network security impact coefficient. Specifically, first collect the network request device information and network request purpose information, and analyze the security event logs of similar requests in the past to identify possible risk patterns. Then extract relevant features from the collected data, such as device type, operating system version, vulnerability severity, requested resource type, access frequency, etc. Using historical data, organize the features and corresponding security event labels into a training data set. Use the random forest algorithm to train the model and learn the risk patterns in historical data. Input the features of the current network request into the trained random forest model to obtain the predicted network security impact coefficient.
[0051] The predicted network security impact coefficient is compared with the preset network security impact tolerance value. The network security impact tolerance value is a pre-set threshold used to determine the acceptability of network security risks. If the predicted network security impact coefficient is greater than or equal to the network security impact tolerance value, the first monitoring computing power is incentivized and adjusted, and the monitoring capacity is incentivized and adjusted by increasing resource allocation and other methods to generate the second monitoring computing power. For example, more CPU cores are allocated, memory is increased, etc.
[0052] Finally, based on the second monitoring computing power, the target network is monitored and managed in real time, including continuous evaluation of the stability of network configuration and topology through static security detection channels to ensure that there are no configuration errors and known vulnerabilities, and real-time monitoring of network traffic and user behavior through dynamic security detection channels to detect abnormal activities and potential threats. According to the real-time monitoring results, the target network is dynamically adjusted to ensure the reasonable allocation of network resources and safe operation.
[0053] Furthermore, in the method provided by the embodiment of the application, based on the network security authentication signal, the network request device is connected to the target network, and network management is performed on the target network according to the network request purpose information and the network environment detection dual channel, and also includes:
[0054] Perform healthy network behavior prediction based on the network request purpose information to obtain predicted healthy network behavior information; obtain real-time network behavior monitoring data of the target user; perform anomaly detection on the real-time network behavior monitoring data based on the predicted healthy network behavior information to obtain network behavior anomaly detection results; and perform network management on the target network based on the network behavior anomaly detection results.
[0055] In the embodiment of the present application, the network request purpose information of the target user is first collected, including the specific access target and operation content. Next, the healthy network behavior model is constructed using historical data and normal network behavior patterns. A large amount of normal behavior data is used as training data to train the random forest and establish a prediction model. For example, the model is trained using the user's past access records, operation behaviors, and network activities to establish a healthy behavior baseline. The network request purpose information is then input into the healthy network behavior model to generate predicted healthy network behavior information.
[0056] Through the dual channels of network environment detection, the network behavior data of the target user is monitored and collected in real time, and the real-time network behavior monitoring data of the target user is obtained, including the user's access log, operation log and network traffic information. Specific technologies include using network monitoring tools such as Wireshark, etc., through traffic analysis and log collection, to record the user's network behavior in real time.
[0057] Then, based on the predicted healthy network behavior information, the real-time network behavior monitoring data is detected for anomalies to obtain network behavior anomaly detection results. Specifically, the real-time monitored user behavior data is compared with the predicted healthy network behavior information to check whether there is any deviation from the normal behavior pattern. Specifically, it includes using difference detection algorithms, such as Euclidean distance, to calculate the deviation between real-time behavior and healthy behavior. Use the rule engine to identify abnormal behaviors that deviate from healthy behavior patterns. For example, if a user suddenly accesses a large amount of sensitive data or attempts to perform unauthorized operations, these behaviors are identified as abnormal and network behavior anomaly detection results are generated.
[0058] Finally, the target network is managed based on the results of abnormal network behavior detection. Specifically, when abnormal behavior is detected, the user's network access rights are immediately restricted, or the security administrator is notified through the security information and event management system for manual review. Or according to the frequency and severity of abnormal behavior, the network security strategy is dynamically adjusted to optimize the monitoring rules and response mechanism, including the use of policy management tools to adjust firewall rules, access control lists and other security strategies by analyzing the statistical data of abnormal behavior.
[0059] Furthermore, in the method provided by the embodiment of the application, based on the network security authentication signal, the network request device is connected to the target network, and network management is performed on the target network according to the network request purpose information and the network environment detection dual channel, and also includes:
[0060] Perform response expectation analysis on the target network according to the network request purpose information to obtain a network response expectation result; obtain a real-time network response result corresponding to the network request purpose information; perform offset detection on the real-time network response result based on the network response expectation result to obtain a network response offset identification result and a network response offset evaluation coefficient; determine whether the network response offset evaluation coefficient is greater than / equal to a network response offset evaluation threshold; if the network response offset evaluation coefficient is greater than / equal to the network response offset evaluation threshold, perform network management on the target network according to the network response offset identification result.
[0061] In the embodiment of the present application, when analyzing the response expectation of the target network, historical data and normal network response patterns are used to build a response expectation model using machine learning algorithms such as linear regression or time series analysis, and the model is trained to establish an expected response baseline. The network request purpose information is input into the model to generate the network response expectation result, which describes the response time and behavior pattern of the network under normal circumstances.
[0062] Then, through the network environment detection dual channel, the network monitoring tool is used to monitor and collect the network response data in real time, including response time, bandwidth usage, packet loss rate, etc. Through this process, the real-time network response result corresponding to the network request destination information is obtained.
[0063] Next, the real-time monitored network response data is compared with the expected network response results, and the deviation between the real-time response and the expected response is calculated using a difference detection algorithm such as mean square error or relative error. After that, the network response deviation evaluation coefficient is calculated, and the deviation is calculated for each response indicator, such as response time, bandwidth usage, packet loss rate, etc. According to the weight of each deviation, the comprehensive deviation is calculated. The weight is set according to the importance of the response indicator. For example, the weight of the response time is set to 0.5, the weight of the bandwidth usage is set to 0.3, and the weight of the packet loss rate is set to 0.2. In order to obtain a standardized evaluation coefficient, the comprehensive deviation is normalized so that the result is between 0 and 1. The final network response deviation evaluation coefficient is: .
[0064] Compare the network response deviation evaluation coefficient with the preset network response deviation evaluation threshold. If the network response deviation evaluation coefficient is greater than / equal to the network response deviation evaluation threshold, take corresponding management measures. For example, through the automated response system, when the response deviation is detected, adjust the network resource allocation or optimize the network configuration, or notify the network administrator through the SIEM system for manual review. At the same time, according to the frequency and severity of the deviation, use policy management tools to dynamically adjust the network management policy and optimize the monitoring rules and response mechanism.
[0065] In the embodiments of the present application, in summary, the embodiments of the present application have at least the following technical effects:
[0066] The present application obtains a network request instruction of a target user, wherein the network request instruction includes a target network, a network request device and a network request purpose information; performs comprehensive authentication on the target user, the network request device and the network request purpose information according to a network request multi-feature authentication channel, and generates a network request comprehensive authentication result; determines whether the network request comprehensive authentication result satisfies the network request comprehensive authentication constraint; if the network request comprehensive authentication result satisfies the network request comprehensive authentication constraint, generates a network request authentication pass signal; based on the network request authentication pass signal, performs security authentication on the target network according to the network environment detection dual channel, and generates a network security authentication signal; based on the network security authentication signal, connects the network request device to the target network, and performs network management on the target network according to the network request purpose information and the network environment detection dual channel. The present invention solves the technical problem that the prior art cannot fully guarantee the security and stability of the network, performs comprehensive authentication on the user, device and request information through a multi-feature authentication channel, generates an authentication result and determines whether it satisfies the constraint condition, if it does, generates a pass signal, and performs security authentication through the network environment detection dual channel, generates a security authentication signal, and finally connects the device to the target network and performs dynamic management, so as to achieve the technical effect of improving the security and reliability of network access.
[0067] Embodiment 2. Based on the inventive concept of a network environment detection security access method in the aforementioned embodiment, the present application also provides a control device, comprising: at least one processor; a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the steps of any one of the methods described in the aforementioned embodiment 1.
[0068] Figure 3 This is a schematic diagram of the structure of an exemplary electronic device of this application. Figure 3In the embodiment, the bus architecture is represented by bus 300, which may include any number of interconnected buses and bridges, and bus 300 connects various circuits including one or more processors represented by processor 302 and memory represented by memory 304. Bus 300 may also connect various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. Bus interface 305 provides an interface between bus 300 and receiver 301 and transmitter 303. Receiver 301 and transmitter 303 may be the same element, namely a transceiver, providing a unit for communicating with various other devices over a transmission medium. Processor 302 is responsible for managing bus 300 and general processing, while memory 304 may be used to store data used by processor 302 when performing operations.
[0069] It should be noted that the above-mentioned sequence of the embodiments of the present application is only for description and does not represent the advantages and disadvantages of the embodiments. And the above-mentioned specific embodiments of this specification are described. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
[0070] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.
[0071] This specification and drawings are merely exemplary illustrations of the present application and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, a person skilled in the art may make various modifications and variations to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present application and its equivalents, the present application intends to include these modifications and variations.
Claims
1. A network environment detection security access method, characterized in that: The method comprises: Obtaining a network request instruction of a target user, wherein the network request instruction includes target network, network request device and network request purpose information; Performing comprehensive authentication on the target user, the network request device and the network request purpose information according to the network request multi-feature authentication channel to generate a network request comprehensive authentication result; Determining whether the network request comprehensive authentication result satisfies the network request comprehensive authentication constraint; If the network request comprehensive authentication result satisfies the network request comprehensive authentication constraint, generating a network request authentication pass signal; Based on the network request authentication pass signal, perform security authentication on the target network according to the network environment detection dual channel, and generate a network security authentication signal; Based on the network security authentication signal, the network request device is connected to the target network, and network management is performed on the target network according to the network request purpose information and the network environment detection dual channel; Among them, performing comprehensive authentication on the target user, the network request device and the network request purpose information according to the network request multi-feature authentication channel to generate a network request comprehensive authentication result also includes: The network request multi-feature authentication channel includes requesting a user feature authentication channel, requesting a device feature authentication channel, and requesting a destination feature authentication channel; Performing identity security authentication on the target user based on the requesting user feature authentication channel to obtain a user security authentication result; Based on the request device feature authentication channel, perform security authentication on the network request device to obtain a device security authentication result; Based on the network request purpose information, perform security authentication according to the request purpose feature authentication channel to obtain the request purpose security authentication result; Arrange the user security authentication result, the device security authentication result and the request purpose security authentication result to obtain the network request comprehensive authentication result; Wherein, based on the network request authentication pass signal, according to the network environment detection dual channel, the target network is security authenticated, and a network security authentication signal is generated, and it also includes: The network environment detection dual channels include a network environment static security detection channel and a network environment dynamic security detection channel; Obtaining real-time static monitoring information and real-time dynamic monitoring information of the target network; Based on the real-time static monitoring information, and according to the network environment static security detection channel, a network environment static security detection coefficient is obtained; Based on the real-time dynamic monitoring information, and according to the network environment dynamic security detection channel, a network environment dynamic security detection coefficient is obtained; The network security authentication signal is obtained based on the network environment static security detection coefficient and the network environment dynamic security detection coefficient.
2. The method according to claim 1, characterized in that Based on the network environment static security detection coefficient and the network environment dynamic security detection coefficient, obtaining the network security authentication signal includes: Obtaining network security authentication constraint conditions, wherein the network security authentication constraint conditions include a network environment static security tolerance condition and a network environment dynamic security tolerance condition; Determining whether the network environment static security detection coefficient meets the network environment static security tolerance condition; Determining whether the network environment dynamic security detection coefficient meets the network environment dynamic security tolerance condition; If the network environment static security detection coefficient satisfies the network environment static security tolerance condition, and the network environment dynamic security detection coefficient satisfies the network environment dynamic security tolerance condition, the network security authentication signal is obtained.
3. The method according to claim 1, characterized in that Based on the network security authentication signal, the network request device is connected to the target network, and network management is performed on the target network according to the network request purpose information and the network environment detection dual channel, including: Obtaining a first monitoring computing power of the target network; Predicting the security impact of the target network according to the network request device and the network request purpose information to obtain a predicted network security impact coefficient; Determining whether the predicted network security impact coefficient is greater than / equal to a network security impact tolerance value; If the predicted network security impact coefficient is greater than / equal to the network security impact tolerance value, the first monitoring computing power is incentivized and adjusted according to the predicted network security impact coefficient to generate a second monitoring computing power; The target network is monitored in real time based on the second monitoring computing power, and network management is performed on the target network in combination with the network environment detection dual channel.
4. The method according to claim 1, characterized in that Based on the network security authentication signal, the network request device is connected to the target network, and network management is performed on the target network according to the network request purpose information and the network environment detection dual channel, including: Predicting healthy network behavior based on the network request purpose information to obtain predicted healthy network behavior information; Obtaining real-time network behavior monitoring data of the target user; Performing anomaly detection on the real-time network behavior monitoring data based on the predicted healthy network behavior information to obtain a network behavior anomaly detection result; The target network is managed based on the network behavior anomaly detection result.
5. The method according to claim 1, characterized in that Based on the network security authentication signal, the network request device is connected to the target network, and network management is performed on the target network according to the network request purpose information and the network environment detection dual channel, including: Performing response expectation analysis on the target network according to the network request purpose information to obtain network response expectation results; Obtaining a real-time network response result corresponding to the network request destination information; Performing deviation detection on the real-time network response result based on the expected network response result to obtain a network response deviation identification result and a network response deviation evaluation coefficient; Determining whether the network response deviation evaluation coefficient is greater than / equal to a network response deviation evaluation threshold; If the network response deviation evaluation coefficient is greater than / equal to the network response deviation evaluation threshold, network management is performed on the target network according to the network response deviation identification result.
6. A control device, characterized in that: The control device comprises: A memory for storing executable instructions; The processor is used to implement a network environment detection and secure access method according to any one of claims 1 to 5 when executing the executable instructions stored in the memory.