Network authority control method and device based on IPv6 technology, equipment and medium

Abstract

The invention provides a network authority control method and device based on an IPv6 technology, equipment and a medium, and the method comprises the steps: obtaining an IPv6 address of a user in response to an access request of the user for an authority network; identifying identity information of the user based on the IPv6 address; distributing corresponding role information to the user based on the identity information, and obtaining permission information of the user according to the role information; and performing dynamic verification on the identity information and the role information of the user through a pre-trained zero-trust model, and performing permission control on the user passing the verification according to the permission information.

Description

Technical Field

[0001] The present disclosure relates to the field of network security, and in particular to a network authority control method, device, equipment and storage medium based on IPv6 technology. Background Art

[0002] Traditional IP-based network permission control methods are implemented by assigning a unique IP address to each device in the network. These IP addresses are used as the device's identity on the network and are used to formulate access control lists (ACLs). Network administrators use ACLs to set policies that clearly indicate which IP addresses can access specific network resources and which cannot. Although the IP-based permission control method has the advantages of simple implementation and easy deployment, it also has some key limitations. First, as the network scale grows, managing a large number of IP addresses and ACLs becomes complex and prone to errors. Second, this method is insufficient in supporting user mobility because when the user device changes its network location, its IP address may change, making the original permission control invalid. In addition, the limited number of IPv4 addresses leads to the problem of address exhaustion, which limits the scalability of IP-based permission control methods. In terms of security, static IP addresses are vulnerable to spoofing attacks and cannot be permanently bound to specific users or devices. At the same time, IP-based methods lack the ability to perform fine-grained access control based on attributes such as user role, time and location. Summary of the invention

[0003] 1. Technical issues to be resolved

[0004] In view of the above problems, the present disclosure provides a network permission control method, apparatus, device and storage medium based on IPv6 technology to at least partially solve the technical problems such as insufficient continuity, flexibility and security of network access under traditional network architecture.

[0005] (II) Technical solution

[0006] The present disclosure provides a network permission control method based on IPv6 technology, comprising: in response to a user's access request to a permissioned network, obtaining the user's IPv6 address; based on the IPv6 address, identifying the user's identity information; based on the identity information, assigning corresponding role information to the user, and obtaining the user's permission information according to the role information; dynamically verifying the user's identity information and role information through a pre-trained zero-trust model, and performing permission control on the user who has passed the verification according to the permission information.

[0007] According to an embodiment of the present disclosure, assigning corresponding role information to the user based on the identity information includes: judging whether the user is a real user based on the identity information of the user; when the user is a real user, verifying the user's terminal through endpoint identification technology; when the user is a real user and the terminal passes the verification, assigning the role information to the user.

[0008] According to an embodiment of the present disclosure, in response to a user's access request to a permissioned network, obtaining the user's IPv6 address includes: receiving a character string to be verified in response to the user's request to access the permissioned network; inputting the character string to be verified into a preset verification mechanism, and parsing the verification character string using the verification mechanism according to a format specification of an IPv6 address; when the parsing result conforms to the format specification of an IPv6 address, obtaining the user's IPv6 address.

[0009] According to an embodiment of the present disclosure, the method also includes: generating a permission configuration set based on the user's identity information, role information and permission information, and storing the permission configuration set in a preset database; when it is detected that at least one of the user's identity information, role information and permission information has changed, updating the permission configuration set in the database.

[0010] According to an embodiment of the present disclosure, the identity information and role information of the user are dynamically verified through a pre-trained zero trust model, and permission control is performed on the verified user based on the permission information, including: obtaining context information of the access request based on the identity information and role information of the user; performing a risk assessment on the context information using the zero trust model to obtain the risk level of the request; judging whether the user has passed the verification based on the risk level; and when the user has passed the verification, performing permission control based on the permission information.

[0011] According to an embodiment of the present disclosure, the method further includes: when the risk level is greater than a preset threshold, dynamically adjusting the permission information of the user; and performing permission control on the access request of the user based on the adjusted permission information.

[0012] According to an embodiment of the present disclosure, the method also includes: when the user accesses the permissioned network, monitoring the user's behavior and access environment through the zero trust model; in response to monitoring abnormal behavior of the user or changes in the access environment, triggering a fault warning mechanism and taking corresponding security response measures.

[0013] The second aspect of the present disclosure provides a network permission control device based on IPv6 technology, including: an acquisition module, used to obtain the IPv6 address of the user in response to the user's access request to the permission network; an identification module, used to identify the identity information of the user based on the IPv6 address; an association module, used to assign corresponding role information to the user based on the identity information, and obtain the permission information of the user according to the role information; a control module, used to dynamically verify the identity information and role information of the user through a pre-trained zero trust model, and perform permission control on the user who has passed the verification according to the permission information.

[0014] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a storage device for storing one or more computer programs, when the one or more programs are executed by the one or more processors, the one or more processors execute the network authority control method based on IPv6 technology.

[0015] The fourth aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, enables the processor to execute the network authority control method based on IPv6 technology.

[0016] (III) Beneficial effects

[0017] The network permission control method, apparatus, device and storage medium based on IPv6 technology provided by the present invention can achieve more fine-grained permission control by defining different role information and permission information of users and combining the address allocation and network management capabilities of IPv6. Combined with the zero trust model, permissions and network configurations can be automatically adjusted according to environmental changes, thereby achieving the effectiveness, continuity and security of permission control. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] For a more complete understanding of the present disclosure and its advantages, reference will now be made to the following description taken in conjunction with the accompanying drawings, in which:

[0019] Figure 1 The flowchart of the network authority control method based on IPv6 technology provided by the embodiment of the present disclosure is schematically shown;

[0020] Figure 2 The following schematically shows an architecture diagram of a network authority control method based on IPv6 technology provided by an embodiment of the present disclosure;

[0021] Figure 3 The structure block diagram of the network authority control device based on IPv6 technology provided according to the embodiment of the present disclosure is schematically shown;

[0022] Figure 4The hardware structure diagram of an electronic device is schematically shown. DETAILED DESCRIPTION

[0023] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0024] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0025] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0026] Some block diagrams and / or flow charts are shown in the accompanying drawings. It should be understood that some blocks or combinations thereof in the block diagrams and / or flow charts may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that these instructions, when executed by the processor, may create a device for implementing the functions / operations described in these block diagrams and / or flow charts.

[0027] Therefore, the technology of the present disclosure can be implemented in the form of hardware and / or software (including firmware, microcode, etc.). In addition, the technology of the present disclosure can take the form of a computer program product on a computer-readable medium storing instructions, which can be used by an instruction execution system or in combination with an instruction execution system. In the context of the present disclosure, a computer-readable medium can be any medium that can contain, store, transmit, propagate, or transmit instructions. For example, a computer-readable medium can include, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, device, or propagation medium. Specific examples of computer-readable media include: magnetic storage devices, such as magnetic tape or hard disk (HDD); optical storage devices, such as compact disk (CD-ROM); memory, such as random access memory (RAM) or flash memory; and / or wired / wireless communication links.

[0028] The embodiments of the present disclosure provide a network authority control method, apparatus, device and storage medium based on IPv6 technology.

[0029] like Figure 1 As shown, the flowchart of the network authority control method based on IPv6 technology includes S1~S4.

[0030] In operation S1, in response to a user's access request to a privileged network, an IPv6 address of the user is obtained.

[0031] In operation S2, identity information of the user is identified based on the IPv6 address.

[0032] In operation S3, corresponding role information is assigned to the user based on the identity information, and permission information of the user is obtained according to the role information.

[0033] In operation S4, the identity information and role information of the user are dynamically verified through a pre-trained zero-trust model, and permission control is performed on the user who has passed the verification based on the permission information.

[0034] It should be noted that IPv6 (Internet Protocol Version 6) is the next generation Internet protocol developed to solve the problem of IPv4 address exhaustion. It provides an extremely large address space by adopting 128-bit addresses. In theory, an address can be assigned to every grain of sand in the world. IPv6 addresses are usually represented by 8 groups of 4-digit hexadecimal numbers. The simplified header format improves the efficiency of data packet processing, and built-in support for IPsec enhances the security of data transmission. In addition, IPv6 also supports stateless address autoconfiguration, allowing devices to automatically configure IP addresses. It also enhances support for multicast and anycast, allowing one-to-many or many-to-one communication modes, and reduces the size of routing tables through better routing aggregation, thereby improving routing efficiency. With the gradual exhaustion of IPv4 addresses, the deployment and application of IPv6 are accelerating, providing a solid foundation for building a more efficient, safer and smarter Internet. The zero-trust model is an advanced network security paradigm that abandons traditional network boundary-based security protection and adopts the core principle of "never trust, always verify". Under this model, no matter where the user is, the system will perform strict identity authentication and permission authorization on each access request to ensure that only legitimate and trusted traffic can access resources.

[0035] Figure 2 The following schematically shows an architecture diagram of a network authority control method based on IPv6 technology provided by an embodiment of the present disclosure.

[0036] like Figure 2As shown in the figure, different network areas are connected by routers to finely control the data packets entering and leaving the network. The switch is responsible for forwarding and exchanging data in the network, allowing user terminals to communicate data efficiently and restricting unauthorized access and data leakage. In the network permission control based on IPv6, the server / database needs to support the IPv6 protocol and configure corresponding security policies to protect the confidentiality, integrity and availability of data. For example, according to the user's identity and permissions, fine-grained control is performed on the access to the database to ensure that only legitimate users can access sensitive data. As the end-user device in the network, the user terminal communicates with the server / database through the IPv6 address.

[0037] Specifically, when a user attempts to access resources or services in the permission network, the system will first capture the user's access request. Although the IPv6 address itself does not directly contain the user's identity information, the IPv6 address can be associated with the user's identity. For example, using an identity proxy service, the service can maintain a mapping table to associate the IPv6 address (or address segment) with the user's authentication information (such as user name, certificate, etc.). Alternatively, the IPv6 address is combined with the user's login session or authentication token, that is, the user first needs to pass identity authentication (such as user name and password, multi-factor authentication, etc.), and then the system will generate a unique authentication token for this session and bind the token to the user's IPv6 address (or the IP address of the session). Then, the system can confirm the user's identity by verifying the authentication token. After obtaining the user's identity information, the corresponding role is assigned according to the user's identity information (such as the department and position to which the user belongs). Each role is given the permission to access specific resources or perform specific operations. By querying the mapping relationship between roles and permissions, the corresponding permission information is obtained. Finally, the zero-trust model is used to dynamically verify the user's identity information and role information. If the verification is successful, the system will execute the corresponding permission control policy based on the user's permission information, such as allowing access to specific resources, performing specific operations, etc. If the verification fails, the system will deny the access request and record relevant logs for subsequent analysis.

[0038] It is understandable that the use of IPv6 technology's almost unlimited address space and built-in security features not only solves the limitations of traditional static IP addresses, but also enhances the security of data transmission. At the same time, role-based access control can dynamically adjust access rights based on the user's identity and attributes, making network permission control dynamic, secure and efficient. In addition, combining the zero trust model with role-based access control can significantly improve the sophistication and adaptability of enterprise security protection, and continuous authentication and context-aware permission adjustment can help maintain a high level of security and compliance in the rapidly changing IPv6 network environment.

[0039] Furthermore, assigning corresponding role information to the user based on the identity information includes: judging whether the user is a real user based on the user's identity information; when the user is a real user, verifying the user's terminal through endpoint identification technology; when the user is a real user and the terminal passes the verification, assigning the role information to the user.

[0040] Specifically, since the user's IPv6 address can change dynamically, it is necessary to authenticate the user and enable an endpoint identification technology, such as a digital certificate or device fingerprint software, which is forcibly installed and run on the user's terminal to identify and track the user.

[0041] Exemplarily, when a user attempts to access a permissioned network (such as an enterprise intranet), he or she first needs to go through a standard identity authentication process, such as entering a username and password. Then, in order to cope with the dynamic changes in IPv6 addresses, a long-term authentication token based on user identity is introduced, which is bound to the user identity rather than a specific IP address. After successfully verifying that the user is a real user, confirm whether the permissioned network terminal has installed and enabled the necessary endpoint identification software, and send the generated device identifier to the access control engine for verification through the endpoint identification software. The access control engine compares the device identifier with the pre-registered device list to confirm the legitimacy and credibility of the terminal. Finally, after confirming that the user is a real user and his or her terminal has passed the verification, the system assigns the corresponding role to the user based on the user's identity information.

[0042] It is understandable that through a strict identity authentication process to determine whether the user is a real user, impersonation and illegal access can be effectively prevented. At the same time, the user's terminal is verified through endpoint identification technology to ensure that the access request comes from a trusted device, thereby further enhancing the security of permission control.

[0043] Furthermore, in response to the user's access request to the permissioned network, obtaining the user's IPv6 address includes: receiving a character string to be verified in response to the user's request to access the permissioned network; inputting the character string to be verified into a preset verification mechanism, and parsing the verification character string using the verification mechanism according to the format specification of the IPv6 address; when the parsing result conforms to the format specification of the IPv6 address, obtaining the user's IPv6 address.

[0044] Specifically, when a user attempts to access a network, the system receives an access request. As part of the request, the system receives a string to be verified, which is expected to contain the user's IPv6 address information. The received string to be verified is then input into a preset verification mechanism, which parses the string to check whether it contains a valid IPv6 address format. If the string conforms to the format specification of the IPv6 address, the verification is successful. Once the verification is successful, it is considered that the string does represent a valid IPv6 address and is used as the user's IPv6 address for subsequent processing.

[0045] Exemplarily, the Python language and its built-in or third-party libraries are used to implement verification. Specifically, the ipaddress module in Python is used to verify whether the incoming string conforms to the format specification of the IPv6 address. Among them, the ipaddress module is part of the Python standard library and can efficiently and accurately process IPv4 and IPv6 addresses. After the IPv6 address information is successfully collected, it is stored in MongoDB. In addition, before storing the data, the data is pre-processed, such as formatting, deduplication, or associating with other user information.

[0046] It should be noted that in an actual production environment, in order to ensure the security of the system, it is recommended to use a certificate issued by a trusted certificate authority to encrypt the transmitted data. At the same time, depending on the web framework and web server used, further configuration may be required to ensure that they can work together securely and efficiently.

[0047] It should be noted that Python is open source software and has a wealth of libraries and frameworks that can simplify the development of role-based access control (RBAC), such as using SQLAlchemy for database operations, or using frameworks such as Flask and Django to quickly build web applications. At the same time, Python is cross-platform, which means that the written RBAC module can run on a variety of operating systems without modification. In addition, Python's automated testing tools, such as unittest and pytest, can easily perform unit testing and integration testing on RBAC modules. Python's automatic memory management and garbage collection mechanisms reduce the risk of memory leaks. Finally, the deployment of Python applications is relatively simple and can be deployed in a variety of ways, such as using a WSGI server or containerized deployment.

[0048] It is understood that by verifying the user's IPv6 address, the system can confirm the source of the access request, help identify potential malicious access or unauthorized access attempts, and thus enhance the security of the system. In addition, compared with regular expressions or other manual verification methods, using a preset verification mechanism to parse and verify IPv6 addresses can ensure the accuracy and efficiency of parsing.

[0049] In an embodiment of the present disclosure, the method also includes: generating a permission configuration set based on the user's identity information, role information and permission information, and storing the permission configuration set in a preset database; when it is detected that at least one of the user's identity information, role information and permission information has changed, updating the permission configuration set in the database.

[0050] Specifically, based on the user's identity information, assigned roles, and the permission information corresponding to these roles, a permission configuration set can be generated, which lists in detail all the operations that the user can perform in the current context. At the same time, the permission configuration set is stored in a preset database, such as a preset set of a MongoDB database. In addition, when the system detects that at least one of the user's identity information, role, or permission information has changed (such as a role change due to a user's promotion, or a permission adjustment due to a system security policy update), the permission configuration set update process will be automatically triggered, including re-evaluating the user's role and permissions, generating a new permission configuration set based on the latest information, and using the pymongo library to store the updated set back into the MongoDB database to replace the old configuration set.

[0051] It is understandable that the automatic generation and update mechanism of permission configuration sets helps reduce human errors and omissions. When the user's identity information, role or permissions change, the system automatically updates the permission configuration, thereby ensuring that the system's permission settings are always consistent with the actual situation, improving the maintainability and stability of the system.

[0052] Furthermore, the user's identity information and role information are dynamically verified through the pre-trained zero trust model, and permission control is performed on the verified user based on the permission information, including: obtaining context information of the access request based on the user's identity information and role information; using the zero trust model, performing a risk assessment on the context information to obtain the risk level of the request; based on the risk level, determining whether the user has passed the verification; when the user has passed the verification, performing permission control based on the permission information.

[0053] In some exemplary embodiments, a zero-trust RBAC model is constructed using a programming language (such as Python). In this process, first, Python's logging module is used to record key operations, such as user login, permission verification, data access, etc., to ensure that all events are traceable. Then, real-time log monitoring is implemented through threading or asyncio to quickly identify abnormal behavior. At the same time, combined with complex regular expressions or machine learning techniques, Python can accurately detect potential security threats from massive logs. In addition, the Flask framework is used to create web services, and basic authentication and role-based permission control are defined. Permission control uses a custom / authenticate decorator to protect routes that require authentication, and a custom / authorize decorator to check whether the user's role has the permission to perform specific operations. Among them, the / login interface is used for user login, and the user ID and role will be stored in the session after successful login. The / write_data interface is protected by @authenticate and @authorize('admin') decorators, and only authenticated administrators can write data. The / read_data interface is protected by the @authenticate decorator, and any authenticated user can read data.

[0054] Furthermore, after the zero-trust model is built and trained, the context information of the request (such as time, IP address, request type, etc.) is obtained based on the user's identity information and role information. The zero-trust model is then used to perform risk assessment on the context information. This process can be based on machine learning algorithms such as decision trees, random forests, or deep learning models to predict the risk level of the request. Based on the risk assessment results, it is determined whether the user has passed the verification. If passed, permission control is performed based on the user's permission information to allow or deny access.

[0055] Understandably, combining the zero-trust model with role-based access control can significantly improve the sophistication and adaptability of security protection. RBAC manages user permissions through roles, while the zero-trust model adds considerations for user behavior, access environment, and resource sensitivity to achieve more fine-grained access control. This combination not only strengthens the defense against internal and external threats, but also improves the monitoring and response speed of access behavior, making security policies more flexible and dynamic. In addition, the zero-trust RBAC model supports continuous authentication and context-aware permission adjustments, which helps maintain a high level of security and compliance in a rapidly changing IPv6 network environment.

[0056] In an embodiment of the present disclosure, the method further includes: when the risk level is greater than a preset threshold, dynamically adjusting the permission information of the user; and performing permission control on the access request of the user based on the adjusted permission information.

[0057] Specifically, after using the zero trust model to perform contextual analysis and risk assessment on the user's access request, a quantified risk level value will be obtained. Then, this risk level value is compared with the preset risk threshold (used to determine whether the access request is a high-risk behavior). If the risk level is greater than the threshold, the system will adjust the user's permission information. The adjustment policy can be pre-defined, such as lowering the user's permission level, temporarily disabling certain permissions, or limiting access time. When the permission adjustment decision is determined, the system will automatically update the user's permission information. For example, modify the permission record stored in the database or memory to ensure that subsequent access requests can be subject to permission control based on the latest permission information. After the permission information is updated, the system will perform permission control based on the new permissions for the user's subsequent access requests.

[0058] It is understandable that dynamically adjusting permissions in high-risk situations can effectively prevent malicious users or insiders from abusing permissions and protect the security of system resources and sensitive data. At the same time, more fine-grained access control can be achieved, and different security measures can be taken for different risk levels and user behaviors.

[0059] In an embodiment of the present disclosure, the method also includes: when the user accesses the permissioned network, monitoring the user's behavior and access environment through the zero trust model; in response to monitoring abnormal behavior of the user or changes in the access environment, triggering a fault warning mechanism and taking corresponding security response measures.

[0060] Specifically, when a user accesses the network, the zero-trust model comprehensively monitors the user's behavior (such as session activity, data access mode, etc.) and access environment (such as device information, network connection, geographic location, etc.). When abnormal user behavior (such as abnormal login mode, frequent access to sensitive resources, etc.) or adverse changes in the access environment (such as the use of untrusted devices or network connections) are monitored, the system can automatically identify and mark these abnormal situations. Once an abnormality is detected, the fault warning mechanism is immediately triggered to alert the security team, including key information such as abnormal details, timestamps, and user identities. After receiving the warning, the automated script immediately executes the preset security response measures, such as dynamically adjusting user permissions through the integrated RBAC system and using encryption tools such as cryptography libraries to strengthen data protection. In addition, libraries such as matplotlib can be used to visualize security events to help the team intuitively understand risk patterns. At the same time, Python's Web frameworks such as Flask or Django can quickly build management interfaces, allowing security teams to monitor and respond to security events in real time to ensure the continued effectiveness of the zero-trust model.

[0061] It is understandable that continuous monitoring of user behavior and access environment, and triggering warnings and taking corresponding measures when risks are detected, can instantly identify potential security risks and effectively block potential security threats, thereby preventing the further spread of security incidents and improving the system's security protection capabilities and compliance.

[0062] Based on the above-mentioned network authority control method based on IPv6 technology, the present disclosure also provides a network authority control device based on IPv6 technology. Figure 3 The device is described in detail.

[0063] like Figure 3 As shown, the network authority control device 300 based on IPv6 technology of this embodiment includes an acquisition module 301 , an identification module 302 , an association module 303 and a control module 304 .

[0064] The acquisition module 301 is used to obtain the IPv6 address of the user in response to a user's access request to the permissioned network.

[0065] The identification module 302 is used to identify the identity information of the user based on the IPv6 address.

[0066] The association module 303 is used to assign corresponding role information to the user based on the identity information, and obtain the authority information of the user according to the role information.

[0067] The control module 304 is used to dynamically verify the identity information and role information of the user through a pre-trained zero-trust model, and to perform permission control on the user who has passed the verification according to the permission information.

[0068] It is understandable that the acquisition module 301, the identification module 302, the association module 303 and the control module 304 can be combined in one module, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present invention, at least one of the acquisition module 301, the identification module 302, the association module 303 and the control module 304 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented in hardware or firmware in any other reasonable way of integrating or packaging the circuit, or in a proper combination of software, hardware and firmware. Alternatively, at least one of the acquisition module 301, the identification module 302, the association module 303 and the control module 304 can be at least partially implemented as a computer program module, and when the program is run by a computer, the function of the corresponding module can be executed.

[0069] Figure 4 The structural block diagram of an electronic device provided by an embodiment of the present disclosure is schematically shown.

[0070] like Figure 4 As shown, the electronic device described in this embodiment includes: the electronic device 400 includes a processor 410 and a computer readable storage medium 420. The electronic device 400 can execute the above reference Figure 1 Describes the method to achieve detection of specific operations.

[0071] Specifically, the processor 410 may include, for example, a general-purpose microprocessor, an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 410 may also include an onboard memory for cache purposes. The processor 410 may be a processor for executing reference Figure 1 The described method flow according to the embodiment of the present disclosure may be a single processing unit or multiple processing units for different actions.

[0072] Computer readable storage medium 420, for example, can be any medium capable of containing, storing, conveying, propagating or transmitting instructions. For example, readable storage media can include, but are not limited to, electrical, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices, devices or propagation media. Specific examples of readable storage media include: magnetic storage devices, such as magnetic tapes or hard disks (HDDs); optical storage devices, such as compact disks (CD-ROMs); memory, such as random access memory (RAM) or flash memory; and / or wired / wireless communication links.

[0073] The computer readable storage medium 420 may include a computer program 421, which may include code / computer executable instructions, which when executed by the processor 410 causes the processor 410 to perform, for example, the above-mentioned combination of Figure 1 The described method sequences and any variations thereof.

[0074] Computer program 421 may be configured to have, for example, computer program code including computer program modules. For example, in an exemplary embodiment, the code in computer program 421 may include one or more program modules, for example, 421A, module 421B, ... It should be noted that the division method and number of modules are not fixed, and those skilled in the art may use appropriate program modules or program module combinations according to actual conditions. When these program module combinations are executed by processor 410, processor 410 may execute, for example, the above combination of Figure 1~Figure 2 The described method sequences and any variations thereof.

[0075] According to an embodiment of the present invention, at least one of the acquisition module 301, the identification module 302, the association module 303 and the control module 304 can be implemented as a reference. Figure 4 The computer program modules described above, when executed by the processor 410, can implement the corresponding operations described above.

[0076] The present disclosure also provides a computer-readable medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0077] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0078] Although the present disclosure has been shown and described with reference to specific exemplary embodiments of the present disclosure, it should be understood by those skilled in the art that various changes in form and details may be made to the present disclosure without departing from the spirit and scope of the present disclosure as defined by the appended claims and their equivalents. Therefore, the scope of the present disclosure should not be limited to the above-mentioned embodiments, but should be determined not only by the appended claims, but also by the equivalents of the appended claims.

Claims

1. A network authority control method based on IPv6 technology, characterized in that: The method comprises: In response to a user's request to access a permissioned network, obtaining an IPv6 address of the user; Based on the IPv6 address, identifying the identity information of the user; Based on the identity information, corresponding role information is assigned to the user, and permission information of the user is obtained according to the role information; The user's identity information and role information are dynamically verified through a pre-trained zero-trust model, and permission control is performed on the user who has passed the verification based on the permission information.

2. The network authority control method based on IPv6 technology according to claim 1, characterized in that: The allocating corresponding role information to the user based on the identity information includes: Based on the identity information of the user, determining whether the user is a real user; When the user is a real user, verifying the user's terminal through endpoint identification technology; When the user is a real user and the terminal passes the verification, the role information is assigned to the user.

3. The network authority control method based on IPv6 technology according to claim 1 is characterized in that: The obtaining, in response to the user's access request to the permissioned network, the IPv6 address of the user comprises: In response to a request from the user to access the permissioned network, receiving a character string to be verified; Input the string to be verified into a preset verification mechanism, and parse the verification string using the verification mechanism according to the format specification of the IPv6 address; When the parsing result complies with the format specification of the IPv6 address, the IPv6 address of the user is obtained.

4. The network authority control method based on IPv6 technology according to claim 1, characterized in that: The method further comprises: Generate a permission configuration set based on the user's identity information, role information and permission information, and store the permission configuration set in a preset database; When it is detected that at least one of the identity information, role information and permission information of the user changes, the permission configuration set in the database is updated.

5. The network authority control method based on IPv6 technology according to claim 1, characterized in that: The dynamically verifying the identity information and role information of the user through the pre-trained zero trust model, and performing permission control on the user who has passed the verification according to the permission information includes: Based on the identity information and role information of the user, obtaining context information of the access request; Using the zero trust model, performing a risk assessment on the context information to obtain a risk level of the request; Based on the risk level, determining whether the user has passed the verification; When the user authentication is passed, authority control is performed according to the authority information.

6. The network authority control method based on IPv6 technology according to claim 5 is characterized in that: The method further comprises: When the risk level is greater than a preset threshold, dynamically adjusting the user's authority information; Based on the adjusted permission information, permission control is performed on the access request of the user.

7. The network authority control method based on IPv6 technology according to claim 1, characterized in that: The method further comprises: When the user accesses the permissioned network, monitoring the user's behavior and access environment through the zero trust model; In response to monitoring abnormal behavior of the user or changes in the access environment, a fault warning mechanism is triggered and corresponding security response measures are taken.

8. A network authority control device based on IPv6 technology, characterized in that: The device comprises: An acquisition module, configured to acquire an IPv6 address of a user in response to a user's access request to a permissioned network; An identification module, used to identify the identity information of the user based on the IPv6 address; An association module, used to assign corresponding role information to the user based on the identity information, and obtain the user's authority information according to the role information; The control module is used to dynamically verify the identity information and role information of the user through a pre-trained zero-trust model, and to perform permission control on the user who has passed the verification based on the permission information.

9. An electronic device, comprising: one or more processors; a storage device for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images