Network access control method, device and equipment and readable storage medium
By obtaining users' network attributes and the timestamp of access traffic in multi -network application scenarios, deciding whether to release, hijack or block access traffic, solve the problem of difficulty in controlling user network access in existing technology, realize data security and Balance of normal behavior of users.
Patent Information
- Application Number
- CN202411508721.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-25
- Publication Date
- 2025-01-28
AI Technical Summary
In multi-network application scenarios, the prior art is difficult to effectively control users' network access, which makes it difficult to ensure data security. At the same time, excessively strict access control methods will affect users' normal network behavior.
When the user's access traffic hits the time -sharing control strategy, obtains the user's network attributes, and according to the timestamp and network attributes of the access traffic, decide whether to let go, hijack or block access traffic, and push the network to switch the window to the user to adjust the attribute to adjust the attribute Group.
Realized the fine control of user network access in multi -network application scenarios, ensuring data security, and avoiding the interference of the normal behavior of users with too strict access control.
Smart Images
Figure CN119382979A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of network access control, and in particular to a network access control method, apparatus, device and readable storage medium. Background Art
[0002] Implementing network security access control is a key concept in the construction of a modern enterprise network security capability system, especially in the context of enterprise digital transformation and development. By selectively restricting or allowing resource users to enter a certain place or access a certain resource, better protection can be achieved for enterprise data assets, and the use of data resources can be controlled. Therefore, in multi-network application scenarios, it is necessary to control the user's network access to ensure data security in multi-network application scenarios. Summary of the invention
[0003] The embodiments of the present application provide a network access control method, apparatus, device and readable storage medium to control the network access of users in multi-network application scenarios, thereby ensuring data security in the multi-network application scenarios.
[0004] The present application provides a network access control method, comprising: obtaining the network attribute of the user when the user's access traffic hits the time-sharing control strategy and the user identity is the target identity;
[0005] If the network attribute is consistent with the target address of the access traffic, release the access traffic; if the network attribute is inconsistent with the target address of the access traffic, extract the timestamp of the access traffic;
[0006] When the timestamp of the access traffic is within the preset time, the access traffic is hijacked and a network switching window is pushed to the user; when the timestamp of the access traffic is not within the preset time, the access traffic is blocked.
[0007] In this way, when the user's access traffic hits the time-sharing control strategy and the user identity is the target identity, the user's access traffic is controlled based on the attribute group of the user network and the time-sharing access strategy. Specifically, when the network attribute does not match the target address of the access traffic and the timestamp of the access traffic is at the preset time, the network switching window is pushed to the user, thereby guiding the user to switch the network to adjust the user's attribute group to achieve network access. In this way, while ensuring the user's secure access, it avoids overly strict network access methods that cause trouble to the user's normal network behavior. In addition, the strictness of the access control policy can be adjusted by adjusting the target identity or the preset time to adapt to multi-network application scenarios with different requirements.
[0008] In a possible implementation, after the step of hijacking the access traffic and pushing the network switching window to the user, the network access control method further includes:
[0009] In response to the user's confirmation operation on the network switching window, obtaining the network attribute of the user again;
[0010] If the network attributes acquired again match the target address of the access traffic, the hijacking operation of the access traffic is released.
[0011] In a possible implementation, before the step of obtaining the network attribute of the user, the network access control method further includes:
[0012] When the user is not connected to the network, based on the access traffic, a network connection window corresponding to the access traffic is pushed to the user.
[0013] In a possible implementation, the network attribute at least includes that the user is in the first network or the second network; the network pointed to by the target address at least includes the first network or the second network;
[0014] The situation where the network attribute meets the target address of the access traffic includes: the network attribute belongs to the first network, and the target address of the access traffic points to the first network; or, the network attribute belongs to the second network, and the target address of the access traffic points to the second network.
[0015] In a possible implementation, the network attribute at least includes that the user is in the first network or the second network; the network pointed to by the target address at least includes the first network or the second network;
[0016] The situation where the network attribute does not conform to the target address of the access traffic includes: the network attribute belongs to the first network, and the target address of the access traffic points to the second network; or, the network attribute belongs to the second network, and the target address of the access traffic points to the first network.
[0017] In a possible implementation, when the target address of the access traffic points to the target network and the access traffic is released, the virus protection function is enabled and the activity log of the user terminal is recorded.
[0018] In a possible implementation, the network access control method includes: when the user's access traffic hits a time-sharing control policy and the user identity is a non-target identity, releasing the access traffic.
[0019] The embodiment of the present application also provides a network access control device, including:
[0020] An acquisition module, used to acquire the network attributes of the user when the user's access traffic hits the time-sharing control strategy and the user identity is the target identity;
[0021] A judgment module, used to judge whether the network attribute conforms to the target address of the access traffic, and to judge whether the timestamp of the access traffic is within a preset time;
[0022] An access traffic control module is used to release the access traffic when the network attributes meet the target address of the access traffic, and to determine and extract the timestamp of the access traffic when the network attributes do not meet the target address of the access traffic; it is also used to hijack the access traffic and push a network switching window to the user when the timestamp of the access traffic is within a preset time, and to block the access traffic when the timestamp of the access traffic is not within the preset time.
[0023] The embodiment of the present application also provides a network access control device, characterized in that it includes: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus;
[0024] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the operation of the above-mentioned network access control method.
[0025] An embodiment of the present application also provides a computer-readable storage medium, characterized in that the storage medium stores at least one executable instruction, and when the executable instruction is executed on a network access control device / apparatus, the network access control device / apparatus performs the operation of the above-mentioned network access control method.
[0026] The embodiments of the present application provide a network access control method, apparatus, device and readable storage medium, wherein the network access control method includes: when the user's access traffic hits the time-sharing control strategy and the user identity is the target identity, obtaining the network attributes of the user; when the network attributes match the target address of the access traffic, releasing the access traffic; when the network attributes do not match the target address of the access traffic, extracting the timestamp of the access traffic; when the timestamp of the access traffic is within a preset time, hijacking the access traffic and pushing a network switching window to the user; when the timestamp of the access traffic is not within the preset time, blocking the access traffic.
[0027] By applying the technical solution of the present application, when the user's access traffic hits the time-sharing control strategy and the user identity is the target identity, the user's access traffic is controlled based on the attribute group of the user network and the time-sharing access strategy. Specifically, when the network attribute does not match the target address of the access traffic and the timestamp of the access traffic is at the preset time, a network switching window is pushed to the user, thereby guiding the user to switch the network to adjust the user's attribute group to achieve network access. In this way, while ensuring the user's secure access, overly strict network access methods are avoided, which may cause trouble to the user's normal network behavior. In addition, the strictness of the access control policy can be adjusted by adjusting the target identity or the preset time to adapt to multi-network application scenarios with different requirements. BRIEF DESCRIPTION OF THE DRAWINGS
[0028] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.
[0029] Figure 1 A schematic diagram of a network access control method provided in an embodiment of the present application Figure 1 ;
[0030] Figure 2 A user interface diagram of a network access control method provided in an embodiment of the present application Figure 1 ;
[0031] Figure 3 A user interface diagram of a network access control method provided in an embodiment of the present application Figure 2 ;
[0032] Figure 4 A user interface diagram of a network access control method provided in an embodiment of the present application Figure 3 ;
[0033] Figure 5 A user interface diagram of a network access control method provided in an embodiment of the present application Figure 4 ;
[0034] Figure 6 A schematic diagram of a network access control method provided in an embodiment of the present application Figure 2 ;
[0035] Figure 7 A user interface diagram of a network access control method provided in an embodiment of the present application Figure 5 ;
[0036] Figure 8A user interface diagram of a network access control method provided in an embodiment of the present application Figure 6 ;
[0037] Fig. 9 A schematic diagram of the structure of a network access control device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0038] In multi-network application scenarios, it is necessary to control the user's network access to ensure data security in multi-network application scenarios. In a network security access control system, the general security administrator will define which users have access rights to which resources. However, in big data application scenarios, the difficulty of authorization management by security administrators will increase dramatically. If the pre-defined access control policy is too strict, then new access requirements are likely to be rejected due to failure to fully comply with the access control policy, thus affecting the availability of the big data system. If the pre-defined access control policy is too loose, then although the availability of the system is guaranteed, the security of the system is greatly reduced.
[0039] In order to solve the above technical problems, the present application provides a network access control method, such as Figure 1 As shown, the network control method includes S110 to S150.
[0040] S110, when the user's access traffic hits the time-sharing control policy and the user identity is the target identity, obtain the network attribute of the user.
[0041] The time-sharing control strategy is determined by the security administrator according to actual needs. For example, the network access of all users under the server management is controlled by the time-sharing control strategy. For another example, the network access of user devices under the server management is controlled by the time-sharing control strategy. For another example, at a specific time, the network access of all users under the server management is controlled by the time-sharing control strategy. For another example, at a specific time, the network access of some users under the server management is controlled by the time-sharing control strategy.
[0042] Among them, user identities include at least authenticated users and non-authenticated users. Authenticated users can also be divided into more detailed identity types as needed, for example, authenticated users include first-level permission users and second-level permission users. In actual application, any one or more types of authenticated users can be set as target users, for example, the target users are all authenticated users, and for example, the target users are first-level permission users among authenticated users.
[0043] The network attributes of the user are determined by the network to which the user is connected. For example, if the user is connected to a first network, the network attributes are the attribute group of the first network.
[0044] S120: When the network attribute matches the target address of the access traffic, the access traffic is released.
[0045] Specifically, the network attribute at least includes that the user is in the first network or the second network; the network pointed to by the target address at least includes the first network or the second network. Thus, the situation where the network attribute meets the target address of the access traffic includes: the network attribute belongs to the first network, and the target address of the access traffic points to the first network; or, the network attribute belongs to the second network, and the target address of the access traffic points to the second network.
[0046] For example, the first network is the external Internet and the second network is the internal network. When the network connected by the user is the external Internet and the access traffic is directed to the external Internet, the user's network attribute is consistent with the target address of the access traffic. Alternatively, when the network connected by the user is the internal network and the access traffic is directed to the internal network, the user's network attribute is consistent with the target address of the access traffic.
[0047] S130: When the network attribute does not match the target address of the access traffic, extract the timestamp of the access traffic.
[0048] Among them, the situation where the network attribute does not conform to the target address of the access traffic includes: the network attribute belongs to the first network, and the target address of the access traffic points to the second network; or, the network attribute belongs to the second network, and the target address of the access traffic points to the first network.
[0049] For example, the first network is the external Internet, and the second network is the internal network. When the network connected by the user is the external Internet, and the access traffic is directed to the internal network, the user's network attributes do not match the target address of the access traffic. Alternatively, when the network connected by the user is the internal network, and the access traffic is directed to the internal network, the user's network attributes do not match the target address of the access traffic.
[0050] When the network attribute of the user does not match the target address of the access traffic, the timestamp of the access traffic is extracted from the access traffic.
[0051] S140, when the timestamp of the access traffic is at a preset time, hijack the access traffic and push a network switching window to the user.
[0052] Based on S130, when the timestamp of the access traffic is at the preset time, it indicates that the user's current access traffic complies with the time-sharing control strategy. For example, the network connected by the user is the external Internet, and the access traffic points to the internal network. If the timestamp of the access traffic falls during the working hours from 08:00 to 12:00, it indicates that the user's current access traffic complies with the time-sharing control strategy, and the access traffic is hijacked. Figure 2As shown, a network switching window for switching the connected network to the internal network can also be pushed to the user.
[0053] For another example, the network connected by the user is an internal network, and the access traffic is directed to the external Internet. If the timestamp of the access traffic falls during the non-working hours from 12:00 to 13:00, it means that the user's current access traffic complies with the time-sharing control strategy. Figure 3 As shown, a network switching window for switching the connected network to the external Internet can be pushed to the user.
[0054] The purpose of pushing the network switching window to the user is to guide the user to switch the connected network to a specific network. For example, a network switching window for switching the connected network to the external Internet is pushed to the user. The network switching window is provided with connection options for the external Internet, such as the connection options including the network name, connection password or authorization key, etc. After the user selects or enters, he clicks the confirmation control.
[0055] After the confirmed network connection passes the verification, the network switching window automatically closes, indicating that the user's confirmation operation on the network switching window is completed. If the confirmed network connection fails the verification, the network switching window may also prompt the reason for the failure, indicating that the user's confirmation operation on the network switching window is not completed. Of course, in actual application, the network switching window is also provided with a close control or a cancel switch control, thereby providing a channel for users to abandon network switching.
[0056] S150: When the timestamp of the access traffic is not within the preset time, block the access traffic.
[0057] Based on S130, if the timestamp of the access traffic is not within the preset time, it indicates that the user's current access traffic does not comply with the time-sharing control strategy. For example, the network connected by the user is the external Internet, and the access traffic points to the internal network. If the timestamp of the access traffic falls during the non-working hours of 12:00 to 13:00, it indicates that the user's current access traffic does not comply with the time-sharing control strategy, and the access traffic is blocked. Figure 4 As shown, a prompt message can be pushed to the user to indicate that the current time is non-working hours and the target address of the internal network cannot be accessed, so that the user can know the reason for blocking the access traffic.
[0058] For another example, the network connected by the user is an internal network, and the access traffic is directed to the external Internet. If the timestamp of the access traffic falls within the working hours from 8:00 to 12:00, it means that the user's current access traffic does not meet the time-sharing control strategy, and the access traffic is blocked. Figure 5As shown, a prompt message can be pushed to the user to indicate that the current time is working hours and the target address of the external network cannot be accessed, so that the user can know the reason for blocking the access traffic.
[0059] The network access control method provided in the embodiment of the present application controls the user's access traffic based on the attribute group of the user network and the time-sharing access policy when the user's access traffic hits the time-sharing control policy and the user identity is the target identity. Specifically, when the network attribute does not match the target address of the access traffic and the timestamp of the access traffic is at a preset time, a network switching window is pushed to the user, thereby guiding the user to switch the network to adjust the user's attribute group to achieve network access. In this way, while ensuring the user's secure access, it avoids overly strict network access methods that cause trouble to the user's normal network behavior. In addition, the strictness of the access control policy can be adjusted by adjusting the target identity or the preset time to adapt to multi-network application scenarios with different requirements.
[0060] Among them, in some embodiments of the present application, after the step of hijacking the access traffic and pushing the network switching window to the user, such as Figure 6 As shown, the network access control method further includes S610 to S620.
[0061] S610, in response to the user's confirmation operation on the network switching window, obtaining the network attribute of the user again.
[0062] It should be noted that when the user confirms the network switching window, it means that the user has completed the network switching. At this time, the network attributes of the user are obtained again. The network attributes obtained again may meet the target address of the access traffic, or the network attributes obtained again may still not meet the target address of the access traffic. When the network attributes obtained again do not meet the target address of the access traffic, the network switching window will be pushed to the user again. Of course, if the user's network switching fails and the original network switching window is still displayed, the new network switching window will not be pushed to the user, but a prompt will be given in other ways, for example, the original network switching window will be displayed in a pop-up manner at the top of the display.
[0063] S620: If the network attribute obtained again matches the target address of the access traffic, the hijacking operation of the access traffic is released.
[0064] It should be noted that if the network attributes obtained again match the target address of the access traffic, the hijacking operation of the access traffic can be directly contacted, that is, the access traffic is released. Of course, in the actual application process, in order to avoid the user switching networks for a long time, the timestamp of the access traffic can also be updated according to the system time, and the updated timestamp is compared with the preset time. When the updated timestamp is within the preset time, the access traffic is released, thus avoiding the time difference caused by the user switching networks, resulting in the user successfully accessing the target network during the prohibited access time of the target network.
[0065] In the embodiment of the present application, before obtaining the network attributes of the user, it is necessary to ensure that the user has connected to the network. If the user is not connected to the network, a network connection window corresponding to the access flow can be pushed to the user based on the access flow. For example, Figure 7 As shown in FIG. 1 , when the user is not connected to the network, if the network to which the access traffic is directed is the internal network, the network connection window for connecting the network to the internal network is pushed to the user. Figure 8 As shown, when the user is not connected to the network, if the network to which the access traffic is directed is the external Internet, a network connection window for connecting the network to the external Internet is pushed to the user. In this way, the user can be guided to connect to the corresponding network according to the target address to be accessed.
[0066] It should be noted that in actual application, the security administrator can set a certain network as the target network, for example, set the internal network as the target network, and enable the virus protection function when the target address of the access traffic points to the target network and the access traffic is released, so that the user can access the target network safely as much as possible. The activity log of the user terminal can also be recorded, so that when unknown security problems occur, the activity log can be used to check the potential security risks of the user's network access behavior.
[0067] In order to more clearly illustrate the technical solution of the present application, the solution is explained below from the perspective of a method for a network security officer to configure network access control.
[0068] In the embodiments of the present application, the user's network attributes can be set according to the actual situation. For example, the attribute group can be configured. The user adds different attributes to represent different networks, and customizes an attribute time-sharing access control policy. Multiple attribute groups can be set, for example, an attribute group named Internet, and another example, an attribute group named internal network, and different attribute values are set for different attribute groups. Time objects can be configured. For example, according to different time objects, users can switch networks within the allowed time objects. Address objects can be configured to divide the network. Different networks can be divided according to different address segments, for example, into external Internet and internal network.
[0069] The present application also provides a network access control device, such as Fig. 9 As shown, it includes: an acquisition module, a judgment module and an access flow control module.
[0070] The acquisition module is used to acquire the network attributes of the user when the user's access traffic hits the time-sharing control strategy and the user identity is the target identity.
[0071] The judgment module is used to judge whether the network attribute conforms to the target address of the access traffic, and to judge whether the timestamp of the access traffic is within a preset time.
[0072] The access traffic control module is used to release the access traffic when the network attributes match the target address of the access traffic, and to determine and extract the timestamp of the access traffic when the network attributes do not match the target address of the access traffic; it is also used to hijack the access traffic and push a network switching window to the user when the timestamp of the access traffic is within a preset time, and to block the access traffic when the timestamp of the access traffic is not within the preset time.
[0073] An embodiment of the present application also provides a network access control device, including: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the operation of the above-mentioned network access control method.
[0074] The embodiment of the present application also provides a computer-readable storage medium, in which at least one executable instruction is stored. When the executable instruction is executed on a network access control device / apparatus, the network access control device / apparatus performs the operation of the above-mentioned network access control method.
[0075] The embodiments of the present application provide a network access control method, apparatus, device and readable storage medium, wherein the network access control method includes: when the user's access traffic hits the time-sharing control strategy and the user identity is the target identity, obtaining the network attributes of the user; when the network attributes match the target address of the access traffic, releasing the access traffic; when the network attributes do not match the target address of the access traffic, extracting the timestamp of the access traffic; when the timestamp of the access traffic is within a preset time, hijacking the access traffic and pushing a network switching window to the user; when the timestamp of the access traffic is not within the preset time, blocking the access traffic.
[0076] By applying the technical solution of the present application, when the user's access traffic hits the time-sharing control strategy and the user identity is the target identity, the user's access traffic is controlled based on the attribute group of the user network and the time-sharing access strategy. Specifically, when the network attribute does not match the target address of the access traffic and the timestamp of the access traffic is at the preset time, a network switching window is pushed to the user, thereby guiding the user to switch the network to adjust the user's attribute group to achieve network access. In this way, while ensuring the user's secure access, overly strict network access methods are avoided, which may cause trouble to the user's normal network behavior. In addition, the strictness of the access control policy can be adjusted by adjusting the target identity or the preset time to adapt to multi-network application scenarios with different requirements.
[0077] The above specific implementation methods further illustrate the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above are only specific implementation methods of the present application and are not used to limit the protection scope of the present application. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the present application should be included in the protection scope of the present application.
Claims
1. A network access control method, characterized in that: include: When the user's access traffic hits the time-sharing control policy and the user's identity is the target identity, the network attribute of the user is obtained; If the network attribute is consistent with the target address of the access traffic, release the access traffic; if the network attribute is inconsistent with the target address of the access traffic, extract the timestamp of the access traffic; When the timestamp of the access traffic is at a preset time, hijacking the access traffic and pushing a network switching window to the user; When the timestamp of the access traffic is not within the preset time, the access traffic is blocked.
2. A network access control method according to claim 1, characterized in that: After the steps of hijacking the access traffic and pushing the network switching window to the user, the method further includes: In response to the user's confirmation operation on the network switching window, obtaining the network attribute of the user again; If the network attributes acquired again match the target address of the access traffic, the hijacking operation of the access traffic is released.
3. A network access control method according to claim 1 or 2, characterized in that: Before the step of obtaining the network attributes of the user, it also includes: In the case that the user is not connected to the network, based on the access traffic, a network connection window corresponding to the access traffic is pushed to the user.
4. A network access control method according to claim 1, characterized in that: The network attribute at least includes that the user is in the first network or the second network; the network pointed to by the target address at least includes the first network or the second network; The situation where the network attribute meets the target address of the access traffic includes: the network attribute belongs to the first network, and the target address of the access traffic points to the first network; or, the network attribute belongs to the second network, and the target address of the access traffic points to the second network.
5. A network access control method according to claim 1, characterized in that: The network attribute at least includes that the user is in the first network or the second network; the network pointed to by the target address at least includes the first network or the second network; The situation where the network attribute does not conform to the target address of the access traffic includes: the network attribute belongs to the first network, and the target address of the access traffic points to the second network; or, the network attribute belongs to the second network, and the target address of the access traffic points to the first network.
6. A network access control method according to claim 1, 4 or 5, characterized in that: When the target address of the access traffic points to the target network and the access traffic is released, the virus protection function is enabled and the activity log of the user terminal is recorded.
7. A network access control method according to claim 1, characterized in that: include: When the user's access traffic hits the time-sharing control policy and the user identity is a non-target identity, the access traffic is released.
8. A network access control device, characterized in that: include: An acquisition module, used to acquire the network attributes of the user when the user's access traffic hits the time-sharing control strategy and the user identity is the target identity; A judgment module, used for judging whether the network attribute is consistent with the target address of the access traffic, and for judging whether the timestamp of the access traffic is within a preset time; An access traffic control module, configured to release the access traffic if the network attribute matches the target address of the access traffic, and to determine and extract a timestamp of the access traffic if the network attribute does not match the target address of the access traffic; It is also used to hijack the access traffic and push a network switching window to the user when the timestamp of the access traffic is within the preset time, and to block the access traffic when the timestamp of the access traffic is not within the preset time.
9. A network access control device, characterized in that: include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the operation of the network access control method as described in any one of claims 1-7.
10. A computer-readable storage medium, characterized in that: The storage medium stores at least one executable instruction. When the executable instruction is executed on the network access control device / apparatus, the network access control device / apparatus performs the operation of the network access control method according to any one of claims 1 to 7.