Authority management method and device for realizing user access control, equipment and medium

Abstract

The invention provides an authority management method and device for realizing user access control, equipment and a medium, and the method comprises the steps: obtaining authentication request information of a user in response to a request of the user for accessing a first network of which authority management is started; based on the authentication request information, obtaining a user permission attribute of the user, the user permission attribute being used for representing an identity of the user; generating an access control list of the user based on the user permission attribute and the authentication request information; and automatically configuring the access control list to a management and control device of a network segment where the user is located, and controlling the permission of the user to access the first network through the management and control device.

Description

Technical Field

[0001] The present disclosure relates to the field of network security, and in particular to a permission management method, device, equipment and storage medium for implementing user access control. Background Art

[0002] In the current digital working environment, the demand for network mobility and dynamism has increased significantly. Traditional network architecture mainly relies on geographical location for network division and management, and the stability and security of its network connection have become a major problem. Specifically, in the traditional network environment, the user's IP address is closely bound to his physical location. Once the user's location changes, his IP address will often change accordingly, which directly affects the continuity and security of network access: on the one hand, the user needs to re-acquire the IP address and may encounter network interruption, which affects work efficiency and user experience; on the other hand, the security policy based on the IP address needs to be manually adjusted to adapt to the new IP allocation, which is not only cumbersome to operate, but also easy to introduce security risks. In addition, there are compatibility issues in the linkage of network devices and security products of different brands and models, which further exacerbates the complexity and challenges of network management. Especially in highly mobile scenarios, how to ensure that users can seamlessly and securely access the required resources at any location while maintaining their original security protection permissions has become a key issue that needs to be urgently solved by traditional network architecture and security system. Summary of the invention

[0003] 1. Technical issues to be resolved

[0004] In view of the above problems, the present disclosure provides a permission management method, apparatus, device and storage medium for implementing user access control, so as to at least partially solve the technical problems such as poor continuity and security of network access and insufficient compatibility under traditional network architecture.

[0005] (II) Technical solution

[0006] The present disclosure provides a permission management method for realizing user access control, comprising: in response to a user's request to access a first network for which permission management has been enabled, obtaining authentication request information of the user; based on the authentication request information, obtaining user permission attributes of the user, wherein the user permission attributes are used to characterize the identity of the user; based on the user permission attributes and the authentication request information, generating an access control list of the user; automatically configuring the access control list to a control device in a network segment where the user is located, and controlling the user's permission to access the first network through the control device.

[0007] According to an embodiment of the present disclosure, generating the access control list of the user based on the user authority attributes and the authentication request information includes: identifying the topology information of the second network where the user is located based on the network address in the authentication request information; querying the network segment configuration information of the network segment where the user is located based on the topology information; matching the user authority attributes, the topology information and the network segment configuration information with a pre-configured first authority rule, and generating the access control list of the user based on the matching result.

[0008] According to an embodiment of the present disclosure, the method also includes: in response to the user terminating access to the first network, matching the authentication request information with a pre-configured second permission rule, and generating a revocation instruction for the user's access control list; sending the revocation instruction to the management and control device of the network segment where the user is located, and revoking the user's access control list.

[0009] According to an embodiment of the present disclosure, automatically configuring the access control list to the control and management device of the network segment where the user is located includes: when the control and management device of the network segment where the user is located supports the extended attribute of the first protocol, automatically receiving the access control list through the extended attribute; or when the control and management device of the network segment where the user is located supports the second protocol, configuring the access control list on the control and management device using the second protocol; or when the control and management device of the network segment where the user is located does not support the first protocol and the second protocol, remotely connecting to the control and management device and configuring the access control list.

[0010] According to an embodiment of the present disclosure, the method further includes: in response to the user accessing the first network, recording and calculating the fee for the user to access the resources of the first network; when the user terminates access to the first network or the user is idle for more than a preset time period, stopping calculating the fee for the user to access the resources of the first network.

[0011] According to an embodiment of the present disclosure, the management and control device and the authority device that generates the access control list are interconnected through a network.

[0012] According to an embodiment of the present disclosure, obtaining the user authority attributes of the user based on the authentication request information includes: judging whether the user is a legitimate network user based on the authentication request information; intercepting the user's access request when the user is an illegal user; and obtaining the user authority attributes of the user when the user is a legitimate user.

[0013] A second aspect of the present disclosure provides a permission management device for implementing user access control, including: an acquisition module, used to obtain authentication request information of a user in response to a request by the user to access a first network for which permission management has been enabled; an authentication module, used to obtain user permission attributes of the user based on the authentication request information, wherein the user permission attributes are used to characterize the identity of the user; a generation module, used to generate an access control list of the user based on the user permission attributes and the authentication request information; and a control module, used to automatically configure the access control list to a management and control device in a network segment where the user is located, and control the user's permission to access the first network through the management and control device.

[0014] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a storage device for storing one or more computer programs, when the one or more programs are executed by the one or more processors, the one or more processors execute the permission management method for implementing user access control.

[0015] The fourth aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the permission management method for implementing user access control.

[0016] (III) Beneficial effects

[0017] The permission management method, device, equipment and storage medium for realizing user access control provided by the present disclosure associates the user's permission control only with the user's permission attribute, and does not need to be pre-configured on the network control device, but is limited to the network segment where the user is located, and is set or revoked according to the user's online location. Therefore, the configuration process is greatly simplified, the management cost is reduced, and the dynamic allocation and revocation of permissions are realized, ensuring the effectiveness, continuity and security of the access control strategy. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] For a more complete understanding of the present disclosure and its advantages, reference will now be made to the following description taken in conjunction with the accompanying drawings, in which:

[0019] Figure 1 A schematic diagram of a flow chart of a method for managing user access control provided by an embodiment of the present disclosure is shown;

[0020] Figure 2 Another flowchart of the method for managing user access control provided by the embodiment of the present disclosure is schematically shown;

[0021] Figure 3 The structure block diagram of the rights management device for implementing user access control provided in accordance with an embodiment of the present disclosure is schematically shown;

[0022] Figure 4 The hardware structure diagram of an electronic device is schematically shown. DETAILED DESCRIPTION

[0023] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0024] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0025] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0026] Some block diagrams and / or flow charts are shown in the accompanying drawings. It should be understood that some blocks or combinations thereof in the block diagrams and / or flow charts may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that these instructions, when executed by the processor, may create a device for implementing the functions / operations described in these block diagrams and / or flow charts.

[0027] Therefore, the technology of the present disclosure can be implemented in the form of hardware and / or software (including firmware, microcode, etc.). In addition, the technology of the present disclosure can take the form of a computer program product on a computer-readable medium storing instructions, which can be used by an instruction execution system or in combination with an instruction execution system. In the context of the present disclosure, a computer-readable medium can be any medium that can contain, store, transmit, propagate, or transmit instructions. For example, a computer-readable medium can include, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, device, or propagation medium. Specific examples of computer-readable media include: magnetic storage devices, such as magnetic tape or hard disk (HDD); optical storage devices, such as compact disk (CD-ROM); memory, such as random access memory (RAM) or flash memory; and / or wired / wireless communication links.

[0028] The inventor has found through research that in the relevant technology, the network segmentation strategy based on geographic location faces significant challenges, especially in scenarios with high user mobility. For example, when an employee crosses a physical area (such as moving from Building A to Building B), his network connection is often interrupted and the IP address needs to be re-acquired, which directly triggers the need to redeploy the security policy. Similarly, when employees move within the office area (such as from an office to a conference room), or collaborate across departments (such as from the marketing department to the R&D department), or even travel remotely to a branch office, their access needs for shared resources and the problem of maintaining permissions become particularly complex. Traditionally, the IP address obtained by the user is closely related to the physical location where the user accesses the Internet, and network security devices (such as firewalls) control access rights through security policies based on IP addresses. This architecture can still maintain stability in static or low-mobility environments, but it has great limitations in the current dynamic and high-mobility work environment. The frequent changes in IP addresses require that security policies must be adjusted accordingly, which not only increases the management burden, but may also introduce security risks, especially when networks and security products of different brands and standards are linked, compatibility and operational complexity become a major problem. Therefore, in order to solve the above problems, the embodiments of the present disclosure provide a permission management method, apparatus, device and storage medium for implementing user access control.

[0029] like Figure 1 As shown, the flowchart of the permission management method for implementing user access control includes S1 to S4.

[0030] In operation S1, in response to a user's request to access a first network for which permission management has been enabled, authentication request information of the user is obtained.

[0031] In operation S2, a user authority attribute of the user is obtained based on the authentication request information, wherein the user authority attribute is used to characterize the identity of the user.

[0032] In operation S3, an access control list of the user is generated based on the user authority attribute and the authentication request information.

[0033] In operation S4, the access control list is automatically configured to the management and control device of the network segment where the user is located, and the user's access to the first network is controlled through the management and control device.

[0034] Figure 2 Another flowchart of the permission management method for implementing user access control provided by an embodiment of the present disclosure is schematically shown.

[0035] In some exemplary embodiments, Figure 2As shown, first, the necessary authentication, authorization, and accounting (AAA) related parameters, including IP address, shared key, etc., are configured on the network access server (NAS). When a user attempts to access the first network with permission management enabled, the NAS intercepts the access request and obtains the user's authentication request information, which usually includes the user name, password, NAS's IP address, and the IP address used by the user when attempting to access (if available). Then, the NAS sends the user's authentication request information to the authentication device through the first protocol (such as the Remote Authentication Dial-in User Service protocol, or RADIUS protocol in English), and verifies the user's identity through the authentication device. The authentication device then sends the authentication result to the permission device, and uses the permission device to further query the user's permission attributes, such as the user group (or the department to which the user belongs), and the user's role (if any). The user's permission attributes are used to characterize the user's identity and permission level in the network. Based on the user's permission attributes, the permission device dynamically generates an access control list (ACL) for the user. The ACL lists in detail the resources and services that the user can access in the network and the corresponding access rights. Finally, the permission device automatically configures the generated access control list to the management and control device of the user's network segment, and controls the user's network access rights according to the rules in the ACL.

[0036] It should be noted that the permission management method for implementing user access control provided by the embodiments of the present disclosure, when implemented, can widely support existing network devices, including but not limited to ordinary access switches, aggregation switches, and core switches, without requiring these switches to have additional special functions or complex configurations, thereby achieving efficient and flexible network access permission management with minimal hardware dependence.

[0037] It is understandable that by associating security policies (permission control) only with the user permission attributes (such as user groups and user roles) of the user to whom they belong, permission confusion or security vulnerabilities caused by changes in the user's physical location are eliminated, ensuring the security of user access, while improving user work efficiency and reducing interruptions and delays caused by permission issues.

[0038] Furthermore, obtaining the user authority attributes of the user based on the authentication request information includes: judging whether the user is a legitimate network user based on the authentication request information; intercepting the user's access request when the user is an illegal user; and obtaining the user authority attributes of the user when the user is a legitimate user.

[0039] Exemplarily, the authentication device verifies the user name and password in the authentication request information, compares the user name and password with the user information stored in the security database, and confirms the identity of the user accessing the first network. If the user name and password match successfully, the authentication device will confirm that the user is a legitimate network user, and continue the subsequent permission allocation process to obtain the user's user permission attributes; if the match fails, the authentication device will immediately reject the user's access request and send a rejection message to the network access server (NAS) or the user terminal, prompting the user that the authentication has failed.

[0040] It should be noted that user permission attributes include user groups and user roles. The authentication device obtains the user group (or the department to which the user belongs) that usually defines the basic permission scope and affiliation of the user in the network by querying the user database or the directory service integrated with it. In some cases, in addition to the user group or department, the system may also assign a user role to the user that defines a series of operations and tasks that the user can perform in the network.

[0041] It can be understood that by ensuring that only legitimate users can access the network, the risk of unauthorized access is reduced and potential security threats are effectively prevented.

[0042] Furthermore, the generation of the access control list of the user based on the user authority attributes and the authentication request information includes: identifying the topology information of the second network where the user is located based on the network address in the authentication request information; querying the network segment configuration information of the network segment where the user is located based on the topology information; matching the user authority attributes, the topology information and the network segment configuration information with the pre-configured first authority rules, and generating the access control list of the user based on the matching result.

[0043] Specifically, the authentication device sends the user's permission attributes and authentication request information, such as the user name, user group, user role, user IP address, and NAS IP address, to the permission device. The permission device determines the physical location of the user's network based on the NAS IP address, that is, the topology information of the second network where the user is located. Then, based on the identified network topology information, the IP configuration information of the user's network segment, that is, the network segment configuration information (gateway IP, switch IP, etc.) is queried from the pre-configured information. Finally, the permission device matches this information with the pre-configured first permission rule, and generates an ACL for the user based on the matching result, which clearly lists the resources that the user can access and are prohibited from accessing.

[0044] It is understandable that by accurately identifying the user's network environment (including network topology and network segment configuration information) and matching permissions based on the user's permission attributes, a highly personalized ACL can be generated to ensure that only users with corresponding permissions can access specific network resources, thereby effectively preventing unauthorized access and potential security threats.

[0045] Furthermore, automatically configuring the access control list to the control and management device of the network segment where the user is located includes: when the control and management device of the network segment where the user is located supports the extended attribute of the first protocol, automatically receiving the access control list through the extended attribute; or when the control and management device of the network segment where the user is located supports the second protocol, configuring the access control list on the control and management device using the second protocol; or when the control and management device of the network segment where the user is located does not support the first protocol and the second protocol, remotely connecting to the control and management device and configuring the access control list.

[0046] Exemplarily, in the process of the authority device sending the user's ACL to the control device (such as a gateway, or access switch, aggregation switch, etc.) of the network segment where the user is located, the specific sending method can be: when the control device of the network segment where the user is located supports the extended attribute of the first protocol (such as the RADIUS protocol), the authority device will encode the ACL as an extended attribute in the RADIUS response message, and then send it to the authentication device. After successfully authenticating the user, the authentication device will parse the ACL information in the RADIUS response and forward the ACL to the corresponding control device through its management interface (such as the RADIUS proxy function). Then, the control device parses these extended attributes and applies the ACL information to its configuration to achieve control of the user's access rights. Alternatively, if the control device of the network segment where the user is located supports the configuration of the second protocol (such as the Simple Network Management Protocol, English expression is SNMP protocol), the user's ACL can be configured through SNMP, that is, a connection is established with the control device through the SNMP protocol, and a SET request is sent to configure the ACL. If the control device in the user's network segment does not support the above two methods, you can also use remote connection protocols such as Secure Shell (SSH) or Remote Login (Telnet) to establish a session between the permission device and the control device. By writing an automated script, you can execute command line operations on the control device to remotely configure the ACL.

[0047] Furthermore, after the user passes the authentication, the ACL is sent to the control device of the network segment where the user is located. When the user uses the network, the ACL takes effect immediately and controls the user's network access rights.

[0048] It is understandable that automated configuration reduces the possibility of human error, improves network security, and reduces the time and resources required for manual configuration of ACLs, thereby improving overall work efficiency. In addition, by supporting multiple protocols and configuration methods, the method provided in the embodiment of the present disclosure can adapt to network devices of different brands and models, thereby enhancing the flexibility and scalability of the system.

[0049] In an embodiment of the present disclosure, the method further includes: in response to the user accessing the first network, recording and calculating the cost of the user accessing the resources of the first network; when the user terminates access to the first network or the user is idle for more than a preset time period, stopping calculating the cost of the user accessing the resources of the first network.

[0050] Specifically, when a user accesses the first network for the first time, he needs to go through an authentication process to verify his identity and access rights. If the user has been authenticated and stored in the system before, he may not need to repeat the complete authentication process when he connects to the network again, but can quickly access the network through cache information or token verification. However, regardless of whether the authentication is repeated, the network access server (NAS) will record the user's access information, including the user name, the IP address of the NAS, the IP address assigned to the user, etc., as the starting point for billing. Once the user successfully accesses and starts to access the resources of the first network, the NAS will start the fee calculation mechanism and calculate and update the user's fee information in real time or periodically (such as every minute, every hour) according to the pre-set billing rules. When the user actively disconnects from the network or does not actively disconnect from the network but is idle for more than a preset time period (such as 30 minutes, 1 hour, etc.), the NAS will detect this behavior and immediately stop calculating the user's fees. At the same time, the NAS will send a billing stop message to the authentication device.

[0051] It is understandable that by monitoring users' network activities in real time, the system can accurately calculate the fees for users to access network resources, avoiding errors and disputes that may occur in traditional billing methods, and improving the transparency and fairness of billing.

[0052] In an embodiment of the present disclosure, the method also includes: in response to the user terminating access to the first network, matching the authentication request information with a pre-configured second permission rule, generating a revocation instruction for the user's access control list; sending the revocation instruction to the management and control device of the network segment where the user is located, and revoking the user's access control list.

[0053] Specifically, when the network access server (NAS) or related network equipment detects that the user terminates access to the first network, the authentication device sends the user's authentication request information (including user name, user IP address, NAS IP address, etc.) to the authority device. The authority device generates the user's access control list revocation instruction (unACL) based on this information and the pre-configured second authority rule. The unACL instruction contains sufficient information (such as the user's unique identifier, the ID or name of the ACL to be revoked, etc.) so that the management and control device can identify and revoke the corresponding ACL. Then, the authority device sends the user's unACL instruction to the management and control device of the network segment where the user is located. The specific sending method can be: if the management and control device supports SNMP configuration ACL, the user's ACL can be directly revoked through SNMP. If the management and control device does not support the above method, it can also connect to the device remotely through SSH or TELNET to automatically revoke the ACL.

[0054] It is understandable that revoking the ACL immediately after the user terminates access can effectively prevent the user from continuing to access network resources in an unauthorized state, reduce security risks, and avoid users from abusing network resources.

[0055] In an embodiment of the present disclosure, the management and control device and the authority device that generates the access control list are interconnected through a network.

[0056] Specifically, the permission device and the control device in the network segment where the user is located must be in a state of network intercommunication, that is, they can communicate with each other. For example, a stable physical connection must be established between the permission device and the control device, such as through optical fiber, twisted pair and other media. At the same time, the network configurations of both parties must be compatible with each other, including the settings of network parameters such as IP address, subnet mask and gateway, to ensure that data packets can be correctly transmitted between the two.

[0057] It is understandable that only when the network is interconnected can the management and control device obtain the access control list generated by the authority device in real time, thereby quickly controlling the user's access rights.

[0058] The permission management method for implementing user access control provided by the embodiments of the present disclosure realizes flexible permission management that is independent of the Internet access IP address. By dynamically generating and managing the access control list, it ensures that even if the user's physical address changes, his or her permission restrictions can be applied in real time and accurately to the network segment where he or she is located, without the need to manually adjust the network configuration.

[0059] Based on the above-mentioned permission management method for implementing user access control, the present disclosure also provides a permission management device for implementing user access control. Figure 3 The device is described in detail.

[0060] like Figure 3 As shown, the rights management device 300 for implementing user access control in this embodiment includes an acquisition module 301 , an authentication module 302 , a generation module 303 and a control module 304 .

[0061] The acquisition module 301 is used to acquire authentication request information of the user in response to a request of the user to access the first network for which permission management is enabled.

[0062] The authentication module 302 is used to obtain the user authority attribute of the user based on the authentication request information, wherein the user authority attribute is used to characterize the identity of the user.

[0063] The generating module 303 is used to generate an access control list of the user based on the user authority attribute and the authentication request information.

[0064] The control module 304 is used to automatically configure the access control list to the management and control device of the network segment where the user is located, and control the user's access rights to the first network through the management and control device.

[0065] It is understandable that the acquisition module 301, the authentication module 302, the generation module 303 and the control module 304 can be combined in one module, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present invention, at least one of the acquisition module 301, the authentication module 302, the generation module 303 and the control module 304 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented in hardware or firmware in any other reasonable way of integrating or packaging the circuit, or in a proper combination of software, hardware and firmware. Alternatively, at least one of the acquisition module 301, the authentication module 302, the generation module 303 and the control module 304 can be at least partially implemented as a computer program module, and when the program is run by a computer, the function of the corresponding module can be executed.

[0066] Figure 4 The structural block diagram of an electronic device provided by an embodiment of the present disclosure is schematically shown.

[0067] like Figure 4 As shown, the electronic device described in this embodiment includes: the electronic device 400 includes a processor 410 and a computer readable storage medium 420. The electronic device 400 can execute the above reference Figure 1Describes the method to achieve detection of specific operations.

[0068] Specifically, the processor 410 may include, for example, a general-purpose microprocessor, an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 410 may also include an onboard memory for cache purposes. The processor 410 may be a processor for executing reference Figure 1 The described method flow according to the embodiment of the present disclosure may be a single processing unit or multiple processing units for different actions.

[0069] Computer readable storage medium 420, for example, can be any medium capable of containing, storing, conveying, propagating or transmitting instructions. For example, readable storage media can include, but are not limited to, electrical, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices, devices or propagation media. Specific examples of readable storage media include: magnetic storage devices, such as magnetic tapes or hard disks (HDDs); optical storage devices, such as compact disks (CD-ROMs); memory, such as random access memory (RAM) or flash memory; and / or wired / wireless communication links.

[0070] The computer readable storage medium 420 may include a computer program 421, which may include code / computer executable instructions, which when executed by the processor 410 causes the processor 410 to perform, for example, the above-mentioned combination of Figure 1 The described method sequences and any variations thereof.

[0071] Computer program 421 may be configured to have, for example, computer program code including computer program modules. For example, in an exemplary embodiment, the code in computer program 421 may include one or more program modules, for example, 421A, module 421B, ... It should be noted that the division method and number of modules are not fixed, and those skilled in the art may use appropriate program modules or program module combinations according to actual conditions. When these program module combinations are executed by processor 410, processor 410 may execute, for example, the above combination of Figure 1~Figure 2 The described method sequences and any variations thereof.

[0072] According to an embodiment of the present invention, at least one of the acquisition module 301, the authentication module 302, the generation module 303 and the control module 304 can be implemented as a reference Figure 4 The computer program modules described above, when executed by the processor 410, can implement the corresponding operations described above.

[0073] The present disclosure also provides a computer-readable medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0074] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0075] Although the present disclosure has been shown and described with reference to specific exemplary embodiments of the present disclosure, it should be understood by those skilled in the art that various changes in form and details may be made to the present disclosure without departing from the spirit and scope of the present disclosure as defined by the appended claims and their equivalents. Therefore, the scope of the present disclosure should not be limited to the above-mentioned embodiments, but should be determined not only by the appended claims, but also by the equivalents of the appended claims.

Claims

1. A method for implementing a rights management for user access control, characterized in that: The method comprises: In response to a request from a user to access a first network for which permission management has been enabled, obtaining authentication request information of the user; Based on the authentication request information, obtaining a user authority attribute of the user, wherein the user authority attribute is used to characterize the identity of the user; Generate an access control list for the user based on the user authority attribute and the authentication request information; The access control list is automatically configured to the management and control device of the network segment where the user is located, and the user's access to the first network is controlled through the management and control device.

2. The method for implementing user access control according to claim 1, characterized in that: The generating the access control list of the user based on the user authority attribute and the authentication request information comprises: Based on the network address in the authentication request information, identifying the topology information of the second network where the user is located; Based on the topology information, query the network segment configuration information of the network segment where the user is located; According to the user authority attribute, the topology information and the network segment configuration information, a match is performed with a pre-configured first authority rule, and an access control list of the user is generated according to the matching result.

3. The method for implementing user access control according to claim 1, characterized in that: The method further comprises: In response to the user terminating access to the first network, matching the authentication request information with a pre-configured second permission rule to generate a revocation instruction for the user's access control list; The revocation instruction is sent to the control device of the network segment where the user is located to revoke the access control list of the user.

4. The method for implementing user access control according to claim 1, characterized in that: The control device that automatically configures the access control list to the network segment where the user is located includes: In a case where the management and control device of the network segment where the user is located supports the extended attribute of the first protocol, automatically receiving the access control list through the extended attribute; or In a case where the control device in the network segment where the user is located supports the second protocol, configuring the access control list on the control device using the second protocol; or When the control device in the network segment where the user is located does not support the first protocol and the second protocol, the control device is remotely connected to configure the access control list.

5. The method for implementing user access control according to claim 1, characterized in that: The method further comprises: In response to the user accessing the first network, recording and calculating a fee for the user accessing resources of the first network; When the user stops accessing the first network or the user is idle for more than a preset time period, the calculation of the fee for the user to access the resources of the first network stops.

6. The method for implementing user access control according to claim 1, characterized in that: The network between the control device and the authority device that generates the access control list is interconnected.

7. The method for implementing user access control according to claim 1, characterized in that: The obtaining of the user authority attribute of the user based on the authentication request information includes: Based on the authentication request information, determining whether the user is a legitimate network user; When the user is not a legitimate user, intercepting the user's access request; When the user is a legitimate user, the user authority attribute of the user is obtained.

8. A rights management device for implementing user access control, characterized in that: The device comprises: an acquisition module, configured to acquire authentication request information of the user in response to a request from the user to access the first network for which permission management has been enabled; An authentication module, configured to obtain a user authority attribute of the user based on the authentication request information, wherein the user authority attribute is used to characterize the identity of the user; A generating module, used for generating an access control list of the user based on the user authority attribute and the authentication request information; A control module is used to automatically configure the access control list to the management and control device of the network segment where the user is located, and control the user's access to the first network through the management and control device.

9. An electronic device, comprising: one or more processors; a storage device for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images