A network access authentication method based on security protocol

Abstract

The present invention provides a network access authentication method based on a security protocol, which relates to the field of network access technology. The method includes: S1, port initialization and configuration, setting a special restricted port and configuring ACL rules matching ONVIF, OBCP and HK protocols; S2, sending a device search message, sending a device search message of a related protocol to a special restricted port; S3, processing the received response message, performing protocol verification and message processing; S4, MAC re-authentication and timeout processing, processing timeout devices and updating port whitelists; S5, device authentication, confirming the network access authority of the device through the MAC address; S6, port interchange processing, automatically updating the port configuration and performing re-authentication. The present invention improves the security and efficiency of network access authentication, supports a variety of security protocols, is applicable to a variety of device access scenarios, and realizes dynamic optimization and data immutability by introducing machine learning and blockchain technology, thereby enhancing the security and applicability of the system.

Description

Technical Field

[0001] The present invention relates to the technical field of network access, and in particular to a network access authentication method based on a security protocol. Background Art

[0002] With the increasing popularity of security monitoring, video surveillance is becoming more network-based, high-definition and intelligent, and the IP wave is sweeping the entire security industry. In theory, any device connected to the public network may be attacked, and the security industry, as a new access to the Internet terminal, may even be more serious than traditional network devices. In recent years, there have been many cyber attacks in the security industry, which shows that it is urgent to strengthen the information security of security networks.

[0003] The commonly used network access authentication method 802.1x relies on the central radius authentication server. The security device interacts with the network access device (restricted port of the switch) through the EAPOL protocol, and the network access device interacts with the radius authentication server through the RADIUS protocol. Finally, the radius authentication server confirms whether the security device has passed the network access authentication, and then the network access device performs network access. In this authentication mode, the radius authentication server needs to add all security device authentication information (authentication account password or MAC). When the security device changes, the security device authentication information needs to be re-added or modified. Security devices also need to support the EAPOL protocol (currently a large part of security devices do not support it), and then use the authentication information added by the radius authentication server for authentication. And because it is a unified authentication by the central radius authentication server, once the radius authentication server is abnormal, all security device access authentication will not pass normally. This authentication method has problems such as cumbersome operation, incomplete support of existing security equipment, and weak reliability. Summary of the invention

[0004] In order to enhance the security of the entire security network equipment group, the present invention provides a network access authentication method based on a security protocol.

[0005] The technical solution provided by the present invention is as follows:

[0006] The present invention provides a network access authentication method based on a security protocol, comprising:

[0007] S1. Port initialization and configuration: Set the port of the switch to a special restricted port in a special restricted mode, wherein the special restricted mode is to disable the MAC address learning function of the special restricted port, initialize the MAC whitelist of the special restricted port to be empty, and configure ACL rules to match device search messages of ONVIF, OBCP and HK protocols;

[0008] S2. Send device search message: Send device search message of ONVIF, OBCP and HK protocol to the special restricted port;

[0009] S3, process the received response message: check whether the received message has timed out. If so, enter the port whitelist MAC re-authentication timeout process. If the received message has not timed out, verify whether it complies with the protocol specification, and then process the valid message;

[0010] S4, MAC re-authentication and timeout processing: Perform re-authentication timeout judgment to determine whether there is a MAC address with re-authentication timeout on the port whitelist. If so, delete the MAC address with re-authentication timeout on the port whitelist and re-enter the message receiving timeout judgment process. If there is no MAC address with re-authentication timeout, re-enter the message receiving timeout judgment process.

[0011] S5. Device authentication: When the port whitelist contains the MAC address of the device, confirm that the network access authentication of the device has been passed. The authenticated security device and the business network are interoperable. If the port whitelist does not contain the MAC address of the device, ensure that the device and the business network of the port are isolated.

[0012] S6, port swap and processing: After the security device and non-security device ports are swapped, ONVIF, OBCP and HK device search messages continue to be sent and response messages are processed as described in S3. For non-security device ports, no response messages will be received, so the MAC whitelist of the non-security device port will re-enter the authentication timeout processing flow. For ports that have added security device MAC addresses, if no response message is received, re-authentication timeout processing will be performed and the corresponding MAC address on the port will be deleted.

[0013] The beneficial effects brought about by the technical solution provided by the present invention include at least:

[0014] (1) In the present invention, the network access authentication method can complete the network access authentication through automated port configuration and protocol matching, without repeating complex configuration operations when the security equipment is switched, which greatly simplifies the operation process, improves the efficiency and flexibility of device access, and is suitable for dynamic access scenarios of large-scale security equipment;

[0015] (2) In the present invention, a distributed authentication mechanism is adopted to directly deploy network access authentication on each network access device, thereby avoiding system failure caused by a single point of failure, ensuring the high reliability and stability of the entire security network, and ensuring the normal operation of device authentication even when the network device load is high or some nodes fail;

[0016] (3) In the present invention, it is compatible with various mainstream security protocols such as ONVIF, OBCP, HK, etc., and device identity authentication is achieved through flexible ACL rules and protocol matching. It can support the access of security devices of different brands and types without relying on specific network access protocols. It has extremely high applicability and is suitable for network access management in various security scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A schematic diagram of a flow chart of a network access authentication method based on a security protocol provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0020] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0021] In the embodiments of the present invention, "image" and "picture" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same. "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same.

[0022] In the embodiments of the present invention, sometimes the subscripts are as follows It may be mistakenly written as a non-subscript form such as W1. When the difference is not emphasized, the meanings they express are the same.

[0023] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0024] Reference Manual Attached Figure 1, shows a flow chart of a network access authentication method based on a security protocol provided in an embodiment of the present invention.

[0025] The embodiment of the present invention provides a network access authentication method based on a security protocol, and the processing flow may include the following steps:

[0026] S1. Port initialization and configuration: Set the port of the switch to a special restricted port in a special restricted mode, wherein the special restricted mode is to turn off the MAC address learning function of the special restricted port, initialize the MAC whitelist of the special restricted port to be empty, and configure ACL rules to match device search messages of ONVIF, OBCP and HK protocols.

[0027] It is understandable that by setting the switch port to a special restricted mode, that is, turning off its MAC address learning function, it is possible to restrict unauthenticated devices from accessing the network. At the same time, by initializing the MAC whitelist to be empty and configuring ACL rules to match specific security protocols, it is ensured that devices can only access after passing protocol verification. This process ensures the initial security of the network and prevents unauthorized devices from accessing the business network.

[0028] S2. Send device search message: Send device search messages of ONVIF, OBCP and HK protocols to special restricted ports.

[0029] It is understandable that the purpose of sending device search messages of ONVIF, OBCP and HK protocols is to detect security devices connected to the network. By searching for protocol matching messages, compliant devices can be found in the network. The purpose of this step is to actively initiate the device authentication process to ensure that only authenticated devices can perform subsequent network operations.

[0030] S3. Process the received response message: Check whether the received message has timed out. If so, enter the port whitelist MAC re-authentication timeout process. If the received message has not timed out, verify whether it complies with the protocol specifications, and then process the valid message.

[0031] It is understandable that the received message is checked for timeout and the protocol specification is verified to ensure that the received message is legitimate. If the message is timed out or does not comply with the protocol specification, it may be a forged or invalid message. Processing these messages can improve the accuracy of authentication and avoid potential security risks.

[0032] S4, MAC re-authentication and timeout processing: Perform re-authentication timeout judgment to determine whether there is a MAC address with re-authentication timeout on the port whitelist. If so, delete the MAC address with re-authentication timeout on the port whitelist and re-enter the message receiving timeout judgment process. If there is no MAC address with re-authentication timeout, re-enter the message receiving timeout judgment process.

[0033] It is understandable that by determining whether the MAC address on the port whitelist has a re-authentication timeout, it can ensure that devices that have not been authenticated for a long time are removed in a timely manner. This processing step helps maintain the security of the network, avoids authentication vulnerabilities caused by long-term unresponsive devices, and ensures that the device continues to meet the requirements during the authentication process.

[0034] S5. Device authentication: When the port whitelist contains the MAC address of the device, confirm that the network access authentication of the device has passed. The authenticated security device and the business network can communicate with each other. If the port whitelist does not contain the MAC address of the device, ensure that the device and the business network of the port are in an isolated state.

[0035] It is understandable that the port whitelist is used to determine whether the device's MAC address is included in the authentication. If the device's MAC address is in the whitelist, the authentication is successful and the device can communicate with the business network; otherwise, the network is isolated. This step ensures that only authenticated devices in the network can communicate with the business network, preventing unauthorized devices from accessing the network.

[0036] S6, port swap and processing: After the security device and non-security device ports are swapped, ONVIF, OBCP and HK device search messages continue to be sent and response messages are processed as in S3. For non-security device ports, no response messages will be received, so the MAC whitelist of non-security device ports will re-enter the authentication timeout processing flow. For ports that have added security device MAC addresses, if no response messages are received, re-authentication timeout processing will be performed and the corresponding MAC address on the port will be deleted.

[0037] It is understandable that after the security device and non-security device ports are swapped, device search messages continue to be sent and responses are processed to ensure the continued validity of device authentication. For non-security device ports, no response messages will be received, and the authentication timeout processing process will be re-entered; for ports that have added security devices, if no response messages are received, re-authentication timeout processing will be performed. This step can ensure the authentication validity of the device after the port change and improve the adaptability and security of the network.

[0038] It should be noted that the matching rules and protocol specifications specifically include:

[0039] The ACL matching rule for the corresponding ONVIF message is that the IPV4 Protocol field is 0x11 and the destination port is 0x0E76;

[0040] The ACL matching rule for the OBCP response message is eth dmac 01:00:5E:64:E4;.

[0041] The ACL matching rule for HK response packets is eth type 0x8033.

[0042] In a possible implementation manner, processing a valid message specifically includes:

[0043] If the valid single source MAC address of the message is not in the port whitelist, the source MAC address is added to the port whitelist and the re-authentication countdown for the MAC is started;

[0044] It should be noted that when a MAC address of a valid message appears for the first time, it is not in the whitelist, so it needs to be added to the whitelist. This step ensures that the network access rights of the device are initially authenticated, allowing it to communicate with the network. At the same time, the role of starting the re-authentication countdown is to prevent the device from remaining in the authentication state for a long time. After the countdown expires, re-authentication is required, thereby improving the security of the network and preventing the MAC address from being abused for a long time.

[0045] If the message is valid and the source MAC address is in the port whitelist, the re-authentication countdown for the MAC address is updated.

[0046] It should be noted that when the MAC address of a valid message is already in the whitelist, the system updates its re-authentication countdown. This means that the device continues to maintain network access rights, but to ensure security, the system periodically re-authenticates the device to prevent any potential security risks, such as device hijacking or MAC address forgery. The update countdown mechanism ensures dynamic management and enhances the security and stability of the network.

[0047] In a possible implementation, during the initialization process, the matching fields of the ACL rules are dynamically adjusted according to the capabilities and requirements of the network device, and the ACL rules are automatically updated according to the protocol version or extended fields supported by the device to adapt to new protocol characteristics.

[0048] In one possible implementation, a machine learning algorithm is introduced to analyze historical device connection data to predict and automatically optimize the configuration of ACL rules and device search messages, thereby improving authentication efficiency and accuracy. The specific steps are as follows:

[0049] 1) Data collection and preprocessing: Collect historical data of security devices connected to the switch in the past, including the MAC address, access time, protocol type (ONVIF, OBCP, HK), response message delay time, time point of successful access authentication, and message characteristics of unauthenticated devices; store the collected data in the form of time series, and the data set is represented as Among them, is the device access time, is the MAC address of the device, is the protocol type, is the response message delay, and is the device access result label (0 means failed, 1 means passed);

[0050] The data is standardized to eliminate the differences between different devices. The standardized data is 2) Feature extraction: Extract key features related to device access authentication through feature engineering, including:

[0051] 3) Training machine learning models: using extracted feature data As input, use the access result As a label, train a prediction model to optimize ACL rules and device search messages. You can choose Random Forest Classifier for training:

[0052] The random forest model consists of multiple decision trees, each of which predicts whether a device will successfully pass authentication based on the device’s characteristics: in T is the number of decision trees, For the t The prediction results of the tree, 4) Dynamically optimize ACL rules: The predicted probability of successful device access is based on the predicted probability of successful device access by the machine learning model. Automatically optimize ACL rules: Then add the MAC address of the device to the whitelist in the port configuration in advance to optimize the frequency of sending device search messages; Adopt stricter ACL matching rules and increase message inspection fields to reduce false positives. The current authentication policy for the device is maintained without optimization. 5) Device search message optimization: Use machine learning models to predict the latency characteristics of device access Adjust the frequency of sending device search messages: Dynamically adjust the frequency of sending device search messages based on the predicted average response delay , improve authentication efficiency and avoid the generation of too many redundant messages.

[0053] 6) Model iteration and adaptive adjustment: Update the data set in real time by continuously monitoring the actual effect of device access authentication D And dynamically adjust the model weights through the online learning mechanism to adapt to network changes.

[0054] In one possible implementation, for each valid response message, deep packet inspection (DPI) is performed to analyze the payload data in the message to verify the identity of the device, and a multi-level authentication mechanism is added to prevent forged response messages, including the link layer, network layer, transport layer, and application layer. The specific steps are as follows:

[0055] 1) Data layer analysis: Disassemble the received valid response message according to the layers of the OSI network model, and extract the data in the link layer, network layer, transport layer and application layer in turn: link layer data (such as MAC address), network layer data (such as IP address, TTL value), transport layer data (such as TCP / UDP port) and application layer load (such as protocol field, device information). 2) Load data extraction and feature analysis: Extract load data from the application layer, including device identification fields in ONVIF, OBCP, and HK protocols, such as device ID, serial number, etc. Map these data into feature vectors Each of these Represents a certain feature.

[0056] 3) Device identity authentication model: Establish a multi-level device identity authentication mechanism based on the historical device information database, use the weighted feature matching algorithm to verify the device identity, and calculate the message feature vector X and the characteristics of the devices registered in the database The similarity between: in, Features The weight of is a feature matching function (such as Euclidean distance or hash matching), similarity Exceeding the threshold , device authentication passed.

[0057] 4) Forged response message detection: Perform in-depth content analysis on the payload data to check whether there are common forged message features, such as forged protocol fields or inconsistent device information. Introduce timestamp-based consistency checks to ensure that the device's response time matches the expected protocol communication timing and timestamp differences. The calculation of is as follows: in, is the time when the message is received, is the expected response time when the device is communicating normally. If it exceeds the set threshold, the message is considered to be forged.

[0058] 5) Multi-level authentication process: After the device identity is authenticated, other information in the message (IP, serial number, etc.) is verified again according to the multi-level authentication mechanism to ensure the authenticity of the device identity. If any level of authentication fails, the authentication process is terminated and an alarm is triggered. In one possible implementation, during the authentication process, a blockchain-based logging mechanism is used to track and record the authentication status and historical changes of the device to ensure the immutability and traceability of the authentication data.

[0059] It should be noted that during the network access authentication process, the authentication status and historical change information of the device are crucial to maintaining system security. The traditional logging mechanism has the risk of data being tampered or deleted, which affects the audit and traceability capabilities. These problems can be effectively solved by introducing a blockchain-based logging mechanism. Blockchain is decentralized and cannot be tampered with, so it is very suitable for storing sensitive authentication data. Through the blockchain-based logging mechanism, the authentication status, historical changes and other information of all devices during the authentication process will be reliably and transparently recorded to ensure that they cannot be tampered with. In this way, even if security incidents such as device counterfeiting or network attacks occur, administrators can trace back through the complete authentication records and quickly locate the problem. This improves the overall security of the system and the credibility of the data, and helps meet compliance and audit requirements.

[0060] In a possible implementation, when the device ports are interchanged, the enhanced dynamic configuration protocol (E-DCP) is used to automatically update the port configuration and re-authenticate the device to adapt to the change in the port role. The specific steps are as follows:

[0061] 1) Port status monitoring and role identification: When a device port swap is detected (i.e., a device is moved from one port to another), the port status detection module is first started. The module identifies the current port role (security device port or non-security device port) based on the device's MAC address and port profile. E-DCP calculates the matching degree of port role identification using the following formula: in, Indicates the current port. To identify the MAC address, For the port configuration file, It is a matching function. If the device MAC and configuration are consistent, it returns 1, otherwise it returns 0. When the role matching degree exceeds a certain threshold, the port role is confirmed.

[0062] 2) Dynamic configuration update process: Once the port role change is confirmed, E-DCP will automatically start the dynamic configuration update process, which includes the following steps:

[0063] Configuration file loading: Based on the role and historical configuration of the new port of the device, E-DCP loads the corresponding ACL rules and device whitelist from the network configuration database;

[0064] Rule reconfiguration: Based on the loaded configuration, the ACL rules applicable to the new port are reapplied to ensure that the device's network permissions match the role of the new port. The reconfiguration process dynamically adjusts the access control lists (ACLs) at the network layer, transport layer, and application layer.

[0065] 3) Port configuration optimization algorithm. In order to optimize the loading and updating of port configuration, E-DCP introduces an enhanced Bayesian optimization algorithm, which predicts and automatically adjusts based on historical configuration data and current network status. The steps of the algorithm are as follows: Define the optimization objective function in Configure parameters (bandwidth limit, priority, and ACL rules) for the current port, with the goal of minimizing latency in device authentication T : Use Bayesian optimization for dynamic adjustment based on historical configuration Update the Bayesian model to predict the optimal configuration of the current port in, Set a threshold for device authentication latency, exceeding which triggers further optimization.

[0066] 4) Re-authenticate the device: After the configuration update is completed, E-DCP automatically triggers the device authentication process as follows:

[0067] Device information re-verification: Based on the configuration of the new port, E-DCP resends the device search message (such as ONVIF, OBCP, HK protocol) and verifies the device's MAC address, IP address, and protocol fields;

[0068] Multi-layered authentication: E-DCP continues to apply the multi-layered authentication mechanisms described previously, including deep packet inspection (DPI), protocol field consistency checks, and timestamp analysis. Device identity is confirmed by calculating the similarity of the device identity: Among them, and are the new port device feature vector and the device feature in the database respectively, which verifies whether the device still maintains identity consistency after the port is swapped.

[0069] 5) Automatically adapt to port role changes: E-DCP automatically adapts to port role changes based on device identity authentication results. If the device passes identity authentication, the corresponding network permissions are granted and the port configuration is updated. If the authentication fails, the device is automatically isolated and removed from the port whitelist to ensure isolation of the device from the business network.

[0070] In a possible implementation, a dynamically generated encryption key verification step is added to the matching rules of the protocol specification, and the response message is encrypted and verified through an encryption algorithm to ensure that the message has not been tampered with and comes from a legitimate device.

[0071] It should be noted that during the network access authentication process, the response message is the key information to verify the legitimacy of the device. However, unencrypted messages may be tampered with or forged, resulting in security vulnerabilities. Therefore, adding a dynamically generated encryption key verification step can improve the security of the message. The response message is encrypted and verified through an encryption algorithm to ensure the integrity of the message and the legitimacy of the source. This can not only effectively prevent malicious attackers from tampering with the message, but also ensure the authenticity and reliability of the data during the device authentication process, further enhancing the security and protection capabilities of the system.

[0072] In one possible implementation, during the authentication process, a multi-factor authentication mechanism (MFA) is used, combining the MAC address of the device, the unique identifier in the response message, and the time-based dynamic password to enhance the security and accuracy of the authentication. The specific steps are as follows:

[0073] 1) Preliminary check of device identity authentication: The authentication process starts with the device sending a response message. First, it verifies whether the basic information of the device (such as MAC address) is consistent with the known port whitelist. The preliminary identity authentication formula is as follows: If the device's MAC address exists in the port's whitelist, the device will enter the next step of the authentication process. If it does not match, the device will be isolated.

[0074] 2) Authentication based on unique identifier in response message: Each device response message contains a unique identifier (UUID), which combined with the device's MAC address provides an additional layer of authentication. The authentication steps are as follows:

[0075] UUID extraction and matching: Extract unique identifiers from response messages And match it with the stored device UUID database: Check the association between UUID and MAC address. To ensure the consistency of the unique identifier and MAC address matching, use the following association function to verify the consistency: in, is a hash function, Represents an exclusive OR operation. If the associated value is 0, it indicates that the two match.

[0076] 3) Time-based One-Time Password (TOTP) generation and verification: Introduce a time-based one-time password (TOTP) mechanism to add a time dynamic factor to device authentication. The TOTP generation and verification process is as follows:

[0077] Dynamic password generation: Use HMAC-SHA1 algorithm to generate dynamic password , the formula is as follows: in, is the shared key of the device, is the current time step (usually calculated in 30-second cycles), It is a stage function used to extract the dynamic password in the result; dynamic password verification: the authentication system generates the corresponding dynamic password , and the dynamic password generated by the device For comparison: The dynamic password is only valid within the current time step, which increases the security of the authentication process and avoids security risks such as replay attacks.

[0078] 4) Comprehensive verification process of multi-factor authentication (MFA): Finally, the comprehensive verification process based on MAC address, unique identifier and dynamic password generated by TOTP is as follows:

[0079] Multi-factor matching formula: Based on the results of the above authentication factors, the system calculates the overall authentication success rate , the formula is as follows: in, , and is the weight coefficient of each factor (according to the security requirements set by the system), and ; Certification pass judgment: If the overall success rate Greater than the passing threshold set by the system Then the device authentication is passed, the formula is as follows: If device authentication is denied, the device will be automatically quarantined and removed from the port whitelist, further improving network security.

[0080] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0081] (1) In the present invention, the network access authentication method can complete the network access authentication through automated port configuration and protocol matching, without repeating complex configuration operations when the security equipment is switched, which greatly simplifies the operation process, improves the efficiency and flexibility of device access, and is suitable for dynamic access scenarios of large-scale security equipment;

[0082] (2) In the present invention, a distributed authentication mechanism is adopted to directly deploy network access authentication on each network access device, thereby avoiding system failure caused by a single point of failure, ensuring the high reliability and stability of the entire security network, and ensuring the normal operation of device authentication even when the network device load is high or some nodes fail;

[0083] (3) In the present invention, it is compatible with various mainstream security protocols such as ONVIF, OBCP, HK, etc., and device identity authentication is achieved through flexible ACL rules and protocol matching. It can support the access of security devices of different brands and types without relying on specific network access protocols. It has extremely high applicability and is suitable for network access management in various security scenarios.

[0084] The above contents are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

[0085] There are a few points to note:

[0086] (1) The drawings of the embodiments of the present invention only involve structures related to the embodiments of the present invention. Other structures may refer to conventional designs.

[0087] (2) For the sake of clarity, in the drawings used to describe the embodiments of the present invention, the thickness of layers or regions is exaggerated or reduced, that is, these drawings are not drawn according to the actual scale. It is understood that when an element such as a layer, film, region or substrate is referred to as being "on" or "under" another element, the element may be "directly" "on" or "under" the other element or there may be intermediate elements.

[0088] (3) In the absence of conflict, the embodiments of the present invention and the features therein may be combined with each other to obtain new embodiments.

[0089] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. The protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A network access authentication method based on a security protocol, characterized in that: include: S1. Port initialization and configuration: Set the port of the switch to a special restricted port in a special restricted mode, wherein the special restricted mode is to disable the MAC address learning function of the special restricted port, initialize the MAC whitelist of the special restricted port to be empty, and configure ACL rules to match device search messages of ONVIF, OBCP and HK protocols; S2. Send device search message: Send device search message of ONVIF, OBCP and HK protocol to the special restricted port; S3, process the received response message: check whether the received message has timed out. If so, enter the port whitelist MAC re-authentication timeout process. If the received message has not timed out, verify whether it complies with the protocol specification, and then process the valid message; S4, MAC re-authentication and timeout processing: Perform re-authentication timeout judgment to determine whether there is a MAC address with re-authentication timeout on the port whitelist. If so, delete the MAC address with re-authentication timeout on the port whitelist and re-enter the message receiving timeout judgment process. If there is no MAC address with re-authentication timeout, re-enter the message receiving timeout judgment process. S5. Device authentication: When the port whitelist contains the MAC address of the device, confirm that the network access authentication of the device has been passed. The authenticated security device and the business network are interoperable. If the port whitelist does not contain the MAC address of the device, ensure that the device and the business network of the port are isolated. S6, port swap and processing: After the security device and non-security device ports are swapped, ONVIF, OBCP and HK device search messages continue to be sent and response messages are processed as described in S3. For non-security device ports, no response messages will be received, so the MAC whitelist of the non-security device port will re-enter the authentication timeout processing flow. For ports that have added security device MAC addresses, if no response message is received, re-authentication timeout processing will be performed and the corresponding MAC address on the port will be deleted.

2. A network access authentication method based on a security protocol according to claim 1, characterized in that: The matching rules and protocol specifications specifically include: The ACL matching rule of the ONVIF corresponding message is that the IPV4 Protocol field is 0x11 and the destination port is 0x0E76; The ACL matching rule of the OBCP response message is eth dmac is 01:00:5E:64:E4; The ACL matching rule of the HK response message is that eth type is 0x8033.

3. A network access authentication method based on a security protocol according to claim 1, characterized in that: The processing of valid messages specifically includes: If the valid single source MAC address of the message is not in the port whitelist, the source MAC address is added to the port whitelist and the re-authentication countdown for the MAC is started; If the message is valid and the source MAC address is in the port whitelist, the re-authentication countdown for the MAC address is updated.

4. A network access authentication method based on a security protocol according to claim 1, characterized in that: include: During the initialization process, the matching fields of ACL rules are dynamically adjusted according to the capabilities and requirements of network devices. According to the protocol versions or extended fields supported by the devices, ACL rules are automatically updated to adapt to new protocol features.

5. A network access authentication method based on security protocol according to claim 1, characterized in that: include: Machine learning algorithms are introduced to analyze historical device connection data to predict and automatically optimize the configuration of ACL rules and device search messages, thereby improving authentication efficiency and accuracy.

6. A network access authentication method based on security protocol according to claim 1, characterized in that: include: For each valid response message, deep packet inspection (DPI) is performed to analyze the payload data in the message to verify the identity of the device, adding a multi-level authentication mechanism to prevent forged response messages, including the link layer, network layer, transport layer and application layer.

7. A network access authentication method based on security protocol according to claim 1, characterized in that: include: During the authentication process, a blockchain-based logging mechanism is used to track and record the authentication status and historical changes of the device.

8. A network access authentication method based on security protocol according to claim 1, characterized in that: include: When device ports are swapped, Enhanced Dynamic Configuration Protocol (E-DCP) is used to automatically update port configurations and re-authenticate devices to accommodate the change in port roles.

9. A network access authentication method based on security protocol according to claim 1, characterized in that: include: In the matching rules of the protocol specification, add a dynamically generated encryption key verification step to encrypt and verify the response message through the encryption algorithm to ensure that the message has not been tampered with and comes from a legitimate device.

10. A network access authentication method based on security protocol according to claim 1, characterized in that: include: During the authentication process, a multi-factor authentication mechanism (MFA) is used, combining the device's MAC address, the unique identifier in the response message, and a time-based dynamic password to enhance the security and accuracy of authentication.

Images