Network access control method

Abstract

The invention relates to a network access control method, and belongs to the technical field of network information security control methods. The technical scheme of the invention is as follows: identity authentication and security compliance check are performed on user terminal equipment accessed to an enterprise park network by means of the park network, antivirus software and a network access control system of the enterprise on the basis of a zero-trust security management concept, and range authority of enterprise information resources of the user is allocated according to actual service requirements of the user. The method has the beneficial effects that the network information security of enterprise information resources is guaranteed to the maximum extent, and finally, the management and control target of the overall security of the enterprise park network is realized.

Description

Technical Field

[0001] The invention relates to a network access control method, belonging to the technical field of network information security control methods. Background Art

[0002] With the continuous deepening of enterprise informatization construction, the scale and number of terminals of enterprise campus networks have grown rapidly, and the role of informatization systems in enterprise experience generation activities has become increasingly important. How to ensure the security of enterprise campus networks and information resources has become a problem that enterprises must solve. The traditional model of network partition isolation through firewalls, focusing on external network protection and neglecting internal network protection is no longer suitable for the current increasingly studied network security forms. It is necessary to update the concept of network security protection and strengthen internal and external network security protection measures of enterprises in order to effectively ensure the security of enterprise network information. Summary of the invention

[0003] The purpose of the present invention is to provide a method for network access control. By making use of the enterprise's own campus network, antivirus software and network access control system, based on the zero-trust security management concept, the user terminal equipment accessing the enterprise campus network is authenticated and security compliance checked, and the scope of authority of the enterprise information resources is allocated according to the actual business needs of the user, so as to maximize the network information security of the enterprise information resources, and ultimately achieve the overall security management and control goals of the enterprise campus network, effectively solving the above-mentioned problems existing in the background technology.

[0004] The technical solution of the present invention is: a method for network access control, comprising the following steps: Step S1, in the system, based on the enterprise personnel information database, enterprise information resource database, enterprise network antivirus software, enterprise campus network and network access control system, sort out the corresponding relationship between the enterprise information resource groups required by the enterprise employees according to business needs, and enter the information into the enterprise's network access control system to form employee accounts, employee groups and enterprise information resource groups, and according to the corresponding relationship between access rights, give each employee group the scope of authority of the corresponding information resource group; Step S2: When an employee's terminal computer accesses the campus network, the network access control system will first obtain the MAC address of the employee's computer to confirm whether it has been bound to the employee's network account. If it has been bound, it will directly enter the compliance check process of the terminal computer; if the MAC address of the terminal computer is not bound to the employee's network account, it will prompt an identity authentication page and require the user to enter identity information; Step S3: If the employee's identity information is correct, the MAC address of the terminal computer is bound to the employee's account to avoid repeated input of authentication information when the terminal logs in again, and the security and compliance inspection process of the computer terminal is started; Step S4, for terminal computers with antivirus software installed, the antivirus software checks the security status of the terminal computers as needed, and writes the IP addresses and MAC addresses of computers that meet the security requirements into the security compliance information library, while the IP addresses and MAC addresses of computers that do not have antivirus software installed or that do not meet the security check requirements are not written into the security compliance information library; Step S5, the network access control system accesses the security and compliance information, and performs compliance confirmation on the terminal computer that has passed the user authentication and whose MAC address has been bound to the user account; if the terminal computer information is in the security and compliance database, the user is given enterprise information resource access rights based on the user group information; if the terminal computer information is not included in the security and compliance information database, security non-compliance information is fed back to the terminal computer, and the terminal computer network access rights are prohibited.

[0005] The step S1 includes the following steps: Step S101, registering the information of employees who need to log in to the enterprise campus network, including employee number, name, department, position and name of the information system to be accessed, based on the enterprise department, to form an employee information database, with each department forming one or more user groups; Step S102, taking the information system as the unit, statistics are collected on all the information resources of the enterprise, and the hosts providing unified information services are grouped into a resource group to form an enterprise information resource database; Step S103: Authorize each user group for access to resources according to the statistics of the information resources that each user group needs to access, to ensure that each user group has and only has the resource access rights required to complete normal business; Step S104: Enter all of the above user information, user group information, information resource information, and information resource group information that has been granted to each user group into the network access control system.

[0006] In step S2, it is assumed that the enterprise already has an Ethernet network covering all employee terminal computers, and the network has a network access control system that matches the network equipment, and a network board antivirus software system that can cover all terminal computers, including the following steps: Step S201: After logging in, the employee terminal computer obtains an IP address that can be used in the campus network through the DHCP system, exchanges login information with the network access control system through the radius network protocol, and sends its MAC address information to the network access system for verification; Step S202: If the network access control system finds the MAC address of the terminal computer in the MAC address table bound to the enterprise employee account (the amount of data bound to each account under the MAC address can be specified as needed), the user verification is passed and the security compliance check phase is entered; Step S203: If the network access control system does not find the address of the terminal in the MAC address table bound to the employee account, a user login page pops up to the terminal computer, requiring the user to enter the employee account and login password.

[0007] The step S3 includes the following steps: Step S301: If the account and password entered by the employee are correct, the MAC address of the terminal computer is bound to the employee account; Step S302: If the account password is incorrect or the number of MAC addresses bound to the account has reached the upper limit of the permitted number, a corresponding error message is fed back to prompt the employee to find a system administrator for a solution.

[0008] The step S4 includes the following steps: Step S401: In order to ensure the security of the enterprise campus network, the enterprise establishes a terminal security compliance information database based on the security inspection results of the network version of the anti-virus software, and saves the terminal computer information that has passed the security inspection and is compliant, so as to assist the network access control system in determining whether the terminal computer has the network access qualification; Step S402: Terminal computers that do not use antivirus software cannot enter the security compliance information database, except for some network printers, copiers, and camera dumb terminals. All devices that should be installed can be installed; Step S403, the enterprise sets security check items in the anti-virus software according to network information security needs; Step S404, the antivirus software monitors the security compliance of the terminal in real time and dynamically deletes the non-compliant terminal information from the security compliance information database in time to ensure the security of the terminal computer connected to the network.

[0009] The step S5 includes the following steps: Step S501, the network access control system sends corresponding network access rights to the switch for the user terminal that has passed identity authentication and meets the security compliance inspection requirements according to the network resource access rights granted to the user group to which the user belongs; In step S502, the enterprise terminal user accesses the enterprise information resources according to the assigned permissions. If the access permissions need to be changed due to business needs, the user submits a permission change application to the system administrator for approval by the unit leader. The administrator adjusts the corresponding resource authorization for the user according to the application.

[0010] The beneficial effects of the present invention are: by leveraging the enterprise's own campus network, antivirus software and network access control system, based on the zero-trust security management concept, identity authentication and security compliance checks are performed on user terminal devices accessing the enterprise campus network, and the scope of authority of the enterprise information resources is allocated according to the user's actual business needs, thereby maximizing the network information security of the enterprise information resources and ultimately achieving the overall security management and control goals of the enterprise campus network. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 It is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0012] In order to make the purpose, technical solutions and advantages of the invention implementation cases clearer, the technical solutions in the implementation cases of the present invention will be clearly and completely described below in conjunction with the drawings in the implementation cases. Obviously, the implementation cases described are only a small part of the implementation cases of the present invention, rather than all the implementation cases. Based on the implementation cases in the present invention, all other implementation cases obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0013] A method for network access control comprises the following steps: Step S1, in the system, based on the enterprise personnel information database, enterprise information resource database, enterprise network antivirus software, enterprise campus network and network access control system, sort out the corresponding relationship between the enterprise information resource groups required by the enterprise employees according to business needs, and enter the information into the enterprise's network access control system to form employee accounts, employee groups and enterprise information resource groups, and according to the corresponding relationship between access rights, give each employee group the scope of authority of the corresponding information resource group; Step S2: When an employee's terminal computer accesses the campus network, the network access control system will first obtain the MAC address of the employee's computer to confirm whether it has been bound to the employee's network account. If it has been bound, it will directly enter the compliance check process of the terminal computer; if the MAC address of the terminal computer is not bound to the employee's network account, it will prompt an identity authentication page and require the user to enter identity information; Step S3: If the employee's identity information is correct, the MAC address of the terminal computer is bound to the employee's account to avoid repeated input of authentication information when the terminal logs in again, and the security and compliance inspection process of the computer terminal is started; Step S4, for terminal computers with antivirus software installed, the antivirus software checks the security status of the terminal computers as needed, and writes the IP addresses and MAC addresses of computers that meet the security requirements into the security compliance information library, while the IP addresses and MAC addresses of computers that do not have antivirus software installed or that do not meet the security check requirements are not written into the security compliance information library; Step S5, the network access control system accesses the security and compliance information, and performs compliance confirmation on the terminal computer that has passed the user authentication and whose MAC address has been bound to the user account; if the terminal computer information is in the security and compliance database, the user is given enterprise information resource access rights based on the user group information; if the terminal computer information is not included in the security and compliance information database, security non-compliance information is fed back to the terminal computer, and the terminal computer network access rights are prohibited.

[0014] The step S1 includes the following steps: Step S101, registering the information of employees who need to log in to the enterprise campus network, including employee number, name, department, position and name of the information system to be accessed, based on the enterprise department, to form an employee information database, with each department forming one or more user groups; Step S102, taking the information system as the unit, statistics are collected on all the information resources of the enterprise, and the hosts providing unified information services are grouped into a resource group to form an enterprise information resource database; Step S103: Authorize each user group for access to resources according to the statistics of the information resources that each user group needs to access, to ensure that each user group has and only has the resource access rights required to complete normal business; Step S104: Enter all of the above user information, user group information, information resource information, and information resource group information that has been granted to each user group into the network access control system.

[0015] In step S2, it is assumed that the enterprise already has an Ethernet network covering all employee terminal computers, and the network has a network access control system that matches the network equipment, and a network board antivirus software system that can cover all terminal computers, including the following steps: Step S201: After logging in, the employee terminal computer obtains an IP address that can be used in the campus network through the DHCP system, exchanges login information with the network access control system through the radius network protocol, and sends its MAC address information to the network access system for verification; Step S202: If the network access control system finds the MAC address of the terminal computer in the MAC address table bound to the enterprise employee account (the amount of data bound to each account under the MAC address can be specified as needed), the user verification is passed and the security compliance check phase is entered; Step S203: If the network access control system does not find the address of the terminal in the MAC address table bound to the employee account, a user login page pops up to the terminal computer, requiring the user to enter the employee account and login password.

[0016] The step S3 includes the following steps: Step S301: If the account and password entered by the employee are correct, the MAC address of the terminal computer is bound to the employee account; Step S302: If the account password is incorrect or the number of MAC addresses bound to the account has reached the upper limit of the permitted number, a corresponding error message is fed back to prompt the employee to find a system administrator for a solution.

[0017] The step S4 includes the following steps: Step S401: In order to ensure the security of the enterprise campus network, the enterprise establishes a terminal security compliance information database based on the security inspection results of the network version of the anti-virus software, and saves the terminal computer information that has passed the security inspection and is compliant, so as to assist the network access control system in determining whether the terminal computer has the network access qualification; Step S402: Terminal computers that do not use antivirus software cannot enter the security compliance information database, except for some network printers, copiers, and camera dumb terminals. All devices that should be installed can be installed; Step S403, the enterprise sets security check items in the anti-virus software according to network information security needs; Step S404, the antivirus software monitors the security compliance of the terminal in real time and dynamically deletes the non-compliant terminal information from the security compliance information database in time to ensure the security of the terminal computer connected to the network.

[0018] The step S5 includes the following steps: Step S501, the network access control system sends corresponding network access rights to the switch for the user terminal that has passed identity authentication and meets the security compliance inspection requirements according to the network resource access rights granted to the user group to which the user belongs; In step S502, the enterprise terminal user accesses the enterprise information resources according to the assigned permissions. If the access permissions need to be changed due to business needs, the user submits a permission change application to the system administrator for approval by the unit leader. The administrator adjusts the corresponding resource authorization for the user according to the application.

[0019] In practical application, the specific implementation content of the present invention includes the following five parts: In the first part, based on the enterprise personnel information database, enterprise information resource database, enterprise network antivirus software, enterprise campus network and network access control system, the corresponding relationship between the enterprise information resource groups required by the enterprise employees is sorted out according to business needs, and the information is entered into the enterprise's network access control system to form employee accounts, employee groups, and enterprise information resource groups. According to the corresponding relationship of access rights, each employee group is given the scope of authority of the corresponding information resource group. The specific implementation steps are as follows: Step S101, registering the information of employees who need to log in to the enterprise campus network, including employee number, name, department, position, name of the information system to be accessed, etc., based on the enterprise department, to form an employee information database, and each department forms one or several user groups; Step S102, taking the information system as the unit, statistics are collected on all the information resources of the enterprise, and the hosts providing unified information services are grouped into a resource group to form an enterprise information resource database; Step S103: Authorize each user group for access to resources according to the statistics of the information resources that each user group needs to access, to ensure that each user group has and only has the resource access rights required to complete normal business; Step S104: Enter all of the above user information, user group information, information resource information, information resource group information, and information resource information granted to each user group into the network access control system.

[0020] In the second part, when an employee's terminal computer accesses the campus network, the network access control system will first obtain the MAC address of the employee's computer to confirm whether it has been bound to a certain employee network account. If it has been bound, it will directly enter the compliance check process of the terminal computer. If the MAC address of the terminal computer is not bound to a certain employee account, an identity authentication page will be prompted, requiring the user to enter identity information. The specific implementation steps are as follows: Note: In each sub-step of step S2, it is assumed that the enterprise already has an Ethernet network covering all employee terminal computers, and the network has a network access control system that can match the network equipment and a network board antivirus software system that can cover all terminal computers; Step S201: After logging in, the employee terminal computer can immediately obtain an IP address that can be used in the campus network through the DHCP system, and exchange login information with the network access control system through the radius network protocol, and send its MAC address information to the network access system for verification; Step S202: If the network access control system finds the MAC address of the terminal computer in the MAC address table bound to the enterprise employee account (the amount of data bound to each account under the MAC address can be specified as needed), the user verification is passed and the security compliance check phase is entered; Step S203: If the network access control system does not find the address of the terminal in the MAC address table bound to the employee account, a user login page pops up to the terminal computer, requiring the user to enter the employee account and login password; In the third part, if the employee's identity information is correct, the MAC address of the terminal computer is bound to the employee's account to avoid repeated authentication information input when the terminal logs in again. At the same time, the security and compliance inspection process of the computer terminal is entered. The specific implementation steps are as follows: Step S301: The inspection rule base in the system should specify an appropriate inspection frequency according to the equipment operation characteristics. In order to reduce the system burden, the inspection frequency should be set to the longest actual period that can detect abnormal equipment status in time; Step S301: If the account and password entered by the employee are correct, the MAC address of the terminal computer is bound to the employee account to avoid the user from repeatedly entering login information when logging in again, thereby increasing the speed of terminal access and reducing the employee's operations; Step S302: If the account password is incorrect or the number of MAC addresses bound to the account has reached the upper limit of the permitted number, a corresponding error message is fed back to prompt the employee to find a system administrator for a solution; The fourth part is for terminal computers with antivirus software installed. The antivirus software can check the security status of the terminal computers as needed. The IP addresses and MAC addresses of computers that meet the security requirements will be written into the security compliance information library. The IP addresses and MAC addresses of computers that do not have antivirus software installed or do not meet the security check requirements will not be written into the security compliance information library. The specific implementation steps are as follows: Step S401: In order to ensure the security of the enterprise campus network, the enterprise should establish a terminal security compliance information database based on the security inspection results of the network version of the anti-virus software, and save the terminal computer information that has passed the security inspection and is compliant, so as to assist the network access control system in determining whether the terminal computer has the network access qualification; Step S402: Terminal computers without antivirus software installed cannot enter the security compliance information database, which effectively guarantees the antivirus software installation rate of terminal computers in the enterprise campus network. Except for some special devices such as dumb terminals such as network printers, copiers, and cameras (dumb terminals can skip user authentication and security compliance check in the network access system and directly grant them corresponding network access rights according to data transmission needs), all antivirus software should be installed; Step S403: The enterprise can set security check items in the anti-virus software according to the network information security needs, generally including the update status of the operating system security patch, the update status of the anti-virus software and virus database, whether illegal software is installed, etc. Step S404, the antivirus software can monitor the security compliance of the terminal in real time and delete the non-compliant terminal information from the security compliance information database in time to ensure the security of the terminal computer connected to the network; In the fifth part, the network access control system will access the security compliance information and confirm the compliance of the terminal computer that has passed the user authentication and whose MAC address has been bound to the user account. If the terminal computer information is in the security compliance database, the user's enterprise information resource access rights will be issued according to the user group information. If the terminal computer information is not included in the security compliance information database, security non-compliance information will be fed back to the terminal computer, prohibiting the terminal computer's network access rights. The specific implementation steps are as follows: Step S501, the network access control system sends corresponding network access rights to the switch for the user terminal that has passed identity authentication and meets the security compliance inspection requirements according to the network resource access rights granted to the user group to which the user belongs; In step S502, enterprise terminal users can access enterprise information resources according to the assigned permissions. If the access permissions need to be changed due to business needs, the user can submit a permission change application to the system administrator for approval by the unit leader. The administrator can adjust the corresponding resource authorization for the user according to the application. The present invention realizes the identity authentication, security compliance detection and control functions of network resource access rights for enterprise campus network user terminals by building a set of network access control systems. Thereby, zero-trust management of enterprise campus network user terminals is realized, and effective security protection of enterprise information resources is carried out. The present invention makes use of the enterprise's own campus network, anti-virus software and network access control system. Based on the zero-trust security management concept, identity authentication and security compliance checks are performed on user terminal devices connected to the enterprise campus network, and the scope of authority of the enterprise information resources is allocated according to the actual business needs of the user, so as to maximize the network information security of the enterprise information resources. Ultimately, the overall security management and control goals of the enterprise campus network are achieved.

Claims

1. A method for network access control, characterized in that The following steps are involved: Step S1, in the system, based on the enterprise personnel information database, enterprise information resource database, enterprise network antivirus software, enterprise campus network and network access control system, sort out the corresponding relationship between the enterprise information resource groups required by the enterprise employees according to business needs, and enter the information into the enterprise's network access control system to form employee accounts, employee groups and enterprise information resource groups, and according to the corresponding relationship between access rights, give each employee group the scope of authority of the corresponding information resource group; Step S2: When an employee's terminal computer accesses the campus network, the network access control system will first obtain the MAC address of the employee's computer to confirm whether it has been bound to the employee's network account. If it has been bound, it will directly enter the compliance check process of the terminal computer; If the MAC address of the terminal computer is not bound to the employee's network account, an identity authentication page will be displayed, requiring the user to enter identity information; Step S3: If the employee's identity information is correct, the MAC address of the terminal computer is bound to the employee's account to avoid repeated input of authentication information when the terminal logs in again, and the security and compliance inspection process of the computer terminal is started; Step S4, for terminal computers with antivirus software installed, the antivirus software checks the security status of the terminal computers as needed, and writes the IP addresses and MAC addresses of computers that meet the security requirements into the security compliance information library, while the IP addresses and MAC addresses of computers that do not have antivirus software installed or that do not meet the security check requirements are not written into the security compliance information library; Step S5, the network access control system access security compliance informationization, and the terminal computer that has passed the user authentication and whose MAC address has been bound to the user account is confirmed to be compliant; If the terminal computer information is in the security compliance database, the user will be given access to enterprise information resources based on the user group information. If the terminal computer information is not in the security compliance information database, security non-compliance information will be fed back to the terminal computer, prohibiting the terminal computer from having network access rights.

2. A network access control method according to claim 1, characterized in that: The step S1 includes the following steps: Step S101, registering the information of employees who need to log in to the enterprise campus network, including employee number, name, department, position and name of the information system to be accessed, based on the enterprise department, to form an employee information database, with each department forming one or more user groups; Step S102, taking the information system as the unit, statistics are collected on all the information resources of the enterprise, and the hosts providing unified information services are grouped into a resource group to form an enterprise information resource information database; Step S103: Authorize each user group for access to resources according to the statistics of the information resources that each user group needs to access, to ensure that each user group has and only has the resource access rights required to complete normal business; Step S104: Enter all of the above user information, user group information, information resource information, and information resource group information that has been granted to each user group into the network access control system.

3. A network access control method according to claim 1, characterized in that: In step S2, it is assumed that the enterprise already has an Ethernet network covering all employee terminal computers, and the network has a network access control system that matches the network equipment, and a network board antivirus software system that can cover all terminal computers, including the following steps: Step S201: After logging in, the employee terminal computer obtains an IP address that can be used in the campus network through the DHCP system, exchanges login information with the network access control system through the radius network protocol, and sends its MAC address information to the network access system for verification; Step S202: If the network access control system finds the MAC address of the terminal computer in the MAC address table bound to the enterprise employee account (the amount of data bound to each account under the MAC address can be specified as needed), the user verification is passed and the security compliance check phase is entered; Step S203: If the network access control system does not find the address of the terminal in the MAC address table bound to the employee account, a user login page pops up to the terminal computer, requiring the user to enter the employee account and login password.

4. A method for network access control according to claim 1, characterized in that: The step S3 includes the following steps: Step S301: If the account and password entered by the employee are correct, the MAC address of the terminal computer is bound to the employee account; Step S302: If the account password is incorrect or the number of MAC addresses bound to the account has reached the upper limit of the permitted number, a corresponding error message is fed back to prompt the employee to find a system administrator for a solution.

5. A method for network access control according to claim 1, characterized in that: The step S4 includes the following steps: Step S401: In order to ensure the security of the enterprise campus network, the enterprise establishes a terminal security compliance information database based on the security inspection results of the network version of the anti-virus software, and saves the terminal computer information that has passed the security inspection and is compliant, so as to assist the network access control system in determining whether the terminal computer has the network access qualification; Step S402: Terminal computers that do not use antivirus software cannot enter the security compliance information database, except for some network printers, copiers, and camera dumb terminals. All devices that should be installed can be installed; Step S403, the enterprise sets security check items in the anti-virus software according to network information security needs; Step S404, the antivirus software monitors the security compliance of the terminal in real time and dynamically deletes the non-compliant terminal information from the security compliance information database in time to ensure the security of the terminal computer connected to the network.

6. A network access control method according to claim 1, characterized in that: The step S5 includes the following steps: Step S501, the network access control system sends corresponding network access rights to the switch for the user terminal that has passed identity authentication and meets the security compliance inspection requirements according to the network resource access rights granted to the user group to which the user belongs; In step S502, the enterprise terminal user accesses the enterprise information resources according to the assigned permissions. If the access permissions need to be changed due to business needs, the user submits a permission change application to the system administrator for approval by the unit leader. The administrator adjusts the corresponding resource authorization for the user according to the application.

Images