Equipment access permission identification method, electronic equipment and storage medium

Abstract

The invention discloses a device access permission identification method, an electronic device and a storage medium, and relates to the technical field of Internet. The method is applied to a tested device and comprises the following steps: receiving a first data packet sent by a proxy device; a source IP address in the first data packet is a first IP address, a destination IP address is a second IP address, the first IP address is an IP address of a test server, and the second IP address is an IP address of a tested device; modifying the first data packet to obtain a second data packet; wherein the source IP address in the second data packet is the second IP address, and the destination IP address in the second data packet is the first IP address; the second data packet is sent to the test server; wherein the second data packet is used for the test server to determine the extranet access authority of the tested equipment, so that the efficiency of identifying the extranet access authority of the equipment is improved.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a method for identifying device access rights, an electronic device, and a storage medium. Background Art

[0002] With the development of the Internet, more and more networked devices will be connected to the network, and counting which networked devices have external network access rights or controllable network access rights is a key requirement.

[0003] In the existing related technologies, generally after the device is logged in, the ping command is executed to detect whether the device has the ability to access the external network. Specifically, after a specific external network IP address is entered through the command line on the device, the device will send an Internet Control Message Protocol (ICMP) request packet and wait for a response packet from the external network. If the device receives a response, it is determined that the device has the external network access right, otherwise, it is determined that the device does not have the external network access right.

[0004] However, in the above method, each detection requires logging in to each device and executing commands, which is cumbersome and time-consuming when dealing with a large number of devices. Summary of the invention

[0005] The present application provides a method for identifying device access rights, an electronic device, and a storage medium, so as to improve the efficiency of identifying device external network access rights.

[0006] In a first aspect, a method for identifying device access rights is provided, which is applied to a device under test, and the method includes:

[0007] Receive a first data packet sent by a proxy device; wherein the source IP address in the first data packet is a first IP address, the destination IP address is a second IP address, the first IP address is an IP address of a test server, and the second IP address is an IP address of the device under test;

[0008] Modify the first data packet to obtain a second data packet; wherein the source IP address in the second data packet is the second IP address, and the destination IP address is the first IP address;

[0009] The second data packet is sent to the test server; wherein the second data packet is used by the test server to determine the external network access rights of the device under test.

[0010] In the embodiment of the present application, since the source address in the first data packet sent by the proxy device is modified to the IP address of the test server, and the destination address is modified to the IP address of the device under test, the device under test will swap the source address and the destination address in the first data packet to obtain a second data packet, and automatically send the second data packet to the test server for external network access permission confirmation. Compared with the prior art, there is no need to log in to each device under test and execute the ping command each time a detection is performed. During the process of sending data packets, each test device only needs to modify the source address and the destination address in the sent data packet to realize the confirmation and statistics of the device's external network access permission, thereby improving the efficiency of identifying the device's external network access permission.

[0011] In some embodiments, both the first data packet and the second data packet are sent using ICMP or TCP.

[0012] In some embodiments, the first data packet and the second data packet both have the second IP address added to their tails.

[0013] In some embodiments, the proxy device is a device with intranet permissions, which is used to record the IP addresses of all tested devices in the intranet.

[0014] In a second aspect, a method for identifying device access rights is provided, which is applied to a test server, and the method includes:

[0015] Receive a second data packet sent by the device under test; wherein the second data packet is generated by the device under test modifying the first data packet sent by the proxy device, the source IP address in the first data packet is the first IP address, the destination IP address is the second IP address, the first IP address is the IP address of the test server, and the second IP address is the IP address of the device under test; the source IP address in the second data packet is the second IP address, and the destination IP address is the first IP address;

[0016] The external network access permission of the device under test is determined according to the second data packet.

[0017] In some embodiments, both the first data packet and the second data packet are sent using ICMP or TCP.

[0018] In some embodiments, the second IP address is added to the tail of both the first data packet and the second data packet; and determining the external network access rights of the device under test according to the second data packet includes:

[0019] The tail of the second data packet is identified, and if the second IP address is identified as the actual IP address of the device under test, it is determined that the device under test has external network access rights.

[0020] In some embodiments, the proxy device is a device with intranet permissions, which is used to record the IP addresses of all tested devices in the intranet.

[0021] In a third aspect, a device under test is provided, including:

[0022] A receiving module, configured to receive a first data packet sent by a proxy device; the source IP address in the first data packet is the first IP address of the test server, and the destination IP address is the second IP address of the device under test;

[0023] A modification module, used to modify the first data packet to obtain a second data packet; wherein the source IP address in the second data packet is the second IP address, and the destination IP address is the first IP address;

[0024] A sending module is used to send the second data packet to the test server; wherein the second data packet is used by the test server to determine the external network access rights of the device under test.

[0025] In a fourth aspect, a test server is provided, comprising:

[0026] a receiving module, configured to receive a second data packet sent by the device under test; wherein the second data packet is generated by the device under test modifying the first data packet sent by the proxy device, the source IP address in the first data packet is the first IP address of the test server, and the destination IP address is the second IP address of the device under test; the source IP address in the second data packet is the second IP address, and the destination IP address is the first IP address;

[0027] A determination module is used to determine the external network access permission of the device under test according to the second data packet.

[0028] In a fifth aspect, an electronic device is provided, including:

[0029] A memory for storing a computer program; a processor for implementing any one of the methods in the first aspect or any one of the methods in the second aspect when executing the computer program stored in the memory.

[0030] In a sixth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in any one of the first aspect is implemented, or the method described in any one of the second aspect is implemented.

[0031] For each of the above-mentioned aspects from the second to the sixth aspects and the technical effects that may be achieved by each of the aspects, please refer to the above-mentioned description of the technical effects that can be achieved by the first aspect or various possible schemes in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A schematic diagram of an application scenario applicable to the embodiments of the present application;

[0033] Figure 2 A flowchart of a method for identifying device access rights applied to a device under test provided in an embodiment of the present application;

[0034] Figure 3 A flowchart of a method for identifying device access rights applied to a test server provided in an embodiment of the present application;

[0035] Figure 4 A schematic diagram of signaling interaction for device access permission identification provided in an embodiment of the present application;

[0036] Figure 5 A schematic diagram of the structure of a device under test provided in an embodiment of the present application;

[0037] Figure 6 A schematic diagram of the structure of a test server provided in an embodiment of the present application;

[0038] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0040] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0041] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0042] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are first explained below.

[0043] Internet Control Message Protocol (ICMP) is a protocol used to transmit control information and error reports between the host server and the router.

[0044] The Transmission Control Protocol (TCP) is a connection-oriented, reliable transmission protocol specially designed based on end-to-end byte stream.

[0045] The following is a brief introduction to the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In specific implementation, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0046] Figure 1The following is a schematic diagram of an application scenario applicable to the embodiment of the present application. As shown in the figure, the application scenario mainly includes: an agent device 100, a device under test 101, and a test server 102. Among them, the agent device 100 and the device under test 101 are devices in the internal network, and the test server 102 is a device in the external network. The internal network and the external network can be isolated by a firewall. The agent device 100, the device under test 101, and the server under test can communicate with each other. The above devices will be introduced one by one below. It should be noted that the number of devices under test can be more. Figure 1 Only one device under test is described.

[0047] The proxy device 100 may be a device with intranet permissions, used to record the IP address of the device under test 101 in the intranet, and may also record information such as the port number of the device under test, which can ensure the accuracy of the test and the integrity of the data during the subsequent test of the device under test 101, while avoiding unnecessary interference or security risks to the network. For example, the proxy device 100 may be used to send customized data packets, which may contain specific source IP addresses, destination IP addresses, port numbers, and any additional information that may be desired (such as the IP address of the device under test 101).

[0048] The device under test 101 is a device that requests to access the external network. It can receive data packets from the proxy device 100 and modify the address content of the source address and the address content of the destination address in the data packet so that the modified data packet can be successfully sent to the test server 102.

[0049] The test server 102 is a device used to test and identify whether the device under test 101 has the external network access right. For example, the test server 102 can receive a data packet sent from the device under test 101, and then identify the data packet to determine whether the data packet contains the actual IP address of the device under test 101. If so, it is identified that the device under test 101 has the external network access right, otherwise it is identified that the device under test 101 does not have the external network access right.

[0050] In other scenarios, when there is no proxy device, traffic injection can be used to insert or modify the source IP address and destination IP address of the sent data packets.

[0051] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps as shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiment of the present application. The method may be executed or executed in parallel in the actual processing process or when the device is executed in accordance with the method sequence shown in the embodiment or drawings.

[0052] Figure 2 A flow chart of a method for identifying device access rights provided in an embodiment of the present application. The process can be performed by the device under test (such as Figure 1 The device under test 101 shown in FIG. 1 is executed to improve the efficiency of identifying device access rights. Figure 2 As shown, the process includes the following steps:

[0053] 201: Receive a first data packet sent by a proxy device, in which the source address of the first data packet is a first IP address and the destination address is a second IP address. In this step, the proxy device may be Figure 1 The proxy device 100 and the test server shown may refer to Figure 1 The test server 102 is shown, the first IP address is the IP address of the test server, and the second IP address is the IP address of the device under test.

[0054] In some embodiments, before the device under test receives the first data packet sent by the proxy device, the proxy device may set the source IP address to the first IP address of the test server and the destination address to the second IP address of the device under test in the created first data packet. At the same time, in order to facilitate the subsequent test server to more quickly identify the IP address of the device under test, the second IP address may be added to the end of the data packet (which can be added in the form of a string), and then the first data packet is sent to the device under test.

[0055] In some embodiments, the proxy device may use ICMP or TCP to send the first data packet, so that the proxy device can ensure the reliability and integrity of data transmission; further, since the process does not require corresponding packet return operations, the proxy device can use a multi-threaded manner to send the first data packet as long as it does not exceed the network bandwidth, thereby improving the efficiency of subsequent device access permission identification.

[0056] 202: Modify the first data packet to obtain a second data packet, in which the source IP address is the second IP address and the destination IP address is the first IP address.

[0057] In this step, the device under test can specifically modify the first IP address in the source address part of the first data packet to the second IP address, and modify the second IP address in the destination address part to the first IP address, without making any modification to the second IP address added at the end, thereby forming a second data packet with the second IP address as the source IP address, the first IP address as the destination IP address, and the second IP address added at the end, so that the second data packet can be successfully and accurately sent to the test server based on the first IP address.

[0058] 203: Send a second data packet to the test server, where the second data packet is used by the test server to determine the external network access permission of the device under test.

[0059] In some embodiments, since the above-mentioned first data packet is sent using ICMP or TCP, the device under test will automatically send the second data packet to the test server based on ICMP or TCP. After receiving the second data packet, the test server can identify the second data packet, and specifically only identify (or parse) the tail of the second data packet; if the second IP address carried by the tail is identified as the actual IP address of the device under test, it indicates that the device under test has external network access rights. Furthermore, the second IP address can be added to a statistical list for recording devices with external network access rights, so as to facilitate subsequent comparison and review based on this; if it is identified that the second IP address carried by the tail does not match the actual IP address of the device under test, it indicates that the device under test does not have external network access rights, and a corresponding prompt message can be generated to prompt the user to take corresponding measures.

[0060] It should be noted that other devices under test can also use the above Figure 2 The method shown is for requesting and confirming device access rights, and the embodiments of the present application will not be described again here.

[0061] In the embodiment of the present application, since the source address in the first data packet sent by the proxy device is modified to the IP address of the test server, and the destination address is modified to the IP address of the device under test, the device under test will swap the source address and the destination address in the first data packet to obtain a second data packet, and automatically send the second data packet to the test server for external network access permission confirmation. Compared with the prior art, there is no need to log in to each device under test and execute the ping command each time a detection is performed. During the process of sending data packets, each test device only needs to modify the source address and the destination address in the sent data packet to realize the confirmation and statistics of the device's external network access permission, thereby improving the efficiency of identifying the device's external network access permission.

[0062] Figure 3A flowchart of another device access permission method provided in an embodiment of the present application, which can be performed by a test server (such as Figure 1 The test server 102 shown in FIG. 1 is executed to improve the efficiency of identifying device access rights. Figure 3 As shown, the process includes the following steps:

[0063] 301: Receive a second data packet sent by the device under test.

[0064] In this step, the second data packet is generated by modifying the first data packet sent by the proxy device by the tested device. The source IP address in the first data packet is the first IP address of the test server, and the destination IP address is the second IP address of the tested device. The source IP address in the second data packet is the second IP address, and the destination IP address is the first IP address.

[0065] In some embodiments, the first data packet and the second data packet are both sent using ICMP or TCP.

[0066] Furthermore, the second IP address is added to the tail of the first data packet and the second data packet, so that the server under test can determine the external network access rights of the device under test only by identifying the tail, thereby reducing the resource occupation of data processing.

[0067] 302: Determine the external network access permission of the device under test according to the second data packet.

[0068] This step may specifically be: identifying the tail of the second data packet; if the second IP address is identified as the actual IP address of the device under test, it is determined that the device under test has external network access rights; further, the second IP address may be added to a statistical list for recording devices with external network access rights, so as to facilitate subsequent comparison and review based on this; if it is identified that the second IP address carried by the tail does not match the actual IP address of the device under test, it indicates that the device under test does not have external network access rights, and a corresponding prompt message may be generated to prompt the user to take corresponding measures.

[0069] In the embodiment of the present application, since the source address in the first data packet sent by the proxy device is modified to the first IP address of the test server, and the destination address is modified to the second IP address of the device under test, the device under test will swap the source address and the destination address in the first data packet to obtain a second data packet, and automatically send the second data packet to the test server for confirmation of the external network access permission. Compared with the prior art, there is no need to log in to each device under test and execute the ping command each time a detection is performed. During the process of sending data packets, each test device only needs to modify the source address and the destination address in the sent data packet to realize the confirmation and statistics of the device's external network access permission, thereby improving the efficiency of identifying the device's external network access permission.

[0070] Based on the above Figure 2 and Figure 3 The method shown, Figure 4 A schematic diagram of signaling interaction for device access rights provided in an embodiment of the present application. Figure 4 As shown, the following steps are included:

[0071] 401: The proxy device sends a first data packet whose source address is the first IP address and whose destination address is the second IP address to the device under test.

[0072] In this step, when ICMP is used to send data packets, the proxy device (such as Figure 1 The proxy device 100 shown in the figure can create an ICMP data packet, modify the source IP address to the IP address of the test server (corresponding to the first IP address in the previous text), set the destination address to the IP address of the device under test (corresponding to the second IP address in the previous text), and add the second IP address (which can exist in the form of a string) to the end of the ICMP data packet.

[0073] In this step, when sending data packets using TCP, the proxy device can create a TCP data packet, set the source IP address to the IP address of the test server (corresponding to the first IP address in the previous text), set the destination address to the IP address of the device under test (corresponding to the second IP address in the previous text), and add the second IP address (which can exist in the form of a string) to the end of the TCP data packet.

[0074] 402: After receiving the first data packet, the device under test modifies the source address in the first data packet to the second IP address and the destination address to the first IP address, thereby obtaining a second data packet.

[0075] In this step, when ICMP is used to send data packets, due to the provisions of ICMP, the device under test (such as Figure 1 After receiving the ICMP data packet (ie, the first data packet), the device under test 101) will automatically modify the source address in the ICMP data packet to the second IP address and the destination address to the first IP address, so that it can be accurately returned to the server under test later.

[0076] In this step, when TCP is used to send data packets, due to the provisions of TCP, after the device under test receives the TCP data packet (i.e., the first data packet), it will automatically modify the source address in the TCP data packet to the second IP address and the destination address to the first IP address, so that it can be accurately returned to the server under test later.

[0077] 403: The device under test sends the second data packet to the test server.

[0078] In this step, the test server can be Figure 1 A test server 102 is shown.

[0079] 404: After receiving the second data packet, the test server parses the second data packet to determine the external network access permission of the device under test.

[0080] Based on the same technical concept, an embodiment of the present application also provides a structural schematic diagram of a device under test, which can implement the device access permission identification method process applied to the device under test side in the embodiment of the present application.

[0081] Figure 5 The structure diagram of a device under test provided in an embodiment of the present application is as follows. The device includes a receiving module 501, a modifying module 502, and a sending module 503.

[0082] The receiving module 501 is used to receive a first data packet sent by a proxy device; the source IP address in the first data packet is a first IP address, the destination IP address is a second IP address, the first IP address is the IP address of the test server, and the second IP address is the IP address of the device under test.

[0083] The modification module 502 is used to modify the first data packet to obtain a second data packet; wherein the source IP address in the second data packet is the second IP address, and the destination IP address is the first IP address.

[0084] The sending module 503 is used to send the second data packet to the test server; wherein the second data packet is used by the test server to determine the external network access permission of the device under test.

[0085] It should be noted here that the above-mentioned device under test provided in the embodiment of the present application can implement all the method steps in the device access permission identification method embodiment on the above-mentioned device under test side, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0086] Based on the same technical concept, an embodiment of the present application also provides a structural diagram of a test server, which can implement the device access permission identification method process applied to the test server side in the embodiment of the present application.

[0087] Figure 6 A structural diagram of a test server provided in an embodiment of the present application. The server includes a receiving module 601 and a determining module 602.

[0088] The receiving module 601 is used to receive a second data packet sent by the device under test; wherein the second data packet is generated by the device under test modifying the first data packet sent by the proxy device, the source IP address in the first data packet is the first IP address, the destination IP address is the second IP address, the first IP address is the IP address of the test server, and the second IP address is the IP address of the device under test; the source IP address in the second data packet is the second IP address, and the destination IP address is the first IP address.

[0089] The determination module 602 is used to determine the external network access permission of the device under test according to the second data packet.

[0090] It should be noted here that the above-mentioned test server provided in the embodiment of the present application can implement all the method steps in the device access permission identification method embodiment on the above-mentioned test server side, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0091] Based on the same technical concept, an electronic device is also provided in an embodiment of the present application, and the electronic device can realize the functions of the aforementioned device under test or test server.

[0092] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0093] At least one processor 701, and a memory 702 connected to the at least one processor 701. The specific connection medium between the processor 701 and the memory 702 is not limited in the embodiment of the present application. Figure 7 In the example, the processor 701 and the memory 702 are connected via a bus 700. Figure 7 The connections between other components are shown in bold lines, and are not intended to be limiting. The bus 700 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, Figure 7 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 701 can also be called a controller, and there is no limitation on the name.

[0094] In the embodiment of the present application, the memory 702 stores instructions that can be executed by at least one processor 701. The at least one processor 701 can execute a device access permission identification method discussed above by executing the instructions stored in the memory 702. The processor 701 can implement Figure 5 or Figure 6 The functions of each module in the device shown.

[0095] Among them, the processor 701 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 702 and calling data stored in the memory 702, the various functions of the device and process data, the device can be monitored as a whole.

[0096] In the embodiment of the present application, the processor 701 may include one or more processing units, and the processor 701 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 701. In some embodiments, the processor 701 and the memory 702 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0097] Processor 701 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of a device access rights identification method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0098] The memory 702 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 702 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 702 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 702 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0099] By programming the processor 701, the code corresponding to the device access permission identification method described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 2 or Figure 3 The embodiment shown is a method for identifying device access rights. How to design and program the processor 701 is a technique known to those skilled in the art and will not be described in detail here.

[0100] It should be noted here that the above-mentioned electronic device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0101] Based on the same technical concept, the embodiment of the present application provides a computer storage medium, which includes: computer program code, when the computer program code is executed on a computer, the computer executes any of the methods for identifying device access rights discussed above. Since the principle of solving the problem by the above-mentioned computer storage medium is similar to that of a method for identifying device access rights, the implementation of the above-mentioned computer storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0102] In the specific implementation process, the computer storage medium may include: Universal Serial Bus Flash Drive (USB), mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and other storage media that can store program codes.

[0103] Based on the same technical concept, the embodiment of the present application also provides a computer program product, which includes: computer program code, when the computer program code is run on a computer, the computer executes any of the device access rights identification methods discussed above. Since the principle of solving the problem by the above computer program product is similar to that of a device access rights identification method, the implementation of the above computer program product can refer to the implementation of the method, and the repeated parts will not be repeated.

[0104] The computer program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more conductors, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0105] The method in the present application can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed on a computer, the process or function described in the present application is executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device, a core network device, an OAM or other programmable device.

[0106] The computer program or instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program or instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired or wireless means. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disk; it may also be a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0107] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0108] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the instructions in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0109] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0110] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for identifying device access rights, characterized in that: Applied to the device under test, the method comprises: Receive a first data packet sent by a proxy device; wherein the source IP address in the first data packet is a first IP address, the destination IP address is a second IP address, the first IP address is an IP address of a test server, and the second IP address is an IP address of the device under test; Modify the first data packet to obtain a second data packet; wherein the source IP address in the second data packet is the second IP address, and the destination IP address is the first IP address; The second data packet is sent to the test server; wherein the second data packet is used by the test server to determine the external network access rights of the device under test.

2. The method according to claim 1, characterized in that The first data packet and the second data packet are both sent using Internet Control Message Protocol ICMP or Transmission Control Protocol TCP.

3. The method according to claim 1, characterized in that The second IP address is added to the tail of both the first data packet and the second data packet.

4. The method according to any one of claims 1 to 3, characterized in that: The proxy device is a device with intranet authority, which is used to record the IP addresses of all tested devices in the intranet.

5. A method for identifying device access rights, characterized in that: Applied to a test server, the method comprises: Receive a second data packet sent by the device under test; wherein the second data packet is generated by the device under test modifying the first data packet sent by the proxy device, the source IP address in the first data packet is the first IP address, the destination IP address is the second IP address, the first IP address is the IP address of the test server, and the second IP address is the IP address of the device under test; the source IP address in the second data packet is the second IP address, and the destination IP address is the first IP address; The external network access permission of the device under test is determined according to the second data packet.

6. The method according to claim 5, characterized in that The first data packet and the second data packet are both sent using Internet Control Message Protocol ICMP or Transmission Control Protocol TCP.

7. The method according to claim 5, characterized in that The second IP address is added to the tail of the first data packet and the second data packet; Determining the external network access rights of the device under test according to the second data packet includes: The tail of the second data packet is identified, and if the second IP address is identified as the actual IP address of the device under test, it is determined that the device under test has external network access rights.

8. The method according to any one of claims 5 to 7, characterized in that: The proxy device is a device with intranet authority, which is used to record the IP addresses of all tested devices in the intranet.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, for implementing the method described in any one of claims 1 to 4, or implementing the method described in any one of claims 5 to 7, when executing the computer program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented, or the method according to any one of claims 5 to 7 is implemented.

Images