Method, device and equipment for admission control in an IPv6 network

Abstract

The application relates to the field of network communication, and provides a method, device and equipment for access control in an IPv6 network, which comprises the following steps: accessing a terminal into a network, receiving a terminal network access request; judging whether the terminal corresponding to the terminal network access request is authorized by a dynamic host configuration protocol (DHCP) version 6 server; when the DHCP version 6 server judges that the terminal is an unauthorized terminal, allocating an isolated network segment IPv6 address to the unauthorized terminal and guiding the unauthorized terminal to a network access page for identity authentication through a routing announcement, re-judging the authorization state of the terminal after the authentication is passed; and when the DHCP version 6 server judges that the terminal is an authorized terminal, allocating a normal network IPv6 address to the authorized terminal and accessing the terminal into the network. The application solves the problem of how to effectively perform access control in an IPv6 network in the prior art.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and in particular to a method, apparatus, and device for access control in an IPv6 network. Background Technology

[0002] With the rapid development of the Internet, IPv6 (Internet Protocol version 6), as the next-generation Internet protocol, is gradually replacing IPv4 and becoming the mainstream network protocol. The introduction of IPv6 has not only greatly expanded the network address space but also improved network configuration and security. However, security issues, especially terminal access security, cannot be ignored in the construction and management of IPv6 networks.

[0003] In existing IPv6 network environments, Dynamic Host Configuration Protocol version 6 (DHCPv6) is the primary networking technology, typically used for IPv6 address allocation. DHCPv6 can also be used to assist in network access control, ensuring that only authorized terminals can access the network. There are two main existing access control technologies: one is based on a MAC address request whitelist mechanism, allocating addresses to MAC addresses on the whitelist and rejecting those not on the whitelist; the other continues the traditional DHCPv4 approach, implementing access control through dynamic switching between isolated and normal network segments.

[0004] However, these existing technologies have significant drawbacks. While MAC address whitelist-based access control is simple and direct, it suffers from the problem of failing to display a guidance page when an IPv6 address is not obtained. This can lead users to mistakenly believe there is a network failure without any feedback, increasing management complexity and inconvenience for users joining the network. On the other hand, methods based on switching between isolated and normal network segments are problematic in IPv6 environments. Due to the RA (Route Advertisement) mechanism, even if an isolated network segment address is configured, unauthorized terminals can still obtain network configuration parameters for the normal network segment through the RA advertisement of a normal router, thus bypassing isolation control and enabling network communication. This significantly reduces the effectiveness of access control. Therefore, how to effectively implement access control in IPv6 networks has become a crucial issue that the industry urgently needs to address. Summary of the Invention

[0005] This invention provides a method, apparatus, and device for admission control in an IPv6 network, which solves the problem of how to effectively perform admission control in an IPv6 network in the prior art, and realizes effective admission control in an IPv6 network.

[0006] This invention provides a method for admission control in an IPv6 network, comprising the following steps: Connect the terminal to the network and receive the terminal's network access request; The Dynamic Host Configuration Protocol version 6 (DIP) server determines whether the terminal corresponding to the network access request is authorized. When the Dynamic Host Configuration Protocol version 6 server determines that the terminal is an unauthorized terminal, it assigns an isolated network segment IPv6 address to the unauthorized terminal and directs it to the network access page for identity authentication through route announcement. After successful authentication, the terminal's authorization status is re-evaluated. When the Dynamic Host Configuration Protocol version 6 server determines that the terminal is an authorized terminal, it assigns a normal network IPv6 address to the authorized terminal so that the terminal can access the network.

[0007] According to the method for admission control in an IPv6 network provided by the present invention, before a terminal accesses the network, the method further includes: creating a one-to-one isolated IPv6 network segment for the isolated network domain based on the IPv6 normal network segment planned in the current network; enabling Dynamic Host Configuration Protocol version 6 service and adjusting the routing announcement priority of the Dynamic Host Configuration Protocol version 6 service for the isolated network domain.

[0008] According to the method for access control in an IPv6 network provided by the present invention, when the Dynamic Host Configuration Protocol version 6 (DHCP) server determines that the terminal is an unauthorized terminal, it allocates an isolated network segment IPv6 address to the unauthorized terminal and directs the terminal to a login page for authentication through route announcement. After successful authentication, the terminal's authorization status is re-determined. Specifically, the method includes: when the DHCP server determines that the terminal is an unauthorized terminal, it allocates an isolated network segment IPv6 address to the unauthorized terminal; it announces a route to the terminal that has obtained the isolated network segment, and the terminal obtains the route information; when the browser is opened to access any information, it hijacks the access according to the route information and generates a login page; it completes the authentication of the unauthorized terminal on the login page; and after successful authentication, it re-enters the loop process of the DHCP server determining whether the terminal is authorized.

[0009] According to the method for access control in an IPv6 network provided by the present invention, after identity authentication is passed, the method further includes: performing a comprehensive evaluation based on multi-dimensional data of the terminal to determine the security risk level of the terminal; the multi-dimensional data includes the terminal's real-time behavior, historical records, and network environment.

[0010] The present invention also provides an apparatus for admission control in an IPv6 network, comprising the following modules: The terminal access module is used to connect the terminal to the network and receive the terminal's network access request; The authorization determination module is used to determine whether the terminal corresponding to the terminal network access request is authorized by the Dynamic Host Configuration Protocol version 6 server. The unauthorized processing module is used to assign an isolated network segment IPv6 address to the unauthorized terminal and guide it to the network access page for identity authentication through routing announcement when the Dynamic Host Configuration Protocol version 6 server determines that the terminal is an unauthorized terminal. After successful authentication, the terminal's authorization status is re-evaluated. The authorization processing module is used to assign a normal network IPv6 address to the authorized terminal when the Dynamic Host Configuration Protocol version 6 server determines that the terminal is an authorized terminal so that the terminal can access the network.

[0011] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement an access control method in any of the above-described IPv6 networks.

[0012] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method of admission control in an IPv6 network as described above.

[0013] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements an access control method in any of the above-described IPv6 networks.

[0014] This invention provides a method, apparatus, and device for access control in an IPv6 network, which offers the following advantages: By using a DHCPv6 server to authorize terminals, it effectively ensures that only authorized terminals can access the normal network, thereby significantly improving network security. For unauthorized terminals, the system intelligently assigns an isolated network segment IPv6 address and directs them to the network access page for authentication via route announcement. This not only prevents unauthorized terminals from accessing the network but also provides a convenient authentication method for legitimate but unauthorized terminals. After successful authentication, the system re-evaluates the terminal's authorization status, further ensuring network security. Furthermore, for authorized terminals, the system directly assigns a normal network IPv6 address, enabling them to quickly and smoothly access the network. This invention ensures both network security and user experience, achieving a dual guarantee of security and efficiency. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0016] Figure 1 This is one of the flowcharts illustrating the method for admission control in an IPv6 network provided by the present invention.

[0017] Figure 2 This is the second flowchart illustrating the method for admission control in an IPv6 network provided by the present invention.

[0018] Figure 3 This is a schematic diagram of the network structure for implementing IPv6 admission control provided by the present invention.

[0019] Figure 4 This is a schematic diagram of the device for admission control in an IPv6 network provided by the present invention.

[0020] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0022] Security is paramount in IPv6 networking. Terminal access security is fundamental; unauthorized terminals configuring IPv6 addresses and communicating with legitimate resources can lead to uncontrollable security risks such as virus propagation, malicious attacks, Trojan implantation, and data leaks. Therefore, network access control in IPv6 environments is essential. Dynamic Host Configuration Protocol version 6 (DHCPv6) is the primary networking technology in IPv6 environments, typically used for IPv6 address allocation. It can also assist in access control. Some DHCPv6 mechanisms establish a whitelist based on requested MAC addresses, allocating addresses to whitelisted MAC addresses and rejecting those not on the whitelist, thus controlling access for unauthorized terminals. Others continue the traditional DHCPv4 approach, implementing access control by switching between isolated and normal network segments.

[0023] The traditional access control method that uses DHCPv6 to allocate or deny IPv6 addresses based on MAC address whitelists has the problem of not being able to pop up the boot page when an IPv6 address is not obtained. When users do not receive any feedback, they usually assume it is a network failure and contact the administrator for on-site maintenance, resulting in a poor user experience, low network access efficiency, and increased information management difficulty.

[0024] Secondly, continuing the dynamic switching between normal and isolated networks as implemented in DHCPv4 presents a problem of lax control in IPv6 environments. This is primarily because IPv6 adds the RA (Routing Advertisement) mechanism to route announcements compared to IPv4. This mechanism, part of the IPv6 Neighbor Discovery Protocol (NDP), is used by routers to announce their existence and network configuration parameters, such as network prefix and default gateway address, to nodes in the network. This reduces the configuration workload for network administrators and speeds up device onboarding. However, this also means that even with isolated network segment addresses configured, devices can still obtain the normal network segment prefix and default gateway address through the RA announcement of the normal router, allowing for normal network communication.

[0025] The purpose of this invention is to propose a method for implementing admission control in IPv6 networks by dividing isolation domains using DHCPv6 and using the priority of RA route advertisements within the isolation domains. This method can both implement admission control and provide network access guidance.

[0026] The following is combined with Figures 1-5 The embodiments of the present invention are described in detail.

[0027] Figure 1 This is a flowchart illustrating the method for admission control in an IPv6 network provided by the present invention, as shown below. Figure 1 As shown, the method includes the following steps: S110. Connect the terminal to the network and receive the terminal's network access request.

[0028] According to the method for admission control in an IPv6 network provided by the present invention, before a terminal accesses the network, a one-to-one isolated IPv6 network segment is created based on the normal IPv6 network segment planned in the current network; Dynamic Host Configuration Protocol version 6 service is enabled, and the routing announcement priority of the Dynamic Host Configuration Protocol version 6 service in the isolated network segment is adjusted.

[0029] Specifically, before a terminal can access the network, it is necessary to first identify the normal IPv6 network segment in the current network plan.

[0030] Based on the existing IPv6 normal network segments in the current network plan, create a corresponding one-to-one isolated IPv6 network segment. The purpose of this step is to build a relatively independent area within the network for pre-admission isolation and censorship of terminals. The creation of the isolated network segment should ensure logical isolation from the normal network segments without affecting the overall network performance and stability.

[0031] Enabling DHCPv6 service in an isolated network domain ensures that terminals can automatically obtain a valid IPv6 address and related network configuration information when accessing the isolated network segment. Enabling DHCPv6 service should follow standard network protocol configuration procedures to ensure the correctness and reliability of the service.

[0032] To achieve fine-grained control over terminal access behavior, the route advertisement priority of the DHCPv6 service in the isolated network domain needs to be adjusted. By adjusting the priority, it is possible to control whether terminals obtain routing information from the isolated network segment first when accessing the network, thereby ensuring that terminals are first guided to the isolated area for access review. This step requires comprehensive consideration of multiple factors such as network topology, routing protocols, and terminal access policies to ensure that the adjusted priority settings meet network security requirements without affecting user experience.

[0033] When a terminal initiates a network access request, the network should be able to correctly receive and process these requests. In the access control process, the terminal's network access request should first be directed to an isolated network segment for review. By checking the terminal's identity information, security status, and compliance policies, it is determined whether the terminal meets the conditions for accessing the normal network segment. Only when the terminal passes the review and meets all access requirements is it allowed to access the normal network segment for network communication.

[0034] By implementing the above solutions, access control for terminals can be effectively achieved in IPv6 networks, improving network security and manageability.

[0035] S120. Determine whether the terminal corresponding to the terminal's network access request is authorized by the Dynamic Host Configuration Protocol version 6 server.

[0036] Specifically, when a terminal attempts to access the network, it sends a network access request. This request contains the terminal's identification information, such as its MAC address, as well as other necessary network access parameters. The Dynamic Host Configuration Protocol version 6 (DHCPv6) server in the network is responsible for receiving these network access requests.

[0037] After receiving a terminal's network access request, the DHCPv6 server extracts the terminal's identification information from the request. This information is the basis for subsequent terminal authorization determination.

[0038] The DHCPv6 server compares the extracted terminal identification information with information pre-stored in the authorization database. The authorization database stores the identification information and corresponding authorization status of authorized terminals. By querying the database, the server can quickly determine whether the terminal sending the network access request has already been authorized to access the network.

[0039] Based on the query results, the DHCPv6 server determines the terminal's authorization status. If a record matching the requesting terminal exists in the database and its authorization status is valid, the server considers the terminal authorized and allows it to access the network. Conversely, if no corresponding record exists in the database or the record indicates that the terminal is unauthorized, the server will reject the terminal's network access request.

[0040] Based on the determined terminal authorization status, the DHCPv6 server will take appropriate measures. For authorized terminals, the server will assign an IPv6 address and other network configuration information, enabling the terminal to access the network normally. For unauthorized terminals, the server will return a rejection message or redirect the terminal to an isolation zone to await further processing or authorization.

[0041] By implementing the above steps, it can be ensured that only authorized terminals can access the network, thereby effectively improving network security and controllability.

[0042] S130. When the Dynamic Host Configuration Protocol version 6 server determines that the terminal is an unauthorized terminal, it assigns an isolated network segment IPv6 address to the unauthorized terminal and directs it to the network access page for authentication through route announcement. After successful authentication, the terminal's authorization status is re-evaluated.

[0043] According to the method for access control in an IPv6 network provided by the present invention, when the Dynamic Host Configuration Protocol version 6 (DHCP) server determines that the terminal is an unauthorized terminal, it allocates an IPv6 address of an isolated network segment to the unauthorized terminal and directs it to a login page for authentication through route announcement. After successful authentication, the terminal's authorization status is re-evaluated. Specifically, the method includes: when the DHCP server determines that the terminal is an unauthorized terminal, it allocates an IPv6 address of an isolated network segment to the unauthorized terminal; it announces a route to the terminal that has obtained the isolated network segment, and the terminal obtains the route information; when the browser is opened to access any information, it hijacks the access according to the route information and generates a login page; it completes the authentication of the unauthorized terminal on the login page; and after successful authentication, it re-enters the loop process of the DHCP server determining whether the terminal is authorized.

[0044] Specifically, after receiving a network access request from a terminal, the DHCPv6 server will first determine the terminal's authorization status. If the server determines that the terminal is unauthorized, it will trigger the subsequent access control process.

[0045] For unauthorized devices, the DHCPv6 server assigns them an IPv6 address in an isolated network segment. This address differs from the address in the normal network segment, ensuring that unauthorized devices are restricted to a specific area isolated from the normal network when accessing the network.

[0046] After assigning IPv6 addresses to isolated network segments, the DHCPv6 server will advertise routes to unauthorized terminals. This is to ensure that terminals receive the correct routing information so that they can forward data packets correctly within the network.

[0047] When an unauthorized device attempts to access arbitrary information through a browser, the network hijacks the access based on previously announced routing information. This means that regardless of which website the device originally tried to access, it will be redirected to a specific "redirection page." This page is used to guide the user through authentication.

[0048] On the onboarding page, unauthorized devices must complete an authentication process, including entering a username, password, verification code, or other forms of authentication such as multi-factor authentication. The authentication process must be secure to prevent unauthorized access.

[0049] Once an unauthorized terminal successfully passes authentication, the system will trigger the DHCPv6 server's authorization process again. This time, the determination will be based on updated authorization information (for example, the terminal may now have been added to the authorization database). If the terminal is now authorized, it will be allowed to access the normal network segment; if it is still unauthorized, the above admission control process will be repeated.

[0050] By following the steps described above, it can be ensured that only authenticated and authorized terminals can access the normal areas of the network, thereby greatly enhancing network security. At the same time, automated access control and authentication processes also improve network management efficiency and user experience.

[0051] S140. When the Dynamic Host Configuration Protocol version 6 server determines that the terminal is an authorized terminal, it assigns a normal network IPv6 address to the authorized terminal so that the terminal can access the network.

[0052] According to the method for access control in an IPv6 network provided by the present invention, after identity authentication is passed, a comprehensive evaluation is performed based on multi-dimensional data of the terminal to determine the security risk level of the terminal; the multi-dimensional data includes the terminal's real-time behavior, historical records, and network environment.

[0053] Specifically, after the terminal is authenticated, the system begins to collect multi-dimensional data about the terminal. This includes real-time behavioral data (such as network access patterns and data transmission rates), historical data (such as past network activity logs and security event records), and network environment data (such as the type of network currently connected, network topology, and information about surrounding devices).

[0054] The collected multi-dimensional data needs to undergo preprocessing and standardization to ensure its accuracy and consistency. Preprocessing includes steps such as data cleaning (removing invalid or erroneous data) and data normalization (adjusting the data to a uniform measurement range). Standardization ensures that data across different dimensions is comparable.

[0055] Based on preprocessed multi-dimensional data, a comprehensive evaluation model is constructed. This model can employ machine learning algorithms, statistical analysis methods, or other risk assessment techniques to quantitatively assess the security risks of endpoints. The model design should consider various security factors and be able to be adjusted and optimized according to actual needs.

[0056] The collected and processed multi-dimensional data is input into a comprehensive assessment model to conduct a security risk assessment of the endpoint. The assessment process includes weighted data processing, threshold determination, etc., to derive a specific security risk level. This level can be a numerical value, a classification label (such as "low risk", "high risk", etc.), or other forms of representation.

[0057] Based on the comprehensive assessment results, the security risk level of the terminal is determined. This level should accurately reflect the security status of the terminal in the current network environment and provide a basis for the formulation of subsequent security strategies.

[0058] Based on the determined security risk level, the system takes corresponding security measures. For terminals with low risk levels, normal access to network resources is allowed; for terminals with high risk levels, additional security audits are required, their network access permissions are restricted, or other necessary security protection measures are taken.

[0059] By implementing the above steps, we can achieve refined assessment and management of terminal security risks, further enhancing the security and controllability of IPv6 networks.

[0060] According to the method for access control in an IPv6 network provided by the present invention, after successful authentication, the process of determining whether the terminal is authorized by the Dynamic Host Configuration Protocol version 6 (DHCP) server is entered again. Specifically, the method includes: after successful authentication, recording the authentication time, number of authentication attempts, and authentication results of the terminal to form a terminal authentication history record; based on the terminal authentication history record, the DHCP server marks terminals whose authentication failures exceed a preset threshold or exhibit abnormal authentication behavior, and restricts the time interval for them to initiate network access requests again or permanently prohibits them from accessing the network.

[0061] Specifically, after a terminal successfully authenticates, the system first records the authentication time, number of authentication attempts, and authentication result. This information is stored in a database called "Terminal Authentication History" for subsequent analysis and processing.

[0062] The DHCPv6 server periodically or in real-time analyzes the terminal authentication history. Through this analysis, the server can identify terminals that have failed authentication more than a preset threshold or exhibit abnormal authentication behavior.

[0063] Before implementing access control methods, it is necessary to pre-set thresholds for authentication failures and criteria for judging abnormal authentication behavior. For example, a threshold can be set for the number of consecutive failures reaching a certain value (such as 5 times, 10 times, etc.), or behaviors such as frequently trying different authentication information in a short period of time or using illegal characters for authentication can be defined as abnormal.

[0064] Once the DHCPv6 server detects that a terminal has failed authentication more than a preset threshold or exhibits abnormal authentication behavior, it will mark the terminal. This marking can take the form of adding a specific status identifier to the terminal in the database, or adding it to a special list of problematic terminals.

[0065] For terminals marked as problematic, the DHCPv6 server will take appropriate measures to restrict or prohibit them from initiating network access requests again. Specific measures include: 1. Increase the time interval between problematic terminals re-initiating network access requests, for example, by setting them to be unable to attempt to reconnect to the network for the next few hours.

[0066] 2. For terminals that seriously violate regulations or consistently exhibit abnormal behavior, the server may choose to permanently block their access to the network.

[0067] While implementing restrictions or prohibitions, the system can also generate notifications to inform network administrators and / or end users of the relevant information. This helps administrators stay informed about security issues on the network and provides users with necessary support and guidance.

[0068] By implementing the above steps, the IPv6 network access control method provided by this invention can effectively identify and respond to potential security risks, and improve the overall security and stability of the network.

[0069] like Figure 2 The diagram shown is the main flowchart of the technical solution of this invention. Figure 2 As shown, the method for network access control in an IPv6 address environment using DHCPv6 combined with RA proposed in this invention includes the following steps: (1) Create a one-to-one isolated IPv6 address range based on the IPv6 network segments in the current network plan; (2) Enable DHCPv6 service; (3) Adjust the RA priority of the DHCPv6 service in the isolated network domain; (4) The terminal accesses the network and automatically obtains an IPv6 address; (5) The DHCPv6 server determines whether the terminal making the request is authorized. If not authorized, the following process is executed: a. Assign IPv6 addresses from isolated network segments to unauthorized terminals; b. Announce RA routes to terminals that have obtained the isolated network segment, with the gateway address being the DHCPv6 server itself and the prefix of the isolated network segment; c. The terminal obtains the isolation network prefix, the default gateway address (DHCPv6 server), and the normal DNS server address; d. Any information accessed through a browser contains DHCPv6 hijacking and provides a page to guide you to the network. e. Complete identity verification on the onboarding page; f. After successful authentication, the process of the DHCPv6 server determining whether the terminal is authorized will resume. (6) When the DHCPv6 server determines that the terminal is an authorized terminal, it assigns a normal network IPv6 address; (7) The normal network segment range is advertised by the router as a normal RA, with the default gateway address and network segment prefix; (8) Once the terminal obtains a normal IPv6 address, gateway and prefix, it can access the network.

[0070] Figure 3 This is a network architecture diagram for implementing IPv6 admission control. It shows that within the same VLAN on the switch, there are normal network segments and isolated network segments. The isolated network segments are virtually created by the DHCPv6 server based on the normal network segments, without needing to be created on the switch side.

[0071] When an unauthorized terminal accesses the network and dynamically obtains an IPv6 address, the DHCPv6 server by default assigns an IPv6 address to an isolated network segment. The DHCPv6 server then announces this address based on a high-priority RA (Range Address Sequence), ensuring that the terminal obtaining the isolated network IPv6 address acquires the isolated network segment prefix. This causes any information the terminal accesses to be directed to the DHCPv6 server. In this case, the DHCPv6 server acts as the gateway, and all access behavior must pass through the DHCPv6 server, thus achieving interception and redirection.

[0072] Once the terminal successfully authenticates in the isolated network segment IPv6 address stage and obtains legitimate authorization, the DHCPv6 client waits for a very short lease period. When it initiates the next address request, the DHCPv6 server allocates a legitimate IPv6 address based on its authentication status. In the normal network environment, the router performs normal RA announcement, thereby obtaining the normal network segment prefix and default gateway address, completing the overall guided network access control.

[0073] This invention implements guided network access control through DHCPv6 combined with RA (Route Admission) architecture. The main innovation lies in creating an isolated network area before network access and utilizing the priority of the RA within the isolated domain to specify the network segment prefix and default gateway. Based on the combination of the isolated domain and RA priority, access control and guided network access are achieved.

[0074] This invention implements guided network access control via DHCPv6. Compared to the allocation / non-allocation control method, this method provides guidance and an isolation buffer capability, allowing unauthorized terminals to self-repair within the isolation zone, thus improving the user experience. Compared to traditional access control based solely on the isolation network, it overcomes the blocking vulnerabilities introduced by the automatic configuration of the network via RA (Route Advertisement) announcement, a feature of IPv6 addresses. Through high-priority RA announcements, it directs network prefixes and gateways, enhancing the security of access control.

[0075] The apparatus for admission control in an IPv6 network provided by the present invention will be described below. The apparatus for admission control in an IPv6 network described below can be referred to in correspondence with the method for admission control in an IPv6 network described above.

[0076] like Figure 4 The image shows an apparatus for admission control in an IPv6 network provided by the present invention, comprising: The terminal access module is used to connect the terminal to the network and receive the terminal's network access request; The authorization determination module is used to determine whether the terminal corresponding to the terminal's network access request is authorized by the Dynamic Host Configuration Protocol version 6 server. The unauthorized handling module is used to assign an isolated network segment IPv6 address to the unauthorized terminal when the Dynamic Host Configuration Protocol version 6 server determines that the terminal is an unauthorized terminal, and to guide the terminal to the network access page for identity authentication through route announcement. After successful authentication, the terminal's authorization status is re-evaluated. The authorization processing module is used to assign a normal network IPv6 address to the authorized terminal when the Dynamic Host Configuration Protocol version 6 server determines that the terminal is an authorized terminal so that the terminal can access the network.

[0077] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5 As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communication bus 540. The processor 510, communications interface 520, and memory 530 communicate with each other via the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute a method for access control in an IPv6 network. This method includes: connecting a terminal to the network and receiving a terminal access request; determining whether the terminal corresponding to the access request is authorized through a Dynamic Host Configuration Protocol (DHCP) version 6 (DMP) server; when the DMP server determines the terminal is unauthorized, allocating an isolated network segment IPv6 address to the unauthorized terminal and directing it to a network access page for authentication via route announcement; after successful authentication, re-determining the terminal's authorization status; when the DMP server determines the terminal is authorized, allocating a normal network IPv6 address to the authorized terminal for network access.

[0078] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0079] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the access control method in the IPv6 network provided by the above methods. The method includes: connecting a terminal to the network and receiving a terminal access request; determining whether the terminal corresponding to the terminal access request is authorized through a Dynamic Host Configuration Protocol (DHCP) version 6 server; when the DHCP version 6 server determines that the terminal is an unauthorized terminal, allocating an isolated network segment IPv6 address to the unauthorized terminal and guiding it to the access page for authentication through route announcement, and re-determining the terminal's authorization status after successful authentication; when the DHCP version 6 server determines that the terminal is an authorized terminal, allocating a normal network IPv6 address to the authorized terminal and allowing the terminal to access the network.

[0080] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements a method for access control in an IPv6 network provided by the methods described above. The method includes: connecting a terminal to the network and receiving a terminal access request; determining, through a Dynamic Host Configuration Protocol (DHCP) version 6 (DMP) server, whether the terminal corresponding to the access request is authorized; when the DMP server determines that the terminal is an unauthorized terminal, allocating an isolated network segment IPv6 address to the unauthorized terminal and directing it to a network access page for authentication via route announcement, and re-determining the terminal's authorization status after successful authentication; when the DMP server determines that the terminal is an authorized terminal, allocating a normal network IPv6 address to the authorized terminal for network access.

[0081] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0082] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for admission control in an IPv6 network, characterized in that, include: Connect the terminal to the network and receive the terminal's network access request; The Dynamic Host Configuration Protocol version 6 (DIP) server determines whether the terminal corresponding to the network access request is authorized. When the Dynamic Host Configuration Protocol version 6 server determines that the terminal is an unauthorized terminal, it assigns an isolated network segment IPv6 address to the unauthorized terminal and directs it to the network access page for identity authentication through route announcement. After successful authentication, the terminal's authorization status is re-evaluated. When the Dynamic Host Configuration Protocol version 6 server determines that the terminal is an authorized terminal, it assigns a normal network IPv6 address to the authorized terminal so that the terminal can access the network. Before the terminal accesses the network, the method further includes: creating a one-to-one isolated IPv6 network segment for the IPv6 normal network segment planned by the current network; enabling Dynamic Host Configuration Protocol version 6 service and adjusting the routing announcement priority of the Dynamic Host Configuration Protocol version 6 service for the isolated network segment, so as to control the terminal to obtain the routing information of the isolated network segment first when accessing the network; The step of guiding the user to the network access page via route announcement includes: performing RA route announcement to terminals that have obtained isolated network segments, so that terminals that have obtained isolated network IPv6 addresses can obtain the isolated network segment prefix and the gateway address is the DHCPv6 server itself.

2. The method for admission control in an IPv6 network according to claim 1, characterized in that, When the Dynamic Host Configuration Protocol version 6 (DHCP) server determines that a terminal is unauthorized, it assigns an isolated network segment IPv6 address to the unauthorized terminal and redirects it to the network access page for authentication via route announcement. After successful authentication, the terminal's authorization status is reassessed. Specifically, this includes: When the Dynamic Host Configuration Protocol version 6 server determines that the terminal is an unauthorized terminal, it assigns an IPv6 address in an isolated network segment to the unauthorized terminal; The route is advertised to the terminals that have obtained the isolated network segment, and the terminals obtain the route information; When a browser is opened and accesses any information, the access is hijacked based on the routing information, and a page is generated to redirect users to the network. Complete the authentication of unauthorized terminals on the network access page; Once authentication is successful, the process of determining whether the terminal is authorized is repeated again by the Dynamic Host Configuration Protocol version 6 server.

3. The method for admission control in an IPv6 network according to claim 1, characterized in that, After successful identity authentication, the method further includes: A comprehensive assessment is conducted based on multi-dimensional data from the terminal to determine its security risk level. The multi-dimensional data includes the terminal's real-time behavior, historical records, and network environment.

4. A device for admission control in an IPv6 network, characterized in that, include: The terminal access module is used to connect the terminal to the network and receive the terminal's network access request; The authorization determination module is used to determine whether the terminal corresponding to the terminal network access request is authorized by the Dynamic Host Configuration Protocol version 6 server. The unauthorized processing module is used to assign an isolated network segment IPv6 address to the unauthorized terminal and guide it to the network access page for identity authentication through routing announcement when the Dynamic Host Configuration Protocol version 6 server determines that the terminal is an unauthorized terminal. After successful authentication, the terminal's authorization status is re-evaluated. The authorization processing module is used to assign a normal network IPv6 address to the authorized terminal so that the terminal can access the network when the Dynamic Host Configuration Protocol version 6 server determines that the terminal is an authorized terminal. The device is also used to: before the terminal accesses the network, create a one-to-one isolated IPv6 network segment based on the IPv6 normal network segment planned by the current network. Enable Dynamic Host Configuration Protocol version 6 (DHCP) service and adjust the routing advertisement priority of DHCP version 6 service in the isolated network domain to control the terminal to obtain routing information of the isolated network segment first when accessing the network; The step of guiding the user to the network access page via route announcement includes: performing RA route announcement to terminals that have obtained isolated network segments, so that terminals that have obtained isolated network IPv6 addresses can obtain the isolated network segment prefix and the gateway address is the DHCPv6 server itself.

5. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements a method for access control in an IPv6 network as described in any one of claims 1 to 3.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements a method for access control in an IPv6 network as described in any one of claims 1 to 3.

7. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements a method for access control in an IPv6 network as described in any one of claims 1 to 3.

Images