Network access control strategy validity verification device, system and method

Abstract

The invention relates to a network access control strategy validity verification device, system and method. The device comprises an ARM architecture single board computer, a multi-network-port line concentration module and a touch screen module. The ARM architecture single board computer is electrically connected with the multi-network-port line concentration module and the display module, and the ARM architecture single board computer is used for operating the network access control strategy validity verification system; the multi-network-port line concentration module is used for connecting a to-be-detected network port; the touch screen module is used for interacting with a network access control strategy validity verification system, the device can quickly and automatically verify whether the access control strategy of the current network access point is valid or not, guarantee is provided for enterprise safety protection, the device can replace manual verification which is high in specialty and complex in operation, the cost is greatly reduced, and the safety is improved.

Description

Technical Field

[0001] The invention relates to a network access control strategy validity verification device, system and method, belonging to the technical field of network security. Background Art

[0002] The Network Access Control System (NAC) strictly manages the process of users, devices or applications connecting to and accessing the network through a series of verification and authorization measures. Its core concept is that "only legitimate users and secure terminals can access the network."

[0003] The network access control system is designed to ensure that only legitimate and trustworthy terminal devices can access the network, thereby protecting the security, reliability and effective use of network resources. Its working principle includes multiple links such as user authentication, authority management, security inspection and flow control, building a comprehensive security protection system.

[0004] The network access control system is designed to ensure that only legitimate and trustworthy terminal devices can access the network, thereby protecting the security, reliability and effective use of network resources. After deploying the network access control system, the network administrator can connect a laptop to the enterprise network port to verify whether the access is deployed in place and whether it can be bypassed by technical means. If the blocking of the network access control system can be bypassed by technical means to achieve the purpose of accessing the target network resources, the network administrator should check whether the access policy is deployed in place and make corresponding rectifications.

[0005] The network access control system is designed to ensure that only legitimate and trustworthy terminal devices can access the network. After an enterprise deploys a network access control system, if the enterprise is large and the network port access points are numerous and widespread, the workload is heavy and it is impossible to fully check whether the access policy of each network port is effective.

[0006] Verifying the effectiveness of network port access policies is a highly professional task, with many ways to bypass access, complicated operations, and high technical requirements, making it beyond the capability of ordinary technicians. Summary of the invention

[0007] In order to solve the above problems existing in the prior art, the present invention proposes a network admission control policy validity verification device, system and method.

[0008] The technical solution of the present invention is as follows:

[0009] On the one hand, the present invention provides a network access control strategy validity verification device, including an ARM architecture single board computer, a multi-network port hub module and a touch screen module;

[0010] The ARM architecture single board computer is electrically connected to the multi-network port hub module and the display module respectively, and the ARM architecture single board computer is used to run the network access control strategy validity verification system;

[0011] The multi-network port hub module is used to connect the network ports to be detected;

[0012] The touch screen module is used to interact with the network admission control policy validity verification system.

[0013] On the other hand, the present invention also provides a network access control policy validity verification system, including a network configuration module, a monitoring module, a scanning module and an analysis module;

[0014] The network configuration module is used to configure the ARM architecture single board computer network card configuration information;

[0015] The monitoring module is used to capture the flow data in the corresponding network of the network port to be detected, and extract all valid IP addresses and MAC addresses in the flow data;

[0016] The scanning module is used to scan the ICMP connectivity, survival port service and survival port service type of the specified network segment in the corresponding network of the network port to be detected;

[0017] The analysis module is used to analyze the effectiveness of the admission strategy according to the scanning result of the scanning module.

[0018] As a preferred implementation manner of the present invention, the configuration information of the ARM architecture single board computer network card includes a network card mode, an address acquisition mode, an IP address and a MAC address.

[0019] In another aspect, the present invention further provides a method for verifying the effectiveness of a network admission control policy, comprising the following steps:

[0020] Change the network card to promiscuous mode through the network configuration module, change the address acquisition mode to automatic address acquisition, and try to automatically obtain the IP address;

[0021] If the IP address is obtained automatically successfully, the traffic data in the network is monitored through the monitoring module, and all valid IP addresses in the traffic data are extracted. The network segment corresponding to the valid IP address is scanned through the scanning module, and then the analysis module is used to determine whether the resources in the network can be accessed based on the scanning results. If the network resource access is successful, the access policy is judged to be invalid.

[0022] As a preferred embodiment of the present invention, if the automatic acquisition of the IP address fails or the resources in the network cannot be accessed after the automatic acquisition of the IP address succeeds, the traffic data in the network is monitored by the monitoring module, and all valid IP addresses and MAC addresses in the traffic data are extracted, and an IP-MAC list is constructed to store the valid IP addresses and MAC addresses;

[0023] The IP-MAC list is traversed through the network configuration module, and the network card IP address is set to the same network segment IP address for each traversed IP address. The network segment is scanned through the scanning module, and then the analysis module is used to determine whether the resources in the network can be accessed based on the scanning results. If the network resource access is successful during the traversal process, the access policy is judged to be invalid.

[0024] As a preferred embodiment of the present invention, if there is no successful access to network resources until the IP-MAC list is traversed, the IP-MAC list is traversed again through the network configuration module, and the IP address and MAC address traversed each time are cloned into the IP address and MAC address of the network card. The network segment is scanned by the scanning module, and then the analysis module is used to determine whether the resources in the network can be accessed based on the scanning results. If there is successful access to network resources during the traversal process, it is determined that the access policy is invalid.

[0025] As a preferred embodiment of the present invention, if the network configuration module still fails to access the network resources successfully after traversing the IP-MAC list again, the analysis module detects whether there is an 802.1x protocol packet in the network. If no 802.1x protocol packet is detected, the access policy is judged to be valid.

[0026] As a preferred embodiment of the present invention, if an 802.1x protocol packet is detected, the EAP authentication packet in the traffic data is analyzed by the analysis module, and a forged EAPOL-Start frame is sent based on the EAP authentication packet to force a request for re-identity authentication. The generated identity authentication is analyzed to determine the EAP method used. If the EAP method is EAP-MD5, the identity information and hash value are captured, the identity information is forged to access the network, the network segment corresponding to the valid IP address is scanned by the scanning module, and then the analysis module is used to determine whether the resources in the network can be accessed based on the scanning results. If the network resource access is successful, the access policy is determined to be invalid. If the network resource access fails, the access policy is determined to be valid.

[0027] The present invention has the following beneficial effects:

[0028] 1. The device of the present invention simulates hacker intrusion by accessing the network port, automatically analyzes the network environment, and tries to break through the access control of the current network to achieve the purpose of connecting the network to access network resources; the device can quickly and automatically verify whether the access control policy of the current network access point is effective, providing protection for enterprise security protection. The device can replace highly professional and complex manual verification, greatly reducing costs and improving security. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a structural diagram of the device of the present invention;

[0030] Figure 2 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0031] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] It should be understood that the step numbers used in this document are only for convenience of description and are not intended to limit the order in which the steps are executed.

[0033] It should be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0034] The terms “include” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0035] The term "and / or" means and includes any and all possible combinations of one or more of the associated listed items.

[0036] Embodiment 1:

[0037] See also Figure 1 , a network access control strategy validity verification device, characterized by comprising an ARM architecture single board computer, a multi-network port hub module and a touch screen module;

[0038] The ARM architecture single board computer is electrically connected to the multi-network port hub module and the display module respectively, and the ARM architecture single board computer is used to run a network access control strategy validity verification system, which is developed based on Python;

[0039] The multi-network port hub module is used to connect the network port to be detected. During the detection, if the network port to be detected is not connected to a device, one end of the network cable is connected to the hub module of the device, and the other end is connected to the network port to be detected; if the network port to be detected is connected to a device, the original device is unplugged from the network port and connected to the hub module of the device, and at the same time, the hub module is connected to the network port to be detected with a network cable;

[0040] The touch screen module is used to interact with the network admission control policy validity verification system.

[0041] Embodiment 2:

[0042] A network access control policy validity verification system, based on the device implementation described in the first embodiment, runs in an ARM architecture single board computer, including a network configuration module, a monitoring module, a scanning module and an analysis module;

[0043] The network configuration module is used to configure the ARM architecture single board computer network card configuration information;

[0044] The monitoring module is used to capture the flow data in the corresponding network of the network port to be detected, and extract all valid IP addresses and MAC addresses in the flow data;

[0045] The scanning module is used to scan the ICMP connectivity, survival port service and survival port service type of the specified network segment in the corresponding network of the network port to be detected;

[0046] The analysis module is used to analyze the effectiveness of the admission strategy according to the scanning result of the scanning module.

[0047] As a preferred implementation of this embodiment, the configuration information of the ARM architecture single board computer network card includes a network card mode, an address acquisition mode, an IP address and a MAC address.

[0048] Embodiment three:

[0049] See also Figure 2 A method for verifying the validity of a network admission control strategy, used in the method described in Embodiment 2, comprises the following steps:

[0050] Change the network card to promiscuous mode through the network configuration module, change the address acquisition mode to automatic address acquisition, and try to automatically obtain the IP address;

[0051] If the IP address is obtained automatically successfully, the traffic data in the network is monitored through the monitoring module, and all valid IP addresses in the traffic data are extracted. The network segment corresponding to the valid IP address is scanned through the scanning module, and then the analysis module is used to determine whether the resources in the network can be accessed based on the scanning results. If the network resource access is successful, the access policy is judged to be invalid.

[0052] As a preferred implementation of this embodiment, if the automatic acquisition of the IP address fails or the resources in the network cannot be accessed after the automatic acquisition of the IP address succeeds, the traffic data in the network is monitored by the monitoring module, and all valid IP addresses and MAC addresses in the traffic data are extracted, and an IP-MAC list is constructed to store the valid IP addresses and MAC addresses;

[0053] The IP-MAC list is traversed through the network configuration module, and the network card IP address is set to the same network segment IP address for each traversed IP address. The network segment is scanned through the scanning module, and then the analysis module is used to determine whether the resources in the network can be accessed based on the scanning results. If the network resource access is successful during the traversal process, the access policy is judged to be invalid.

[0054] As a preferred implementation mode of this embodiment, if the network resource access is not successful until the IP-MAC list traversal is completed, the IP-MAC list is traversed again through the network configuration module, and the IP address and MAC address traversed each time are cloned into the IP address and MAC address of the network card. The network segment is scanned by the scanning module, and then the analysis module is used to determine whether the resources in the network can be accessed based on the scanning results. If the network resource access is successful during the traversal process, it is determined that the access policy is invalid.

[0055] As a preferred implementation of this embodiment, if the network configuration module still fails to access the network resources successfully after traversing the IP-MAC list again, the analysis module detects whether there is an 802.1x protocol packet in the network. If no 802.1x protocol packet is detected, the access policy is judged to be valid.

[0056] As a preferred implementation mode of this embodiment, if an 802.1x protocol packet is detected, the EAP authentication packet in the traffic data is analyzed by the analysis module, and a forged EAPOL-Start frame is sent based on the EAP authentication packet to force a request for re-identity authentication. The generated identity authentication is analyzed to determine the EAP method used. If the EAP method is EAP-MD5, the identity information and hash value are captured, the identity information is forged to access the network, the network segment corresponding to the valid IP address is scanned by the scanning module, and then the analysis module is used to determine whether the resources in the network can be accessed based on the scanning results. If the network resource access is successful, the access policy is determined to be invalid. If the network resource access fails, the access policy is determined to be valid.

[0057] In the embodiments of the present application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can be represented by: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c can be single or multiple.

[0058] Those of ordinary skill in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented in a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0059] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0060] In several embodiments provided in the present application, if any function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory; hereinafter referred to as: ROM), random access memory (Random Access Memory; hereinafter referred to as: RAM), disk or optical disk, and other media that can store program codes.

[0061] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A network access control strategy validity verification device, characterized in that: Including ARM architecture single board computer, multi-port hub module and touch screen module; The ARM architecture single board computer is electrically connected to the multi-network port hub module and the display module respectively, and the ARM architecture single board computer is used to run the network access control strategy validity verification system; The multi-network port hub module is used to connect the network ports to be detected; The touch screen module is used to interact with the network admission control policy validity verification system.

2. A network access control policy validity verification system, implemented based on the device of claim 1, characterized in that: Including network configuration module, monitoring module, scanning module and analysis module; The network configuration module is used to configure the ARM architecture single board computer network card configuration information; The monitoring module is used to capture the flow data in the corresponding network of the network port to be detected, and extract all valid IP addresses and MAC addresses in the flow data; The scanning module is used to scan the ICMP connectivity, survival port service and survival port service type of the specified network segment in the corresponding network of the network port to be detected; The analysis module is used to analyze the effectiveness of the admission strategy according to the scanning result of the scanning module.

3. A network access control policy validity verification system according to claim 2, characterized in that: The configuration information of the ARM architecture single board computer network card includes network card mode, address acquisition mode, IP address and MAC address.

4. A method for verifying the effectiveness of a network access control strategy, used in the system of claim 2, characterized in that: The following steps are involved: Change the network card to promiscuous mode through the network configuration module, change the address acquisition mode to automatic address acquisition, and try to automatically obtain the IP address; If the IP address is obtained automatically successfully, the traffic data in the network is monitored through the monitoring module, and all valid IP addresses in the traffic data are extracted. The network segment corresponding to the valid IP address is scanned through the scanning module, and then the analysis module is used to determine whether the resources in the network can be accessed based on the scanning results. If the network resource access is successful, the access policy is judged to be invalid.

5. A method for verifying the effectiveness of a network access control strategy according to claim 4, characterized in that: If the automatic acquisition of the IP address fails or the resources in the network cannot be accessed after the automatic acquisition of the IP address succeeds, the traffic data in the network is monitored through the monitoring module, and all valid IP addresses and MAC addresses in the traffic data are extracted, and an IP-MAC list is constructed to store the valid IP addresses and MAC addresses; The IP-MAC list is traversed through the network configuration module, and the network card IP address is set to the same network segment IP address for each traversed IP address. The network segment is scanned through the scanning module, and then the analysis module is used to determine whether the resources in the network can be accessed based on the scanning results. If the network resource access is successful during the traversal process, the access policy is judged to be invalid.

6. A method for verifying the effectiveness of a network access control strategy according to claim 5, characterized in that: If network resource access is not successful until the IP-MAC list is traversed, the IP-MAC list is traversed again through the network configuration module, and the IP address and MAC address traversed each time are cloned into the IP address and MAC address of the network card. The network segment is scanned by the scanning module, and then the analysis module is used to determine whether the resources in the network can be accessed based on the scanning results. If network resource access is successful during the traversal process, the access policy is judged to be invalid.

7. A method for verifying the effectiveness of a network access control strategy according to claim 6, characterized in that: If the network configuration module still fails to access the network resource successfully after traversing the IP-MAC list again, the analysis module detects whether there is an 802.1x protocol packet in the network. If no 802.1x protocol packet is detected, the admission policy is determined to be valid.

8. A method for verifying the effectiveness of a network access control strategy according to claim 7, characterized in that: If an 802.1x protocol packet is detected, the EAP authentication packet in the traffic data is analyzed through the analysis module, and a forged EAPOL-Start frame is sent based on the EAP authentication packet to force a request for re-authentication. The generated authentication is analyzed to determine the EAP method used. If the EAP method is EAP-MD5, the identity information and hash value are captured, the identity information is forged to access the network, the network segment corresponding to the valid IP address is scanned through the scanning module, and then the analysis module is used to determine whether the resources in the network can be accessed based on the scanning results. If the network resource access is successful, the access policy is invalid. If the network resource access fails, the access policy is valid.

Images