Terminal security protection method and system for resisting excessive access

Abstract

The invention discloses a terminal security protection method and system for resisting excessive access, and relates to the technical field of terminal security protection, and the method comprises the steps: carrying out the first recognition of a terminal identity, and carrying out the security check; performing first control on the access behavior, and performing authority management; and monitoring terminal information and recording a security log. According to the method disclosed by the invention, the terminal identity is accurately identified and authenticated by adopting a multi-dimensional identity identification technology, and legal and illegal terminals are effectively distinguished, so that the security of the system is improved, and the risk of unauthorized access is reduced; the access terminal is subjected to equipment security check to ensure that the terminal meets the security requirement before accessing the network, so that the possibility that security vulnerabilities are utilized is reduced, and the overall network security level is improved; by establishing the authority management system, refined access control can be performed according to the terminal type, the user role and the access target, the excessive access behavior of the terminal is effectively limited, and the security of network resources is guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of terminal security protection, and in particular to a terminal security protection method and system for resisting excessive access. Background Art

[0002] With the rapid development of information technology, terminal security protection has become an important research topic in the field of network security. Existing terminal security protection technologies mainly use identity authentication, access control and security monitoring to ensure the security of terminal devices and their access to the network. However, with the diversification and complexity of attack methods, at the same time, the main security threats and risks faced by enterprises today are not entirely from external malicious attacks or malware, but from trusted internal personnel, including not only malicious internal personnel, but also negligent internal personnel. Therefore, enterprises now believe that they are vulnerable to internal attacks. The main risk factors are that there are too many users with excessive access rights, too many devices accessing sensitive data, and information technology is becoming more and more complex. Existing terminal security protection technologies have certain limitations in practical applications.

[0003] Although existing technologies can prevent unauthorized access to a certain extent, they still have shortcomings in dealing with excessive access, refined permission management, and real-time monitoring and response. First, existing technologies for terminal identity identification often rely on a single identification technology, which is vulnerable to forgery or tampering attacks and difficult to effectively identify illegal terminals. Secondly, the access control strategy is relatively simple and cannot achieve refined permission management for different users and scenarios, leading to security risks. Furthermore, existing technologies have weak monitoring and logging functions for terminal behavior, making it difficult to detect and prevent abnormal behavior in real time, and unable to provide sufficient data support for post-audit. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is that the existing terminal security protection methods have the problems of inaccurate terminal identity recognition, overly simple access control strategies, insufficient monitoring and alarm functions, and how to achieve refined permission management and real-time response.

[0006] To solve the above technical problems, the present invention provides the following technical solutions: a terminal security protection method for resisting excessive access, comprising first identifying the terminal identity and performing a security check; first controlling the access behavior and performing authority management; monitoring terminal information and recording security logs.

[0007] As a preferred solution of the terminal security protection method against excessive access described in the present invention, wherein: the first identification of the terminal identity includes identifying the access terminal through a first identification technology and verifying the identity account information.

[0008] As a preferred solution of the terminal security protection method against excessive access described in the present invention, wherein: the security check includes performing a device security check on the access terminal.

[0009] As a preferred solution of the terminal security protection method for resisting excessive access described in the present invention, wherein: the first control of the access behavior includes setting access permission for the access behavior of the terminal through the first control method.

[0010] As a preferred solution of the terminal security protection method against excessive access described in the present invention, wherein: the authority management includes establishing an authority management system to restrict terminal access.

[0011] As a preferred solution of the terminal security protection method for resisting excessive access described in the present invention, the monitoring of terminal information includes real-time monitoring of terminal behavior, alarming of abnormal behavior, and taking measures to block or isolate it; monitoring and analyzing terminal traffic to identify potential security threats.

[0012] As a preferred solution of the terminal security protection method for resisting excessive access described in the present invention, wherein: the recording of security logs includes recording terminal operation records, providing an audit log query function, and generating security reports.

[0013] Another object of the present invention is to provide a terminal security protection system that resists excessive access, which can accurately identify and authenticate the terminal identity by adopting a multi-dimensional identity recognition method, thereby solving the problem of inaccurate identity recognition in current terminal security protection technology.

[0014] As a preferred solution of the terminal security protection system for resisting excessive access described in the present invention, it includes: a terminal access module, an access control module, and a monitoring and alarm module; the terminal access module is used to perform a first identification of the terminal identity and perform a security check; the access control module is used to perform a first control on the access behavior and perform authority management; the monitoring and alarm module is used to monitor terminal information and record security logs.

[0015] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement a terminal security protection method against excessive access.

[0016] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a terminal security protection method for resisting excessive access.

[0017] Beneficial effects of the present invention: The terminal security protection method for resisting excessive access provided by the present invention accurately identifies and authenticates the terminal identity by adopting multi-dimensional identity recognition technology, effectively distinguishes between legal and illegal terminals, thereby improving the security of the system and reducing the risk of unauthorized access; by performing equipment security checks on access terminals, it is ensured that the terminal meets security requirements before accessing the network, thereby reducing the possibility of security vulnerabilities being exploited and improving the overall network security level; by establishing a permission management system, it is possible to perform refined access control according to terminal type, user role and access target, effectively limiting the excessive access behavior of the terminal and ensuring the security of network resources; by real-time monitoring of terminal behavior and traffic, alarming abnormal behavior and taking measures, it is possible to timely discover and respond to potential security threats and reduce the occurrence of security incidents; by recording the operation records of the terminal and providing an audit log query function, it is helpful to analyze and track security incidents afterwards, and the generated security report provides important decision support for network managers. The present invention achieves better results in limiting excessive access, system security and discovering potential security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0019] Figure 1 An overall flow chart of a terminal security protection method for resisting excessive access provided in the first embodiment of the present invention.

[0020] Figure 2 An overall flow chart of a terminal security protection system for resisting excessive access provided in the third embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0022] Example 1, reference Figure 1 , as an embodiment of the present invention, provides a terminal security protection method for resisting excessive access, comprising:

[0023] S1: Perform the first identification of the terminal and conduct a security check.

[0024] Furthermore, performing the first identification on the terminal identity includes performing identity identification on the access terminal through a first identification technology and verifying the identity account information.

[0025] The system automatically discovers all access terminal devices in the network through network scanning and performs identity recognition through the first recognition technology.

[0026] The first identification technology may be a variety of methods, such as MAC address identification technology, IP address allocation technology, device fingerprint technology, and 802.1X authentication for identity identification.

[0027] In the embodiment of the present application, the first identification technology uses a combination of MAC address identification technology and 802.1X authentication technology to form a multi-dimensional identification technology, and its specific principles and steps are: while ensuring that the network switch and router support 802.1X authentication, configure the switch port as a controlled port, require authentication to access the network, set up a RADIUS server as an authentication and authorization center, configure the RADIUS server to communicate with the network device, install and configure the 802.1X client software on the terminal device, configure the network settings of the terminal device, and ensure that the 802.1X authentication request can be initiated.

[0028] The terminal device accesses the network and attempts to establish a connection with the network switch. The switch detects the connection request of the terminal device and starts the 802.1X authentication process. The 802.1X client of the terminal device communicates with the RADIUS server through the EAP protocol. The user enters the user name and password, and the client sends the information to the RADIUS server through an EAP message. The 802.1X client also sends the MAC address of the terminal device as part of the identity authentication to the RADIUS server. The RADIUS server verifies the user credentials and MAC address to confirm the identity of the terminal device.

[0029] If the authentication is successful, the RADIUS server sends an authorization instruction to the switch, allowing the terminal device to access the network. The switch allows or denies the terminal device's network access based on the authorization instruction of the RADIUS server. The RADIUS server and switch record all logs of the authentication process for auditing and monitoring.

[0030] In an optional embodiment, the first identification technology uses certificate authentication technology for identity identification, and its specific principle steps are: create or select a trusted certificate authority CA, and issue a digital certificate through the CA. The CA generates a public key and a private key pair, and embeds the public key into the digital certificate. The CA verifies the terminal device, and after confirming the identity, issues a digital certificate containing the public key, installs the digital certificate issued by the CA on the terminal device, configures the terminal operating system and network application to trust the CA, and uses the installed certificate for identity authentication.

[0031] The terminal device attempts to establish a connection with the network. During the connection process, the terminal device submits a digital certificate to the network authentication server. The authentication server verifies the validity of the digital certificate, which includes whether the certificate is issued by a trusted CA, whether it is within the validity period, whether it has been revoked, etc. The authentication server extracts the public key from the digital certificate and uses the public key of the terminal device for key exchange to generate a session key. If the certificate verification is successful, the authentication server confirms the identity of the terminal device and allows the terminal device to access network resources.

[0032] It should be noted that performing a security check includes performing a device security check on the access terminal.

[0033] Equipment security checks include whether antivirus software, firewalls and other security software are installed, whether key system patches are installed, whether there are security vulnerabilities or improper configurations, and whether it complies with corporate security policy requirements.

[0034] Terminals that fail security checks will be isolated by the system and can only access the network after being repaired or upgraded.

[0035] S2: Perform primary control over access behavior and perform permission management.

[0036] Furthermore, performing the first control on the access behavior includes setting access permission for the access behavior of the terminal through a first control method.

[0037] There are many methods for the first control, such as access control list, role-based access control, attribute-based access control, etc., to control the access behavior of the terminal.

[0038] In the embodiment of the present application, the first control uses the access control list ACLs to set access rights for the access behavior of the terminal. The specific principle steps are as follows: according to the access requirements, ACL rules are formulated. The ACL rules will determine whether to allow or deny access traffic. ACL is configured on routers, switches, firewalls and other devices. The configuration includes creating a new ACL on the device and assigning a unique number to the device. Allow or deny conditions are added to the ACL, such as source IP address, destination IP address, port number, protocol type, etc., and the rules in the ACL are sorted in the correct order. The configured ACL is applied to the interface of the network device, and a test is performed after the ACL is applied. After the test is completed, the access right setting for the terminal's access behavior is completed.

[0039] In an optional embodiment, the first control uses network access control NAC to set access rights for terminal access behavior. The specific principles and steps are: formulate access policies according to security policies and business needs, configure network devices to enable network devices to support NAC, implement terminal device authentication, terminal device authentication can be based on user identity, device identity, or a combination of the two. According to the authentication results, there should be an authorization policy, implement access control at the network access layer to ensure that only authenticated and authorized devices can access, execute defined access policies on network devices, restrict or allow specific network traffic, monitor network activities, ensure that NAC policies are effectively implemented, and record all authentication attempts and access times for subsequent auditing and analysis.

[0040] It should be noted that performing permission management includes establishing a permission management system and restricting terminal access.

[0041] S3: Monitor terminal information and record security logs.

[0042] Furthermore, monitoring terminal information includes real-time monitoring of terminal behavior, alerting of abnormal behavior, and taking measures to block or isolate it;

[0043] Monitor and analyze terminal traffic to identify potential security threats.

[0044] It should be noted that recording security logs includes recording terminal operation records, providing audit log query functions, and generating security reports.

[0045] Example 2 is an embodiment of the present invention, which provides a terminal security protection method for resisting excessive access. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0046] First, this embodiment aims to verify the effectiveness of a terminal security protection method against excessive access, which mainly includes terminal identity recognition and security inspection, access behavior control and authority management, terminal information monitoring and log recording.

[0047] The experiment was conducted in a simulated enterprise network environment. The network contained various types of terminal devices, including desktop computers, laptops, tablet computers and smart phones. The experiment was divided into two phases. The first phase used existing technologies for security protection, and the second phase used the method of the present invention for security protection. The advantages of the method of the present invention were evaluated by comparing the frequency of security incidents, terminal access compliance, and security log record integrity indicators in the two phases.

[0048] Secondly, in the experimental preparation, a simulated enterprise network environment is built, traditional security protection measures are deployed at the existing stage, and terminal access modules, access control modules and monitoring alarm modules are deployed at the method stage of the present invention.

[0049] During the experimental implementation process, in the prior art stage, the access behavior and security events of the terminal devices are observed and recorded. In the method stage of the present invention, the terminal identity is identified to ensure that all terminal devices accessing the network are known and authenticated devices. Security checks are performed on the access terminals. Access rights are set according to the terminal type, user role and access target to achieve refined permission management, monitor terminal behavior and traffic in real time, issue alarms for abnormal behavior, and take measures to block or isolate it. The terminal's operation records and security logs are recorded, an audit log query function is provided, and security reports are generated.

[0050] Table 1 Experimental data comparison table

[0051]

[0052]

[0053] From the table data obtained from the simulation experiment, it can be seen that the number of security incidents occurred, under the existing technical conditions, different types of terminal devices had an average of 25 security incidents, and after adopting the method of the present invention, this data dropped significantly to 3.25 times, which shows that the present invention has a greater effect in reducing security incidents; terminal access compliance, under the existing technical conditions, the average compliance is 60%, and the method of the present invention improves the compliance to 97.75%, covering almost all terminal devices, which proves the effectiveness of the method of the present invention in ensuring terminal compliance; comprehensive log record integrity, under the existing technical conditions, the integrity of the log record is 74% on average, while the present invention can fully record all operations and security events, which shows that the method of the present invention provides reliable and complete data support for security audits; the average response time under the existing technical conditions is 117.5 seconds, while the method of the present invention shortens the response time to 27.25 seconds, which significantly improves the response speed to security events; the average system resource occupancy rate is 10.75%, while the method of the present invention reduces it to 6%, which shows that the method of the present invention improves system efficiency and reduces the consumption of system resources; the abnormal traffic detection rate, under the existing technical conditions, the average abnormal traffic detection rate is 43.75%, while the method of the present invention increases it to 89%, which shows that the method of the present invention improves the detection and prevention capabilities of security threats.

[0054] Example 3, reference Figure 2 , which is an embodiment of the present invention, provides a terminal security protection system for resisting excessive access, including a terminal access module, an access control module, and a monitoring alarm module.

[0055] The terminal access module is used to perform the first identification of the terminal identity and conduct security checks; the access control module is used to perform the first control of access behavior and perform authority management; the monitoring and alarm module is used to monitor terminal information and record security logs.

[0056] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0057] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0058] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0059] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc. It should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not limited. Although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

[0060] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A terminal security protection method for resisting excessive access, characterized in that: include: First identify the terminal identity and perform a security check; Perform primary control over access behavior and perform permission management; Monitor terminal information and record security logs.

2. The terminal security protection method for resisting excessive access according to claim 1, characterized in that: The first identification of the terminal identity includes identifying the access terminal through a first identification technology and verifying the identity account information.

3. The terminal security protection method for resisting excessive access according to claim 2, characterized in that: The performing of security check includes performing a device security check on the access terminal.

4. The terminal security protection method for resisting excessive access according to claim 3, characterized in that: The first controlling of the access behavior includes setting access permission for the access behavior of the terminal through a first control method.

5. The terminal security protection method for resisting excessive access according to claim 4, characterized in that: The authority management includes establishing an authority management system and restricting terminal access.

6. The terminal security protection method for resisting excessive access according to claim 5, characterized in that: The monitoring of terminal information includes real-time monitoring of terminal behavior, alerting of abnormal behavior, and taking measures to prevent or isolate the abnormal behavior; Monitor and analyze terminal traffic to identify potential security threats.

7. The terminal security protection method for resisting excessive access according to claim 6, characterized in that: The security log recording includes recording the operation records of the terminal, providing an audit log query function, and generating a security report.

8. A system using the terminal security protection method for resisting excessive access as claimed in any one of claims 1 to 7, characterized in that: Including terminal access module, access control module, monitoring and alarm module; The terminal access module is used to first identify the terminal identity and perform a security check; The access control module is used to perform a first control on access behavior and perform authority management; The monitoring and alarm module is used to monitor terminal information and record security logs.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the terminal security protection method against excessive access described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the terminal security protection method against excessive access described in any one of claims 1 to 7 are implemented.

Images