Method, device and equipment for admission control in IPv6 (Internet Protocol Version 6) network

Abstract

The invention relates to the field of network communication, and provides a method, a device and equipment for admission control in an IPv6 (Internet Protocol Version 6) network, and the method comprises the steps: enabling a terminal to access the network, and receiving a network access request of the terminal; judging whether a terminal corresponding to the terminal network access request is authorized or not through a server of a sixth version of a dynamic host configuration protocol; when the server of the sixth version of the dynamic host configuration protocol judges that the terminal is an unauthorized terminal, an isolation network segment IPv6 address is distributed to the unauthorized terminal, the terminal is guided to a guiding network access page through routing declaration for identity authentication, and the authorization state of the terminal is judged again after authentication is passed; and when the server of the sixth version of the dynamic host configuration protocol judges that the terminal is an authorized terminal, a normal network IPv6 address terminal is allocated to the authorized terminal to access the network. According to the invention, the problem of how to effectively carry out admission control in the IPv6 network in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and in particular to a method, device and equipment for performing access control in an IPv6 network. Background Art

[0002] With the rapid development of the Internet, IPv6 (Internet Protocol version 6), as the next generation Internet protocol, is gradually replacing IPv4 and becoming the mainstream network protocol. The introduction of IPv6 not only greatly expands the network address space, but also improves network configuration and security. However, in the process of establishing and managing IPv6 networks, security construction issues cannot be ignored, especially terminal access security.

[0003] In the existing IPv6 network environment, Dynamic Host Configuration Protocol Version 6 (DHCPv6) is the most important networking technology and is usually used for IPv6 address allocation. DHCPv6 can also be used to assist in implementing network access control to ensure that only authorized terminals can access the network. There are two main existing access control technologies: one is to establish a whitelist mechanism based on the requested MAC address, allocate addresses to MAC addresses in the whitelist, and refuse to allocate MAC addresses not in the whitelist; the other is to continue the traditional DHCPv4 solution and implement access control by dynamically switching between isolated network segments and normal network segments.

[0004] However, these existing technologies have obvious defects. Although the access control method based on the MAC address whitelist is simple and direct, there is a problem that the boot page cannot pop up when the IPv6 address is not obtained, which causes users to easily mistakenly believe that there is a network failure without feedback, thereby increasing the difficulty of management and the inconvenience of users accessing the network. Based on the method of switching between isolated network segments and normal network segments, in the IPv6 environment, due to the existence of the RA routing announcement mechanism, even if the isolated network segment address is configured, unauthorized terminals may still obtain the network configuration parameters of the normal network segment through the RA announcement of the normal router, thereby bypassing the isolation control for network communication, which greatly reduces the management and control effect of the access control. Therefore, how to effectively perform access control in IPv6 networks has become an important issue that needs to be urgently solved in the industry. Summary of the invention

[0005] The present invention provides a method, device and equipment for performing access control in an IPv6 network, which solves the problem of how to effectively perform access control in an IPv6 network in the prior art and realizes effective access control in an IPv6 network.

[0006] The present invention provides a method for performing access control in an IPv6 network, comprising the following steps: Connecting the terminal to the network and receiving a network access request from the terminal; Determining, by a Dynamic Host Configuration Protocol Version 6 server, whether a terminal corresponding to the terminal network access request is authorized; When the Dynamic Host Configuration Protocol version 6 server determines that the terminal is an unauthorized terminal, it allocates an isolated network segment IPv6 address to the unauthorized terminal and guides it to the boot network page for identity authentication through routing announcement. After the authentication is passed, the terminal authorization status is re-determined; When the DHCP version 6 server determines that the terminal is an authorized terminal, a normal network IPv6 address terminal access network is allocated to the authorized terminal.

[0007] According to the method for performing access control in an IPv6 network provided by the present invention, before the terminal accesses the network, the method further includes: creating a one-to-one IPv6 isolation network segment of an isolated network domain according to the IPv6 normal network segment planned in the current network; enabling the Dynamic Host Configuration Protocol version 6 service, and adjusting the routing declaration priority of the Dynamic Host Configuration Protocol version 6 service of the isolated network domain.

[0008] According to the method for access control in an IPv6 network provided by the present invention, when the dynamic host configuration protocol version 6 server determines that the terminal is an unauthorized terminal, an isolated network segment IPv6 address is allocated to the unauthorized terminal and the terminal is guided to the boot network page for identity authentication through a routing announcement, and the terminal authorization status is re-judged after the authentication is passed. The method specifically includes: when the dynamic host configuration protocol version 6 server determines that the terminal is an unauthorized terminal, an isolated network segment IPv6 address is allocated to the unauthorized terminal; a routing announcement is made to the terminal that has obtained the isolated network segment, and the terminal obtains the routing information; when the browser is opened to access any information, the access is hijacked according to the routing information, and a boot network page is generated; the identity authentication of the unauthorized terminal is completed on the boot network page; when the identity authentication is passed, the dynamic host configuration protocol version 6 server is again entered into a cycle process of judging whether the terminal is authorized.

[0009] According to the method for access control in an IPv6 network provided by the present invention, after identity authentication is passed, the method further includes: performing a comprehensive evaluation based on multi-dimensional data of the terminal to determine the security risk level of the terminal; the multi-dimensional data includes the real-time behavior, historical records and network environment of the terminal.

[0010] The present invention also provides a device for performing access control in an IPv6 network, comprising the following modules: A terminal access module, used to access the terminal to the network and receive a network access request from the terminal; An authorization judgment module, used to judge whether the terminal corresponding to the terminal network access request is authorized through a dynamic host configuration protocol version 6 server; An unauthorized processing module is used to allocate an isolated network segment IPv6 address to the unauthorized terminal and guide it to the boot network page for identity authentication through routing announcement when the dynamic host configuration protocol version 6 server determines that the terminal is an unauthorized terminal, and re-determine the terminal authorization status after the authentication is passed; The authorization processing module is used to allocate a normal network IPv6 address terminal access network to the authorized terminal when the dynamic host configuration protocol version 6 server determines that the terminal is an authorized terminal.

[0011] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for performing access control in an IPv6 network as described in any one of the above is implemented.

[0012] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method for performing access control in an IPv6 network as described in any one of the above is implemented.

[0013] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method for performing admission control in an IPv6 network as described in any one of the above is implemented.

[0014] The present invention provides a method, device and equipment for access control in an IPv6 network, including the following beneficial effects: by performing authorization judgment on the terminal through the DHCPv6 server, it is effectively ensured that only authorized terminals can access the normal network, thereby greatly improving the security of the network. For unauthorized terminals, the system intelligently allocates an isolated network segment IPv6 address, and guides it to the network access page for identity authentication through routing announcements, which not only prevents the access of illegal terminals, but also provides a convenient authentication path for legal but unauthorized terminals. After the authentication is passed, the system will judge the authorization status of the terminal again, further ensuring the security of the network. In addition, for authorized terminals, the system directly allocates a normal network IPv6 address, so that it can quickly and smoothly access the network. The present invention not only ensures the security of the network, but also takes into account the user experience, achieving dual guarantees of security and efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 This is one of the flow charts of the method for performing access control in an IPv6 network provided by the present invention.

[0017] Figure 2 This is the second flow chart of the method for performing access control in an IPv6 network provided by the present invention.

[0018] Figure 3 The present invention provides a schematic diagram of the network structure for implementing IPv6 access control.

[0019] Figure 4 It is a structural schematic diagram of a device for performing access control in an IPv6 network provided by the present invention.

[0020] Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] Security construction cannot be ignored in the process of IPv6 networking. Terminal access security is the basic security. Once an unauthorized terminal configures an IPv6 address to communicate with legitimate resources, uncontrollable security risks such as virus propagation, malicious attacks, Trojan horse implantation, and data leakage will occur. Therefore, it is necessary to build network access control for the IPv6 environment. Dynamic Host Configuration Protocol Version 6 (DHCPv6) DHCPv6 is the most important networking technology in the IPv6 network environment and is usually used for IPv6 address allocation. It can also be used to assist in access control. Some establish a whitelist mechanism based on the requested MAC address, allocate addresses to MAC addresses in the whitelist, and refuse to allocate MAC addresses not in the whitelist, so as to achieve access control for unauthorized terminals. Some continue the traditional DHCPv4 solution and implement access control based on switching between isolated network segments and normal network segments.

[0023] The traditional access control implementation method of allocating and not allocating IPv6 addresses based on the MAC address whitelist through DHCPv6 has the problem that the boot page cannot be popped up due to the failure to obtain the IPv6 address. When users do not get any feedback, they usually think it is a network failure and contact the administrator for on-site maintenance, resulting in poor user network experience and low network efficiency, which increases the difficulty of information management.

[0024] Secondly, the implementation method of dynamic switching between the normal network and the isolated network of DHCPv4 continues, and there is a problem of lax control in the IPv6 environment. The main reason is that IPv6 adds the RA routing announcement mechanism compared to IPv4 in terms of routing announcement. This mechanism is part of the IPv6 Neighbor Discovery Protocol (NDP) and is used by routers to announce their existence and network configuration parameters, such as network prefix and default gateway address, to nodes in the network, reducing the configuration workload of network administrators and speeding up the network access of devices. However, this also means that even if the isolated network segment address is configured, the normal network segment prefix and default gateway address can still be obtained through the RA announcement of the normal router, and normal network communication can still be achieved.

[0025] The purpose of the present invention is to propose a method for implementing access control in an IPv6 network by using DHCPv6 to divide isolation domains and using the priority of RA routing announcements in the isolation domains, which can not only implement access control but also provide network access guidance.

[0026] Combine the following Figure 1-Figure 5 Embodiments of the present invention are described in detail.

[0027] Figure 1 Schematic diagram of the method for performing access control in an IPv6 network provided by the present invention. Figure 1 As shown, the method comprises the following steps: S110: Connect the terminal to the network and receive a terminal network access request.

[0028] According to the method for access control in an IPv6 network provided by the present invention, before a terminal accesses the network, a one-to-one IPv6 isolation network segment of an isolated network domain is created according to the IPv6 normal network segment currently planned for the network; the Dynamic Host Configuration Protocol version 6 service is enabled, and the routing declaration priority of the Dynamic Host Configuration Protocol version 6 service of the isolated network domain is adjusted.

[0029] Specifically, before the terminal accesses the network, it is first necessary to clarify the normal IPv6 network segment planned for the current network.

[0030] Based on the IPv6 normal network segment of the current network planning, create a one-to-one IPv6 isolation network segment that is an isolated network domain. The purpose of this step is to build a relatively independent area in the network for the isolation and review of terminals before access. The creation of the isolation network segment should ensure its logical isolation from the normal network segment, while not affecting the overall performance and stability of the network.

[0031] Enabling DHCPv6 service in an isolated network domain is to ensure that the terminal can automatically obtain a valid IPv6 address and related network configuration information when accessing the isolated network segment. The activation of DHCPv6 service should follow the standard network protocol configuration process to ensure the correctness and reliability of the service.

[0032] In order to achieve fine-grained control over terminal access behavior, it is necessary to adjust the routing announcement priority of the DHCPv6 service in the isolated network domain. By adjusting the priority, the terminal can be controlled to obtain the routing information of the isolated network segment first when accessing the network, thereby ensuring that the terminal is first directed to the isolated area for access review. This step requires comprehensive consideration of multiple factors such as network topology, routing protocols, and terminal access policies to ensure that the adjusted priority setting meets network security requirements without affecting user experience.

[0033] When a terminal initiates a network access request, the network should be able to correctly receive and process these requests. In the access control process, the terminal's network access request should first be directed to the isolated network segment for review. By checking the terminal's identity information, security status, and compliance policy, it is determined whether it meets the conditions for accessing the normal network segment. Only when the terminal passes the review and meets all access requirements is it allowed to access the normal network segment for network communication.

[0034] Through the implementation of the above solutions, terminal access control can be effectively implemented in the IPv6 network, improving the security and manageability of the network.

[0035] S120. Determine, through the Dynamic Host Configuration Protocol version 6 server, whether the terminal corresponding to the terminal network access request is authorized.

[0036] Specifically, when a terminal attempts to access the network, it sends a network access request. This request contains the terminal's identification information, such as the MAC address, and other necessary network access parameters. The Dynamic Host Configuration Protocol Version 6 (DHCPv6) server in the network is responsible for receiving these network access requests.

[0037] After receiving the network access request from the terminal, the DHCPv6 server will extract the terminal's identification information from the request. This information is the basis for subsequent terminal authorization judgment.

[0038] The DHCPv6 server compares the extracted terminal identification information with the information pre-stored in the authorization database. The authorization database stores the identification information of authorized terminals and the corresponding authorization status. By querying the database, the server can quickly determine whether the terminal sending the network access request has been authorized to access the network.

[0039] Based on the query results, the DHCPv6 server will determine the authorization status of the terminal. If there is a record matching the requesting terminal in the database and its authorization status is valid, the server considers the terminal to be authorized and allows it to access the network. On the contrary, if there is no corresponding record in the database or the record shows that the terminal is not authorized, the server will reject the terminal's request to access the network.

[0040] Based on the determined authorization status of the terminal, the DHCPv6 server will take appropriate measures. For authorized terminals, the server will allocate IPv6 addresses and other network configuration information so that the terminals can access the network normally. For unauthorized terminals, the server will return a rejection message or redirect the terminal to an isolated area to wait for further processing or authorization.

[0041] By implementing the above steps, it can be ensured that only authorized terminals can access the network, thereby effectively improving the security and controllability of the network.

[0042] S130. When the Dynamic Host Configuration Protocol version 6 server determines that the terminal is an unauthorized terminal, an isolated network segment IPv6 address is allocated to the unauthorized terminal and the unauthorized terminal is guided to the boot network page for identity authentication through a routing announcement. After the authentication is passed, the terminal authorization status is re-determined.

[0043] According to the method for access control in an IPv6 network provided by the present invention, when a dynamic host configuration protocol version 6 server determines that a terminal is an unauthorized terminal, an isolated network segment IPv6 address is allocated to the unauthorized terminal and the terminal is guided to a boot-to-network page through a routing announcement for identity authentication, and the terminal authorization status is re-judged after the authentication is passed. The method specifically includes: when the dynamic host configuration protocol version 6 server determines that the terminal is an unauthorized terminal, an isolated network segment IPv6 address is allocated to the unauthorized terminal; a routing announcement is made to the terminal that has obtained the isolated network segment, and the terminal obtains the routing information; when a browser is opened to access any information, the access is hijacked according to the routing information, and a boot-to-network page is generated; the identity authentication of the unauthorized terminal is completed on the boot-to-network page; when the identity authentication is passed, the dynamic host configuration protocol version 6 server is again entered into a cycle process of judging whether the terminal is authorized.

[0044] Specifically, after receiving the network access request from the terminal, the DHCPv6 server will first determine the authorization status of the terminal. If the server determines that the terminal is an unauthorized terminal, it will trigger the subsequent admission control process.

[0045] For unauthorized terminals, the DHCPv6 server will assign them an IPv6 address of an isolated network segment. This address is different from the address of the normal network segment, which ensures that unauthorized terminals are restricted to a specific area isolated from the normal network when accessing the network.

[0046] After allocating the isolated network segment IPv6 address, the DHCPv6 server will announce the route to the unauthorized terminal. The purpose of this is to allow the terminal to obtain the correct routing information so that the correct data packet forwarding can be performed in the network.

[0047] When an unauthorized terminal attempts to access any information through a browser, the network will hijack the access based on the previously announced routing information. This means that no matter which URL the terminal originally attempts to access, it will be redirected to a specific "bootstrap page". This page is used to guide the user to authenticate.

[0048] On the boot-up page, unauthorized terminals need to complete the identity authentication process, including entering user name, password, verification code and other verification information, or performing other forms of identity authentication, such as multi-factor authentication, etc. The authentication process should ensure security and prevent unauthorized access.

[0049] Once the unauthorized terminal successfully passes the identity authentication, the system will trigger the authorization decision process of the DHCPv6 server again. This decision will be based on the updated authorization information (for example, the terminal may now have been added to the authorization database). If the terminal is now authorized, it will be allowed to access the normal network segment; if it is still unauthorized, the above admission control process will be repeated.

[0050] Through the above steps, it can be ensured that only authenticated and authorized terminals can access the normal area of ​​the network, thus greatly enhancing the security of the network. At the same time, through the automated access control and identity authentication process, the efficiency of network management and user experience are also improved.

[0051] S140. When the DHCP version 6 server determines that the terminal is an authorized terminal, it allocates a normal network IPv6 address to the authorized terminal so that the terminal can access the network.

[0052] According to the method for access control in an IPv6 network provided by the present invention, after identity authentication is passed, a comprehensive evaluation is performed based on the multi-dimensional data of the terminal to determine the security risk level of the terminal; the multi-dimensional data includes the real-time behavior, historical records and network environment of the terminal.

[0053] Specifically, after the terminal passes the identity authentication, the system starts to collect multi-dimensional data of the terminal, such as real-time behavior data of the terminal (such as network access mode, data transmission rate, etc.), historical record data (such as past network activity logs, security event records, etc.), and network environment data (such as the type of network currently connected, network topology, peripheral device information, etc.).

[0054] The collected multi-dimensional data needs to be preprocessed and standardized to ensure the accuracy and consistency of the data. Preprocessing includes steps such as data cleaning (removing invalid or erroneous data) and data normalization (adjusting the data to a uniform measurement range). Standardization is to ensure that the data between different dimensions are comparable.

[0055] Based on the preprocessed multi-dimensional data, a comprehensive assessment model is constructed. This model can use machine learning algorithms, statistical analysis methods or other risk assessment techniques to quantitatively assess the security risks of the terminal. The design of the model should take into account various security factors and be able to be adjusted and optimized according to actual needs.

[0056] The collected and processed multi-dimensional data is input into the comprehensive assessment model to conduct terminal security risk assessment. The assessment process includes weighted processing of data, threshold judgment, etc., to obtain a specific security risk level. This level can be a numerical value, a classification label (such as "low risk", "high risk", etc.) or other forms of expression.

[0057] Based on the results of the comprehensive assessment, the security risk level of the terminal is determined. This level should be able to accurately reflect the security status of the terminal in the current network environment and provide a basis for the subsequent security policy formulation.

[0058] The system takes corresponding security measures according to the determined security risk level. For low-risk terminals, they can be allowed to access network resources normally; for high-risk terminals, additional security reviews are required, their network access rights are restricted, or other necessary security protection measures are taken.

[0059] By implementing the above steps, we can achieve refined assessment and management of terminal security risks, further improving the security and controllability of IPv6 networks.

[0060] According to the method for access control in an IPv6 network provided by the present invention, after identity authentication is passed, a cyclic process of the dynamic host configuration protocol version 6 server to determine whether the terminal is authorized is entered again, which specifically includes: after identity authentication is passed, the authentication passing time, authentication times and authentication results of the terminal are recorded to form a terminal authentication history record; the dynamic host configuration protocol version 6 server marks the terminal whose authentication failure times exceed a preset threshold or has abnormal authentication behavior according to the terminal authentication history record, and limits the time interval for the terminal to initiate a network access request again or permanently prohibits the terminal from accessing the network.

[0061] Specifically, after the terminal passes the identity authentication, the system will first record the terminal's authentication passing time, authentication times, and authentication results. This information will be stored in a database called "Terminal Authentication History" for subsequent analysis and processing.

[0062] The DHCPv6 server analyzes the terminal authentication history periodically or in real time. Through analysis, the server can identify terminals whose authentication failure times exceed the preset threshold or have abnormal authentication behaviors.

[0063] Before implementing the access control method, it is necessary to pre-set the threshold of authentication failure and the judgment criteria for abnormal authentication behavior. For example, you can set the number of consecutive failures to a specific value (such as 5 times, 10 times, etc.) as the threshold, or define behaviors such as frequently trying different authentication information in a short period of time and using illegal characters for authentication as abnormal.

[0064] Once the DHCPv6 server finds that the number of authentication failures of a terminal exceeds the preset threshold or there is abnormal authentication behavior, it will mark the terminal. The marking can be in the form of adding a specific status identifier for the terminal in the database or adding it to a special problem terminal list.

[0065] For the marked problematic terminals, the DHCPv6 server will take appropriate measures to restrict or prohibit them from initiating network access requests again. Specific measures include: 1. Increase the time interval for the problematic terminal to re-initiate network access requests, for example, set it to be unable to try to reconnect to the network within the next few hours.

[0066] 2. For terminals that seriously violate regulations or continue to exhibit abnormal behavior, the server may choose to permanently ban them from accessing the network.

[0067] When restricting or prohibiting, the system can also generate notifications to inform network administrators and / or end users of the situation. This helps administrators understand security issues in the network in a timely manner and provide users with necessary support and guidance.

[0068] Through the implementation of the above steps, the IPv6 network access control method provided by the present invention can effectively identify and respond to potential security risks and improve the overall security and stability of the network.

[0069] like Figure 2 The main flow chart of the technical solution of the present invention is shown in FIG. Figure 2 As shown, the method proposed by the present invention for implementing network access control in an IPv6 address environment by combining DHCPv6 with RA includes the following steps: (1) Create a one-to-one isolated network IPv6 address segment based on the IPv6 network segment currently planned; (2) Enable DHCPv6 service; (3) Adjust the RA priority of the DHCPv6 service in the isolated domain; (4) The terminal accesses the network and automatically obtains an IPv6 address; (5) The DHCPv6 server determines whether the terminal making the request is authorized. If not, the following process is performed: a. Allocate IPv6 addresses of isolated network segments to unauthorized terminals; b. Announce RA routing to the terminal that has obtained the isolated network segment, and the gateway address is the DHCPv6 server itself and the prefix of the isolated network segment; c. The terminal obtains the isolated network prefix, default gateway address (DHCPv6 server), and normal DNS server address; d. Any information accessed by opening the browser will be hijacked by DHCPv6 and a page will be provided to guide you to the network. e. Complete identity authentication on the network access page; f. After authentication, the DHCPv6 server will enter the cycle again to determine whether the terminal is authorized; (6) When the DHCPv6 server determines that the terminal is an authorized terminal, it allocates a normal network IPv6 address; (7) The normal network segment range is announced by the router through normal RA, with the default gateway address and network segment prefix; (8) The terminal obtains the normal IPv6 address, gateway and prefix and can access the network.

[0070] Figure 3 Schematic diagram of the network structure for implementing IPv6 admission control. It can be seen that the normal network segment and the isolated network segment are divided under the same VLAN of the switch. The isolated network segment is virtually formed by the DHCPv6 server in comparison with the normal network segment and does not need to be created on the switch side.

[0071] When an unauthorized terminal accesses the network and obtains an IPv6 address dynamically, the DHCPv6 server allocates an IPv6 address of the isolated network segment by default, and the DHCPv6 server announces a high-priority RA so that the terminal that obtains the IPv6 address of the isolated network obtains the prefix of the isolated network segment, so that any information it accesses is directed to the DHCPv6 server. At this time, the DHCPv6 server acts as the gateway, and its access behavior must go through the DHCPv6 server, thereby achieving interception and guidance.

[0072] When the terminal passes the authentication in the isolated network segment IPv6 address stage and obtains legal authorization, the DHCPv6 client waits for a very short lease period. When initiating the next address request, the DHCPv6 server allocates a legal IPv6 address based on its authentication status. In a normal network environment, the router performs normal RA announcements to obtain the normal network segment prefix and default gateway address, completing the overall guided network access control.

[0073] The present invention realizes guided access control by combining DHCPv6 with RA. The main invention is to create an isolated network area before access and use the isolation domain RA routing announcement priority to point to the network segment prefix and default gateway. Based on the combination of isolation domain and RA priority, access control and guided access are realized.

[0074] The present invention implements guided network access control through DHCPv6. Compared with the allocation / non-allocation control method, this method has a guiding role and an isolation buffer zone capability. Unauthorized terminals can complete self-repair in the isolation zone, which improves the user's network access experience. Compared with the traditional access based only on the isolation network, it makes up for the blocking vulnerability caused by the automatic configuration of the RA routing announcement network with IPv6 address characteristics. Through the high-priority RA announcement, the network prefix and gateway are pointed, which improves the security of access control.

[0075] The following is a description of an apparatus for performing admission control in an IPv6 network provided by the present invention. The apparatus for performing admission control in an IPv6 network described below and the method for performing admission control in an IPv6 network described above can be referred to each other.

[0076] like Figure 4 The present invention provides a device for performing access control in an IPv6 network, comprising: The terminal access module is used to connect the terminal to the network and receive the terminal access request; An authorization judgment module is used to judge whether the terminal corresponding to the terminal access request is authorized through the dynamic host configuration protocol version 6 server; An unauthorized processing module is used to allocate an isolated network segment IPv6 address to the unauthorized terminal and guide it to the boot network page for identity authentication through routing announcement when the dynamic host configuration protocol version 6 server determines that the terminal is an unauthorized terminal. After the authentication is passed, the terminal authorization status is re-determined; The authorization processing module is used to allocate a normal network IPv6 address to the authorized terminal to access the network when the dynamic host configuration protocol version 6 server determines that the terminal is an authorized terminal.

[0077] Figure 5 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 5 As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communication interface 520 and the memory 530 complete mutual communication through the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute a method for access control in an IPv6 network, the method comprising: connecting a terminal to a network, receiving a terminal access request; judging whether a terminal corresponding to the terminal access request is authorized through a dynamic host configuration protocol version 6 server; when the dynamic host configuration protocol version 6 server judges that the terminal is an unauthorized terminal, allocating an isolated network segment IPv6 address to the unauthorized terminal and guiding it to the boot network page through a routing announcement for identity authentication, and re-judging the terminal authorization status after the authentication is passed; when the dynamic host configuration protocol version 6 server judges that the terminal is an authorized terminal, allocating a normal network IPv6 address to the authorized terminal to access the network.

[0078] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0079] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the method for performing access control in an IPv6 network provided by the above methods, the method including: connecting a terminal to the network and receiving a terminal access request; judging whether the terminal corresponding to the terminal access request is authorized through a dynamic host configuration protocol version 6 server; when the dynamic host configuration protocol version 6 server judges that the terminal is an unauthorized terminal, allocating an isolated network segment IPv6 address to the unauthorized terminal and guiding it to the boot access page for identity authentication through a routing announcement, and re-judging the terminal authorization status after the authentication is passed; when the dynamic host configuration protocol version 6 server judges that the terminal is an authorized terminal, allocating a normal network IPv6 address to the authorized terminal to enable the terminal to access the network.

[0080] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the method for performing access control in an IPv6 network provided by the above-mentioned methods, the method comprising: connecting a terminal to the network and receiving a terminal access request; determining whether the terminal corresponding to the terminal access request is authorized through a dynamic host configuration protocol version 6 server; when the dynamic host configuration protocol version 6 server determines that the terminal is an unauthorized terminal, allocating an isolated network segment IPv6 address to the unauthorized terminal and guiding it to a boot access page for identity authentication through a routing announcement, and re-determining the terminal authorization status after the authentication is passed; when the dynamic host configuration protocol version 6 server determines that the terminal is an authorized terminal, allocating a normal network IPv6 address to the authorized terminal to enable the terminal to access the network.

[0081] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0082] Through the description of the above implementation modes, those skilled in the art can clearly understand that each implementation mode can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on such an understanding, the above technical solution can essentially or in other words be embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for performing access control in an IPv6 network, characterized in that: include: Connecting the terminal to the network and receiving a network access request from the terminal; Determining, by a Dynamic Host Configuration Protocol Version 6 server, whether a terminal corresponding to the terminal network access request is authorized; When the Dynamic Host Configuration Protocol version 6 server determines that the terminal is an unauthorized terminal, it allocates an isolated network segment IPv6 address to the unauthorized terminal and guides it to the boot network page for identity authentication through routing announcement. After the authentication is passed, the terminal authorization status is re-determined; When the DHCP version 6 server determines that the terminal is an authorized terminal, a normal network IPv6 address terminal access network is allocated to the authorized terminal.

2. The method for performing access control in an IPv6 network according to claim 1, characterized in that: Before the terminal accesses the network, the method further includes: Create a one-to-one IPv6 isolation network segment for the isolated network domain based on the IPv6 normal network segment of the current network planning; The Dynamic Host Configuration Protocol Version 6 service is enabled, and the routing announcement priority of the Dynamic Host Configuration Protocol Version 6 service of the isolated network domain is adjusted.

3. The method for performing access control in an IPv6 network according to claim 2, characterized in that: When the DHCP version 6 server determines that the terminal is an unauthorized terminal, an isolated network segment IPv6 address is allocated to the unauthorized terminal and the terminal is guided to the network access page for identity authentication through a routing announcement. After the authentication is passed, the terminal authorization status is re-determined, specifically including: When the DHCP version 6 server determines that the terminal is an unauthorized terminal, it allocates an IPv6 address of an isolated network segment to the unauthorized terminal; The route is announced to the terminal that has obtained the isolated network segment, and the terminal obtains the route information; When a browser is opened to access any information, the access is hijacked according to the routing information, and a page guiding access to the network is generated; Complete the identity authentication of the unauthorized terminal on the network access page; When the identity authentication is passed, the dynamic host configuration protocol version 6 server enters the cycle process again to determine whether the terminal is authorized.

4. The method for performing access control in an IPv6 network according to claim 1, characterized in that: After the identity authentication is passed, the method further includes: Conduct a comprehensive assessment based on the terminal's multi-dimensional data to determine the terminal's security risk level; The multi-dimensional data includes the real-time behavior, historical records and network environment of the terminal.

5. A device for performing access control in an IPv6 network, characterized in that: include: A terminal access module, used to access the terminal to the network and receive a network access request from the terminal; An authorization judgment module, used to judge whether the terminal corresponding to the terminal network access request is authorized through a dynamic host configuration protocol version 6 server; An unauthorized processing module is used to allocate an isolated network segment IPv6 address to the unauthorized terminal and guide it to the boot network page for identity authentication through routing announcement when the dynamic host configuration protocol version 6 server determines that the terminal is an unauthorized terminal, and re-determine the terminal authorization status after the authentication is passed; The authorization processing module is used to allocate a normal network IPv6 address terminal access network to the authorized terminal when the dynamic host configuration protocol version 6 server determines that the terminal is an authorized terminal.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method for performing admission control in an IPv6 network as claimed in any one of claims 1 to 4 is implemented.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for performing admission control in an IPv6 network as claimed in any one of claims 1 to 4 is implemented.

8. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for performing admission control in an IPv6 network as claimed in any one of claims 1 to 4 is implemented.

Images