A security gateway and terminal network traffic control method

Abstract

The present invention relates to a security gateway and a terminal network traffic control method, belonging to the field of network security technology, wherein the security gateway comprises: an acquisition module, used to acquire a target identification set from a terminal management system, wherein the target identification set includes an identity identification corresponding to a terminal with a security control installed; a configuration module, used to configure a terminal control policy, wherein the terminal control policy includes an allow state and a reject state; a control module, used to control the network traffic of the terminal based on the security control installation status of the terminal and the terminal control policy; and a push module, used to push the installation of the security control to the terminal without the security control installed. The present invention can ensure that each terminal in the system is installed with the corresponding security control, and realize the network traffic request control of the terminal, thereby improving the security of the terminal in the enterprise when it is used.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a security gateway and a terminal network traffic control method. Background Art

[0002] With the development of information technology and network security industry, the terminal management systems or other terminal security software developed and released by various network security industry manufacturers are different, and the security aspects involved are also uneven, such as the number of viruses and risk levels contained in a certain type of virus library are also different. Especially in the enterprise-level terminal management, using only one or several network security industry manufacturers to develop and release terminal management systems or other terminal security software as terminal security controls cannot fully guarantee the security of the enterprise's terminals.

[0003] Therefore, how to improve the security of terminals when used within the enterprise has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] In view of this, it is necessary to provide a security gateway and a terminal network traffic control method to solve the problem of insufficient security when using terminals within an enterprise.

[0005] In order to solve the above problems, the present invention provides a security gateway, comprising:

[0006] An acquisition module, used to acquire a target identification set from a terminal management system, wherein the target identification set includes an identity identification corresponding to a terminal on which a security control has been installed, wherein the terminal management system is used to provide security controls for the terminal and acquire the identity identification corresponding to the terminal on which the security control has been installed at a preset period;

[0007] A configuration module, used to configure a terminal control policy, wherein the terminal control policy includes an allow state and a deny state;

[0008] A control module, used to control the network traffic of the terminal based on the installation status of the terminal's security controls and the terminal control strategy;

[0009] The push module is used to push security control installation to terminals that do not have security controls installed.

[0010] In a possible implementation, the acquisition module is further used to acquire a security control installation path from the terminal management system;

[0011] The push module is also used to push the security control installation path to the terminal without the security control installed when the security control installation is pushed to the terminal without the security control installed.

[0012] In a possible implementation, the configuration module is further used to configure a preset time interval, where the preset time interval is a time interval for pushing security control installation to a terminal that does not have the security control installed when the terminal control policy is in an allowed state;

[0013] The control module is also used to remotely control the terminal on which the security control is installed.

[0014] The present invention also provides a terminal network traffic control method, which is applied to the security gateway as described above, comprising:

[0015] Obtain a target identification set from the terminal management system and receive a network traffic request initiated by the target terminal;

[0016] Determining the identity of the target terminal based on the network traffic request initiated by the target terminal;

[0017] Based on the identity of the target terminal, the target identification set and the terminal control policy, the network traffic request initiated by the target terminal is controlled.

[0018] In a possible implementation manner, the controlling the network traffic request initiated by the target terminal based on the identity of the target terminal, the target identification set and the terminal control policy includes:

[0019] When the identity identifier of the target terminal is within the target identifier set, allowing the network traffic request initiated by the target terminal to pass;

[0020] In a case where the identity of the target terminal is not in the target identity set, the network traffic request initiated by the target terminal is controlled based on the terminal control policy.

[0021] In a possible implementation, the controlling the network traffic request initiated by the target terminal based on the terminal control policy includes:

[0022] When the terminal control policy is in the allowed state, the network traffic request initiated by the target terminal is controlled based on the request type and the preset time interval corresponding to the network traffic request initiated by the target terminal;

[0023] When the terminal control policy is in a rejection state, the network traffic request initiated by the target terminal is controlled based on the request type corresponding to the network traffic request initiated by the target terminal.

[0024] In a possible implementation, the controlling the network traffic request initiated by the target terminal based on the request type and the preset time interval corresponding to the network traffic request initiated by the target terminal includes:

[0025] If the time interval between the current moment and the first moment is less than or equal to the preset time interval, the network traffic request initiated by the target terminal is released, and the first moment is the moment of the last security control installation push to the target terminal;

[0026] When the time interval between the current moment and the first moment is greater than the preset time interval, the network traffic request initiated by the target terminal is controlled based on the request type corresponding to the network traffic request initiated by the target terminal.

[0027] In a possible implementation manner, the controlling the network traffic request initiated by the target terminal based on the request type corresponding to the network traffic request initiated by the target terminal includes:

[0028] When the request type corresponding to the network traffic request initiated by the target terminal is a Hypertext Transfer Protocol request, blocking the network traffic request initiated by the target terminal;

[0029] When the request type corresponding to the network traffic request initiated by the target terminal is not a Hypertext Transfer Protocol request, the network traffic request initiated by the target terminal is discarded.

[0030] In a possible implementation manner, the controlling the network traffic request initiated by the target terminal based on the request type corresponding to the network traffic request initiated by the target terminal includes:

[0031] When the request type corresponding to the network traffic request initiated by the target terminal is a Hypertext Transfer Protocol request, blocking the network traffic request initiated by the target terminal;

[0032] When the request type corresponding to the network traffic request initiated by the target terminal is not a Hypertext Transfer Protocol request, the network traffic request initiated by the target terminal is released.

[0033] In a possible implementation, the method further includes:

[0034] In the case of blocking the network traffic request initiated by the target terminal, the network traffic request initiated by the target terminal is redirected to a uniform resource location, and a network traffic request response is sent to the target terminal, wherein the network traffic request response is used to control the target terminal's access to the security control installation path.

[0035] The beneficial effects of the present invention are as follows: the security gateway and terminal network traffic control method provided by the present invention can first obtain the identity identification of the terminal with installed security controls from the terminal management system, and then push the security control installation to the terminal without installed security controls, and at the same time control the network traffic of the terminal according to the configured terminal control policy and the security control installation status of the terminal. The present invention can ensure that each terminal in the system is installed with the corresponding security controls, and realize the network traffic request control of the terminal, thereby improving the security of the terminals in use within the enterprise. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A schematic diagram of the structure of an embodiment of a security gateway provided by the present invention;

[0037] Figure 2 A schematic diagram of a flow chart of an embodiment of a terminal network traffic control method provided by the present invention;

[0038] Figure 3 A schematic diagram of the structure of an embodiment of a terminal network traffic control system provided by the present invention;

[0039] Figure 4 A schematic diagram of a flow chart of an embodiment of a terminal network traffic control process provided by the present invention. DETAILED DESCRIPTION

[0040] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not used to limit the scope of the present invention.

[0041] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0042] In the description of the present invention, reference to an "embodiment" means that a particular feature, structure, or characteristic described in conjunction with the embodiment may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive of other embodiments. It is explicitly and implicitly understood by those skilled in the art that the described embodiments may be combined with other embodiments.

[0043] With the development of information technology and network security industry, the terminal management systems or other terminal security software developed and released by various network security industry manufacturers are different, and the security aspects involved are also uneven, such as the number of viruses and risk levels contained in a certain type of virus library are also different. Especially in the enterprise-level terminal management, using only one or several network security industry manufacturers to develop and release terminal management systems or other terminal security software as terminal security controls cannot fully guarantee the security of the enterprise's terminals.

[0044] Since security gateways are an indispensable part of enterprise-level networks, the linkage between terminal management systems and security gateways can ensure the security of terminals within the enterprise to a certain extent.

[0045] To this end, the present invention configures the access terminal management system on the security gateway through the linkage between the security gateway and the terminal management system, and configures the security control push strategy and the security control installation path on the security gateway. The terminal accesses the Internet through the security gateway, and the security gateway can install and push the security control to the terminal and block or release the terminal from accessing the Internet according to the configured strategy through the installation status of the security control on the terminal synchronized by the terminal management system.

[0046] The specific embodiments are described in detail below:

[0047] A specific embodiment of the present invention discloses a security gateway, combined with Figure 1 Come and see, Figure 1 This is a schematic diagram of the structure of an embodiment of a security gateway provided by the present invention. The security gateway 100 specifically includes:

[0048] The acquisition module 101 is used to acquire a target identification set from a terminal management system, wherein the target identification set includes an identity identification corresponding to a terminal on which a security control has been installed. The terminal management system is used to provide security controls for terminals and acquire the identity identification corresponding to the terminal on which the security control has been installed at a preset period.

[0049] Configuration module 102, used to configure terminal control policy, the terminal control policy includes an allow state and a deny state;

[0050] The control module 103 is used to control the network traffic of the terminal based on the security control installation status of the terminal and the terminal control policy;

[0051] The push module 104 is used to push the security control installation to the terminal that has not installed the security control.

[0052] During implementation, the security gateway can first obtain the target identification set from the terminal management system through the acquisition module to determine the identity identification corresponding to the terminal with the installed security control. The terminal management system can be a terminal management system installed in a cloud security server or a physical security server, which can provide security controls for the terminal to achieve terminal security protection, and can also obtain the identity identification corresponding to the terminal with the installed security control according to a preset period. The security gateway can access or switch to a specific terminal management system according to actual needs.

[0053] Subsequently, the terminal control policy can be configured on the configuration module of the security gateway. The terminal control policy includes the allow state and the deny state. The terminal control policy can be set according to the actual network security risk situation. For example, when the network security risk is high, it can be set to the deny state, and when the network security risk is low, it can be set to the allow state.

[0054] When performing terminal network traffic control, the security gateway can control the terminal network traffic through the control module according to the terminal security control installation status and terminal control policy. The terminal security control installation status can be determined based on the target identifier set.

[0055] In addition, the security gateway can also push security controls to terminals that do not have security controls installed through the push module to ensure that all terminals eventually have security controls installed.

[0056] The security gateway provided by the present invention can be applied to network security protection scenarios of large networks such as enterprises and institutions, and can also be applied to network security protection scenarios of small home networks, and the present invention does not make specific limitations on this.

[0057] Compared with the prior art, the security gateway provided in this embodiment can first obtain the identity of the terminal with installed security controls from the terminal management system, and then push the security control installation to the terminal without installed security controls. At the same time, the network traffic of the terminal is controlled according to the configured terminal control policy and the security control installation status of the terminal. The present invention can ensure that each terminal in the system is installed with the corresponding security controls and realize the network traffic request control of the terminal, thereby improving the security of the terminals in use within the enterprise.

[0058] Exemplarily, the acquisition module is further used to acquire the security control installation path from the terminal management system;

[0059] The push module is also used to push the security control installation path to the terminal without the security control installed when the security control installation is pushed to the terminal without the security control installed.

[0060] Specifically, the acquisition module in the security gateway can also obtain the security control installation path from the terminal management system, and when the push module pushes the security control installation to the terminal that does not have the security control installed, it can also push the security control installation path at the same time, so that the terminal can quickly complete the installation of the security control and further improve the security of the terminal when using it.

[0061] Exemplarily, the configuration module is further used to configure a preset time interval, where the preset time interval is a time interval for pushing security control installation to a terminal that does not have the security control installed when the terminal control policy is in the allowed state;

[0062] The control module is also used to remotely control the terminal on which the security control is installed.

[0063] Specifically, when the terminal control policy is configured in the configuration module to be in the allowed state, the time interval for pushing security controls to terminals that do not have security controls installed can be set. Furthermore, when the terminal does not generate network traffic, security controls can be pushed to terminals that do not have security controls installed, thereby further improving the security of the terminal when in use.

[0064] In addition, the security gateway can also remotely control terminals with installed security controls through the control module, such as shutting down, restarting, isolating the network, restoring the network, etc., so as to respond promptly when security incidents occur on certain terminals.

[0065] The embodiment of the present invention also provides a terminal network traffic control method, which is applied to the security gateway as described above, combined with Figure 2 Come and see, Figure 2 The flowchart of an embodiment of the terminal network traffic control method provided by the present invention includes steps S201 to S203, wherein:

[0066] In step S201, a target identification set is obtained from a terminal management system, and a network traffic request initiated by a target terminal is received;

[0067] In step S202, based on the network traffic request initiated by the target terminal, the identity of the target terminal is determined;

[0068] In step S203, based on the identity of the target terminal, the target identification set and the terminal control policy, the network traffic request initiated by the target terminal is controlled.

[0069] During implementation, the security gateway can first obtain a target identification set from the terminal management system, that is, a set of identity identifications of terminals on which security controls have been installed, and simultaneously receive a network traffic request initiated by the target terminal.

[0070] Subsequently, the security gateway can determine the identity of the target terminal based on the network traffic request initiated by the target terminal, and then control the network traffic request initiated by the target terminal based on the identity of the target terminal, the target identification set and the terminal control policy.

[0071] The terminal network traffic control method provided by the present invention can be applied to network security protection scenarios of large networks such as enterprises and institutions, and can also be applied to network security protection scenarios of small home networks, and the present invention does not make specific limitations on this.

[0072] Compared with the prior art, the terminal network traffic control method provided in this embodiment can, when the security gateway performs terminal network traffic control, first obtain the identity of the terminal with installed security controls from the terminal management system, and then determine the identity of the target terminal based on the network traffic request initiated by the target terminal, and finally control the network traffic request initiated by the target terminal based on the identity of the target terminal, the identity of the terminal with installed security controls, and the terminal control policy. The present invention can implement network traffic request control of the target terminal based on the security control installation status of the target terminal, thereby improving the security of terminals in use within the enterprise.

[0073] Exemplarily, the controlling the network traffic request initiated by the target terminal based on the identity of the target terminal, the target identification set and the terminal control policy includes:

[0074] When the identity identifier of the target terminal is within the target identifier set, allowing the network traffic request initiated by the target terminal to pass;

[0075] In a case where the identity of the target terminal is not in the target identity set, the network traffic request initiated by the target terminal is controlled based on the terminal control policy.

[0076] Specifically, when the identity of the target terminal is within the target identity set, that is, the target terminal has installed the security control, the security gateway can confirm that the network environment of the target terminal is safe and the network traffic request initiated by the target terminal can be released.

[0077] When the identity of the target terminal is not in the target identification set, that is, the target terminal has no security controls installed, the security gateway needs to control the network traffic request initiated by the target terminal according to its own terminal control strategy.

[0078] Exemplarily, controlling the network traffic request initiated by the target terminal based on the terminal control policy includes:

[0079] When the terminal control policy is in the allowed state, the network traffic request initiated by the target terminal is controlled based on the request type and the preset time interval corresponding to the network traffic request initiated by the target terminal;

[0080] When the terminal control policy is in a rejection state, the network traffic request initiated by the target terminal is controlled based on the request type corresponding to the network traffic request initiated by the target terminal.

[0081] Specifically, when the target terminal has no security controls installed, the security gateway needs to control the network traffic requests initiated by the target terminal according to its own terminal control policy. At this time, it can first determine the request type corresponding to the network traffic request initiated by the target terminal, that is, determine whether the request type corresponding to the network traffic request initiated by the target terminal is a Hypertext Transfer Protocol (HTTP) request. The HTTP request can include ordinary HTTP requests and Hypertext Transfer Protocol Secure (HTTPS) requests.

[0082] When the terminal control policy is in the allowed state, the security gateway can control the network traffic requests initiated by the target terminal according to the request type corresponding to the network traffic requests initiated by the target terminal and the time interval for pushing security control installation to terminals that do not have security controls installed.

[0083] When the terminal control policy is in the reject state, the security gateway can control the network traffic request initiated by the target terminal according to the request type corresponding to the network traffic request initiated by the target terminal.

[0084] Exemplarily, the controlling the network traffic request initiated by the target terminal based on the request type and the preset time interval corresponding to the network traffic request initiated by the target terminal includes:

[0085] If the time interval between the current moment and the first moment is less than or equal to the preset time interval, the network traffic request initiated by the target terminal is released, and the first moment is the moment of the last security control installation push to the target terminal;

[0086] When the time interval between the current moment and the first moment is greater than the preset time interval, the network traffic request initiated by the target terminal is controlled based on the request type corresponding to the network traffic request initiated by the target terminal.

[0087] Specifically, when the target terminal has no security control installed and the terminal control policy is in the allowed state, if the time interval between the current moment and the last time the security control installation was pushed to the target terminal is less than or equal to the preset time interval, the security gateway can release the network traffic request initiated by the target terminal; if the time interval between the current moment and the last time the security control installation was pushed to the target terminal is greater than the preset time interval, the security gateway also needs to control the network traffic request initiated by the target terminal according to the request type corresponding to the network traffic request initiated by the target terminal.

[0088] Exemplarily, the controlling the network traffic request initiated by the target terminal based on the request type corresponding to the network traffic request initiated by the target terminal includes:

[0089] When the request type corresponding to the network traffic request initiated by the target terminal is a Hypertext Transfer Protocol request, blocking the network traffic request initiated by the target terminal;

[0090] When the request type corresponding to the network traffic request initiated by the target terminal is not a Hypertext Transfer Protocol request, the network traffic request initiated by the target terminal is discarded.

[0091] Specifically, when the target terminal has no security controls installed and the terminal control policy is in the reject state, if the request type corresponding to the network traffic request initiated by the target terminal is an HTTP request, the security gateway can block the network traffic request initiated by the target terminal; if the request type corresponding to the network traffic request initiated by the target terminal is not an HTTP request, the security gateway can directly discard the network traffic request initiated by the target terminal.

[0092] Exemplarily, the controlling the network traffic request initiated by the target terminal based on the request type corresponding to the network traffic request initiated by the target terminal includes:

[0093] When the request type corresponding to the network traffic request initiated by the target terminal is a Hypertext Transfer Protocol request, blocking the network traffic request initiated by the target terminal;

[0094] When the request type corresponding to the network traffic request initiated by the target terminal is not a Hypertext Transfer Protocol request, the network traffic request initiated by the target terminal is released.

[0095] Specifically, when the target terminal has no security control installed, the terminal control policy is in the allowed state, and the time interval between the current moment and the last time the security control installation was pushed to the target terminal is greater than the preset time interval, if the request type corresponding to the network traffic request initiated by the target terminal is an HTTP request, the security gateway can block the network traffic request initiated by the target terminal; if the request type corresponding to the network traffic request initiated by the target terminal is not an HTTP request, the security gateway can release the network traffic request initiated by the target terminal.

[0096] Exemplarily, the method further includes:

[0097] In the case of blocking the network traffic request initiated by the target terminal, the network traffic request initiated by the target terminal is redirected to a uniform resource location, and a network traffic request response is sent to the target terminal, wherein the network traffic request response is used to control the target terminal's access to the security control installation path.

[0098] Specifically, when blocking the network traffic request initiated by the target terminal, the security gateway can also redirect the network traffic request initiated by the target terminal to perform uniform resource location (URL) processing, and send a network traffic request response to the target terminal, so that the target terminal can access the security control installation path and install the security control. If the terminal control policy of the security gateway is in the allowed state, the security control installation push timestamp corresponding to the target terminal can also be updated at the same time.

[0099] The following is a specific application scenario to better illustrate the technical solution of the present invention:

[0100] The terminal network flow control process provided by the present invention is based on the terminal network flow control system, combined with Figure 3 Come and see, Figure 3 This is a schematic diagram of the structure of an embodiment of a terminal network traffic control system provided by the present invention.

[0101] Combination Figure 4 Come and see, Figure 4 This is a flow chart of an embodiment of a terminal network traffic control process provided by the present invention. The specific steps of the process are as follows:

[0102] 1. Connect the security gateway to or switch it to the terminal management system, and configure the security control installation path, terminal control policy (allow / deny), and the time interval for pushing security control installation when the terminal control policy allows on the security gateway.

[0103] 2. The security gateway periodically obtains terminal information with installed security controls from the terminal management system and caches it locally. Operation and maintenance personnel can manage such terminals as needed, such as shutting down, restarting, isolating the network, and restoring the network.

[0104] 3.1. The terminal's Internet traffic passes through the security gateway. The security gateway extracts the terminal information from the user and session information of the traffic, and queries the terminal cache list to determine whether the terminal has installed security controls. If it has been installed, it will be directly released and enter step 4. If it has not been installed and the policy action is to deny, it will enter step 3.4. If it has not been installed and the policy action is to allow, it will enter step S3.2.

[0105] 3.2. Analyze whether the traffic is an http(s) request. If yes, proceed to step 3.3; otherwise, proceed to step 4.

[0106] 3.3. According to the http(s) request corresponding to the traffic, perform redirection URL processing and block the traffic, so that the terminal can access the security control installation path configured in step 1, update the push timestamp information in the online user information corresponding to the traffic, and go to step 6.2.

[0107] 3.4. Analyze whether the traffic is an http(s) request. If yes, proceed to step 3.5; otherwise, proceed to step 5.

[0108] 3.5. According to the http(s) request corresponding to the traffic, redirect the URL and block the traffic, so that the terminal can access the security control installation path configured in step 1 and proceed to step 6.1.

[0109] 4. Release the traffic and go to step 7.

[0110] 5. Discard the message and go to step 6.3.

[0111] 6.1. Record the log, which contains the blocking and pushing of security control installation, and go to step 7.

[0112] 6.2. Record the log, the content is to push the security control installation, go to step 7.

[0113] 6.3. Record the log with the content of discarded message and go to step 7.

[0114] 7. End the process.

[0115] In the present invention, the security gateway can control the Internet access of terminals that do not have security controls installed based on the installation status information of security controls on terminals synchronized with the terminal management system, and push the installation of security controls to terminals that do not have security controls installed as needed, and at the same time effectively manage terminals that have installed controls as needed.

[0116] The present invention discloses a security gateway and a terminal network traffic control method. First, the identity of a terminal with a security control installed can be obtained from a terminal management system, and then the security control installation is pushed to the terminal without the security control installed. At the same time, the network traffic of the terminal is controlled according to the configured terminal control policy and the security control installation status of the terminal. The present invention can ensure that each terminal in the system is installed with the corresponding security control and realize the network traffic request control of the terminal, thereby improving the security of the terminal in the enterprise.

[0117] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. A terminal network traffic control method, characterized in that: Applied to security gateways, including: Obtain a target identification set from the terminal management system and receive a network traffic request initiated by the target terminal; Determining the identity of the target terminal based on the network traffic request initiated by the target terminal; Controlling the network traffic request initiated by the target terminal based on the identity of the target terminal, the target identification set and the terminal control policy; The controlling the network traffic request initiated by the target terminal based on the identity of the target terminal, the target identification set and the terminal control policy includes: When the identity identifier of the target terminal is within the target identifier set, allowing the network traffic request initiated by the target terminal to pass; When the identity of the target terminal is not in the target identifier set, controlling the network traffic request initiated by the target terminal based on the terminal control policy; The controlling the network traffic request initiated by the target terminal based on the terminal control policy includes: When the terminal control policy is in the allowed state, the network traffic request initiated by the target terminal is controlled based on the request type and the preset time interval corresponding to the network traffic request initiated by the target terminal; When the terminal control policy is in a rejection state, controlling the network traffic request initiated by the target terminal based on the request type corresponding to the network traffic request initiated by the target terminal; The controlling the network traffic request initiated by the target terminal based on the request type corresponding to the network traffic request initiated by the target terminal and the preset time interval includes: If the time interval between the current moment and the first moment is less than or equal to the preset time interval, the network traffic request initiated by the target terminal is released, and the first moment is the moment of the last security control installation push to the target terminal; When the time interval between the current moment and the first moment is greater than the preset time interval, controlling the network traffic request initiated by the target terminal based on the request type corresponding to the network traffic request initiated by the target terminal; The security gateway comprises: An acquisition module, used to acquire a target identification set from a terminal management system, wherein the target identification set includes an identity identification corresponding to a terminal on which a security control has been installed, wherein the terminal management system is used to provide security controls for the terminal and acquire the identity identification corresponding to the terminal on which the security control has been installed at a preset period; A configuration module, used to configure a terminal control policy, wherein the terminal control policy includes an allow state and a deny state; A control module, used to control the network traffic of the terminal based on the installation status of the terminal's security controls and the terminal control strategy; The push module is used to push the installation of security controls to terminals that do not have security controls installed; The acquisition module is also used to obtain the security control installation path from the terminal management system; The push module is also used to push the security control installation path to the terminal without the security control installed when the security control installation is pushed to the terminal without the security control installed; The configuration module is further used to configure a preset time interval, which is a time interval for pushing security control installation to a terminal that does not have the security control installed when the terminal control policy is in the allowed state; The control module is also used to remotely control the terminal on which the security control is installed.

2. The terminal network traffic control method according to claim 1, characterized in that: The controlling the network traffic request initiated by the target terminal based on the request type corresponding to the network traffic request initiated by the target terminal includes: When the request type corresponding to the network traffic request initiated by the target terminal is a Hypertext Transfer Protocol request, blocking the network traffic request initiated by the target terminal; When the request type corresponding to the network traffic request initiated by the target terminal is not a Hypertext Transfer Protocol request, the network traffic request initiated by the target terminal is discarded.

3. The terminal network traffic control method according to claim 1, characterized in that: The controlling the network traffic request initiated by the target terminal based on the request type corresponding to the network traffic request initiated by the target terminal includes: When the request type corresponding to the network traffic request initiated by the target terminal is a Hypertext Transfer Protocol request, blocking the network traffic request initiated by the target terminal; When the request type corresponding to the network traffic request initiated by the target terminal is not a Hypertext Transfer Protocol request, the network traffic request initiated by the target terminal is released.

4. The terminal network traffic control method according to claim 2 or 3, characterized in that: The method further comprises: In the case of blocking the network traffic request initiated by the target terminal, the network traffic request initiated by the target terminal is redirected to a uniform resource location, and a network traffic request response is sent to the target terminal, wherein the network traffic request response is used to control the target terminal's access to the security control installation path.

Images