Security control method and device, electronic equipment, storage medium and program product

Abstract

The invention relates to a security control method and device, electronic equipment, a storage medium and a program product. The method comprises the following steps: receiving an Internet access authentication request sent by a client; based on the Internet access authentication request, executing Internet access authentication on the client; sending a connection request to a network access server (NAS) under the condition that the Internet access authentication is passed, so that a terminal where the client is located accesses a target network through the NAS; receiving a two-dimensional code generation request sent by a client; after two-dimensional code information is generated based on the two-dimensional code generation request, the two-dimensional code information is sent to the client; and under the condition that a code scanning comparison result of the client based on the two-dimensional code information is not received in a preset time period or the code scanning comparison result of the client based on the two-dimensional code information received in the preset time period indicates that code scanning comparison fails, sending a disconnection request to the NAS, so that a terminal where the client is located exits the target network. According to the method, the terminal where the client is located is prevented from being always in a network connection state, and the overall security of the system is improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a security management and control method, device, electronic device, storage medium and program product. Background Art

[0002] With the advancement of enterprise digital network construction, security control of enterprise network access has become the basis of enterprise network informatization. Security control of enterprise network access includes security control of desktop terminals such as office computers that access the enterprise network. In some scenarios where there are many users accessing the enterprise network, such as state-owned enterprise networks and large private enterprise networks, industry customers have proposed the requirement of scanning QR codes to log in to the terminals accessing the enterprise network for convenience. In this process, the desktop terminal is always in a state of network connection, and the probability of the system being attacked or invaded is high, which makes the overall security of the system low. Summary of the invention

[0003] The present invention intends to provide a security management method, device, electronic device, storage medium and program product to solve the deficiencies in the prior art. The technical problem to be solved by the present invention is achieved through the following technical solutions.

[0004] According to a first aspect of the present disclosure, a security management and control method is provided, which is executed by a server, and the method includes: Receive the Internet access authentication request sent by the client; Based on the online authentication request, performing online authentication on the client; When the Internet access authentication is passed, a connection request is sent to a network access server NAS, so that the terminal where the client is located can access the target network through the NAS; Receiving a QR code generation request sent by the client; After generating the QR code information based on the QR code generation request, sending the QR code information to the client; If the scan comparison result based on the QR code information of the client is not received within the preset time period or the scan comparison result based on the QR code information received by the client within the preset time period indicates that the scan comparison has failed, a disconnection request is sent to the NAS to make the terminal where the client is located exit the target network.

[0005] Furthermore, the online authentication request carries the login account of the client and the identification information of the terminal where the client is located; The performing online authentication on the client based on the online authentication request includes: Performing Internet access authentication on the client based on the login account of the client and the identification information of the terminal where the client is located; When the Internet access authentication is passed, sending a connection request to a network access server NAS includes: When the login account of the client matches the identification information of the terminal where the client is located, a connection request is sent to the NAS.

[0006] Furthermore, before receiving the Internet access authentication request sent by the client, the method further includes: Receiving an initial Internet access authentication request sent by a client, wherein the initial Internet access authentication request carries a login account and a login password of the client; Performing initial Internet access authentication on the client based on the login account and the login password; When the initial Internet access authentication is successful, the identification information of the terminal where the client is located is obtained, and the corresponding relationship between the login account and the identification information of the terminal where the client is located is stored.

[0007] According to a second aspect of the present disclosure, a security management and control method is provided, which is executed by a client and includes: Send an Internet authentication request to the server; When the server performs Internet access authentication based on the Internet access authentication request and the Internet access authentication is successful, accessing the target network through NAS; Sending a QR code generation request to the server; Receiving the QR code information sent by the server based on the QR code generation request; Obtaining a scan comparison result after the user scans the QR code information using a target application; The code scanning comparison result is sent to the server within a preset time period.

[0008] Furthermore, the Internet access authentication request carries the login account of the client and the identification information of the terminal where the client is located.

[0009] Furthermore, before sending the Internet access authentication request to the server, the method further includes: Sending an initial Internet access authentication request to the server, wherein the initial Internet access authentication request carries the login account and login password of the client.

[0010] According to a third aspect of the present disclosure, a security management and control device is provided, which is executed by a server and includes: The first receiving module is used to receive an Internet access authentication request sent by a client; A first authentication module, configured to perform Internet access authentication on the client based on the Internet access authentication request; A first sending module is used to send a connection request to the NAS when the Internet access authentication is passed, so that the terminal where the client is located can access the target network through the NAS; A second receiving module, used to receive a QR code generation request sent by the client; A second sending module, configured to send the QR code information to the client after generating the QR code information based on the QR code generation request; The third sending module is used to send a disconnection request to the NAS so that the terminal where the client is located exits the target network if the scan code comparison result based on the QR code information of the client is not received within a preset time period or the scan code comparison result based on the QR code information received by the client within the preset time period indicates that the scan code comparison has failed.

[0011] According to a fourth aspect of the present disclosure, a security management and control device is provided, which is executed by a client and includes: The fourth sending module is used to send an Internet access authentication request to the server; A first access module, configured to access a target network through NAS when the server performs Internet access authentication based on the Internet access authentication request and the Internet access authentication is successful; A fifth sending module, used to send a QR code generation request to the server; A third receiving module, used to receive the QR code information sent by the server based on the QR code generation request; A first acquisition module is used to obtain a scan comparison result after the user scans the QR code information using a target application; The sixth sending module is used to send the code scanning comparison result to the server within a preset time period.

[0012] According to a fifth aspect of the present disclosure, an electronic device is provided. The electronic device includes: a memory and a processor, wherein a computer program is stored in the memory, and the method is implemented when the processor executes the computer program.

[0013] According to a sixth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and the computer program implements the method when executed by a processor.

[0014] According to a seventh aspect of the present disclosure, a computer program product is provided, comprising computer instructions, which implement the method when executed by a processor.

[0015] The embodiments of the present invention include the following advantages: The security management method, device, electronic device, storage medium and program product provided by the embodiment of the present invention include receiving an Internet access authentication request sent by a client; performing Internet access authentication on the client based on the Internet access authentication request; sending a connection request to a network access server NAS when the Internet access authentication passes, so that the terminal where the client is located can access the target network through the NAS; receiving a QR code generation request sent by the client; after generating QR code information based on the QR code generation request, sending the QR code information to the client; if the result of the code scanning comparison based on the QR code information is not received by the client within a preset time period or the result of the code scanning comparison based on the QR code information received by the client within the preset time period indicates that the code scanning comparison fails, sending a disconnection request to the NAS so that the terminal where the client is located can exit the target network. In this embodiment, by setting a preset time period to open the network for a short period of time for the client to complete the QR code scanning authentication, and disconnecting the network when the QR code comparison result is not received within the preset time period or the received QR code comparison result fails, the terminal where the client is located is prevented from being in a network connection state all the time, reducing the probability of the system being attacked or invaded, thereby improving the overall security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 is a schematic diagram of a security management and control system for executing a security management and control method of the present invention; Figure 2 It is one of the step flow charts of an embodiment of a security control method executed by a server of the present invention; Figure 3 It is a functional module diagram of an enterprise office authentication security management and control AAA system of the present invention; Figure 4 This is a second step flow chart of an embodiment of a security control method executed by a server of the present invention; Figure 5 is a flowchart of steps of an embodiment of a security control method executed by a client of the present invention; Figure 6 It is a structural schematic diagram of an embodiment of a security control device applied to a server of the present invention; Figure 7 It is a structural schematic diagram of an embodiment of a security control device applied to a client of the present invention; Figure 8 It is a structural schematic diagram of an electronic device of the present invention. DETAILED DESCRIPTION

[0017] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0018] In order to describe the security control methods of the following embodiments in detail, firstly, the security control system for executing the security control method is explained. Figure 1 , Figure 1 The following is a schematic diagram of a security control system. The security control system is mainly used for enterprise office authentication. Desktop terminals such as PCs of users in different branches of the enterprise access the enterprise border gateway (BGW) through the switch (SW) of the access layer device and the network access server (NAS) of the convergence layer device to access the enterprise-related network. NAS is the client of the authentication signaling process, and the enterprise office authentication security control AAA system is the server of the authentication signaling process. They interact through the Remote Authentication Dial-In User Service (Radius) signaling. The desktop terminals such as PCs of users in different branches of the enterprise are installed with a unified dial-up client. In normal mode, users perform the Internet authentication process through the enterprise office authentication security control AAA system. When the network is reachable, the unified dial-up client interacts with the QR code generation server to perform further authentication. The enterprise office (Application, APP) on the mobile phone of the enterprise user can dial to access the network through the Internet virtual private network (VPN). Data such as the account number and password used during VPN dial-up comes from the enterprise personnel master data platform, and the account opening data of the database users of the enterprise office authentication security management and control AAA system also comes from the enterprise personnel master data platform.

[0019] Figure 2 A flowchart of a security management method 200 according to an embodiment of the present disclosure is shown. Can be executed by the server, where the server can be understood as Figure 1 The computer system is a combination of the CIMC enterprise personnel master data platform, the enterprise office authentication security management and control AAA system and the QR code generation server. Specifically, the method 200 includes: S201, receiving an Internet access authentication request sent by a client; In some embodiments, the client may understand Figure 1 The user opens the unified dial-up client on a desktop terminal such as a PC and sends an Internet access authentication request to the enterprise office authentication security management and control AAA system through the unified dial-up client.

[0020] S202, performing Internet authentication on the client based on the Internet authentication request; In some embodiments, the Internet access authentication request carries the login account of the client and the identification information of the terminal where the client is located; The performing online authentication on the client based on the online authentication request includes: Performing Internet access authentication on the client based on the login account of the client and the identification information of the terminal where the client is located; In some embodiments, the user can enable QR code scanning login through the client to initiate an Internet authentication request to the enterprise office authentication security management and control AAA system, and the enterprise office authentication security management and control AAA system parses the client's login account and the identification information of the terminal where the client is located from the Internet authentication request. The enterprise office authentication security management and control AAA system performs authentication verification on the client's login account and the identification information of the terminal where the client is located based on the correspondence table between the account and the terminal identification stored in the database. Therefore, the premise that the user enables QR code scanning login through the client to initiate an Internet authentication request to the enterprise office authentication security management and control AAA system is that the login account and the terminal identification information corresponding to the login account have been stored in the database of the enterprise office authentication security management and control AAA system. Among them, the identification information of the terminal where the client is located can be the media access control (Media Access Control, MAC) address of the terminal, or it can be a machine code, which is not limited here. The machine code can be generated by the client by obtaining the cupid of the user's PC and the C drive serial number assigned by the operating system.

[0021] In the above embodiment, the client is authenticated through the client's login account and the identification information of the terminal where the client is located. For fixed devices, users do not need to frequently re-authenticate after the initial authentication, thereby improving the convenience of use. In addition, for lost or stolen devices, the access rights of the device can be quickly revoked to reduce potential risks.

[0022] In some embodiments, the user can also complete the Internet access authentication process with the enterprise office authentication security management and control AAA system through login passwords, verification codes, etc. Specifically, the client sends an Internet access authentication request to the enterprise office authentication security management and control AAA system, and the Internet access authentication request carries the login account and login password, or the login account and login verification code; the enterprise office authentication security management and control AAA system performs Internet access authentication on the client based on the login account and login password or the login account and login verification code.

[0023] In some embodiments, before receiving the Internet access authentication request sent by the client, the method further includes: Receiving an initial Internet access authentication request sent by a client, wherein the initial Internet access authentication request carries a login account and a login password of the client; Performing initial Internet access authentication on the client based on the login account and the login password; When the initial Internet access authentication is successful, the identification information of the terminal where the client is located is obtained, and the corresponding relationship between the login account and the identification information of the terminal where the client is located is stored.

[0024] In some embodiments, it should be noted that if the user is authenticating for the first time online, the online authentication can only be performed by means of a login password or a verification code. After the initial online authentication is successful, the enterprise office authentication security management and control AAA system can parse the calling station identification (Calling-Station-ID) attribute (i.e. the identification information of the terminal where the client is located) and the username (Username) attribute (i.e. the login account mentioned above) from the Radius access request (Access-Request) message (i.e. the initial online authentication request mentioned above) sent by the client through NAS. The enterprise office authentication security management and control AAA system then queries the database to see whether the terminal identification information list corresponding to the login account is empty. If it is empty, the corresponding relationship between the login account and the identification information of the terminal where the client is located is stored.

[0025] In the above embodiment, when the initial Internet authentication is successful, the server obtains the identification information of the terminal where the client is located, and stores the corresponding relationship between the login account and the identification information of the terminal where the client is located. For frequently used devices, users can simplify the subsequent authentication process after one authentication, which is conducive to simplifying the authentication process for subsequent users. In addition, the corresponding relationship between the storage device identification and the user account enables the administrator to track user activities more accurately, discover abnormal behavior, and improve the efficiency of network security management and control.

[0026] S203, when the Internet access authentication is passed, sending a connection request to a network access server NAS, so that the terminal where the client is located can access the target network through the NAS; In some embodiments, when the Internet access authentication is passed, sending a connection request to a network access server NAS includes: When the login account of the client matches the identification information of the terminal where the client is located, a connection request is sent to the NAS.

[0027] In some embodiments, if the enterprise office authentication security management and control AAA system verifies the client's login account and the identification information of the terminal where the client is located, and determines that the client's login account matches the identification information of the terminal where the client is located, it means that the verification is successful, and the enterprise office authentication security management and control AAA system sends a connection request to NAS, then the terminal is allowed to access the enterprise network. If the verification fails, a message of authentication failure is sent to the client, and the client prompts the user that the authentication has failed, and the terminal is denied access to the enterprise network.

[0028] S204, receiving a QR code generation request sent by the client; In some embodiments, after the terminal where the client is located is successfully authenticated, the client can send a QR code generation request to the QR code generation server in the service end for further authentication.

[0029] S205, after generating the QR code information based on the QR code generation request, sending the QR code information to the client; In some embodiments, the QR code generation server generates QR code information based on the QR code generation request and sends the QR code information to the client. It should be noted that the QR code generation server of the present application is deployed on the enterprise intranet, not the Internet, so as to prevent the leakage of the QR code information generated by the QR code generation server, thereby improving the security of the entire authentication process. The client displays the QR code information to the user, and the user can scan the code by opening the enterprise office application (Application, APP) on the mobile phone. After the enterprise office APP scans the code, the user account and other information in the QR code are obtained for comparison, and the comparison results need to be fed back to the QR code generation server. The QR code generation server then returns the QR code scanning authentication result to the client, and the client returns the scanning comparison result to the enterprise office authentication security management AAA system. The entire scanning authentication process needs to be completed within a preset time period (for example, 3 minutes).

[0030] S206. If no scan comparison result based on the QR code information is received from the client within a preset time period or if the scan comparison result based on the QR code information received from the client within the preset time period indicates that the scan comparison has failed, send a disconnection request to the NAS to cause the terminal where the client is located to exit the target network.

[0031] In some embodiments, if the enterprise office authentication security management and control AAA system does not receive the client's scan comparison result based on the QR code information within a preset time period, or the client's scan comparison result based on the QR code information received within the preset time period indicates that the scan comparison failed, the enterprise office authentication security management and control AAA system sends a disconnection request to NAS, and NAS disconnects the terminal where the client is located from the network; if the enterprise office authentication security management and control AAA system receives the client's scan comparison result based on the QR code information within the preset time period, indicating that the scan comparison is successful, the enterprise office authentication security management and control AAA system does not take any action, the client enters the main interface, and the short-term authentication changes to long-term authentication.

[0032] See also Figure 3 , Figure 3 This is a functional module composition diagram of the enterprise office authentication security management AAA system. The enterprise office authentication security management AAA system includes a message parsing module, a login mode recognition module, a terminal identification information self-learning module, a terminal control module, a data storage module, and an operation and maintenance center (OMC) management module. Among them, the message parsing module is used to parse signaling messages and record logs; the login mode recognition module is used to identify whether the terminal login adopts a static password mode or a QR code scanning login mode, and start different reverse cut-off timer control strategies; the terminal identification information self-learning module is used to realize the self-learning of terminal identification information when the static password login mode is used; the control module is used to realize the logical judgment and control of the long-term or short-term release of terminal network access according to the terminal identification information after the terminal accesses; the data storage module is used to store user login account data, terminal identification information data, binding relationship data, online information data and log data; the OMC management module provides a global wide area network (World Wide Web, WEB) maintenance management interface for industry customer administrators to realize user account opening and closing, terminal identification information data management, binding management and log query, etc.

[0033] See also Figure 4In some embodiments, the terminal user opens the unified dial-up client and enters the login account (the account column will remember the last login account by default). The user has two dial-up options, that is, there are two online authentication options. One is to use a static password or a graphic verification code to authenticate. If the enterprise office authentication security management AAA system passes the online authentication based on the login account, static password or graphic verification code entered by the user, it can further query whether the terminal's identification information (such as MAC address, machine code, etc.) is stored in the database. If the terminal's identification information is not stored in the database, the user's login account is bound to the terminal's identification information and then stored; another is to use QR code scanning for online authentication. The enterprise office authentication security management AAA system performs online authentication based on the user's login account and the terminal's identification information. If the online authentication passes, the enterprise office authentication security management AAA system will open the network for a short period of time to perform further authentication. The unified dial-up client sends a QR code generation request to the QR code generation server. After the QR code generation server generates the QR code information, the user needs to complete the code scanning authentication process within a preset time period. If the user does not complete the code scanning authentication process within the preset time period, that is, the enterprise office authentication security management AAA system does not receive the code scanning authentication result returned by the unified dial-up client within the preset time period, or the received code scanning authentication result indicates that the code scanning authentication failed, the enterprise office authentication security management AAA system forces the terminal to exit the network. If the code scanning authentication result received by the enterprise office authentication security management AAA system within the preset time period indicates that the code scanning authentication is successful, the unified dial-up client enters the main page, and the authentication changes from short-term to long-term.

[0034] For example, assume that a corporate network allows a single user account to access the network through two desktop terminals such as PCs, and performs network access control based on the terminal identification information MAC address, and uses the user's mobile phone number 123456 as the user's account to access the corporate intranet. After setting the maximum number of bindings for the terminal identification information MAC address to 2, the account 123456 can be authenticated and logged in by scanning the QR code.

[0035] The user selects a login method. If it is the first time to log in, the only way to initiate an Internet authentication request is to enter the login password. At this time, the security management system completes the self-learning binding of the terminal identification MAC address. The specific implementation steps are as follows: 1. Enter the login account and password and other information on terminal 1 to go online. The enterprise office authentication security management AAA system receives the Radius Access-Request message sent by NAS. After successful authentication, it parses the Calling-Station-ID attribute and the Username attribute. Parse the account information "123456" from the Username attribute, and parse the MAC address "MAC1" of terminal 1 from the Calling-Station-ID attribute field. The enterprise office authentication security management AAA system queries the database to see if the terminal identification information list corresponding to the account "123456" is empty. If it is empty, it updates the terminal identification information list corresponding to the account "123456". Record the authentication log and respond to the Access-Accept message.

[0036] 2. Terminal 1 is successfully connected, and the enterprise office authentication security management AAA receives the Radius accounting start request (Accounting-Request (Start)) message sent by NAS, records the accounting start log and responds to the accounting response (Accounting-Response) message.

[0037] 3. Terminal 1 goes offline, and the enterprise office authentication security management AAA receives the Radius accounting stop request (Accounting-Request (Stop)) message sent by NAS, records the accounting end log and responds to the accounting response (Accounting-Response) message.

[0038] 4. Enter the login account and login password on terminal 2 to go online, and complete the collection of the terminal 2 identification information MAC address "MAC2". The system determines that the number of terminal identification information entered at this time is 1 (that is, the MAC address of terminal 1) which is less than the maximum number of terminals allowed by the system set account 2, and continues to enter the MAC address of this terminal 2. Terminal 2 is successfully connected. At this time, the terminal identification information list corresponding to the login account "123456" is as follows; User name Login account Terminal identification Information type MAC address; Zhao XX 123456 MAC address MAC1; Zhao XX 123456 MAC address MAC2.

[0039] 5. Enter the login account and password and other information on terminal 3 to go online. The enterprise office authentication security management AAA system receives the Radius Access-Request message sent by NAS and parses the Calling-Station-ID attribute and the Username attribute. The login account "123456" is parsed from the Username attribute, and the MAC address "MAC3" of terminal 3 is parsed from the Calling-Station-ID attribute field. The system finds that this MAC address is not in the terminal identification information list corresponding to the account "123456", and the number of terminal identification information entered is 2, which is equal to the maximum number of terminals set by the system, so terminal 3 is rejected to go online.

[0040] Similarly, the terminal machine code can also be used as the terminal identification information. The difference is that the machine code is a letter sequence generated by the unified dial-up client by obtaining the cupid of the user terminal and the C drive serial number assigned by the operating system. The example is as follows: OD4A8434-5088-11E3-94EA-FCB0460D1100@BFEBFBFF000206A9@@@LENOVO@BA01340899.

[0041] When the terminal goes online, the unified dial-up client encapsulates the machine code in the Calling-Station-ID attribute field.

[0042] The specific implementation steps for Internet authentication by scanning a QR code are as follows (the terminal identification information here still uses the MAC address as an example, and the machine code is the same): 1. The user uses the unified dial-up client to perform QR code scanning authentication on terminal 3 with the login account "123456". The unified dial-up client encapsulates the login account "123456" in the Radius attribute username and the terminal identification information MAC address "MAC3" in the Radius attribute password. The enterprise office authentication security management AAA system receives the Radius Access-Request message sent by the NAS device, parses the password attribute and the username attribute from the Access-Request message, and obtains the login account "123456" and the terminal identification information MAC address "MAC3". The enterprise office authentication security management AAA system queries the terminal identification information list of the login account "123456" in the data storage module, and determines that the MAC address is not in the terminal identification information list of "123456", and then refuses access to terminal 3. Even if terminal 3 switches to the static password login mode, it will still be denied access because the MAC address is inconsistent with the content in the terminal identification information list. Because the system sets the maximum number of terminals that can access the network for a single user to be 2. The terminal identification information of terminal 3 is not in the terminal identification information list recorded by the system. Therefore, even if terminal 3 switches to static password login and the login account and login password are correct, it will be rejected. In short, when the system sets the maximum number of terminals that can access the network with a single account, when the terminal logs in, the system will verify the terminal account and static login password, and also verify the terminal identification information (MAC address). If the terminal identification information list is empty, the terminal identification information of the first two terminals will be automatically recorded. Other terminals will not be able to access even if the account and static login password are correct. This can effectively avoid the situation where the account and password are stolen.

[0043] 2. The user uses the unified dial-up client to perform QR code scanning authentication on terminal 2 with the login account "123456". The unified dial-up client encapsulates the login account "123456" in the Radius attribute username and the terminal identification information MAC address "MAC2" in the Radius attribute password. The enterprise office authentication security management AAA system receives the Radius Access-Request message sent by the NAS device, parses the password attribute and the username attribute from the Access-Request message, obtains the login account "123456" and the terminal identification information MAC address "MAC2", queries the terminal identification information list of the login account "123456" in the data storage module, and determines that the MAC address is in the terminal identification information list of the login account "123456", then allows terminal 2 to access, and starts the reverse cut-off timer (for example, 3 minutes) to open the network for a short period of time.

[0044] 3. After terminal 2 is connected, the unified dial-up client obtains the QR code from the QR code generation server and displays it to the user. After the user completes scanning the code within a specified time (for example, 3 minutes), the QR code scanning and comparison result is fed back to the unified dial-up client.

[0045] 4. The unified dial-up client feeds back the QR code scanning comparison result to the enterprise office authentication security management AAA system. If the scan code comparison result indicates that the scan code comparison is successful, the enterprise office authentication security management AAA system turns off the 3-minute reverse disconnection timer, the network continues to remain connected, the unified dial-up client enters the main interface, and the terminal 2 network authentication changes from short-term authentication to long-term authentication; if the scan code comparison result indicates that the scan code comparison fails, or the enterprise office authentication security management AAA system does not receive the QR code scanning comparison result fed back by the unified dial-up client within the preset time period, the enterprise office authentication security management AAA sends a disconnect request (Disconnect Message, DM) message to the NAS to reversely disconnect the terminal 2.

[0046] 5. Scan the QR code for authentication on terminal 1. The steps are the same as those on terminal 2 and will not be repeated here.

[0047] According to an embodiment of the present disclosure, the server receives an Internet access authentication request sent by a client; based on the Internet access authentication request, performs Internet access authentication on the client; if the Internet access authentication passes, sends a connection request to a network access server NAS, so that the terminal where the client is located can access the target network through the NAS; receives a QR code generation request sent by the client; after generating QR code information based on the QR code generation request, sends the QR code information to the client; if the result of the code scanning comparison based on the QR code information is not received by the client within a preset time period or the result of the code scanning comparison based on the QR code information received by the client within the preset time period indicates that the code scanning comparison fails, sends a disconnection request to the NAS, so that the terminal where the client is located can exit the target network. In this embodiment, by setting a preset time period to open the network for a short period of time for the client to complete the QR code scanning authentication, and disconnecting the network when the QR code comparison result is not received within the preset time period or the received QR code comparison result fails, the terminal where the client is located is prevented from being in a network connection state all the time, reducing the probability of the system being attacked or invaded, thereby improving the overall security of the system. In addition, this method is particularly suitable for environments where the network is temporarily unavailable or there are unplanned operation requirements, such as conference rooms, remote office sites, etc. In case of emergency, the network can be quickly opened for a short period of time to perform necessary operations and flexibly manage permissions. In this way, desktop terminal users can operate without a network, and then through the process of short-term opening and scanning code verification, the working environment can be restored as soon as possible even in an offline environment.

[0048] Figure 5 A flowchart of a security management method 500 according to an embodiment of the present disclosure is shown. The method 500 may be executed by a client, and includes: S501, sending an Internet access authentication request to the server; In some embodiments, the Internet access authentication request carries the login account of the client and the identification information of the terminal where the client is located.

[0049] S502, accessing the target network through NAS when the server performs Internet access authentication based on the Internet access authentication request and the Internet access authentication is successful; S503, sending a QR code generation request to the server; S504, receiving the QR code information sent by the server based on the QR code generation request; S505, obtaining a scan comparison result after the user scans the QR code information using the target application; S506: Send the code scanning comparison result to the server within a preset time period.

[0050] In some embodiments, before sending the Internet access authentication request to the server, the method further includes: Sending an initial Internet access authentication request to the server, wherein the initial Internet access authentication request carries the login account and login password of the client.

[0051] It should be noted that this embodiment is Figure 2 The implementation method of the corresponding client in the embodiment shown in the figure can be found in the specific implementation method. Figure 2 In order to avoid repeated description, the relevant description of the embodiment shown will not be repeated in this embodiment, and the same beneficial effects can still be achieved.

[0052] According to the embodiment of the present disclosure, the client sends an Internet access authentication request to the server; when the server performs Internet access authentication based on the Internet access authentication request and passes, the client accesses the target network through NAS; sends a QR code generation request to the server; receives the QR code information sent by the server based on the QR code generation request; obtains the scan code comparison result after the user scans the QR code information using the target application; and sends the scan code comparison result to the server within a preset time period. In this embodiment, the client can only access the target network where the server is located if the Internet access authentication request passes. It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present disclosure is not limited by the order of the actions described, because according to the present disclosure, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present disclosure.

[0053] The above is an introduction to the method embodiment. The following is a further explanation of the scheme disclosed in the present invention through an apparatus embodiment.

[0054] Figure 6 A block diagram of a security management and control device 600 applied to a server according to an embodiment of the present disclosure is shown, and the device 600 includes: The first receiving module 601 is used to receive an Internet access authentication request sent by a client; A first authentication module 602, configured to perform Internet authentication on the client based on the Internet authentication request; The first sending module 603 is used to send a connection request to the NAS when the Internet access authentication is passed, so that the terminal where the client is located can access the target network through the NAS; The second receiving module 604 is used to receive a QR code generation request sent by the client; A second sending module 605 is used to send the QR code information to the client after generating the QR code information based on the QR code generation request; The third sending module 606 is used to send a disconnection request to the NAS so that the terminal where the client is located exits the target network if the scan code comparison result based on the QR code information of the client is not received within a preset time period or the scan code comparison result based on the QR code information received by the client within the preset time period indicates that the scan code comparison has failed.

[0055] In some embodiments, the Internet access authentication request carries the login account of the client and the identification information of the terminal where the client is located; The first authentication module 602 includes: A first authentication unit, configured to perform Internet access authentication on the client based on the login account of the client and the identification information of the terminal where the client is located; The second sending module 605 includes: The first sending unit is used to send a connection request to the NAS when the login account of the client matches the identification information of the terminal where the client is located.

[0056] In some embodiments, the apparatus further comprises: A third receiving module is used to receive an initial Internet access authentication request sent by a client, wherein the initial Internet access authentication request carries a login account and a login password of the client; A second authentication module, used to perform initial Internet authentication on the client based on the login account and the login password; The first storage module is used to obtain the identification information of the terminal where the client is located when the initial Internet authentication is successful, and store the corresponding relationship between the login account and the identification information of the terminal where the client is located.

[0057] Figure 7 A block diagram of a security management and control device 700 applied to a client according to an embodiment of the present disclosure is shown, and the device 700 includes: The fourth sending module 701 is used to send an Internet access authentication request to the server; The first access module 702 is used to access the target network through NAS when the server performs Internet access authentication based on the Internet access authentication request and passes the Internet access authentication; The fifth sending module 703 is used to send a QR code generation request to the server; A third receiving module 704 is used to receive the QR code information sent by the server based on the QR code generation request; The first acquisition module 705 is used to obtain the scanning comparison result after the user scans the two-dimensional code information using the target application; The sixth sending module 706 is used to send the code scanning comparison result to the server within a preset time period.

[0058] In some embodiments, the Internet access authentication request carries the login account of the client and the identification information of the terminal where the client is located.

[0059] In some embodiments, the apparatus further comprises: The seventh sending module is used to send an initial Internet access authentication request to the server, wherein the initial Internet access authentication request carries the login account and login password of the client.

[0060] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0061] Figure 8 An example of a physical structure diagram of an electronic device is shown. The electronic device may be a smart terminal, and its internal structure diagram may be as follows: Figure 8As shown. The electronic device includes a processor, a memory and a network interface connected via a system bus. Among them, the processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the electronic device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, the above-mentioned security management and control method is implemented.

[0062] On the other hand, the present invention also provides a computer storage medium storing a computer program, which implements the above-mentioned security management and control method when executed by a processor.

[0063] In another aspect, a computer program product or a computer program is provided, the computer program product or the computer program comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor implements the above-mentioned security management and control method when executing the computer instructions.

[0064] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory.

[0065] By way of illustration and not limitation, Random Access Memory (RAM) is available in many forms, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), Rambus Direct RAM (RDRAM), Direct Rambus Dynamic RAM (DRDRAM), and Rambus Dynamic RAM (RDRAM).

[0066] It should be noted that the above detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the art to which the present application belongs.

[0067] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should also be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0068] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein.

[0069] In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or inherent to these processes, methods, products, or apparatuses.

[0070] For ease of description, spatially relative terms, such as "above", "above", "on the upper surface of", "above", etc., may be used herein to describe the spatial positional relationship between a device or feature and other devices or features as shown in the figure. It should be understood that spatially relative terms are intended to include different orientations of the device in use or operation in addition to the orientation described in the figure. For example, if the device in the accompanying drawings is inverted, the device described as "above other devices or structures" or "above other devices or structures" will be positioned as "below other devices or structures" or "below other devices or structures". Thus, the exemplary term "above" may include both "above" and "below". The device may also be positioned in other different ways, such as rotated 90 degrees or in other orientations, and the spatially relative descriptions used herein are interpreted accordingly.

[0071] In the above detailed description, reference is made to the accompanying drawings, which form a part of this document. In the accompanying drawings, similar symbols typically identify similar components unless the context indicates otherwise. The illustrated embodiments described in the detailed description, drawings, and claims are not meant to be limiting. Other embodiments may be used, and other changes may be made, without departing from the spirit or scope of the subject matter presented herein.

[0072] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A security control method, It is characterized in that Executed by the server, the method includes: Receive the Internet access authentication request sent by the client; Based on the online authentication request, performing online authentication on the client; When the Internet access authentication is passed, a connection request is sent to a network access server NAS, so that the terminal where the client is located can access the target network through the NAS; Receiving a QR code generation request sent by the client; After generating the QR code information based on the QR code generation request, sending the QR code information to the client; If the scan comparison result based on the QR code information of the client is not received within the preset time period or the scan comparison result based on the QR code information received by the client within the preset time period indicates that the scan comparison has failed, a disconnection request is sent to the NAS to make the terminal where the client is located exit the target network.

2. The security management method according to claim 1, It is characterized in that The online authentication request carries the login account of the client and the identification information of the terminal where the client is located; The performing online authentication on the client based on the online authentication request includes: Performing Internet access authentication on the client based on the login account of the client and the identification information of the terminal where the client is located; When the Internet access authentication is passed, sending a connection request to a network access server NAS includes: When the login account of the client matches the identification information of the terminal where the client is located, a connection request is sent to the NAS.

3. The security management method according to claim 2, It is characterized in that Before receiving the Internet access authentication request sent by the client, the method further includes: Receiving an initial Internet access authentication request sent by a client, wherein the initial Internet access authentication request carries a login account and a login password of the client; Performing initial Internet access authentication on the client based on the login account and the login password; When the initial Internet access authentication is successful, the identification information of the terminal where the client is located is obtained, and the corresponding relationship between the login account and the identification information of the terminal where the client is located is stored.

4. A security control method, It is characterized in that Executed by a client, the method includes: Send an Internet authentication request to the server; When the server performs Internet access authentication based on the Internet access authentication request and the Internet access authentication is successful, accessing the target network through NAS; Sending a QR code generation request to the server; Receiving the QR code information sent by the server based on the QR code generation request; Obtaining a scan comparison result after the user scans the QR code information using a target application; The code scanning comparison result is sent to the server within a preset time period.

5. The security management method according to claim 4, It is characterized in that The online authentication request carries the login account of the client and the identification information of the terminal where the client is located.

6. The security management method according to claim 4, It is characterized in that Before sending the Internet access authentication request to the server, the method further includes: Sending an initial Internet access authentication request to the server, wherein the initial Internet access authentication request carries the login account and login password of the client.

7. A safety control device, It is characterized in that Applied to the server, the device comprises: The first receiving module is used to receive an Internet access authentication request sent by a client; A first authentication module, configured to perform Internet access authentication on the client based on the Internet access authentication request; A first sending module is used to send a connection request to the NAS when the Internet access authentication is passed, so that the terminal where the client is located can access the target network through the NAS; A second receiving module, used to receive a QR code generation request sent by the client; A second sending module, configured to send the QR code information to the client after generating the QR code information based on the QR code generation request; The third sending module is used to send a disconnection request to the NAS so that the terminal where the client is located exits the target network if the scan code comparison result based on the QR code information of the client is not received within a preset time period or the scan code comparison result based on the QR code information received by the client within the preset time period indicates that the scan code comparison has failed.

8. A safety control device, It is characterized in that Applied to a client, the device comprises: The fourth sending module is used to send an Internet access authentication request to the server; A first access module, configured to access a target network through NAS when the server performs Internet access authentication based on the Internet access authentication request and the Internet access authentication is successful; A fifth sending module, used to send a QR code generation request to the server; A third receiving module, used to receive the QR code information sent by the server based on the QR code generation request; A first acquisition module is used to obtain a scan comparison result after the user scans the QR code information using a target application; The sixth sending module is used to send the code scanning comparison result to the server within a preset time period.

9. An electronic device, It is characterized in that The method comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the steps of the security management and control method as described in any one of claims 1 to 3 when executed by the processor, or implements the steps of the security management and control method as described in any one of claims 4 to 6 when executed by the processor.

10. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the security management and control method as described in any one of claims 1 to 3, or the computer program, when executed by the processor, implements the steps of the security management and control method as described in any one of claims 4 to 6.

11. A computer program product, It is characterized in that It includes computer instructions, which, when executed by a processor, implement the steps of the security management and control method as described in any one of claims 1 to 3, or the computer instructions, when executed by a processor, implement the steps of the security management and control method as described in any one of claims 4 to 6.

Images