Device access control method, device, electronic device, storage medium and product

Abstract

The present application discloses a device access control method, apparatus, electronic device, storage medium and product, which relates to the field of intelligent device access management technology and is applied to device access control systems, including: receiving a device access request of a target device and detecting the system network status, and the user authority information of the operator corresponding to the device access control system, analyzing the device access request, the system network status and the user authority information, and determining the optimal access strategy path; authenticating the target device according to the optimal access strategy path, and accessing the target device according to the optimal access strategy path when the authentication is passed; monitoring the target device in real time and calculating the risk score of the target device, and updating the optimal access strategy path when the risk score exceeds the preset risk threshold; and executing the step of authenticating the target device according to the optimal access strategy path based on the updated optimal access strategy path. The present application solves the technical problem that device access is not intelligent.

Description

Technical Field

[0001] The present application relates to the technical field of smart device access management, and in particular to a device access control method, apparatus, electronic device, storage medium and computer program product. Background Art

[0002] With the popularization of IoT devices, the current device access management methods mostly use static rules, which are difficult to adapt to the dynamic changes of device attributes, network conditions and user permissions. This not only leads to low device access efficiency, but also increases the complexity of management, making resource allocation and optimization difficult, and difficult to meet the needs of actual applications. Therefore, there is a problem of unintelligent device access in the current device access management methods. Summary of the invention

[0003] The main purpose of this application is to provide a device access control method, apparatus, electronic device, storage medium and computer program product, aiming to solve the technical problem of unintelligent device access.

[0004] To achieve the above purpose, the present application proposes a device access control method, which is applied to a device access control system. The device access control method includes:

[0005] Receive a device access request from a target device and detect the system network status and the user authority information of the operator corresponding to the device access control system, analyze the device access request, the system network status and the user authority information through a dynamic access rule engine, and determine the optimal access strategy path;

[0006] Authenticating the target device according to the optimal access policy path, and accessing the target device according to the optimal access policy path if the authentication passes;

[0007] When the target device is accessed, the target device is monitored in real time and a risk score of the target device is calculated. When the risk score exceeds a preset risk threshold, the risk information of the target device is fed back to the dynamic access rule engine to update the optimal access strategy path.

[0008] The step of authenticating the target device according to the optimal access policy path is performed based on the updated optimal access policy path.

[0009] In one embodiment, the dynamic access rule engine includes a rule parser and a dynamic rule generator, and the step of analyzing the device access request, the system network status and the user authority information through the dynamic access rule engine to determine the optimal access strategy path includes:

[0010] Parsing the device access request to obtain device information of the target device, and storing the device information;

[0011] Selecting a rule set that matches the device information and the system network status from a preset rule library, and parsing the rule set into a policy component through the rule parser;

[0012] Based on the dynamic rule generator, the weights of the policy components are calculated in combination with the device information, the system network status and the user authority information to generate an optimal access policy path.

[0013] In one embodiment, the step of authenticating the target device according to the optimal access policy path includes:

[0014] Selecting an optimal authentication method according to the optimal access strategy path;

[0015] Under the optimal authentication mode, parsing the device information, and calculating the authentication success rate of the target device based on the extracted device identifier and device authentication key;

[0016] When the authentication success rate is higher than a preset success rate threshold, it is determined that the authentication is successful.

[0017] In one embodiment, the step of monitoring the target device in real time and calculating the risk score of the target device includes:

[0018] Monitoring the device behavior change and the system network status change after the target device is connected to the system according to a preset period;

[0019] The device behavior change amount and the network status change amount are input into a risk assessment function to calculate the risk score of the target device.

[0020] In one embodiment, the step of feeding back the risk information of the target device to the dynamic access rule engine to update the optimal access strategy path includes:

[0021] Packing the device execution status and system resource allocation status after the target device is connected as risk information;

[0022] The risk information is fed back to the dynamic access rule engine, and the dynamic access rule engine is used to parse the risk information and adjust the optimal access strategy path to meet the access requirements of the target device.

[0023] In one embodiment, after the step of authenticating the target device according to the optimal access policy path based on the updated optimal access policy path, the step further includes:

[0024] Recording the execution result of the updated optimal access strategy path, and updating the execution result to the preset strategy library;

[0025] When the optimal access strategy path needs to be updated again, record the number of updates of the optimal access strategy path;

[0026] When the number of updates reaches a preset update threshold, the target device is recorded as a problem device and an alarm message is output.

[0027] In addition, to achieve the above-mentioned purpose, the present application also proposes a device access control device, which is applied to a device access control system. The device access control device includes:

[0028] A path generation module is used to receive a device access request from a target device and detect a system network status and user authority information of an operator corresponding to the device access control system, and analyze the device access request, the system network status and the user authority information through a dynamic access rule engine to determine an optimal access strategy path;

[0029] A device access module, configured to authenticate the target device according to the optimal access strategy path, and if the authentication is successful, access the target device according to the optimal access strategy path;

[0030] A risk feedback module, configured to monitor the target device in real time and calculate the risk score of the target device when the target device is accessed, and when the risk score exceeds a preset risk threshold, feed back the risk information of the target device to the dynamic access rule engine to update the optimal access strategy path;

[0031] A policy updating module is used to execute the step of authenticating the target device according to the optimal access policy path based on the updated optimal access policy path.

[0032] In addition, to achieve the above objectives, the present application also proposes an electronic device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the device access control method as described above.

[0033] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the device access control method described above are implemented.

[0034] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the device access control method described above are implemented.

[0035] The present application provides a device access control method, which is applied to a device access control system. The device access control method includes: receiving a device access request of a target device and detecting a system network status and user authority information of an operator corresponding to the device access control system, analyzing the device access request, the system network status and the user authority information, and determining an optimal access policy path; authenticating the target device according to the optimal access policy path, and accessing the target device according to the optimal access policy path when the authentication is passed; when the target device is accessed, monitoring the target device in real time and calculating a risk score of the target device, and updating the optimal access policy path when the risk score exceeds a preset risk threshold; and executing the step of authenticating the target device according to the optimal access policy path based on the updated optimal access policy path.

[0036] This application receives the device access request of the target device, detects the current network status of the system and the user authority information of the operator corresponding to the device access control system, ensures the environmental assessment before the target device accesses, and provides basic data for subsequent intelligent decision-making. Through dynamic analysis, the system can intelligently generate the optimal access strategy according to different scenarios and needs, realize efficient allocation and management of resources, and through intelligent authentication and access, ensure that only devices that meet the requirements can access the system, improve the security of the system, and through real-time monitoring and feedback, the system can timely discover and deal with potential security risks to ensure the continuous security of the network. Compared with related solutions that mostly use static rules for device access management and cannot flexibly respond to changes in device attributes, network status and user permissions, this application automatically generates access strategies based on multiple dynamic factors such as device access requests, system network status and user permissions, and dynamically adjusts access strategies according to real-time changes before, during and after device access, to realize intelligent access and control of devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0039] Figure 1 A flowchart of the first embodiment of the device access control method of the present application is provided;

[0040] Figure 2 A flowchart of the second embodiment of the device access control method of the present application is provided;

[0041] Figure 3 A flowchart of Embodiment 3 of the device access control method of the present application is provided;

[0042] Figure 4 This is a schematic diagram of the module structure of the device access control device according to an embodiment of the present application;

[0043] Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the device access control method in the embodiment of the present application.

[0044] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0045] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0046] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0047] The embodiment of the present application is applied to a device access control system, and the main solution is: receiving a device access request of a target device and detecting the system network status, and the user authority information of the operator corresponding to the device access control system, analyzing the device access request, the system network status and the user authority information, and determining the optimal access policy path; authenticating the target device according to the optimal access policy path, and when the authentication is passed, accessing the target device according to the optimal access policy path; when the target device is accessed, monitoring the target device in real time and calculating the risk score of the target device, and when the risk score exceeds a preset risk threshold, updating the optimal access policy path; and executing the step of authenticating the target device according to the optimal access policy path based on the updated optimal access policy path.

[0048] In this embodiment, for ease of description, the following description is made by taking the device access control system as the execution subject.

[0049] Since existing device access management methods generally rely on static rules, it is difficult to flexibly respond to dynamic changes in device attributes, network conditions and user permissions. This not only reduces device access efficiency, but also increases management complexity, resulting in challenges in resource allocation and optimization, and making it difficult to meet actual application needs.

[0050] The present application provides a solution that automatically generates access policies based on multiple dynamic factors such as device access requests, system network status, and user permissions, and dynamically adjusts access policies based on real-time changes before, during, and after device access, to achieve intelligent access and control of devices.

[0051] It should be noted that the execution subject of this embodiment may be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a device access control system, etc. The following takes the device access control system as an example to illustrate this embodiment and the following embodiments.

[0052] Based on this, the present application embodiment provides a device access control method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the device access control method of the present application.

[0053] In this embodiment, the device access control method is applied to a device access control system and includes steps S01 to S04:

[0054] Step S01, receiving a device access request from a target device and detecting the system network status and the user authority information of the operator corresponding to the device access control system, analyzing the device access request, the system network status and the user authority information through a dynamic access rule engine, and determining the optimal access strategy path;

[0055] It should be noted that the device access control system is an intelligent system that can analyze various information (such as device access requests, system network status and user authority information, etc.) through a dynamic access rule engine, and determine the optimal access strategy path accordingly. The operator refers to the user or entity that interacts with the device access control system, which can be the owner, manager or user of the device. The target device refers to the device requesting access. The device access request is the signal of the target device requesting access to the network. The system network status refers to the current network load, bandwidth and other conditions. User authority information refers to whether the user has the authority to access the device. The dynamic access rule engine is a system that intelligently analyzes and generates access policies. The optimal access strategy path is the best access plan determined based on the current situation.

[0056] In addition, it should be noted that there is a device discovery module in the system, which is used to discover new access devices, collect basic information of the devices (such as device ID, device type, device status, etc.), and package the information and pass it to the dynamic access rule engine. The device discovery module monitors the access request of the target device and collects the basic information of the target device, including but not limited to key data such as device ID, device type and current device status. The collected device information is packaged and passed to the dynamic access rule engine. Inside the dynamic access rule engine, there is a dynamic rule generator. The dynamic rule generator comprehensively analyzes the device access request in combination with the current system network status and user authority information, and generates an optimal access strategy path based on these real-time information.

[0057] It is understandable that since most existing device access management methods use static rules and are difficult to adapt to dynamic changes, step S01 is performed to generate the optimal strategy path based on real-time information through a dynamic access rule engine, and dynamically adjust the strategy, thereby improving the flexibility and efficiency of device access and reducing management complexity.

[0058] Step S02, authenticating the target device according to the optimal access strategy path, and accessing the target device according to the optimal access strategy path if the authentication passes;

[0059] It should be noted that there are also authentication modules and device access control modules in the system. The authentication module can authenticate the device according to the access policy, and the device access control module can control the access operation of the device according to the access policy. After determining the optimal access policy path, the authentication module authenticates the target device according to the requirements in the policy, including single-factor authentication (such as password verification) or multi-factor authentication (such as password + biometric recognition) and other methods to ensure the legitimacy and security of the device. If the authentication is successful, the device access control module will perform access operations on the target device according to the optimal access policy path, including the allocation of network resources (such as IP addresses, ports, etc.), control of device behavior (such as data transmission rate, access rights, etc.), etc.

[0060] It is understandable that since the existing device access management method has a single authentication method and lacks flexibility, step S02 is performed to achieve flexible selection of multiple authentication methods, support single-factor and multi-factor authentication, and can more comprehensively verify the device identity, thereby improving the security and flexibility of device access.

[0061] Step S03, when the target device is connected, the target device is monitored in real time and the risk score of the target device is calculated. When the risk score exceeds the preset risk threshold, the risk information of the target device is fed back to the dynamic access rule engine to update the optimal access strategy path;

[0062] It should be noted that there is also a real-time monitoring and feedback module in the system, which is used to monitor the access status and network environment of the device, adjust the access strategy in real time according to the changes in device behavior and network status, and pass the feedback information to the dynamic access rule engine to achieve dynamic optimization of the strategy. The risk score is a quantitative assessment of the degree of risk that may be brought about by the target device after access. The preset risk threshold is the upper limit of risk tolerance set by the system. Risk information refers to abnormal conditions or potential threats that occur during the device access process.

[0063] In addition, it should be noted that the real-time monitoring and feedback module continuously monitors the target device after access, including multiple aspects such as device behavior and network status, calculates the risk score of the target device, and comprehensively evaluates multiple dimensions such as device behavior, network traffic, and anomaly detection. If the risk score exceeds the preset risk threshold, risk information is generated and fed back to the dynamic access rule engine.

[0064] It is understandable that since the existing device access management method lacks real-time monitoring and dynamic adjustment of the device after access, step S03 is performed to monitor the device status in real time and dynamically adjust the access strategy according to the risk score, thereby realizing risk monitoring and dynamic adjustment of the target device after access and improving the security of the network.

[0065] Step S04: authenticating the target device according to the optimal access policy path based on the updated optimal access policy path.

[0066] It should be noted that after receiving the risk information, the dynamic access rule engine adjusts the current optimal access policy path according to the risk information and generates a new optimal access policy path. When determining the updated policy path, the authentication module will authenticate the target device again, and the device access control module will also make corresponding adjustments and controls to the access operation of the target device according to the new policy path.

[0067] It is understandable that, since the existing device access management method cannot dynamically adjust the access strategy according to the changes after the device is accessed, step S04 is performed to achieve continuous optimization and dynamic adjustment of the access strategy through real-time monitoring and dynamic adjustment, thereby improving the intelligence level of device access.

[0068] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 2 In step S01, the dynamic access rule engine includes a rule parser and a dynamic rule generator. The dynamic access rule engine analyzes the device access request, the system network status and the user authority information, and the step of determining the optimal access strategy path includes steps S11 to S13:

[0069] Step S11, parsing the device access request to obtain device information of the target device, and storing the device information;

[0070] It should be noted that the dynamic access rule engine receives a device access request, extracts device information including key attributes such as the device's unique identifier, type, and required resources, and stores the device information in an internal database or cache for use in subsequent steps.

[0071] Step S12, selecting a rule set that matches the device information and the system network status from a preset rule library, and parsing the rule set into a policy component through a rule parser;

[0072] It should be noted that the rule parser is responsible for converting the abstract description in the rule set into executable policy components, ensuring that the rules can be correctly understood and applied. Device information is a data set that describes the characteristics, requirements and status of the device, and is an important basis for rule matching and policy generation. The preset rule base stores rule sets applicable to various device access scenarios. These rule sets are built based on past experience or expert knowledge to guide the selection of device access policies. The rule set is a collection of multiple rules that describe the actions to be taken under specific conditions. The policy component is a specific action item after the rule set is parsed, such as a specific authentication process or bandwidth allocation plan.

[0073] In addition, it should be noted that based on the parsed device information and system network status (such as bandwidth, latency, signal strength), the dynamic access rule engine retrieves and selects rule sets that match the conditions from the preset rule library, and parses these rule sets into specific policy components through the rule parser, such as different authentication methods, bandwidth allocation strategies, etc.

[0074] Step S13, based on the dynamic rule generator, the weights of the policy components are calculated in combination with the device information, the system network status and the user authority information to generate the optimal access policy path.

[0075] It should be noted that the dynamic rule generator comprehensively considers device information, system network status and user permission information, and calculates the applicability weight of each policy component through a weight formula. The weight calculation formula is:

[0076] W(S) =α×P_dev(S)+β×P_net(S)+γ×P_user(S)

[0077] Among them, P_dev(S), P_net(S) and P_user(S) represent the matching degree between the policy and the device information, the system network status and the user authority information respectively. α, β and γ are weight coefficients, which can be adjusted dynamically according to the actual situation. The optimal access strategy path S_opt is selected according to the sorted weights, including authentication method, bandwidth allocation, priority setting, etc.

[0078] In this implementation, by parsing device access requests, the accuracy and completeness of device information are ensured, laying the foundation for the efficient execution of subsequent steps. By dynamically selecting and parsing rule sets, flexible customization of access policies is achieved, the accuracy of rule matching and the intelligence of policy generation are improved, and the access policies are made more in line with the current network and device status. By comprehensively considering multiple factors to generate the optimal policy path, intelligent access management is achieved, the efficiency and security of device access are improved, the reasonable allocation of network resources and user priority setting are ensured, and the overall network access experience is optimized.

[0079] In a feasible implementation manner, in step S02, the step of authenticating the target device according to the optimal access strategy path includes steps A01 to A03:

[0080] Step A01, selecting the optimal authentication method according to the optimal access strategy path;

[0081] It should be noted that the optimal authentication method refers to the authentication method that can most effectively improve authentication efficiency and user experience while meeting security requirements, such as single-factor authentication, multi-factor authentication, etc. The authentication module receives the optimal access strategy and stored device information, analyzes the specific requirements of the access strategy (such as security, efficiency, etc.), and selects an optimal authentication method from the predefined authentication methods (such as single-factor authentication, multi-factor authentication, etc.), aiming to improve authentication efficiency and user experience as much as possible while meeting security requirements.

[0082] Step A02, in the optimal authentication mode, parsing the device information, and calculating the authentication success rate of the target device based on the extracted device identifier and device authentication key;

[0083] It should be noted that the device identifier is the unique identification code of the target device, which is used to distinguish different devices. The device authentication key is used to verify the identity of the target device and is used together with the device identifier for authentication. The authentication success rate refers to the probability that the device successfully passes the authentication given the device identifier and authentication key. After selecting the optimal authentication method, the authentication module will extract the device identifier (ID) and device authentication key (K) from the device information, and use the predefined function f to calculate the authentication success rate (P_auth) of the target device. The authentication success rate is calculated as follows:

[0084] P_auth = f(ID, K)

[0085] Among them, ID is the device identifier, K is the authentication key, and function f is used to evaluate the authentication success rate of the device.

[0086] Step A03: When the authentication success rate is higher than a preset success rate threshold, the authentication is determined to be successful.

[0087] It should be noted that the preset success rate threshold (such as 90%) is a preset value used to determine whether the device authentication success rate is high enough to decide whether to allow the device to access the network. After calculating the device's authentication success rate, the authentication module compares it with the preset success rate threshold. If the device's authentication success rate is higher than this threshold, the authentication module determines that the authentication is successful and allows the device to continue the subsequent access process. Otherwise, the authentication module will determine that the authentication has failed.

[0088] In this implementation, by introducing the optimal access strategy path, the most appropriate authentication method is dynamically selected according to multi-dimensional factors such as the current network environment, device type, and security requirements, thereby improving the flexibility and pertinence of the authentication method, ensuring that different devices can adopt the most suitable authentication method in different situations, thereby improving the intelligence level of access management, and by calculating the authentication success rate, a quantitative evaluation of the device authentication capability is achieved, providing data support for subsequent authentication decisions, and by introducing a preset success rate threshold, a quantitative judgment of the authentication result is achieved, thereby improving the accuracy and flexibility of access management.

[0089] In a feasible implementation, in step S03, the step of real-time monitoring of the target device and calculating the risk score of the target device includes steps A11 to A12:

[0090] Step A11, monitoring the device behavior change amount and the system network status change amount after the target device is connected to the system according to a preset period;

[0091] It should be noted that the preset cycle refers to the monitoring time interval set by the system, which is used to regularly collect and analyze device behavior and network status data. The device behavior change (ΔD) mainly monitors the changes in data traffic and operation frequency after the device is connected to the system. These changes can reflect the usage and behavior patterns of the device. The network status change (ΔN) mainly monitors the network bandwidth occupancy, changes in network delay, increase or decrease in packet loss rate, etc. These changes can reflect the stability of the network environment and the impact of device access on the network.

[0092] In addition, it should be noted that the system uses a real-time monitoring and feedback module to continuously monitor the behavior changes of the target device after it is connected to the system and the changes in the system's network status according to a preset time period (i.e., preset period), covering real-time changes in device behavior data (such as increases or decreases in data traffic, changes in operating frequency, etc.) and current network status (such as bandwidth occupancy, network delay, packet loss rate, etc.).

[0093] Step A12: input the device behavior change and the network status change into a risk assessment function to calculate the risk score of the target device.

[0094] It should be noted that the system uses the risk assessment function to take the device behavior change (ΔD) and network status change (ΔN) calculated in step A11 as input parameters to calculate and obtain the risk score (R_score) of the target device. The formula of the risk assessment function is:

[0095] R_score = g(ΔN, ΔD)

[0096] Among them, ΔN is the change in network status, ΔD is the change in device behavior, and function g is used to evaluate the risk during device access.

[0097] In this implementation, by collecting and analyzing device behavior data and network status data, the changes in device behavior and network status are calculated, thereby achieving dynamic tracking of the device status after access, and improving the intelligence and security of access management. By calling the risk assessment function, the changes in device behavior and network status are used as input to calculate the risk score, thereby achieving accurate quantification of device access risks and providing data support for subsequent access policy adjustments.

[0098] In a feasible implementation, in step S03, the risk information of the target device is fed back to the dynamic access rule engine, and the step of updating the optimal access strategy path includes steps A21-A22:

[0099] Step A21, packaging the device execution status and system resource allocation status after the target device is connected as risk information;

[0100] It should be noted that the system collects the device execution status and system resource allocation status after the target device is connected through the real-time monitoring and feedback module. The device execution status includes the device's operating status, data traffic, operation frequency, etc. The system resource allocation status includes the network bandwidth, computing resources, storage resources, etc. allocated to the device. This information is integrated and packaged into risk information for subsequent risk assessment and strategy adjustment.

[0101] Step A22, feeding back the risk information to the dynamic access rule engine, which is used to analyze the risk information and adjust the optimal access strategy path to meet the access requirements of the target device.

[0102] It should be noted that the risk information collected in step A21 is fed back to the dynamic access rule engine, which parses the information, evaluates the risks brought by device access, and dynamically adjusts the optimal access policy path based on the current network and device status. The adjusted policy path is designed to better meet the access requirements of the target device while ensuring the security and stability of the network.

[0103] In this implementation, by collecting and packaging risk information, the system can have a more comprehensive understanding of the actual situation after device access, and provide data support for subsequent risk assessment and policy adjustments. Through real-time analysis and adjustment of the dynamic access rule engine, the system can flexibly adjust the access strategy according to the actual situation after device access, ensuring the rational allocation of network resources and smooth access of devices.

[0104] Based on the first embodiment and / or the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those of the above-mentioned first and second embodiments can refer to the above introduction, and will not be repeated later. Figure 3 In step S04, after the step of authenticating the target device according to the optimal access policy path based on the updated optimal access policy path, steps S21 to S23 are also included:

[0105] Step S21, recording the execution result of the updated optimal access strategy path, and updating the execution result to the preset strategy library;

[0106] It should be noted that the execution result refers to the actual operation result after the optimal access policy path is adjusted, such as whether it is successfully executed, the device status after execution, etc. The preset policy library is a database that stores multiple access policy paths and corresponding execution results, which is used to guide subsequent policy adjustments and optimizations. When the dynamic access rule engine adjusts the strategy according to real-time feedback and generates a new optimal access policy path, the device access control module will perform corresponding adjustment operations according to this optimal access policy path, such as reallocating network resources or modifying device operation permissions. After the execution is completed, the execution result of this policy adjustment is recorded and updated to the preset policy library. The execution result usually includes whether the policy is successfully executed, the device status after execution, the network status, etc.

[0107] Step S22, when the optimal access strategy path needs to be updated again, record the number of updates of the optimal access strategy path;

[0108] It should be noted that when the system detects that the device access status, network status or device behavior data has changed, resulting in the need to update the optimal access policy path again, the number of times the optimal access policy path is updated is recorded. The number of updates refers to the number of times the optimal access policy path is updated or adjusted during the device access process, reflecting the frequency of policy adjustments during the device access process.

[0109] Step S23: When the number of updates reaches a preset update threshold, the target device is recorded as a problem device and an alarm message is output.

[0110] It should be noted that problem devices refer to devices that frequently need to update the optimal access strategy path during the access process. These devices may have unstable access or abnormal behavior. Alarm information is a warning message sent by the system to the administrator to prompt the administrator to deal with the problem device in time. When the system detects that the number of optimal access strategy path updates of a device reaches the preset update threshold, it will automatically mark the device as a problem device and output an alarm message. The alarm information may include the device ID, problem type, alarm time, etc., so that the administrator can deal with it in time.

[0111] In this implementation, by recording and updating the execution results of the optimal access policy path, rich policy execution data is accumulated to provide a basis for subsequent policy optimization and intelligent decision-making. By recording the number of updates of the optimal access policy path, abnormal behavior in the device access process is discovered in a timely manner, providing a basis for subsequent troubleshooting and problem location. By introducing preset update thresholds and alarm mechanisms, unstable access devices can be discovered and handled in a timely manner, thereby improving the overall stability and security of the network.

[0112] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the device access control method of the present application. More simple transformations based on this technical concept are all within the protection scope of the present application.

[0113] This application also provides a device access control device, please refer to Figure 4 , applied to a device access control system, the device access control device includes:

[0114] The path generation module 10 is used to receive the device access request of the target device and detect the system network status and the user authority information of the operator corresponding to the device access control system, analyze the device access request, the system network status and the user authority information through the dynamic access rule engine, and determine the optimal access strategy path;

[0115] The device access module 20 is used to authenticate the target device according to the optimal access strategy path, and if the authentication is successful, access the target device according to the optimal access strategy path;

[0116] The risk feedback module 30 is used to monitor the target device in real time and calculate the risk score of the target device when the target device is connected. When the risk score exceeds a preset risk threshold, the risk information of the target device is fed back to the dynamic access rule engine to update the optimal access strategy path;

[0117] The policy updating module 40 is used to execute the step of authenticating the target device according to the optimal access policy path based on the updated optimal access policy path.

[0118] Optionally, the dynamic access rule engine includes a rule parser and a dynamic rule generator, and the path generation module 10 is further used for:

[0119] Parse the device access request to obtain the device information of the target device and store the device information;

[0120] Select a rule set that matches the device information and system network status from a preset rule library, and parse the rule set into a policy component through a rule parser;

[0121] Based on the dynamic rule generator, the weights of policy components are calculated by combining device information, system network status and user permission information to generate the optimal access policy path.

[0122] Optionally, the device access module 20 is further configured to:

[0123] Select the best authentication method based on the best access strategy path;

[0124] Under the optimal authentication method, parse the device information and calculate the authentication success rate of the target device based on the extracted device identifier and device authentication key;

[0125] When the authentication success rate is higher than the preset success rate threshold, the authentication is determined to be successful.

[0126] Optionally, the risk feedback module 30 is further used to:

[0127] Monitor the device behavior changes and the system network status changes after the target device is connected to the system according to a preset period;

[0128] The device behavior change and network status change are input into the risk assessment function to calculate the risk score of the target device.

[0129] Optionally, the risk feedback module 30 is further used to:

[0130] Pack the device execution status and system resource allocation status after the target device is connected as risk information;

[0131] The risk information is fed back to the dynamic access rule engine, which is used to parse the risk information and adjust the optimal access strategy path to meet the access requirements of the target device.

[0132] Optionally, the device access control apparatus further includes a problem alarm module 50, and the problem alarm module 50 is further used to:

[0133] Record the execution result of the updated optimal access strategy path, and update the execution result to the preset strategy library;

[0134] When the optimal access strategy path needs to be updated again, the update times of the optimal access strategy path are recorded;

[0135] When the number of updates reaches the preset update threshold, the target device is recorded as a problem device and an alarm message is output.

[0136] The device access control device provided by the present application adopts the device access control method in the above embodiment, which can solve the technical problem of unintelligent device access. Compared with the prior art, the beneficial effects of the device access control device provided by the present application are the same as the beneficial effects of the device access control method provided by the above embodiment, and other technical features in the device access control device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0137] The present application provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the device access control method in the above-mentioned embodiment 1.

[0138] Reference below Figure 5 , which shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present application. The electronic devices in the embodiments of the present application may include but are not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions: tablet computers), PMPs (Portable Media Players: portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0139] like Figure 5As shown, the electronic device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the electronic device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows an electronic device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0140] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0141] The electronic device provided by the present application adopts the device access control method in the above embodiment to solve the technical problem of unintelligent device access. Compared with the prior art, the beneficial effects of the electronic device provided by the present application are the same as the beneficial effects of the device access control method provided by the above embodiment, and other technical features in the electronic device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0142] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0143] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0144] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, the computer-readable program instructions being used to execute the device access control method in the above-mentioned embodiment.

[0145] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM: Random Access Memory), a read-only memory (ROM: Read Only Memory), an erasable programmable read-only memory (EPROM: Erasable Programmable Read Only Memory or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM: CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency: Radio Frequency), etc., or any suitable combination of the above.

[0146] The computer-readable storage medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0147] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the device access control device: receives the device access request of the target device and detects the system network status and the user authority information of the operator corresponding to the device access control system, analyzes the device access request, the system network status and the user authority information, and determines the optimal access policy path; authenticates the target device according to the optimal access policy path, and when the authentication is passed, accesses the target device according to the optimal access policy path; when the target device is accessed, monitors the target device in real time and calculates the risk score of the target device, and when the risk score exceeds the preset risk threshold, updates the optimal access policy path; and executes the step of authenticating the target device according to the optimal access policy path based on the updated optimal access policy path.

[0148] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0149] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0150] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0151] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned device access control method, and can solve the technical problem of unintelligent device access. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the device access control method provided in the above-mentioned embodiment, and will not be repeated here.

[0152] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned device access control method when executed by a processor.

[0153] The computer program product provided by this application can solve the technical problem of unintelligent device access. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the device access control method provided by the above embodiment, which will not be repeated here.

[0154] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A device access control method, characterized in that: Applied to a device access control system, the device access control method comprises: Receive a device access request from a target device and user authority information of an operator corresponding to the device access control system, detect a system network status of the device access control system, analyze the device access request, the system network status and the user authority information through a dynamic access rule engine, and determine an optimal access strategy path; Authenticating the target device according to the optimal access policy path, and accessing the target device according to the optimal access policy path if the authentication passes; When the target device is accessed, the target device is monitored in real time and a risk score of the target device is calculated. When the risk score exceeds a preset risk threshold, the risk information of the target device is fed back to the dynamic access rule engine to update the optimal access strategy path. Performing a step of authenticating the target device according to the optimal access policy path based on the updated optimal access policy path; The dynamic access rule engine includes a rule parser and a dynamic rule generator, and the step of analyzing the device access request, the system network status and the user authority information through the dynamic access rule engine to determine the optimal access strategy path includes: Parsing the device access request to obtain device information of the target device, and storing the device information; Selecting a rule set that matches the device information and the system network status from a preset rule library, and parsing the rule set into a policy component through the rule parser; Based on the dynamic rule generator, the weights of the policy components are calculated in combination with the device information, the system network status and the user authority information to generate an optimal access policy path.

2. The device access control method according to claim 1, characterized in that: The step of authenticating the target device according to the optimal access strategy path comprises: Selecting an optimal authentication method according to the optimal access strategy path; Under the optimal authentication mode, parsing the device information, and calculating the authentication success rate of the target device based on the extracted device identifier and device authentication key; When the authentication success rate is higher than a preset success rate threshold, it is determined that the authentication is successful.

3. The device access control method according to claim 1, characterized in that: The step of monitoring the target device in real time and calculating the risk score of the target device includes: Monitoring the device behavior change and the system network status change after the target device is connected to the system according to a preset period; The device behavior change amount and the network status change amount are input into a risk assessment function to calculate the risk score of the target device.

4. The device access control method according to claim 1, characterized in that: The step of feeding back the risk information of the target device to the dynamic access rule engine to update the optimal access strategy path includes: Packing the device execution status and system resource allocation status after the target device is connected as risk information; The risk information is fed back to the dynamic access rule engine, and the dynamic access rule engine is used to parse the risk information and adjust the optimal access strategy path to meet the access requirements of the target device.

5. The device access control method according to claim 1, characterized in that: After the step of authenticating the target device according to the optimal access policy path based on the updated optimal access policy path, the following step further includes: Recording the execution result of the updated optimal access strategy path, and updating the execution result to the preset strategy library; When the optimal access strategy path needs to be updated again, record the number of updates of the optimal access strategy path; When the number of updates reaches a preset update threshold, the target device is recorded as a problem device and an alarm message is output.

6. A device access control device, characterized in that: Applied to a device access control system, the device access control device comprises: A path generation module is used to receive a device access request of a target device and user authority information of an operator corresponding to the device access control system, detect the system network status of the device access control system, analyze the device access request, the system network status and the user authority information through a dynamic access rule engine, and determine an optimal access strategy path; A device access module, configured to authenticate the target device according to the optimal access strategy path, and if the authentication is successful, access the target device according to the optimal access strategy path; A risk feedback module, configured to monitor the target device in real time and calculate a risk score of the target device when the target device is accessed, and to feed back the risk information of the target device to the dynamic access rule engine to update the optimal access strategy path when the risk score exceeds a preset risk threshold; A policy updating module, configured to execute, based on the updated optimal access policy path, a step of authenticating the target device according to the optimal access policy path; The dynamic access rule engine includes a rule parser and a dynamic rule generator, and the path generation module is also used for: Parsing the device access request to obtain device information of the target device, and storing the device information; Selecting a rule set that matches the device information and the system network status from a preset rule library, and parsing the rule set into a policy component through the rule parser; Based on the dynamic rule generator, the weights of the policy components are calculated in combination with the device information, the system network status and the user authority information to generate an optimal access policy path.

7. An electronic device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the device access control method according to any one of claims 1 to 5.

8. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the device access control method according to any one of claims 1 to 5 are implemented.

9. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the device access control method according to any one of claims 1 to 5 are implemented.

Images