Access control method and device, electronic equipment and computer storage medium

Abstract

The invention relates to an access control method and device, electronic equipment and a computer storage medium, and belongs to the technical field of computer network security, and the access control method comprises the following steps: obtaining message data in service flow, and analyzing the message data to obtain a source MAC address and a destination MAC address in the message data; querying a preset flow control strategy based on the source MAC address and the target MAC address to obtain a target flow control strategy corresponding to the source MAC address and the target MAC address; and performing access control on the service traffic based on the target traffic control strategy. According to the invention, the attack source can be quickly positioned according to the MAC address in the traffic data, access control is carried out on the service traffic of the attack source, other devices in the networking environment can be prevented from being influenced, and the network security of the networking environment is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security, and in particular to an access control method, device, electronic equipment and computer storage medium. Background Art

[0002] With the rapid development of network technology, network security equipment must not only effectively control the traffic from the external network to the internal network, but also effectively control the traffic from the internal network to the internal network, the external network and the border server.

[0003] Currently, most network security vendors control based on users, source and destination interfaces, source and destination IPs, source and destination ports, protocols, applications, etc. The above control methods can meet the control requirements of most network configurations. However, in the DHCP (Dynamic Host Configuration Protocol) networking environment, although the policy control based on these conditions can also meet the needs of most users, when some computers are infected or attacked and send a large number of packets, resulting in a sudden increase in network traffic and even network paralysis, affecting user external access, it is impossible to quickly locate the source of the attack and control the attack source, resulting in hidden dangers in network security.

[0004] It can be seen that the existing technology of traffic access control in a DHCP networking environment has security risks. Summary of the invention

[0005] In view of this, it is necessary to provide an access control method, device, electronic device and computer storage medium to solve the problem of potential security risks in traffic access control in a DHCP networking environment in the prior art.

[0006] In order to solve the above problem, the present invention provides an access control method, comprising: Obtain the message data in the service traffic, parse the message data to obtain the source MAC address and destination MAC address in the message data; The preset flow control policy is queried based on the source MAC address and the destination MAC address to obtain the target flow control policy corresponding to the source MAC address and the destination MAC address; Perform access control on business traffic based on target traffic control policies.

[0007] In a possible implementation manner, obtaining message data in service traffic includes: When the service traffic is service traffic in a layer 2 networking environment, the service traffic is obtained between a layer 2 switch and a router in the layer 2 networking environment, and message data in the service traffic is obtained; When the service traffic is the service traffic in the three-layer networking environment, the service traffic is obtained between the three-layer switch in the three-layer networking environment and the external network, and the message data in the service traffic is obtained.

[0008] In a possible implementation, when the service traffic is service traffic in a layer 2 networking environment, querying a preset traffic control policy based on a source MAC address and a destination MAC address includes: Obtain the user real name information bound to the source MAC address and / or the destination MAC address; Query preset traffic control strategies based on user real-name information.

[0009] In a possible implementation, when the service traffic is service traffic in a layer 3 networking environment, querying a preset traffic control policy based on a source MAC address and a destination MAC address includes: Determine whether there is bound user real-name information for the source MAC address and / or the destination MAC address based on the address resolution protocol table in the three-layer networking environment; When the address resolution protocol table contains user real-name information bound to the source MAC address and / or the destination MAC address, a preset traffic control policy is queried based on the user real-name information; When the user real name information bound to the source MAC address and / or the destination MAC address does not exist in the address resolution protocol table, a default traffic control policy is allocated to the service traffic.

[0010] In a possible implementation, querying a preset flow control policy based on the source MAC address and the destination MAC address to obtain a target flow control policy corresponding to the source MAC address and the destination MAC address includes: Based on the source MAC address and the destination MAC address, a fast matching tree algorithm is used in the preset flow control policy to search for a target flow control policy corresponding to the source MAC address and / or the destination MAC address.

[0011] In a possible implementation, the preset traffic control strategy based on the user real-name information query includes: Based on the user real-name information, a fast matching tree algorithm is used in the preset flow control strategy to find the target flow control strategy corresponding to the user real-name information.

[0012] In a possible implementation, performing access control on service traffic based on a target traffic control policy includes: Based on the target traffic control policy and the service relationship between the source MAC address and the destination MAC address, the service traffic is released or controlled.

[0013] The present invention also provides an access control device, comprising: An address acquisition module is used to acquire message data in the service flow, parse the message data to obtain the source MAC address and the destination MAC address in the message data; A control strategy determination module is used to query a preset flow control strategy based on a source MAC address and a destination MAC address to obtain a target flow control strategy corresponding to the source MAC address and the destination MAC address; The access control module is used to perform access control on business traffic based on the target traffic control policy.

[0014] The present invention also provides an electronic device, comprising a memory and a processor, wherein: Memory, used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the steps in the access control method of any one of the above implementations.

[0015] The present invention also provides a computer-readable storage medium for storing a computer-readable program or instruction, which can implement the steps of the access control method of any of the above-mentioned embodiments when the program or instruction is executed by a processor.

[0016] The beneficial effects of the present invention are as follows: the access control method provided by the present invention obtains the message data in the business traffic, parses the message data to obtain the source MAC address and the destination MAC address, searches for the corresponding target traffic control policy in the preset traffic control policy based on the source MAC address and the destination MAC address, and performs access control on the business traffic based on the target traffic control side. If the business traffic is invalid or harmful traffic data sent by a poisoned or attacked device, the attack source can be quickly located according to the MAC address in the traffic data, and access control can be performed on the business traffic of the attack source, which can prevent other devices in the networking environment from being affected and ensure the network security of the networking environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A flowchart of an access control method provided by an embodiment of the present invention; Figure 2 A flow chart of a method for acquiring service flow provided by an embodiment of the present invention; Figure 3 A schematic diagram of a layer 2 DHCP networking environment structure provided by an embodiment of the present invention; Figure 4 A schematic diagram of a three-layer DHCP networking environment structure provided by an embodiment of the present invention; Figure 5 A flow chart of a method for querying a flow control policy in a layer 2 DHCP networking environment provided by an embodiment of the present invention; Figure 6 A flow chart of a method for querying a flow control policy in a three-layer DHCP networking environment provided by an embodiment of the present invention; Figure 7 A schematic diagram of the structure of an access control device provided by an embodiment of the present invention; Figure 8 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The preferred embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of the present invention and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not used to limit the scope of the present invention.

[0020] In the description of the embodiments of the present invention, unless otherwise specified, "multiple" means two or more than two. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" may mean: A exists alone, A and B exist at the same time, and B exists alone.

[0021] The descriptions of "first", "second", etc. involved in the embodiments of the present invention are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the technical features defined as "first" and "second" may explicitly or implicitly include at least one of the features.

[0022] Reference to an "embodiment" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiment may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0023] A specific embodiment of the present invention, as Figure 1 As shown, an access control method is disclosed, comprising: S101, obtaining message data in the service traffic, parsing the message data to obtain a source MAC address and a destination MAC address in the message data; S102, querying a preset flow control policy based on the source MAC address and the destination MAC address to obtain a target flow control policy corresponding to the source MAC address and the destination MAC address; S103: Perform access control on the service traffic based on the target traffic control policy.

[0024] In an embodiment of the present invention, the access control method provided is applicable to a DHCP networking environment. In the DHCP networking environment, a terminal obtains an address through DHCP. When access control is performed based on users, source and destination interfaces, source and destination IPs, source and destination ports, protocols, and applications, because the source IP obtains an address through DHCP, the IP address obtained by the same terminal each time may be the same or different, so it is difficult to accurately control access control of traffic.

[0025] In an embodiment of the present invention, service traffic is traffic data transmitted in a DHCP networking environment, and the service traffic includes message data and service data packets. After obtaining the service traffic, based on the message data in the service traffic, the source MAC address and destination MAC address in the message data can be parsed to obtain the source MAC address and the destination MAC address. The source MAC address refers to the MAC address of the terminal that sends the service traffic, and the destination MAC address refers to the MAC address of the terminal that receives the service traffic.

[0026] Furthermore, the pre-set flow control policy refers to the access control policy for terminal devices with different MAC addresses set in advance. The flow control policy includes the access control policy for all terminals in the DHCP networking environment. The access control policy includes multiple access control methods such as release, speed limit, and discard. Optionally, based on the source MAC address and / or the destination MAC address, the corresponding target flow control policy can be searched in the preset flow control policy. The specific search method will be described in detail later in the present invention. After determining the target flow control policy corresponding to the service flow, access control is performed on the service flow based on the target flow control policy.

[0027] The access control method provided by the present invention obtains the message data in the business traffic, parses the message data to obtain the source MAC address and the destination MAC address, searches for the corresponding target traffic control policy in the preset traffic control policy based on the source MAC address and the destination MAC address, and performs access control on the business traffic based on the target traffic control side. If the business traffic is invalid or harmful traffic data sent by a poisoned or attacked device, the attack source can be quickly located according to the MAC address in the traffic data, and access control can be performed on the business traffic of the attack source, which can prevent other devices in the networking environment from being affected and ensure the network security of the networking environment.

[0028] As a possible implementation mode of the present invention, in this implementation mode, Figure 2 As shown, the packet data in the service traffic is obtained, including: S201, when the service traffic is service traffic in a layer 2 networking environment, obtaining the service traffic between a layer 2 switch and a router in the layer 2 networking environment, and obtaining message data in the service traffic; S202, when the service traffic is service traffic in a three-layer networking environment, obtain the service traffic between a three-layer switch in the three-layer networking environment and an external network, and obtain message data in the service traffic.

[0029] In the embodiment of the present invention, for different DHCP networking environments, the method of obtaining the message data in the service flow is different, because different DHCP networking environments have different network structures. Specifically, Figure 3 and Figure 4 As shown in the figure, they are Layer 2 DHCP networking environment and Layer 3 DHCP networking environment. Figure 3 As shown in the figure, in a Layer 2 DHCP networking environment, there is a router between the Layer 2 switch and the external network, and the DHCP function is enabled on the router's internal network port. Then, network security devices (such as Internet behavior management devices or firewalls, etc.) can be transparently deployed between the router and the Layer 2 switch to obtain the business traffic passing through the network security device and the message data in the business traffic. Figure 4 As shown, in a three-layer DHCP networking environment, if there is no router between the three-layer switch and the external network, a network security device can be transparently deployed directly between the three-layer switch and the external network to obtain the service traffic passing through the network security device and the message data in the service traffic.

[0030] The present invention deploys network security devices for a layer 2 DHCP networking environment and a layer 3 DHCP networking environment respectively, so as to facilitate acquisition of service flow.

[0031] As a possible implementation mode of the present invention, in this implementation mode, Figure 5 As shown in the figure, when the service traffic is the service traffic in the Layer 2 networking environment, the preset traffic control policy is queried based on the source MAC address and the destination MAC address, including: S501, obtaining user real-name information bound to a source MAC address and / or a destination MAC address; S502, querying a preset traffic control strategy based on the user's real-name information.

[0032] In the embodiment of the present invention, Figure 3As shown in the figure, the gateway of the PC (Personal Computer) of Business Department 1 and Business Department 2 is on the router, and the IP address is automatically obtained through DHCP. The PC of Business Department 1 and Business Department 2 belongs to the same business VLAN (Virtual Local Area Network), but is responsible for different businesses. The Layer 2 switches are not interconnected, and business mutual access cannot be directly performed through the Layer 2 switch. Business mutual access must be performed through network security devices. If a PC is infected with a virus or attacked and sends a large number of messages to the outside, and the messages sent to the outside are irregular, if such PCs are not controlled, a series of network devices such as switches, network security devices, routers, and network services will be affected, affecting normal business interaction; at the same time, it is impossible to quickly locate the source of attack or poisoning; fine-grained control of terminal MAC addresses on network security devices can effectively solve the monitoring of interactions between intranet services. Specifically, all terminal devices in the Layer 2 DHCP networking environment are bound with user real-name information, and when service traffic is transmitted in the networking environment, the source and destination MAC addresses will not change. Therefore, the corresponding user real-name information can be directly determined according to the source and destination MAC, and the preset traffic control policy can be queried based on the user real-name information.

[0033] On the other hand, Figure 6 As shown in the figure, when the service traffic is the service traffic in the three-layer network environment, the preset traffic control policy is queried based on the source MAC address and the destination MAC address, including: S601, determining whether there is bound user real-name information for a source MAC address and / or a destination MAC address based on an address resolution protocol table in a layer 3 networking environment; S602, when the address resolution protocol table contains user real-name information bound to the source MAC address and / or the destination MAC address, querying a preset traffic control policy based on the user real-name information; S603: When the user real-name information bound to the source MAC address and / or the destination MAC address does not exist in the address resolution protocol table, a default traffic control policy is allocated to the service traffic.

[0034] In the embodiment of the present invention, Figure 4As shown in the figure, when business department 3 and business department 4 access the external network, since the terminal obtains the IP address through DHCP, the network security device performs fine-grained policy control, auditing, speed limit and other requirements for terminal users. If the IP cannot meet the enterprise needs, and the MAC address of the terminal is fixed, but the MAC address will become the MAC of the layer 3 switch after passing through the layer 3 switch to the network security device, then it is necessary to enable the SNMP (Simple Network Management Protocol) learning function on the network security device to read the ARP (Address Resolution Protocol) table information of the layer 3 switch, and update the ARP table information learned on the device after obtaining the real MAC address. At the same time, bind the MAC address with the user name to realize real-name authentication, and finally perform fine-grained access control based on the real-name MAC address. Specifically, when the address resolution protocol table contains user real-name information bound to the source MAC address and / or destination MAC address, the preset traffic control policy is queried based on the user real-name information. When the address resolution protocol table does not contain user real-name information bound to the source MAC address and / or destination MAC address, the default traffic control policy is assigned to the service traffic. Generally, the default traffic control policy is to discard.

[0035] The embodiment of the present invention obtains the user real-name information of the three-layer DHCP networking environment to ensure the normal access control in different networking environments.

[0036] As a possible implementation mode of the present invention, in this implementation mode, a preset flow control policy is queried based on the source MAC address and the destination MAC address to obtain a target flow control policy corresponding to the source MAC address and the destination MAC address, including: Based on the source MAC address and the destination MAC address, a fast matching tree algorithm is used in the preset flow control policy to search for a target flow control policy corresponding to the source MAC address and / or the destination MAC address.

[0037] In a possible implementation of the present invention, the access control policy may not be queried based on the user's real-name information, but may be directly queried in the preset traffic control policy based on the source MAC address and the destination MAC address. Specifically, the preset traffic control policy is set for the MAC address of each terminal in the networking environment, rather than the user's real-name information bound to the MAC address. A corresponding traffic control policy is set for the MAC address of each terminal in the networking environment. When there are many terminals in the networking environment and there are also many traffic control policies, a fast matching tree algorithm may be used to quickly search for the target traffic control policy corresponding to the source MAC address and / or destination MAC address to improve the response rate of access control.

[0038] Furthermore, the preset traffic control strategy based on the user real-name information query includes: Based on the user real-name information, a fast matching tree algorithm is used in the preset flow control strategy to find the target flow control strategy corresponding to the user real-name information.

[0039] In an embodiment of the present invention, as in the aforementioned embodiment, when searching for a corresponding target traffic control policy based on the user real-name information, a fast matching tree algorithm may be used to search for a target traffic control policy corresponding to the user real-name information.

[0040] Furthermore, access control is performed on service traffic based on the target traffic control policy, including: Based on the target traffic control policy and the service relationship between the source MAC address and the destination MAC address, the service traffic is released or controlled.

[0041] In the embodiment of the present invention, for the convenience of description, a specific embodiment is taken as an example. Figure 3 As shown in the figure, Business Department 1 has opened the database service, and Business Department 2 has opened the FTP (File Transfer Protocol) service. Business Department 1 needs to access the FTP service of Business Department 2, and Business Department 2 needs to access the database service (mysql) of Business Department 1. If the MAC address range of Business Department 1 is 01:00:5e:40:98:00-01:00:5e:40:98:ff, and the MAC address range of Business Department 2 is 01:21:ab:40:9a:00-01:21:ab:40:9a:ff, first configure the user name corresponding to the MAC address of Business Department 1 on the device, that is, bind the user name to the MAC address of Business Department 1, and at the same time, the MAC address of Business Department 2 The MAC address is also bound to the corresponding MAC address by the username. In this way, the MAC addresses of Business Department 1 and Business Department 2 are real-named. The traffic control policy (control, audit, speed limit) is called based on the real-name MAC address username. The traffic control policy can select the real-name object from the source to the destination and control, audit, and speed limit in combination with the specific business. For example, the FTP business from Zhang San's MAC in Business Department 1 to Li Si's MAC in Business Department 2 is allowed, and the MySQL business from Li Si's MAC in Business Department 2 to Business Department 1 is allowed. Audit and speed limit services are configured for the real-name users of Business 1 and Business MAC, and all other unauthorized services are blocked.

[0042] The present invention can effectively ensure normal business exchanges between businesses through the above configuration based on the real-name MAC address and the service mode, while completely blocking abnormal businesses. At the same time, it can limit the speed of high-traffic businesses and audit all businesses to ensure all-round control of intranet businesses.

[0043] In order to better implement the access control method in the embodiment of the present invention, based on the access control method, correspondingly, Figure 7 As shown, the embodiment of the present invention further provides an access control device, the access control device 700 includes: The address acquisition module 701 is used to acquire the message data in the service flow, and parse the message data to obtain the source MAC address and the destination MAC address in the message data; A control strategy determination module 702 is used to query a preset flow control strategy based on a source MAC address and a destination MAC address to obtain a target flow control strategy corresponding to the source MAC address and the destination MAC address; The access control module 703 is used to perform access control on the service traffic based on the target traffic control policy.

[0044] The access control device 700 provided in the above embodiment can implement the technical solution described in the above access control method embodiment. The specific implementation principles of the above modules or units can refer to the corresponding contents in the above access control method embodiment, which will not be repeated here.

[0045] The access control device provided by the present invention obtains the message data in the business traffic, parses the message data to obtain the source MAC address and the destination MAC address, searches for the corresponding target traffic control policy in the preset traffic control policy based on the source MAC address and the destination MAC address, and performs access control on the business traffic based on the target traffic control side. If the business traffic is invalid or harmful traffic data sent by a poisoned or attacked device, the attack source can be quickly located according to the MAC address in the traffic data, and access control can be performed on the business traffic of the attack source, which can prevent other devices in the networking environment from being affected and ensure the network security of the networking environment.

[0046] like Figure 8 As shown, the present invention also provides an electronic device 800. The electronic device 800 includes a processor 801, a memory 802 and a display 803. Figure 8 Only some components of the electronic device 800 are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0047] In some embodiments, the processor 801 may be a central processing unit (CPU), a microprocessor or other data processing chip, and is used to run program codes or process data stored in the memory 802, such as the access control method of the present invention.

[0048] In some embodiments, the processor 801 may be a single server or a server group. The server group may be centralized or distributed. In some embodiments, the processor 801 may be local or remote. In some embodiments, the processor 801 may be implemented in a cloud platform. In some embodiments, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an internal cloud, a multi-cloud, etc., or any combination thereof.

[0049] In some embodiments, the memory 802 may be an internal storage unit of the electronic device 800, such as a hard disk or memory of the electronic device 800. In other embodiments, the memory 802 may also be an external storage device of the electronic device 800, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc., equipped on the electronic device 800.

[0050] Furthermore, the memory 802 may include both an internal storage unit of the electronic device 800 and an external storage device. The memory 802 is used to store application software installed in the electronic device 800 and various data.

[0051] In some embodiments, the display 803 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 803 is used to display information of the electronic device 800 and to display a visual user interface. The components 801-803 of the electronic device 800 communicate with each other via a system bus.

[0052] In some embodiments, when the processor 801 executes the access control program in the memory 802, the following steps may be implemented: Obtain the message data in the service traffic, parse the message data to obtain the source MAC address and destination MAC address in the message data; The preset flow control policy is queried based on the source MAC address and the destination MAC address to obtain the target flow control policy corresponding to the source MAC address and the destination MAC address; Perform access control on business traffic based on target traffic control policies.

[0053] It should be understood that: when the processor 801 executes the access control program in the memory 802, in addition to the above functions, other functions may also be implemented, and details may refer to the description of the above corresponding method embodiments.

[0054] Furthermore, the embodiment of the present invention does not specifically limit the type of the electronic device 800 mentioned, and the electronic device 800 may be a portable electronic device such as a mobile phone, a tablet computer, a personal digital assistant (PDA), a wearable device, a laptop computer, etc. Exemplary embodiments of portable electronic devices include but are not limited to portable electronic devices equipped with IOS, Android, Microsoft or other operating systems. The above-mentioned portable electronic devices may also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the present invention, the electronic device 800 may not be a portable electronic device, but a desktop computer with a touch-sensitive surface (e.g., a touch panel).

[0055] Accordingly, an embodiment of the present invention further provides a computer-readable storage medium, which is used to store computer-readable programs or instructions. When the program or instructions are executed by a processor, the steps or functions in the access control method provided by the above-mentioned method embodiments can be implemented.

[0056] Those skilled in the art can understand that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0057] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. An access control method, characterized in that: include: Acquire message data in the service traffic, and parse the message data to obtain a source MAC address and a destination MAC address in the message data; Querying a preset flow control policy based on the source MAC address and the destination MAC address to obtain a target flow control policy corresponding to the source MAC address and the destination MAC address; Access control is performed on the service traffic based on the target traffic control policy.

2. The access control method according to claim 1, characterized in that: The obtaining of message data in the service flow includes: When the service traffic is service traffic in a layer 2 networking environment, obtaining the service traffic between a layer 2 switch and a router in the layer 2 networking environment, and obtaining message data in the service traffic; When the service traffic is service traffic in a three-layer networking environment, the service traffic is obtained between a three-layer switch in the three-layer networking environment and an external network, and message data in the service traffic is obtained.

3. The access control method according to claim 2, characterized in that: When the service traffic is service traffic in a layer 2 networking environment, the querying of a preset traffic control strategy based on the source MAC address and the destination MAC address includes: Obtaining user real-name information bound to the source MAC address and / or the destination MAC address; A preset flow control strategy is queried based on the user's real-name information.

4. The access control method according to claim 2, characterized in that: When the service traffic is service traffic in a three-layer networking environment, the querying of a preset traffic control strategy based on the source MAC address and the destination MAC address includes: Determine whether the source MAC address and / or the destination MAC address has bound user real-name information based on the address resolution protocol table in the three-layer networking environment; When the address resolution protocol table contains user real-name information bound to the source MAC address and / or the destination MAC address, querying a preset traffic control strategy based on the user real-name information; When the user real-name information bound to the source MAC address and / or the destination MAC address does not exist in the address resolution protocol table, a default flow control policy is allocated to the service flow.

5. The access control method according to claim 1, characterized in that: The querying of a preset flow control policy based on the source MAC address and the destination MAC address to obtain a target flow control policy corresponding to the source MAC address and the destination MAC address includes: Based on the source MAC address and the destination MAC address, a fast matching tree algorithm is used in the preset flow control policy to search for a target flow control policy corresponding to the source MAC address and / or the destination MAC address.

6. The access control method according to claim 3, characterized in that: The preset flow control strategy based on the user real-name information query includes: Based on the user real-name information, a fast matching tree algorithm is used in the preset flow control strategy to search for a target flow control strategy corresponding to the user real-name information.

7. The access control method according to claim 1, characterized in that: The performing access control on the service traffic based on the target traffic control policy includes: The service traffic is released or controlled based on the target traffic control policy and the service relationship between the source MAC address and the destination MAC address.

8. An access control device, characterized in that: include: An address acquisition module is used to acquire message data in the service flow, and parse the message data to obtain a source MAC address and a destination MAC address in the message data; A control strategy determination module, used to query a preset flow control strategy based on the source MAC address and the destination MAC address to obtain a target flow control strategy corresponding to the source MAC address and the destination MAC address; An access control module is used to perform access control on the business traffic based on the target traffic control policy.

9. An electronic device, characterized in that: comprising a memory and a processor, wherein: The memory is used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the steps of the access control method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store computer-readable programs or instructions, which, when executed by a processor, can implement the steps of the access control method described in any one of claims 1 to 7.

Images