Verification method for network access control and related device

Abstract

The invention discloses a network access control verification method and a related device, and relates to the field of network security, and the method comprises the steps: firstly obtaining a request IP address of a requester of a to-be-verified network access behavior, then obtaining at least one destination IP address which cannot be accessed by the request IP address based on a preset network access security rule, and carrying out the verification of the network access control. Acquiring network access control information of each network device, and determining at least one network access path for accessing the destination IP address from the request IP address in a preset network diagram; and then determining each network device in the network access path, and determining an accessible IP address range of the request IP address based on the network access control information of each network device and each network access path. The whole verification process is automatically completed, whether the network access behavior of the request IP address has a risk can be accurately judged based on whether the destination IP address exists in the accessible IP address range, and the network security is improved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a verification method and related devices for network access control. Background Art

[0002] With the development of the Internet, the importance of network security is increasing.

[0003] Network access control can set the destination IP addresses that can be accessed or not for a certain IP address or a certain IP address segment. Through network access control, network security can be effectively improved. Currently, network access control is generally achieved by setting or modifying configuration information on network devices.

[0004] When configuration information is wrong, it will bring a major threat to network security. How to improve network security is still a technical problem that needs to be solved urgently. Summary of the invention

[0005] In view of the above problems, the present application provides a verification method and related devices for network access control. In order to improve network security, the specific scheme is as follows:

[0006] The first aspect of the present application provides a network access control verification method, characterized by comprising:

[0007] Obtain the requesting IP address of the requester of the network access behavior to be verified;

[0008] Based on a preset network access security rule, obtaining that the requesting IP address is inaccessible to at least one destination IP address;

[0009] In a preset network diagram, determining at least one network access path from the request IP address to the destination IP address, and determining each network device in the network access path;

[0010] Acquire network access control information of each of the network devices, and determine an IP address range accessible to the requesting IP address based on the network access control information of each of the network devices and each of the network access paths, wherein the accessible IP address range includes at least one accessible IP address;

[0011] It is determined whether the destination IP address exists in the accessible IP address range. If so, it is determined that the network access behavior of the requesting IP address is risky.

[0012] In a possible implementation, obtaining, based on a preset network access security rule, that at least one destination IP address is inaccessible to the requesting IP address includes:

[0013] Based on the preset network access security rule, obtaining an actual IP address that is inaccessible to the request IP address, and using the actual IP address as the destination IP address;

[0014] and / or,

[0015] Based on the preset network access security rule, a random IP address that is inaccessible to the request IP address is obtained, and the random IP address is used as the destination IP address.

[0016] In a possible implementation, the obtaining the network access control information of each of the network devices includes:

[0017] Obtaining configuration information of each of the network devices, parsing the configuration information, and obtaining parsing results;

[0018] Based on the analysis result, determining the device type of each of the network devices;

[0019] Determining the manufacturer of each of the network devices according to the device type and the configuration syntax description in each of the configuration information;

[0020] Using a configuration analysis template that matches each of the device types and each of the manufacturers, the network access configuration in each of the configuration information is analyzed to obtain network access control information for each of the network devices.

[0021] In a possible implementation, after analyzing the network access configuration in each of the configuration information using the configuration analysis template matching each of the device types and each of the manufacturers, the routing configuration information of each of the network devices is also obtained;

[0022] The generation process of the preset network diagram includes:

[0023] The preset network diagram is generated according to each of the routing configuration information, the management address information in each of the configuration information, and the network device interconnection address information in each of the configuration information.

[0024] In a possible implementation, determining the IP address range accessible to the requesting IP address based on the network access control information of each of the network devices and each of the network access paths includes:

[0025] For each of the network access paths, determining the IP address range accessible to the requesting IP address on the network access path based on the network access control information of each network device on the network access path;

[0026] Based on the IP address range accessible to the requesting IP address on each of the network access paths, the IP address range accessible to the requesting IP address is determined.

[0027] In a possible implementation, for each of the network access paths, determining the IP address range accessible to the request IP address on the network access path based on the network access control information of each network device on the network access path includes:

[0028] For each of the network access paths, based on the network access control information of each network device on the network access path, determine the IP address range accessible to the request IP address specified by each network device on the network access path;

[0029] An intersection of IP address ranges accessible to the requesting IP address specified by each network device on the network access path is calculated, and the intersection is determined as the IP address range accessible to the requesting IP address on the network access path.

[0030] A second aspect of the present application provides a verification device for network access control, comprising:

[0031] A first obtaining unit, used to obtain a requesting IP address of a requesting party of the network access behavior to be verified;

[0032] A second obtaining unit, configured to obtain, based on a preset network access security rule, that at least one destination IP address is inaccessible to the requesting IP address;

[0033] A first determining unit, configured to determine, in a preset network diagram, at least one network access path for accessing the destination IP address from the request IP address, and to determine each network device in the network access path;

[0034] A second determining unit is used to obtain network access control information of each of the network devices, and determine an IP address range accessible to the request IP address based on the network access control information of each of the network devices and each of the network access paths, wherein the accessible IP address range includes at least one IP address;

[0035] The judging unit is used to judge whether the destination IP address exists in the accessible IP address range, and if so, determine that the network access behavior of the requesting IP address is risky.

[0036] A third aspect of the present application provides a computer program product, comprising computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements the network access control verification method of the first aspect or any implementation of the first aspect.

[0037] A fourth aspect of the present application provides an electronic device, comprising at least one processor and a memory connected to the processor, wherein:

[0038] The memory is used to store computer programs;

[0039] The processor is used to execute the computer program so that the electronic device can implement the network access control verification method of the above-mentioned first aspect or any implementation manner of the first aspect.

[0040] A fifth aspect of the present application provides a computer storage medium, which carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement the network access control verification method of the above-mentioned first aspect or any implementation of the first aspect.

[0041] By means of the above technical scheme, the present application provides a verification method and related device for network access control. The present application first obtains the requesting IP address of the requesting party of the network access behavior to be verified, and then obtains at least one destination IP address that cannot be accessed by the requesting IP address based on the preset network access security rules, and then in the preset network diagram, at least one network access path for accessing the destination IP address from the requesting IP address is determined, and each network device in the network access path is determined; then, the network access control information of each network device is obtained, and based on the network access control information of each network device and each network access path, the IP address range accessible to the requesting IP address is determined, and the accessible IP address range includes at least one accessible IP address, and finally, it is determined whether there is a destination IP address in the accessible IP address range, and if so, it is determined that the network access behavior of the requesting IP address is at risk. The entire verification process of the present application is completed automatically, and it can accurately determine whether there is a risk in the network access behavior of the requesting IP address, which is conducive to improving network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0043] Figure 1 A flowchart of a verification method for network access control provided in an embodiment of the present application;

[0044] Figure 2 A schematic diagram of a preset network diagram provided in an embodiment of the present application;

[0045] Figure 3 A schematic diagram of the structure of a verification device for network access control provided in an embodiment of the present application;

[0046] Figure 4 A schematic diagram of the hardware structure of a network access control verification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] The following describes the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0048] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0049] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0050] In order to improve network security, the present application provides a network access control verification method. The network access control verification method provided by the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0051] Please see attached Figure 1 , Figure 1 A flowchart of a network access control verification method provided in an embodiment of the present application. The method may include the following steps:

[0052] Step S101: Obtain the requesting IP address of the requesting party of the network access behavior to be verified.

[0053] It should be noted that each terminal device (such as a computer, mobile phone, server, etc.) has a unique identifier, namely an IP address. The IP address is used to locate and identify the terminal device on the network.

[0054] In this application, when a terminal device attempts to access network resources (such as web pages, files, databases, etc.), it sends a network request that contains the IP address of the request source device, that is, the requesting IP address of the requester.

[0055] For ease of understanding, an example is given below: the request IP addresses may be 1.1.1.1, 1.1.2.1, and 1.1.3.1.

[0056] Step S102: Based on a preset network access security rule, obtaining at least one destination IP address that is inaccessible to the requesting IP address.

[0057] It should be noted that network access security rules are a series of policies formulated to ensure the security and availability of network resources. These rules define which IP addresses can access which network resources and which network resources cannot be accessed. Network resources that cannot be accessed may be listed as key protection objects due to their sensitivity, importance or the presence of key data. They may include IP addresses that are absolutely prohibited from access or IP addresses that are restricted based on the requester's level / identity. Among them, IP addresses that are absolutely prohibited from access refer to network areas represented by these IP addresses that are not allowed to be accessed by any user or device. These areas may contain highly sensitive data or systems that perform critical tasks. IP addresses that are restricted based on the requester's level / identity refer to IP addresses whose access rights depend on the level or identity of the requester. For example, some advanced network areas may only allow users with specific permissions or identities to access. By implementing these rules, security threats such as unauthorized access, data leakage and network attacks can be effectively prevented. The destination IP address refers to the IP address of the network resource that the requesting IP address wants to access.

[0058] For ease of understanding, an example is given below: Network access security rules can be that 1.1.1.1 and 1.1.2.1 are not allowed to access network area A (2.2.2.0 / 24) and network area B (2.2.3.0 / 24); 1.1.3.1 is not allowed to access network area A. Other IP addresses in the three network segments 1.1.1.0 / 24, 1.1.2.0 / 24, and 1.1.3.0 / 24 are allowed to access network area A and network area B.

[0059] The preset network access security rules usually include the following aspects: Access Control List (ACL): defines which IP addresses can access which destination IP addresses. Through ACL, network traffic can be finely controlled to ensure that only legitimate requests can pass. For example, if the requesting IP address is not in the ACL's allowed list, the requesting IP address will be rejected.

[0060] Firewall rules: Firewalls are the first line of defense for network security. By setting firewall rules, you can block or allow specific network traffic to pass through. For example, you can configure the firewall to deny access requests from specific request IP addresses, or only allow specific types of traffic (such as HTTP, HTTPS) to pass through.

[0061] Routing policy: Routing policy determines the transmission path of network traffic. By configuring routing policy, you can ensure that network traffic is transmitted along the predetermined path, thereby avoiding unnecessary delays and security risks. These resources can be servers, databases, file sharing devices, etc. If the routing policy is not configured properly, or there is a routing obstacle between the network where the destination IP address is located and the network where the request IP address is located (such as network failure, configuration error, etc.), then the request will not be able to reach the destination IP address.

[0062] There may also be other security policies (such as intrusion detection system (IDS), intrusion prevention system (IPS), etc.) to monitor and filter requests. If the request is determined to be malicious or suspicious by these security policies, it will be blocked or discarded.

[0063] In the present application, as an implementable method, based on a preset network access security rule, an actual IP address that is inaccessible to the requesting IP address is obtained, and the actual IP address is used as the destination IP address.

[0064] This method is to identify the specific IP address that the requesting IP address (such as a device or computer) should not access based on the set security rules, that is, the actual IP address. Then, this actual IP address will be used as the destination IP address for detection or testing to verify whether the requesting IP actually complies with the security rules and does not attempt to access the prohibited destination IP address.

[0065] As another possible implementation method, based on a preset network access security rule, a random IP address that is inaccessible to the requesting IP address is obtained, and the random IP address is used as the destination IP address.

[0066] This method does not select a specific, known inaccessible IP address, but randomly selects one or more IP addresses from the prohibited network area as the target IP address for detection. It can more comprehensively detect whether the requesting IP address complies with a wider range of network access restrictions, rather than just for a specific destination IP address. Among them, the random IP address can be in use or unallocated. By randomly selecting the destination IP, security vulnerabilities caused by only detecting fixed IPs can be avoided. Because some network devices may only prohibit access to specific IPs, while other IPs in the entire network area can still be accessed, this may lead to security risks.

[0067] For ease of understanding, the following example is given: 2.2.2.2 is an actual host in network area A, 2.2.3.2 is an actual host in network area B, and an IP address 2.2.2.56 is randomly selected in network area A, and an IP address 2.2.3.111 is randomly selected in network area B. The above four IP addresses will be used as the destination IP addresses in network access security detection, also known as target IP addresses.

[0068] Step S103: In a preset network diagram, determine at least one network access path from the request IP address to the destination IP address, and determine each network device in the network access path.

[0069] In the present application, the configuration information of each network device can be first obtained, and the configuration information can be parsed to obtain the parsing result. Then, based on the parsing result, the device type of each network device can be determined. Then, according to the device type and the configuration syntax description in each configuration information, the manufacturer of each network device can be determined. Then, using the configuration analysis template matching each device type and each manufacturer, the network access configuration in each configuration information is analyzed to obtain the routing configuration information of each network device. Finally, according to each routing configuration information, the management address information in each configuration information, and the network device interconnection address information in each configuration information, the preset network diagram is generated.

[0070] Specifically, the current configuration information of a network device can be obtained through its command line interface (CLI) or network management protocol (such as SNMP, NETCONF, RESTCONF, etc.). The obtained configuration information is often in text format, so regular expressions, XML / JSON parsers or device-specific parsing libraries can be used to identify the structure of the configuration information (such as key-value pairs, nested structures, command blocks, etc.) and extract key information to obtain parsing results. The parsing results can include the name of the file and the name of the network device. The file name and the network device name are matched with known identifiers. These identifiers can be abbreviations based on industry standards (such as AR, AS, FW, etc.), and then the device type of the network device is determined (such as AR for routers, AS for switches, FW for firewalls, etc.).

[0071] Devices from different manufacturers may have differences in configuration syntax, which may be reflected in command naming, parameter format, configuration file organization structure, etc. Therefore, after determining the device type, you can further determine the specific manufacturer of the device based on the configuration syntax description. This usually involves the following steps: Devices from different manufacturers may use different commands when viewing the current configuration. For example, Maipu routers use the "show running-config" command, while Huawei routers use the "display current-configuration" command. By matching these specific commands, you can narrow down the possible manufacturers. In addition to the commands themselves, the overall structure of the configuration file also provides information about the manufacturer. For example, the configuration files of some manufacturers may contain specific header information, comment styles, or configuration block separators. After initially determining the manufacturer, you can further confirm it by verifying other features, including checking whether the configuration file contains commands or parameters unique to a specific manufacturer, analyzing the encoding format and character set of the configuration file, etc.

[0072] For different device types and manufacturers, corresponding configuration analysis templates need to be prepared in advance. These configuration analysis templates are based on the configuration syntax and file structure specific to the device type and manufacturer. For example, for Huawei routers, the configuration analysis template needs to clearly know which configuration file (such as acl.cfg) the network access control (such as ACLs, Access Control Lists) is usually located in, and what the keywords in these configuration statements (such as permit, deny, ip, tcp, udp, etc.) mean.

[0073] Next, extract key configuration information related to network security access control, routing configuration, and IP address planning and use from the configuration files of network devices. This usually involves identifying and extracting specific configuration blocks or statements. For example: Network security access control: such as all configurations between ip access-list extended 1001 and the nearest exit, or all configuration statements starting with policy access in the firewall configuration. Routing configuration: such as the ip route-static statement or the output of display ip routing-table; IP address planning: such as VLAN-related configuration, including VLAN ID, IP address range, etc.

[0074] The extracted key configuration information can be matched to the corresponding configuration analysis template. This usually involves parsing the configuration statements and converting them into a standardized format according to the rules defined in the template. For example, for network access control configuration, permit ip 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 can be converted into a network access control detail entry, where the source IP address: 192.168.1.0 / 24 (represented by mask 255.255.255.0); destination IP address: 10.0.0.0 / 24 (also represented by mask); access relationship: access is allowed (indicated by the permit keyword); access port information: all ports (because no specific port is specified, the default is all); whether it is effective: judged according to the context of the configuration file and the operating status of the device; network device where the policy is located: extract the device ID or name of the configuration. Through this process, the key information originally scattered in the configuration file can be integrated into standardized data with a clear structure, easy to understand and analyze. These data can provide strong support for subsequent network management, optimization, troubleshooting and other tasks.

[0075] The preset network diagram is a graphical representation of network devices. It shows the connection relationships and access paths between network devices, providing network administrators with an intuitive network view. These relationships can be based on physical connections (such as optical fibers, network cables, etc.) or logical connections (such as VPNs, tunnels, etc.). A network diagram can represent a local area network (such as a company's internal network) or the public Internet (such as a global network connection). Based on the routing configuration information, management address information, and device interconnection address information of the network device, the access and interconnection relationships between network devices can be clarified. Graphical tools (such as Visio, Lucidchart, etc.) or network management software can be used to draw the connection relationships and access paths between network devices to generate a network diagram. For details, please refer to Figure 2 , Figure 2 A schematic diagram of a preset network diagram provided for an embodiment of the present application.

[0076] Routing configuration information refers to the routing table, routing protocols (such as OSPF, BGP, etc.), and routing policies configured on network devices (such as routers). Routing configuration information determines the transmission path of data packets in the network. When a data packet arrives at a network device, the device will decide which device or interface to send the data packet to next based on its routing configuration information. When generating a network diagram, routing configuration information is an important basis for determining the connection relationship between network devices.

[0077] Management address information refers to the address information used for network device management and maintenance, such as the device's IP address, host name, physical address, etc. Management address information enables network administrators to remotely access and manage network devices, for example, by logging into the device through SSH, Telnet, or a web interface. Management address information can be used to mark the identity and location of each device in a network diagram, making it easier for administrators to identify and manage.

[0078] Network device interconnection address information refers to the address configuration used for interconnection between network devices, such as interface IP address, subnet mask, VLAN configuration, VRRP (Virtual Router Redundancy Protocol) configuration, etc. Network device interconnection address information ensures that communication between devices can proceed normally. For example, when two routers are connected through a link, they need to configure the same subnet or VLAN on the link to ensure that data packets can be transmitted correctly. Network device interconnection address information can be used to draw connection lines and interface information between devices in a network diagram, thereby more intuitively displaying the network structure.

[0079] The network graph consists of nodes (representing network devices) and edges (representing connections or communication paths). The requesting IP address is the starting node, and the destination IP address is the target node. You can use graph traversal algorithms such as depth-first search (DFS) or breadth-first search (BFS) to traverse the network access path from the requesting IP address to the destination IP address in the network graph and determine the network devices in the network access path. For ease of understanding, the following example is given: Figure 2 In the example, the network access path from the request IP address 1.1.1.1 to the destination IP address 2.2.2.2 in network area A is: request IP address 1.1.1.1->switch 1->firewall 1->switch 4->firewall 2->switch 5->destination IP address 2.2.2.2. The network devices in the network access path are: switch 1, firewall 1, switch 4, firewall 2, switch 5 and firewall 2.

[0080] Step S104: Obtain the network access control information of each of the network devices, and determine the IP address range accessible to the request IP address based on the network access control information of each of the network devices and each of the network access paths, wherein the accessible IP address range includes at least one accessible IP address.

[0081] In the present application, after analyzing the network access configuration in the configuration information using a configuration analysis template that matches the device type and manufacturer, the network access control information of each network device can be obtained. First, for each network access path, based on the network access control information of each network device on the network access path, the IP address range accessible to the requesting IP address on the network access path can be determined. Then, based on the IP address range accessible to the requesting IP address on each network access path, the IP address range accessible to the requesting IP address can be determined.

[0082] If an IP address has both a policy that allows access and a policy that denies access, the execution priority needs to be determined based on the order in which it appears in the configuration information. Usually, the later policy will override the earlier policy, unless the priority rule is explicitly specified in the configuration. The parsed configuration information can be converted into network access control details one by one to obtain the network access control information of the network device, which contains detailed information about how network traffic is controlled and managed by the network device.

[0083] Among them, for each network access path, based on the network access control information of each network device on the network access path, the IP address range accessible to the request IP address specified by each network device on the network access path can be determined. The intersection of the IP address ranges accessible to the request IP address specified by each network device on the network access path is calculated, and the intersection is determined as the IP address range accessible to the request IP address on the network access path. It is also possible to determine in sequence whether the request IP address specified by each network device can access the destination IP address according to the order of the network access control information of the network devices on the network access path, and then directly find the destination IP address accessible to the request IP address on the network access path.

[0084] For ease of understanding, the following examples are given: Figure 2 The permissions of the requesting IP addresses 1.1.1.1, 1.1.2.1, and 1.1.3.1 are checked.

[0085] Check the permission of 1.1.1.1 to access 2.2.2.2: 1.1.1.1 first connects to switch 1. The access control information of switch 1 is checked in sequence. It is found that the policy "1.1.1.1 2.2.2.0 / 24 deny" exists, and the access is denied. At the same time, 1.1.1.1 has no other network access path, so 1.1.1.1 cannot access 2.2.2.2.

[0086] Check the permission of 1.1.1.1 to access 2.2.2.56: 1.1.1.1 first connects to switch 1. The access control information of switch 1 is checked in sequence. It is found that the policy "1.1.1.1 2.2.2.0 / 24 deny" exists, and the access is denied. At the same time, 1.1.1.1 has no other network access path, so 1.1.1.1 cannot access 2.2.2.56.

[0087] Check the permission of 1.1.1.1 to access 2.2.3.2: 1.1.1.1 first connects to switch 1. The access control information of switch 1 is checked in sequence. It is found that the policy "1.1.1.1 2.2.3.0 / 24 deny" exists, and the access is denied. At the same time, 1.1.1.1 has no other network access path, so 1.1.1.1 cannot access 2.2.3.2.

[0088] Check the permission of 1.1.1.1 to access 2.2.3.111: 1.1.1.1 first connects to switch 1. The access control information of switch 1 is checked in sequence. It is found that the policy "1.1.1.1 2.2.3.0 / 24 deny" exists, and the access is denied. At the same time, 1.1.1.1 has no other network access path, so 1.1.1.1 cannot access 2.2.3.111.

[0089] Check the permission of 1.1.2.1 to access 2.2.2.2: 1.1.2.1 first connects to Switch 2 and checks the access control information of Switch 2 in sequence. No deny policy is found, and the access is allowed on Switch 2. Then it enters the next network node, Firewall 1. The access control information of Firewall 1 is checked in sequence and a deny policy "1.1.2.1 2.2.2.0 / 24deny" is found. Access is denied. At the same time, 1.1.2.1 has no other network access path, so 1.1.2.1 cannot access 2.2.2.2.

[0090] Check 1.1.2.1's permission to access 2.2.2.56: 1.1.2.1 first connects to Switch 2 and checks the access control information of Switch 2 in sequence. No deny policy is found, so the access is allowed on Switch 2 and enters the next network node, Firewall 1. Check the access configuration of Firewall 1 in sequence and find that there is a deny policy "1.1.2.1 2.2.2.0 / 24deny". Access is denied. At the same time, 1.1.2.1 has no other accessible path, so 1.1.2.1 cannot access 2.2.2.56.

[0091] Check the permission of 1.1.2.1 to access 2.2.3.2: 1.1.2.1 first connects to switch 2, and checks the access control information of switch 2 in sequence. No rejection policy is found, and the access is allowed on switch 2. Enter the next network node firewall 1, and check the access control information of firewall 1 in sequence. It is found that there is a release policy "1.1.2.0 / 24 2.2.3.0 / 24 permit", and the access is allowed. Enter the next network node switch 4, and check the access control information of switch 4 in sequence. The configuration is to release all. Next, there are two network devices that can be accessed, firewall 2 and firewall 3. First, we look at the access branch of firewall 2. We find no release policy from 1.1.2.1 to 2.2.3.2, so access is denied. Then, we look at the access branch of firewall 3. We find that there is a release policy "1.1.0.0 / 16 2.2.3.0 / 24 permit", so access is allowed. We then go to the next network node, switch 6, which is configured to allow all traffic. Therefore, 1.1.2.1 can finally access 2.2.3.2.

[0092] Check the permission of 1.1.2.1 to access 2.2.3.111: 1.1.2.1 first connects to switch 2, and checks the access control information of switch 2 in sequence. No rejection policy is found, and the access is allowed on switch 2. Enter the next network node, firewall 1, and check the access control information of firewall 1 in sequence. It is found that there is a release policy "1.1.2.0 / 242.2.3.0 / 24 permit", and the access is allowed. Enter the next network node, switch 4, and check the access control information of switch 4 in sequence. The configuration is to release all. Next, there are two network devices that can be accessed, firewall 2 and firewall 3. First, we look at the access branch of firewall 2. We find no release policy from 1.1.2.1 to 2.2.3.2, so access is denied. Then, we look at the access branch of firewall 3. We find that there is a release policy "1.1.0.0 / 16 2.2.3.0 / 24 permit", so access is allowed. We then go to the next network node, switch 6, which is configured to allow all traffic. Therefore, 1.1.2.1 can finally access 2.2.3.111.

[0093] Check the permission of 1.1.3.1 to access 2.2.2.2: 1.1.3.1 first connects to switch 3, checks the access control information of switch 3 in sequence, and finds no deny policy. The access is allowed on switch 3, and enters the next network node, firewall 1. Check the access control information of firewall 1 in sequence, and find that there is a release policy "1.1.3.0 / 24 2.2.2.0 / 24 permit", and the access is allowed. Enter the next network node, switch 4, and check the access control information of switch 4 in sequence. The configuration is to allow all. Next, there are two network devices that can be accessed, firewall 2 and firewall 3. First look at the access branch of firewall 2, and find that there is a deny policy "1.1.3.1 2.2.2.2 deny", and the access is denied. Then look at the access branch of firewall 3, and find no release policy from 1.1.3.1 to 2.2.2.2, and the access is denied. Therefore, 1.1.3.1 cannot access 2.2.2.2.

[0094] Check the permission of 1.1.3.1 to access 2.2.2.56: 1.1.3.1 first connects to switch 3, checks the access control information of switch 3 in sequence, and finds no deny policy. The access is allowed on switch 3, and enters the next network node, firewall 1. The access control information of firewall 1 is checked in sequence, and it is found that there is a release policy "1.1.3.0 / 24 2.2.2.0 / 24 permit", and the access is allowed. Enter the next network node, switch 4, and check the access control information of switch 4 in sequence. The configuration is to allow all. Next, there are two network devices that can be accessed, firewall 2 and firewall 3. First look at the access branch of firewall 2, and find that there is a release policy "1.1.0.0 / 16 2.2.2.0 / 24 permit", and the access is allowed. Enter the next network node, switch 5, which is configured to allow all. Therefore, 1.1.3.1 can finally access 2.2.2.56.

[0095] Step S105: Determine whether the destination IP address exists in the accessible IP address range. If so, determine that the network access behavior of the requested IP address is risky.

[0096] In this application, it can be determined whether the destination IP address exists in the accessible IP address range. If the destination IP address is found in the accessible IP address range, then it is determined that the network access behavior of the requested IP address is risky, indicating that the network access behavior of the requesting party violates the network security policy or has not obtained proper authorization.

[0097] For ease of understanding, an example is given below: The network access security rule can be that 1.1.1.1 and 1.1.2.1 are not allowed to access network area A (2.2.2.0 / 24) and network area B (2.2.3.0 / 24); 1.1.3.1 is not allowed to access network area A.

[0098] The destination IP addresses 2.2.2.2, 2.2.2.56, 2.2.3.2, and 2.2.3.111 do not exist in the IP address range accessible to 1.1.1.1. The detection of these four destination IP addresses is passed, so it can be determined that the network access behavior of 1.1.1.1 is normal.

[0099] The IP address range accessible to 1.1.2.1 includes the destination IP addresses 2.2.3.2 and 2.2.3.111. These two destination IP addresses have not passed the detection. Therefore, it can be determined that the network access behavior of 1.1.2.1 is risky.

[0100] The destination IP address 2.2.2.56 exists in the accessible IP address range of 1.1.3.1, and this destination IP address fails the detection. Therefore, it can be determined that the network access behavior of 1.1.3.1 is risky.

[0101] In summary, an embodiment of the present application provides a verification method for network access control. The present application first obtains the requesting IP address of the requesting party of the network access behavior to be verified, and then obtains at least one destination IP address that is inaccessible to the requesting IP address based on the preset network access security rules, and then obtains the network access control information of each network device, and determines at least one network access path from the requesting IP address to the destination IP address in the preset network diagram; then determines each network device in the network access path, and based on the network access control information of each network device and each network access path, determines the IP address range accessible to the requesting IP address, the accessible IP address range includes at least one accessible IP address, and finally determines whether there is a destination IP address in the accessible IP address range. If so, it is determined that the network access behavior of the requesting IP address is at risk. The entire verification process of the present application is completed automatically, and it can accurately determine whether there is a risk in the network access behavior of the requesting IP address, which is conducive to improving network security.

[0102] A network access control verification method provided in an embodiment of the present application is introduced above, and a device for executing the above-mentioned network access control verification method will be introduced below.

[0103] See also Figure 3 , Figure 3 A schematic diagram of the structure of a verification device for network access control provided in an embodiment of the present application. Figure 3As shown, the verification device for network access control includes:

[0104] The first obtaining unit 11 is used to obtain the request IP address of the requester of the network access behavior to be verified.

[0105] The second obtaining unit 12 is used to obtain, based on a preset network access security rule, at least one destination IP address that is inaccessible to the request IP address.

[0106] The first determining unit 13 is used to determine at least one network access path from the request IP address to the destination IP address in a preset network diagram, and to determine each network device in the network access path.

[0107] The second determination unit 14 is used to obtain the network access control information of each of the network devices, and based on the network access control information of each of the network devices and each of the network access paths, determine the IP address range accessible to the request IP address, wherein the accessible IP address range includes at least one accessible IP address.

[0108] The judging unit 15 is used to judge whether the destination IP address exists in the accessible IP address range, and if so, determine that the network access behavior of the requesting IP address has risks.

[0109] In a possible implementation, the second obtaining unit 12 includes:

[0110] The first obtaining subunit is used to obtain the actual IP address that is inaccessible to the request IP address based on the preset network access security rule, and use the actual IP address as the destination IP address.

[0111] and / or,

[0112] The second obtaining subunit is used to obtain a random IP address that is inaccessible to the request IP address based on the preset network access security rule, and use the random IP address as the destination IP address.

[0113] In a possible implementation, the acquiring of the network access control information of each of the network devices by the second determining unit 14 includes:

[0114] The first acquisition subunit is used to acquire the configuration information of each of the network devices, parse the configuration information, and obtain a parsing result.

[0115] The first determining subunit is used to determine the device type of each of the network devices based on the parsing result.

[0116] The second determining subunit is used to determine the manufacturer of each of the network devices according to the device type and the configuration syntax description in each of the configuration information.

[0117] The second acquisition subunit is used to analyze the network access configuration in each of the configuration information using a configuration analysis template that matches each of the device types and each of the manufacturers, and acquire the network access control information of each of the network devices.

[0118] In a possible implementation, after analyzing the network access configuration in each of the configuration information using a configuration analysis template that matches each of the device types and each of the manufacturers, the routing configuration information of each of the network devices is also obtained.

[0119] The device also includes:

[0120] The first generating unit is used to generate the preset network diagram according to each of the routing configuration information, the management address information in each of the configuration information, and the network device interconnection address information in each of the configuration information.

[0121] In a possible implementation, the second determining unit 14 determines the IP address range accessible to the request IP address based on the network access control information of each of the network devices and each of the network access paths, including:

[0122] The third determining subunit is used to determine, for each of the network access paths, a range of IP addresses accessible to the requesting IP address on the network access path based on network access control information of each network device on the network access path.

[0123] The fourth determining subunit is used to determine the IP address range accessible to the requesting IP address based on the IP address range accessible to the requesting IP address on each of the network access paths.

[0124] In a possible implementation, the third determining subunit includes:

[0125] The fifth generating subunit is used to determine, for each of the network access paths, based on the network access control information of each network device on the network access path, the IP address range accessible to the request IP address specified by each network device on the network access path.

[0126] The sixth determining subunit is used to calculate the intersection of the IP address ranges accessible to the requesting IP address specified by each network device on the network access path, and determine the intersection as the IP address range accessible to the requesting IP address on the network access path.

[0127] The present application also provides an electronic device in an embodiment. Figure 4 As shown, it shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiment of the present application. The electronic device in the embodiment of the present application may include but is not limited to fixed terminals such as mobile phones, laptops, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, etc. Figure 4 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0128] like Figure 4 As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage device 408 to a random access memory (RAM) 403. When the electronic device is powered on, various programs and data required for the operation of the electronic device are also stored in the RAM 403. The processing device 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0129] Typically, the following devices may be connected to the I / O interface 405: an input device 406 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 407 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 408 including, for example, a memory card, a hard disk, etc.; and a communication device 409. The communication device 409 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although Figure 4 An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0130] An embodiment of the present application also provides a computer program product including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements any network access control verification method provided in the embodiment of the present application.

[0131] A computer-readable storage medium is also provided in an embodiment of the present application. The storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any network access control verification method provided in the embodiment of the present application.

[0132] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0133] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0134] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0135] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

Claims

1. A verification method for network access control, characterized in that: include: Obtain the requesting IP address of the requester of the network access behavior to be verified; Based on a preset network access security rule, obtaining that the requesting IP address is inaccessible to at least one destination IP address; In a preset network diagram, determining at least one network access path from the request IP address to the destination IP address, and determining each network device in the network access path; Acquire network access control information of each of the network devices, and determine an IP address range accessible to the requesting IP address based on the network access control information of each of the network devices and each of the network access paths, wherein the accessible IP address range includes at least one accessible IP address; It is determined whether the destination IP address exists in the accessible IP address range. If so, it is determined that the network access behavior of the requesting IP address is risky.

2. The verification method for network access control according to claim 1, characterized in that: The obtaining, based on a preset network access security rule, that the requesting IP address is inaccessible to at least one destination IP address comprises: Based on the preset network access security rule, obtaining an actual IP address that is inaccessible to the request IP address, and using the actual IP address as the destination IP address; and / or, Based on the preset network access security rule, a random IP address that is inaccessible to the request IP address is obtained, and the random IP address is used as the destination IP address.

3. The verification method for network access control according to claim 1, characterized in that: The obtaining of network access control information of each of the network devices includes: Obtaining configuration information of each of the network devices, parsing the configuration information, and obtaining parsing results; Based on the analysis result, determining the device type of each of the network devices; Determining the manufacturer of each of the network devices according to the device type and the configuration syntax description in each of the configuration information; Using a configuration analysis template that matches each of the device types and each of the manufacturers, the network access configuration in each of the configuration information is analyzed to obtain network access control information for each of the network devices.

4. The verification method for network access control according to claim 3, characterized in that: After analyzing the network access configuration in each of the configuration information using the configuration analysis template matching each of the device types and each of the manufacturers, further acquiring the routing configuration information of each of the network devices; The generation process of the preset network diagram includes: The preset network diagram is generated according to each of the routing configuration information, the management address information in each of the configuration information, and the network device interconnection address information in each of the configuration information.

5. The verification method for network access control according to claim 1, characterized in that: The determining, based on the network access control information of each of the network devices and each of the network access paths, a range of IP addresses accessible to the requesting IP address comprises: For each of the network access paths, determining the IP address range accessible to the requesting IP address on the network access path based on the network access control information of each network device on the network access path; Based on the IP address range accessible to the requesting IP address on each of the network access paths, the IP address range accessible to the requesting IP address is determined.

6. The verification method for network access control according to claim 5, characterized in that: The determining, for each of the network access paths, based on network access control information of each network device on the network access path, a range of IP addresses accessible to the requesting IP address on the network access path includes: For each of the network access paths, based on the network access control information of each network device on the network access path, determine the IP address range accessible to the request IP address specified by each network device on the network access path; An intersection of IP address ranges accessible to the requesting IP address specified by each network device on the network access path is calculated, and the intersection is determined as the IP address range accessible to the requesting IP address on the network access path.

7. A verification device for network access control, characterized in that: include: A first obtaining unit, used to obtain a requesting IP address of a requesting party of the network access behavior to be verified; A second obtaining unit, configured to obtain, based on a preset network access security rule, that at least one destination IP address is inaccessible to the requesting IP address; A first determining unit, configured to determine, in a preset network diagram, at least one network access path for accessing the destination IP address from the request IP address, and to determine each network device in the network access path; A second determining unit is used to obtain network access control information of each of the network devices, and determine an IP address range accessible to the request IP address based on the network access control information of each of the network devices and each of the network access paths, wherein the accessible IP address range includes at least one IP address; The judging unit is used to judge whether the destination IP address exists in the accessible IP address range, and if so, determine that the network access behavior of the requesting IP address is risky.

8. A computer program product, characterized in that It comprises computer-readable instructions, and when the computer-readable instructions are executed on an electronic device, the electronic device implements the verification method for network access control as claimed in any one of claims 1 to 6.

9. An electronic device, characterized in that: The method comprises at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the electronic device can implement the network access control verification method as described in any one of claims 1 to 6.

10. A computer storage medium, characterized in that: The storage medium carries one or more computer programs, and when the one or more computer programs are executed by an electronic device, the electronic device can implement the network access control verification method as described in any one of claims 1 to 6.

Images