Network security protection method and device based on multiple production environments
By obtaining the host-side activity history and status, calling the corresponding authentication policy for the status for one authentication, and selecting the secondary authentication policy based on the host-side status, it solves the problem of taking into account both user convenience and network security, reduces frequent verification and improves Security of network access.
Patent Information
- Application Number
- CN202411079050.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-07
- Publication Date
- 2024-12-10
AI Technical Summary
The existing technology cannot take into account both user convenience and network security, especially under the demand for low permissions. Frequent dynamic password verification brings inconvenience to users and cannot effectively solve the convenience of user-side verification.
By obtaining the active history of the host side in each production environment, judging the active tense of the host side, calling the authentication strategy in different states for one authentication, and performing secondary authentication only after one authentication is passed, and selecting dynamic or Static authentication strategy to reduce non-essential password verification.
Improve network security, reduce the user's password memory burden, ensure that even if the password in a certain tense is cracked, the host side in other tense is still safe, isolate secondary authentication, avoid frequent dynamic verification, and improve network connection security.
Smart Images
Figure CN119109619A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security protection technology, and in particular to a network security protection method and device based on multiple production environments. Background Art
[0002] Information and communication edge devices serve as the foundation of digital, secure, and intelligent services. Due to the diversity of services they carry and the multi-source ownership of equipment, there are great security risks in the horizontal subsystems and workspace subsystems of the integrated wiring system, and at the network access ports that are vulnerable to social attacks. In addition, there is uncertainty in the source of operating personnel, operating methods, and work units. For a long time, the information and communication management party, the information and communication company, has been unable to achieve real-time on-site construction monitoring due to various reasons such as the large number of integrated wiring subsystems in each unit and a lack of supervisory manpower.
[0003] In the related art, complex passwords are used to enhance network security protection, which easily increases the burden of password memory for users. Although dynamic password verification can enhance network security protection and reduce the burden of password memory for users, if users only need lower permissions, frequent dynamic password verification will cause inconvenience to users.
[0004] The Chinese patent "Network Security Protection Method, Server, Security Device, System and Storage Medium", publication number: CN118250105A, publication date: June 25, 2024, specifically discloses the acquisition of threat data reported by each security device in the distributed protection cluster, the threat data is obtained by the security device performing a first aggregation process on the network attack threat information, the network attack threat information includes the Internet Protocol address that initiates the attack; the threat data is subjected to a second aggregation process, and the threat score corresponding to the Internet Protocol address is calculated, the threat score is used to characterize the degree of impact of the attack behavior implemented by the Internet Protocol address on network security; according to the ranking order of the threat score, a threat intelligence library containing the Internet Protocol address is generated, and sent to each security device to perform security protection actions based on the threat intelligence library. This solution performs security protection based on the generation of the threat intelligence library, and does not solve the inconvenience caused to users by user-side verification.
[0005] The Chinese patent "Network Security Protection Method, Device, Electronic Equipment and Medium", publication number: CN 118214617A, publication date: June 18, 2024, specifically discloses: obtaining the port information of the website; determining the port status matrix of the website according to the port information, wherein the port status in the port status matrix includes: open state, closed state and unknown state, when the port status is open, the port is represented as vector 1; when the port status is closed, the port is represented as vector -1; when the port status is unknown, the port is represented as vector 0; according to the port status matrix, determine the security level of the website; according to the security level, determine the protection process text of the website. This solution determines the protection process text of the website according to the security level, and does not solve the inconvenience caused to users by user-side verification. Summary of the invention
[0006] In order to solve the problem that the prior art cannot balance user convenience and network security, the present application provides a network security protection method based on multiple production environments. The active state of each host end is obtained through the active history of the host end in each production environment. Whether the accessed host end is in an active state is determined according to the timing of the user port access signal. The authentication strategy in different states is called according to the state of the host end, and the user authentication information is authenticated once. Only after the primary authentication is passed, a secondary authentication is performed with the user. While enhancing network security, since the primary authentication is performed by the host end, the user does not need to remember more passwords, reducing the user's memory burden. Whether the secondary authentication needs to be dynamically verified is determined by the state of the host end. When the host end is in an inactive state and the user has already been dynamically verified within a preset period, the user's dynamic verification can be avoided, reducing the frequent verification of users under low authority requirements while ensuring network security.
[0007] In order to achieve the above-mentioned technical objectives, a technical solution provided by the present application is a network security protection method based on multiple production environments, including the following steps: S1: Obtain the active history of the host end in each production environment, and determine the active state of each host end; S2: When receiving the user port access signal, judge the current state of the access host end according to the current timing and the active state of each host end, and call the state authentication strategy according to the current state of the access host end; S3: Obtain user authentication information, perform an authentication on the user authentication information based on the state authentication strategy, and judge whether the authentication is passed. If so, execute S4, if not, execute an alarm; S4: Judge whether the next timing state of the access host end belongs to the active state. If so, execute the dynamic authentication strategy, if not, execute the static authentication strategy. The authentication strategy for secondary authentication is determined based on whether the next sequential state of the access host is an active state. If the next sequential state of the access host is an active state, the dynamic password authentication in the dynamic authentication strategy is executed, that is, a short-term dynamic verification code is sent to the user's preset verification terminal for further verification. If the next sequential state of the access host is a standby state, the periodic authentication frequency authentication in the static authentication strategy is executed, that is, whether to perform dynamic password authentication is determined according to the preset period and the preset authentication frequency. Therefore, when the authentication frequency within the preset period meets the preset authentication frequency, dynamic password authentication is not performed, thereby reducing password verification in unnecessary states and alleviating the verification burden of users with low authority requirements.
[0008] Furthermore, judging the current state of the access host terminal according to the current timing and the active state of each host terminal includes: calling the active state of the access host terminal, if the current timing matches the active state of the access host terminal, then the current state of the access host terminal is considered to be an active state; if the current timing does not match the active state of the access host terminal, then the current state of the access host terminal is considered to be a standby state.
[0009] Furthermore, the calling of the state authentication policy according to the current state of the access host side includes: when the current state of the access host side is an active state, calling the active state authentication policy; when the current state of the access host side is a standby state, calling the standby state authentication policy; the standby state authentication policy includes at least a first standby state authentication policy for static initial authentication and a second standby state authentication policy for state transition authentication.
[0010] Further, S3 includes: obtaining user authentication information, and obtaining a user authentication target based on the user authentication information; and determining whether to perform an authentication using the first standby state authentication strategy or the second standby state authentication strategy based on the user authentication target.
[0011] Furthermore, the S1 also includes: dividing the first authentication sequence corresponding to the active state authentication policy, the second authentication sequence corresponding to the first standby state authentication policy, and the third authentication sequence corresponding to the second standby state authentication policy based on the preset password sequence specification.
[0012] Further, performing an authentication on the user authentication information based on the state authentication policy includes: calling an authentication string of the user password in the user authentication information based on an authentication sequence matched by the state authentication policy, and performing an authentication to determine whether the authentication string meets a preset authentication rule.
[0013] Furthermore, the dynamic authentication strategy includes at least dynamic password authentication, and the static authentication strategy includes at least periodic authentication frequency authentication.
[0014] Another technical solution provided by the present application is a network security protection device based on multiple production environments, which is used to implement the above method, including: an authentication unit, which authenticates user authentication information based on a preset authentication strategy.
[0015] Furthermore, the authentication unit is a Cortex M4 microcontroller.
[0016] Furthermore, it also includes: a network chip, which is used to query the link status of the network port in real time; the network chip is a Switch chip with management function.
[0017] The beneficial effects of the present application are as follows: the active state of each host terminal is obtained through the active history of the host terminal in each production environment, and whether the accessed host terminal is in the active state is determined according to the timing of the user port access signal. The authentication strategy in different states is called according to the state of the host terminal, and the user authentication information is authenticated once. Only after the first authentication is passed, the user is authenticated for the second time. At the same time, the second authentication selects a dynamic authentication strategy or a static authentication strategy based on the next timing state of the host terminal, and the authentication strategy is divided according to the active state, so as to ensure that even if the password in a certain state is cracked, the security of the host terminal in other states can still be ensured. At the same time, the second authentication is isolated to ensure that even if the first authentication is attacked, the security of the second authentication will not be affected, thereby improving network access security. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] Figure 1 This is a flowchart of the network security protection method based on multiple production environments in this application.
[0019] Figure 2 This is a schematic diagram of the interface of the network security protection device based on multiple production environments in this application.
[0020] Figure 3 This is a schematic diagram of the structure of the network security protection device based on multiple production environments in this application. DETAILED DESCRIPTION
[0021] In order to make the purpose, technical solutions and advantages of the present application more clear, the present application is further described in detail below in conjunction with the drawings and examples. It should be understood that the specific implementation method described here is only an optimal embodiment of the present application, which is only used to explain the present application and does not limit the scope of protection of the present application. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.
[0022] like Figure 1 As shown, as the first embodiment of the present application, a network security protection method based on multiple production environments includes the following steps: S1: Obtain the active history of the host side in each production environment and determine the active state of each host side; S2: When receiving a user port access signal, the current state of the access host is determined according to the current timing and the active state of each host, and a state authentication policy is called according to the current state of the access host; S3: Obtain user authentication information, perform an authentication on the user authentication information based on the state authentication policy, and determine whether the authentication is passed. If so, execute S4, otherwise, execute an alarm; S4: Determine whether the next timing state of the access host is an active state. If so, execute the dynamic authentication strategy; if not, execute the static authentication strategy.
[0023] In this embodiment, the active state of each host end is obtained through the active history of the host end in each production environment, and whether the accessed host end is in the active state is determined according to the timing of the user port access signal. The authentication strategy in different states is called according to the state of the host end, and the user authentication information is authenticated once. Only after the first authentication is passed, the user is authenticated for the second time. At the same time, the secondary authentication selects a dynamic authentication strategy or a static authentication strategy based on the next timing state of the host end. The authentication strategy is divided according to the active state, so as to ensure that even if the password in a certain state is cracked, the security of the host end in other states can still be ensured. At the same time, the secondary authentication is isolated to ensure that even if the first authentication is attacked, the security of the secondary authentication will not be affected, thereby improving network access security.
[0024] Specifically, due to the production requirements in the production environment, the active time of the host side is different. Acquiring the active history of the host side in each production environment and determining the active tense of each host side includes: Obtain the running status of the host side in each production environment, assign values to the host side states at different time sequences according to the running status differences, build a host side state table based on the state assignments, and use the host side state table to determine the active tense of each host side.
[0025] The running status of the host side can be divided according to the network interaction status. The host that is currently interacting with the network is regarded as the active host, and the host in the standby state is regarded as the standby host. At this time, if the host is in the active state at the current timing, the state is assigned to "1", if the host is in the standby state at the current timing, the state is assigned to "0", and the host side status table of each host side is constructed.
[0026] The current status of the access host is determined based on the current timing and the active state of each host: The active state of the access host is called. If the current timing matches the active state of the access host, the current state of the access host is considered to be an active state. If the current timing does not match the active state of the access host, the current state of the access host is considered to be a standby state.
[0027] When a user port access signal is received, the host-side status table is called according to the current timing to determine whether the output status is assigned to "1". If so, it is considered that the current timing matches the active state of the access host. If not, that is, the output status is assigned to "0", it is considered that the current timing does not match the active state of the access host.
[0028] The authentication strategies corresponding to the call status according to the current status of the access host include: When the current state of the access host is active, the active state authentication policy is called; When the current state of the access host is in standby state, the standby state authentication strategy is called; The standby state authentication policy includes at least a first standby state authentication policy for static initial authentication and a second standby state authentication policy for state transition authentication.
[0029] In this embodiment, an active state authentication policy and a standby state authentication policy are preset. The active state authentication policy is called when the current state of the access host end is an active state, and the standby state authentication policy is called when the current state of the access host end is a standby state. Therefore, even if the network is attacked and the authentication policy under a certain time sequence is deciphered, the security of the authentication policy of the other state can still be ensured.
[0030] At the same time, considering that the user access process may prompt the host to switch from the standby state to the active state, the user's authority needs to be further confirmed. Therefore, S3 includes: Obtain user authentication information, and obtain a user authentication target based on the user authentication information; Whether to perform authentication once using the first standby state authentication policy or the second standby state authentication policy is determined based on the user authentication target.
[0031] When user authentication only requires host-side interaction permissions in standby state, the user is authenticated once with the first standby state authentication policy, and when user authentication requires the host-side standby state to be converted to active state, the user is authenticated once with the second standby state authentication policy. This avoids the situation where the host-side state is converted to active state after the user's standby state access permission is granted to circumvent active state authentication, further improving network security.
[0032] In this embodiment, S1 further includes: The first authentication sequence corresponding to the active state authentication policy, the second authentication sequence corresponding to the first standby state authentication policy, and the third authentication sequence corresponding to the second standby state authentication policy are divided based on the preset password sequence specification.
[0033] In order to balance the convenience of users and the security of authentication, the first authentication sequence corresponding to the active state authentication strategy, the second authentication sequence corresponding to the first standby state authentication strategy, and the third authentication sequence corresponding to the second standby state authentication strategy are pre-stored in the authentication unit. The user only needs to set a password according to the preset password sequence specification to achieve authentication in three states. The following is a specific implementation situation, such as the preset password sequence specification is 8 strings, the user password is cs123456, the first authentication sequence is [2,1; 4,2; 5,3], the second authentication sequence is [1,1; 3,2; 8,3], and the third authentication sequence is [6,1; 7,2]. According to the user authentication information, that is, the user authentication password, the authentication string corresponding to the first authentication sequence is s23, the authentication string corresponding to the second authentication sequence is c16, and the authentication string corresponding to the third authentication sequence is 45. Therefore, when the network is attacked, if the authentication result corresponding to the first authentication sequence is deciphered as s23, only the permissions in the active state can be accepted, and the authentication results corresponding to the remaining authentication sequences cannot be obtained, that is, the standby state and state transition permissions cannot be obtained. It can be understood that the above is only one implementation case, that is, the password sequences used by each authentication sequence do not cross, while in other implementation cases with higher security, the password sequences used by each authentication sequence cross and the order does not correspond, such as the first authentication sequence is [7,1; 4,2; 8,3; 1,4], the second authentication sequence is [8,1; 5,2; 3,3; 6,4], and the third authentication sequence is [2,1; 7,2; 1,3; 5,4]. According to the user authentication information, that is, the user authentication password, the authentication string corresponding to the first authentication sequence is 526c, the authentication string corresponding to the second authentication sequence is 6314, and the authentication string corresponding to the third authentication sequence is s5c3. At this time, performing an authentication on the user authentication information based on the state authentication strategy includes: The authentication sequence based on the state authentication policy matching calls the authentication string of the user password in the user authentication information, and performs an authentication to see if the authentication string meets the preset authentication rules.
[0034] The preset authentication rules can be set based on the encryption algorithm, such as pre-storing the encrypted authentication results on the server, encrypting the authentication string, and judging whether it matches the pre-stored authentication results. If so, the authentication is passed once. The encryption algorithm can be AES, RSA, SHA, etc. By encrypting the authentication string, the authentication string can be prevented from being intercepted and directly used during the transmission process. Even if the attacker can intercept the encrypted authentication string, they cannot know the original authentication string without the corresponding decryption key. In the remaining embodiments, different algorithms can be used to encrypt different authentication strings in certain production environments with higher network security requirements, so that even if a certain authentication string is deciphered, the remaining authentication strings cannot be deciphered. At this time, the active state authentication policy includes at least a first authentication sequence and a first encryption algorithm, the first standby state authentication policy includes at least a second authentication sequence and a second encryption algorithm, and the second standby state authentication policy includes at least a third authentication sequence and a third encryption algorithm.
[0035] In the remaining embodiments, the user authentication information also includes the user IP address and the user ID. At this time, characters of different sequences are selected according to the user IP address, the user ID and the user password to form an authentication string. The first authentication sequence, the second authentication sequence and the third authentication sequence include at least the user IP address sequence information, the user ID sequence information and the user password sequence information.
[0036] In this embodiment, the dynamic authentication strategy includes at least dynamic password authentication, and the static authentication strategy includes at least periodic authentication and frequency authentication.
[0037] Considering the possibility of password leakage, a secondary authentication is set up, and the primary authentication is isolated from the secondary authentication. The secondary authentication process is started only after the primary authentication is passed. The authentication strategy for secondary authentication is determined based on whether the next sequential state of the access host is an active state. If the next sequential state of the access host is an active state, the dynamic password authentication in the dynamic authentication strategy is executed, that is, a short-term dynamic verification code is sent to the user's preset verification terminal for further verification. If the next sequential state of the access host is a standby state, the periodic authentication frequency authentication in the static authentication strategy is executed, that is, according to the preset period and the preset authentication frequency, it is determined whether to perform dynamic password authentication. Therefore, when the authentication frequency within the preset period meets the preset authentication frequency, dynamic password authentication is not performed, which reduces password verification in non-essential states and reduces the verification burden of users with low authority requirements.
[0038] In the remaining embodiments, the active historical data of the host side in each production environment, such as CPU usage, network traffic, disk I / O, etc., is continuously monitored and recorded, and the active tense of the host side is identified through machine learning or statistical analysis methods.
[0039] In this embodiment, the host end can be a switch in each production environment, and the user end performs authentication when accessing the switch. In a multi-production environment, there are usually multiple switches, such as one production environment corresponds to one switch, and the active state of the switch changes with the production environment.
[0040] As a second embodiment of the present application, a network security protection device based on multiple production environments includes: The authentication unit authenticates the user authentication information based on a preset authentication strategy.
[0041] In this embodiment, the authentication unit is a Cortex M4 microcontroller.
[0042] The network security protection device based on multiple production environments also includes: Network chip, used to query the link status of the network port in real time; The network chip is a Switch chip with management function.
[0043] The network chip queries the link status of the network port in real time. When a link down event is found, the port is disabled to prevent further network communication, an alarm is issued, and the event information is sent to a log server or local storage for subsequent analysis.
[0044] like Figure 2 As shown, the network security protection device is provided with multiple interfaces, the user end is connected to the downlink interface of the network security protection device, and the host end is connected to the downlink interface of the network security protection device.
[0045] The network security protection device adopts AC / DC dual power supply, namely AC220V and DC-48V power supply. When the city power is cut off, the backup power supply can be used to detect the power supply status in real time. After the power outage, the configuration file will be saved immediately and all modules will be notified.
[0046] The network security protection device is also equipped with three maintenance interfaces, which are used for telnet parameter configuration and status viewing, Web parameter configuration and status viewing, and Snmp parameter configuration and status viewing.
[0047] In this embodiment, when the MAC address of the user terminal matches the MAC address preset by the network security protection device, the network security protection method based on multiple production environments is executed, that is, secondary authentication can be performed only when they match, otherwise intercommunication is not performed.
[0048] The hardware platform of the network security protection device includes DEVICE, Core, CPU, M0, and Memories modules. The software platform of the network security protection device is μC / OS-II, which supports telnet and Snmp interfaces.
[0049] The network security protection device adopts a high-density mechanical installation structure, 1U / 19-inch standard rack-mounted, front and rear wiring, and card line access at the rear end, which can be smoothly upgraded and replaced on the original patch panel.
[0050] like Figure 3 As shown, the isolation gateway of the network security protection device has 10M / 100M / 1000M adaptive access and supports up to 24 ports. Physical isolation between each port ensures data security. The 8-way modular design is easy to expand and maintain.
[0051] The network security protection device also includes a remote network management module to realize port matching authentication configuration of the local network. The network management module and the business module are physically isolated to ensure data security, and support port multi-device authentication bundling and illegal access alarm recording.
[0052] When the network security protection device is powered on, the initialization parameters of the configuration file are loaded, the network chip / business function implementation FPGA / serial port chip, etc. are configured, and the configuration parameters are loaded into the shared memory to determine whether the configuration file loading is abnormal. If so, the configuration file is restored in the preset order.
[0053] The specific implementation methods described above are preferred implementation methods of the network security protection method and device based on multiple production environments of the present application, and are not intended to limit the specific implementation scope of the present application. The scope of the present application includes but is not limited to the specific implementation methods. All equivalent changes made in accordance with the shape and structure of the present application are within the protection scope of the present application.
Claims
1. A network security protection method based on multiple production environments, characterized by: The steps include: S1: Obtain the active history of the host side in each production environment and determine the active state of each host side; S2: When receiving a user port access signal, the current state of the access host is determined according to the current timing and the active state of each host, and a state authentication policy is called according to the current state of the access host; S3: Obtain user authentication information, perform an authentication on the user authentication information based on the state authentication policy, and determine whether the authentication is passed. If so, execute S4, otherwise, execute an alarm; S4: Determine whether the next timing state of the access host is an active state. If so, execute the dynamic authentication strategy; if not, execute the static authentication strategy.
2. The network security protection method based on multiple production environments according to claim 1 is characterized in that: The step of determining the current state of the access host terminal according to the current time sequence and the active state of each host terminal includes: The active state of the access host is called. If the current timing matches the active state of the access host, the current state of the access host is considered to be an active state. If the current timing does not match the active state of the access host, the current state of the access host is considered to be a standby state.
3. The network security protection method based on multiple production environments as claimed in claim 2, characterized in that: The authentication strategy for calling the state corresponding to the current state of the access host terminal includes: When the current state of the access host is active, the active state authentication policy is called; When the current state of the access host is in standby state, the standby state authentication strategy is called; The standby state authentication policy includes at least a first standby state authentication policy for static initial authentication and a second standby state authentication policy for state transition authentication.
4. The network security protection method based on multiple production environments as claimed in claim 3 is characterized by: The S3 includes: Obtain user authentication information, and obtain a user authentication target based on the user authentication information; Whether to perform authentication once using the first standby state authentication policy or the second standby state authentication policy is determined based on the user authentication target.
5. The network security protection method based on multiple production environments as claimed in claim 3 is characterized by: The S1 further comprises: The first authentication sequence corresponding to the active state authentication policy, the second authentication sequence corresponding to the first standby state authentication policy, and the third authentication sequence corresponding to the second standby state authentication policy are divided based on the preset password sequence specification.
6. The network security protection method based on multiple production environments according to claim 5, characterized in that: The performing of an authentication on the user authentication information based on the state authentication strategy comprises: The authentication sequence based on the state authentication policy matching calls the authentication string of the user password in the user authentication information, and performs an authentication to see if the authentication string meets the preset authentication rules.
7. The network security protection method based on multiple production environments according to claim 1 is characterized in that: The dynamic authentication strategy at least includes dynamic password authentication, and the static authentication strategy at least includes periodic authentication frequency authentication.
8. A network security protection device based on multiple production environments, used to implement the method according to any one of claims 1 to 7, characterized in that: include: The authentication unit authenticates the user authentication information based on a preset authentication strategy.
9. The network security protection device based on multiple production environments as claimed in claim 8, characterized in that: The authentication unit is a Cortex M4 microcontroller.
10. The network security protection device based on multiple production environments as claimed in claim 8, characterized in that: Also includes: Network chip, used to query the link status of the network port in real time; The network chip is a Switch chip with management function.