Network access method, device, equipment, medium and product

Abstract

Disclosed are a network access method, apparatus, device, medium and product, which can be applied to the field of financial science and technology, the method comprising: determining an access permission verification scheme of a device to be verified according to network access information, the network access information being network traffic data and / or access demand information of a terminal device, the access permission verification scheme is a link verification scheme and / or a flow verification scheme; determining a first permission verification result of the to-be-verified device based on the link verification scheme and the access demand information of the terminal device, and / or determining a second permission verification result of the to-be-verified device based on the traffic verification scheme and the network traffic data; and based on the first permission verification result and / or the second permission verification result, controlling the to-be-verified equipment to access the intranet information and / or adjusting the equipment parameters. Two permission verification methods are deployed, access work of different types is processed in a targeted mode, comprehensiveness of permission verification work is ensured, and safety of enterprise internal information is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of information security technology and can be applied to the field of financial technology, and in particular to a network access method, device, equipment, medium and product. Background Art

[0002] In order to ensure the security of internal enterprise information, the access terminal's authority needs to be verified during network access to prevent unauthorized terminals from accessing internal enterprise information and causing data leakage.

[0003] At present, the network access method of the terminal is to send the data packet to the network access server through the switch. The network access server authenticates the access authority of the terminal according to the account, password, digital certificate, product serial number (SN) and other information in the data packet, and returns the authentication result to the terminal so that the terminal can access the data or perform secondary authentication. On the one hand, the terminal access needs to rely on the 802.1x authentication (a port-based network access control protocol) of the switch. If the authentication link of the network access server fails, the terminal will not be able to access the intranet, access the internal information of the enterprise and work normally; on the other hand, the way the switch forwards the access application information and the access server determines the access rights of the terminal cannot identify the access of the port external hub (Hub), which poses a security risk of external devices accessing the enterprise intranet. Summary of the invention

[0004] The present invention provides a network access method, device, equipment, medium and product, which can be applied to the field of financial technology. Two permission verification methods are deployed for access to terminal devices and access to external devices to ensure the comprehensiveness of permission verification work and protect the security of internal enterprise information.

[0005] According to one aspect of the present invention, a network access method is provided, the method comprising:

[0006] Obtaining network access information, and determining an access rights verification scheme for the device to be inspected based on the network access information, wherein the network access information is network traffic data and / or access requirement information of the terminal device, and the access rights verification scheme is a link verification scheme and / or a traffic verification scheme;

[0007] Determine a first permission verification result of the device to be verified based on the link verification scheme and the access requirement information of the terminal device, and / or determine a second permission verification result of the device to be verified based on the traffic verification scheme and the network traffic data;

[0008] Based on the first permission verification result and / or the second permission verification result, the device to be inspected is controlled to access the intranet information and / or adjust the device parameters.

[0009] According to another aspect of the present invention, a network access device is provided, and the network access device is used to implement the network access method in any embodiment of the present invention, and the device includes:

[0010] An acquisition module is used to acquire network access information and determine an access rights verification scheme for the device to be inspected based on the network access information, wherein the network access information is network traffic data and / or access requirement information of the terminal device, and the access rights verification scheme is a link verification scheme and / or a traffic verification scheme;

[0011] A determination module, used to determine a first permission verification result of the device to be checked based on a link verification scheme and access requirement information of the terminal device, and / or to determine a second permission verification result of the device to be checked based on a traffic verification scheme and network traffic data;

[0012] The verification module is used to control the device to be inspected to access intranet information and / or adjust device parameters based on the first permission verification result and / or the second permission verification result.

[0013] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0014] at least one processor; and a memory communicatively coupled to the at least one processor;

[0015] The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by at least one processor so that the at least one processor can execute the network access method in any embodiment of the present invention.

[0016] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network access method in any embodiment of the present invention when executed.

[0017] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the network access method of any embodiment of the present invention is implemented.

[0018] The network access method of the present invention comprises: obtaining network access information, and determining the access permission verification scheme of the device to be inspected according to the network access information, the network access information is network flow data and / or access requirement information of the terminal device, and the access permission verification scheme is a link verification scheme and / or a flow verification scheme; based on the link verification scheme and the access requirement information of the terminal device, determining the first permission verification result of the device to be inspected, and / or, based on the flow verification scheme and the network flow data, determining the second permission verification result of the device to be inspected; based on the first permission verification result and / or the second permission verification result, controlling the device to be inspected to access the intranet information and / or adjusting the device parameters. The present invention sets two permission verification methods (i.e., link verification scheme and flow verification scheme), firstly, targetedly handle different types of access work (i.e., access of terminal devices and access of external devices), ensure the comprehensiveness of permission verification work, and protect the security of internal information of the enterprise, secondly, the link verification scheme of the present invention supports offline network access authentication, ensures that the access permission of the terminal device can be verified and evaluated in time, and ensures the real-time nature of access work while ensuring information security. It solves the problem that terminal access requires 802.1x authentication of the switch. If the authentication link of the network access server fails, the terminal will not be able to access the intranet, and will not be able to access internal corporate information or work normally. It also solves the problem that the switch forwards access application information and the access server determines the terminal's access rights and cannot identify the port external hub, posing a security risk to external devices accessing the corporate intranet.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0021] Figure 1 It is a flow chart of a network access method provided by the present invention;

[0022] Figure 2 It is a structural schematic diagram of a network access device provided by the present invention;

[0023] Figure 3 It is a structural schematic diagram of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present invention, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0025] It should be noted that the terms "first", "second", "initial", "candidate", "intermediate", "target", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] Industries such as finance and healthcare have strict data security requirements and require verification of terminal access rights. If terminals accessing the company's internal information system are not inspected and restricted, the following problems will occur: 1) Unauthorized terminals access the company network, increasing the risk of hacker attacks and malware infections. 2) Sensitive information may be accessed by unauthorized terminals, posing a risk of data leakage. 3) When a security incident occurs, it is impossible to track the terminal or user, increasing the difficulty of investigation and analysis. 4) Without checking the security status of the access terminal (for example, operating system updates, antivirus software installation, etc.), or without confirming whether the terminal configuration meets the company's internal requirements, allowing the terminal to directly log in to the company's internal network poses a risk of non-compliance. To ensure the safe and stable operation of the company's internal information system and avoid the above problems, the company needs to conduct network access before the terminal accesses the company's internal network, and only allow terminals that meet the company's internal requirements to access the internal information system and data.

[0027] Figure 1 This is a flow chart of a network access method provided by the present invention. This embodiment can be applied to comprehensively evaluate the access rights of devices with access requirements, ensure the security of data in the enterprise intranet, etc. The method can be executed by the network access device provided by the present invention, and the device can be implemented in the form of hardware and / or software. In a specific embodiment, the device can be integrated in an electronic device. The following embodiments will be described by taking the device integrated in an electronic device as an example. Figure 1, the method specifically comprises the following steps:

[0028] S101. Obtain network access information, and determine an access rights verification scheme for a device to be inspected based on the network access information.

[0029] Network access is a network security technology that prevents unauthorized devices from accessing protected computer networks (for example, the intranet database of financial enterprises, the intranet database of the medical industry, etc.) through a series of verification measures such as identity authentication, authorization, and compliance checks. The device to be tested can be understood as a device that requires access rights verification. Generally, the executor of the access work can be a terminal (forwarding information through a switch) or an interface device (forwarding information through a port). Therefore, the device to be tested includes terminals and external devices. Network access information can be understood as the access information of the device to be tested. The network access information is network traffic data and / or access demand information of the terminal device. The network traffic data is generated by the external device and can be determined by monitoring the port information. The access demand information is forwarded by the terminal device (i.e., the terminal) through the switch. The access demand information of the terminal device includes the terminal account, password, digital certificate, SN number, etc., which is used to assist the access server in determining the patch version of the terminal operating system, firewall settings, antivirus software version, malware data and other information, and then evaluate whether the terminal can access the enterprise intranet. The access permission verification scheme is a link verification scheme and / or a flow verification scheme. The link verification scheme is used to verify the access permission of the terminal device, and the flow verification scheme is used to verify the access permission of the external device.

[0030] In one embodiment, S101 may specifically include: utilizing an information acquisition device deployed on an access verification server to acquire network traffic data and / or access requirement information of a terminal device; the access requirement information of the terminal device is generated by a first device to be inspected (i.e., a terminal), and the network traffic data is generated by a second device to be inspected (i.e., an external device); when the network access information is network traffic data, determining that the access permission verification scheme is a traffic verification scheme; when the network access information is the access requirement information of a terminal device, determining that the access permission verification scheme is a link verification scheme; when the network access information is network traffic data and access requirement information of a terminal device, determining that the access permission verification scheme is a traffic verification scheme and a link verification scheme.

[0031] Since different types of devices have different permission verification methods, in order to ensure the security of internal enterprise information and completely prohibit unauthorized devices from accessing internal enterprise information, the present invention sets up two permission verification methods: a link verification scheme and a traffic verification scheme. The type information of the device that needs to be verified is determined according to the network access information, and then the verification scheme is started in a targeted manner to improve the verification efficiency under the premise of ensuring the smooth verification work.

[0032] S102: Determine a first permission verification result of the device to be verified based on a link verification scheme and access requirement information of the terminal device, and / or determine a second permission verification result of the device to be verified based on a traffic verification scheme and network traffic data.

[0033] Specifically, the first permission verification result can be understood as the permission verification result of the first device to be tested, which is used to indicate whether the first device to be tested can access the internal data of the enterprise, and the second permission verification result can be understood as the permission verification result of the second device to be tested, which is used to indicate whether the second device to be tested can access the internal data of the enterprise. When the permission verification result is authorized, the corresponding device is allowed to access the internal data of the enterprise, and when the permission verification result is unauthorized, the corresponding device is prohibited from accessing the internal data of the enterprise or is only allowed to access the public data of the enterprise, that is, the enterprise data is graded and different data is opened to devices with different permissions.

[0034] When the network access information only includes network traffic data and the access permission verification scheme is a traffic verification scheme, it is determined that the only device with access requirements is the terminal, and only the first permission verification result needs to be determined. S102 is to determine the first permission verification result of the device to be tested based on the link verification scheme and the access requirement information of the terminal device. Similarly, when the network access information only includes the access requirement information of the terminal device and the access permission verification scheme is a link verification scheme, it is determined that the only device with access requirements is the external device, and only the second permission verification result needs to be determined. S102 is to determine the second permission verification result of the device to be tested based on the traffic verification scheme and the network traffic data. When the network access information includes network traffic data and the access requirement information of the terminal device, the access permission verification scheme is a link verification scheme and a traffic verification scheme, it is determined that the devices with access requirements include the terminal and the external device, and the link verification scheme and the traffic verification scheme are used to respectively verify the access rights of the corresponding devices. S102 is to determine the first permission verification result of the device to be tested based on the link verification scheme and the access requirement information of the terminal device, and to determine the second permission verification result of the device to be tested based on the traffic verification scheme and the network traffic data.

[0035] On the one hand, based on the link verification scheme and the access requirement information of the terminal device, the first permission verification result of the device to be inspected is determined, including: determining whether the access link of the access verification server is faulty; if the access link of the access verification server is normal, using the access verification server to process the access requirement information of the terminal device to obtain the first permission verification result; if the access link of the access verification server is faulty, sending a self-test instruction to the device to be inspected, so that the device to be inspected determines the first permission verification result based on the access requirement information of the terminal device and a pre-trained target permission prediction model.

[0036] When there is no abnormality in the access link, the access link will be used first to verify the access rights of the terminal. The implementation process of this method includes: 1) The terminal sends the data packet to the network access server through the switch; 2) The network access server performs access authentication based on the account, password, digital certificate, SN number and other information in the data packet, determines the terminal's operating system patch version, firewall settings, antivirus software version and malware, and obtains the network authentication result; 3) The network access server determines the terminal's access rights based on the network authentication result and compliance check, and returns the corresponding network access rights policy to the terminal; 4) If the network access rights policy indicates that the terminal is authorized, the terminal is allowed to access the company's internal data; if the network access rights policy indicates that the compliance check fails, the terminal will be isolated to a restricted network area, and the user will be prompted to repair the terminal according to the guide to re-authenticate the process. It is worth noting that the network access server will continuously monitor the network behavior of the authenticated device to ensure that it always complies with the security policy. Once the device behavior is abnormal, it will immediately restrict access or isolate the terminal to protect the company's internal data.

[0037] If the access link fails, it may cause a large area of ​​terminals to be unable to access, affecting the daily work of users. Therefore, the present invention sets an offline network access authentication method, and the self-check instruction can be understood as the start instruction of the offline network access authentication. The target authority prediction model can be understood as an algorithm that is pre-trained and stored on the terminal and can predict and analyze the access rights of the terminal. The present invention can achieve offline network access, that is, the algorithm model is deployed on the terminal. When the network access link fails, the control terminal uses the artificial intelligence (AI) algorithm model to analyze the local knowledge base of the terminal, and then decides whether the terminal has the authority to access the network, quickly achieves network access, and avoids the terminal being unable to access the internal data of the enterprise due to the suspension of network access work, which affects the user's work.

[0038] Determining a target permission prediction model includes: obtaining historical access verification information of an access verification server, the historical access verification information including terminal information, user information and log information; training an initial permission prediction model based on the terminal information, user information and log information, and when the initial permission prediction model meets pre-set model convergence conditions (including but not limited to the number of iterations and loss function), determining the trained initial permission prediction model as the target permission prediction model.

[0039] The present invention will control each terminal to interact with the network access server regularly when the access link is normal, obtain the permission verification data on the network access server, build a local knowledge base containing network access related information on each terminal, and train the permission prediction model to verify the access rights of the terminal when the access link fails, ensuring the stability and feasibility of the verification work. The data of the model is true and reliable, so the accuracy of the prediction results is guaranteed. Secondly, the model will also be optimized regularly. The purpose of this setting is to ensure the real-time nature of the model and the accuracy of the prediction results.

[0040] The historical access verification information can be understood as the permission verification information recorded on the network access server. The terminal information includes but is not limited to the terminal's media access control address (also known as the local area network address, Media Access ControlAddress, MAC), Internet Protocol (Internet Protocol, IP) address and device type; user information includes but is not limited to account number and password; log information includes but is not limited to network usage logs and historical behavior patterns of devices. In addition, the historical access verification information can also include security policies and compliance requirements that the terminal needs to comply with, such as the version number of the operating system, the minimum patch number requirement of the operating system, the version number of the software, the minimum patch number requirement of the software, the installation requirements of the antivirus software, the virus code update requirements of the antivirus software, user permission requirements and blacklist software, etc. The specific information can be set and adjusted according to the terminal management and verification requirements, and the present invention does not limit this.

[0041] The model training process includes: deploying AI algorithms on the terminal to realize data analysis and access decision-making functions. The present invention may involve supervised learning algorithms, unsupervised learning algorithms and deep learning algorithms. Supervised learning algorithms can train classification models based on historical data to identify and predict the authorization status of devices. Unsupervised learning algorithms can discover unknown device behavior patterns. Deep learning algorithms can handle more complex patterns and predictions. The purpose of this setting is to train a permission prediction model with high accuracy, high flexibility and high popularity.

[0042] The decision-making access authentication includes: when the access link fails, based on the device information of the current terminal (i.e., the access requirement information of the terminal device), use the trained model to identify whether the current terminal is an authorized device, and then judge whether the current terminal meets the access conditions based on the security policy and compliance information in the current knowledge base; at the same time, it is also necessary to detect whether the terminal has abnormal behavior, for example, whether blacklist software is installed, whether there is an attack, etc. If the model recognizes that the terminal is an authorized device and the behavior is normal, then the first permission verification result is determined to be passed, that is, the current terminal is allowed to access the enterprise intranet. Otherwise, the current terminal is denied access to the enterprise intranet, and the security detection mechanism can also be triggered to perform terminal security detection. Secondly, the present invention can also optimize the function of the model so that it has the ability to automatically access the network and start the security detection mechanism, saving manpower and processor work, reducing costs and increasing efficiency.

[0043] On the other hand, determining the second permission verification result of the device to be inspected based on the traffic verification scheme and network traffic data includes: using predetermined device behavior data to determine interface device detection information; determining the second permission verification result based on the interface device detection information and network traffic data.

[0044] Network traffic data is generally obtained through the external port status identification component of the network access module. The network access module can collect network traffic data from the network access server, analyze normal network traffic (device behavior data), parse user browsing habits, communication frequency and other information, and then determine the operating parameters of the external device to which access rights are granted, that is, the interface device detection information.

[0045] The present invention will collect network traffic data of the network access server in real time and analyze its traffic pattern. If the network traffic data is abnormal (for example, a sudden increase in traffic, an abnormal communication pattern, etc.), it indicates that an external device is connected through the Hub. At that time, through pattern matching technology, it is identified whether the external device is a known device (that is, whether it is a device included in the interface device detection information). If it is a known device, it is determined that the permission of the external device is authorized. If it is not a known device, it is determined that the permission of the external device is unauthorized, and an alarm will be issued to remind the user that there is a security threat.

[0046] It is worth noting that the present invention can also train a network information detection model, which is a model for judging the current network status and used to identify normal network behavior and abnormal network behavior. The purpose of this setting is to improve the diagnostic efficiency of network traffic data. Similarly, the model will also be regularly optimized to adapt to network changes and new security threats.

[0047] S103: Based on the first permission verification result and / or the second permission verification result, control the device to be inspected to access intranet information and / or adjust device parameters.

[0048] The present invention can start different processing tasks according to different verification results, which not only ensures the access security of intranet information, but also adjusts the parameters of abnormal terminal devices to improve the stability of the terminal.

[0049] On the one hand, when the first permission verification result is an authorized state, the first device to be inspected is controlled to access the intranet information; when the first permission verification result is an unauthorized state, the first device to be inspected is controlled to perform a security check, and the device parameters of the first device to be inspected are adjusted according to the security check result of the first device to be inspected.

[0050] For example, when the security detection result indicates that the terminal's operating system patch version is low, the terminal's operating system patch is upgraded, which not only improves the terminal's performance, but also prepares for the terminal's secondary triggering access process and improves the success rate of secondary access.

[0051] On the other hand, when the second permission verification result is an authorized state, the second device to be inspected is controlled to access the intranet information; when the second permission verification result is an unauthorized state, a first warning message is generated.

[0052] The first warning information is used to instruct the user to handle abnormal external devices in a timely manner to ensure the security of intranet information.

[0053] The present invention sets up two permission verification methods (i.e., link verification scheme and flow verification scheme). First, different types of access work (i.e., access of terminal devices and access of external devices) are handled in a targeted manner to ensure the comprehensiveness of permission verification work and the security of internal enterprise information. Secondly, the link verification scheme of the present invention supports offline network access authentication to ensure that the access rights of terminal devices can be verified and evaluated in a timely manner, ensuring the real-time nature of access work while ensuring information security. It solves the problem that terminal access requires the 802.1x authentication of the switch. If the authentication link of the network access server fails, the terminal will not be able to access the intranet, access internal enterprise information and work normally. It also solves the problem that the switch forwards access application information and the access server determines the access rights of the terminal in a way that cannot identify the port external hub, and there is a security risk of external devices accessing the enterprise intranet. The beneficial effects of the present invention include: 1) quickly verifying the access rights of the terminal in an offline network access manner when the network access link is interrupted; 2) identifying external devices such as hubs to avoid security threats of port-type devices.

[0054] Figure 2 Schematic diagram of the structure of a network access device provided by the present invention. Figure 2 As shown, the device includes: an acquisition module 201, a determination module 202 and a verification module 203.

[0055] The acquisition module 201 is used to obtain network access information and determine the access permission verification scheme of the device to be inspected based on the network access information, wherein the network access information is network traffic data and / or access requirement information of the terminal device, and the access permission verification scheme is a link verification scheme and / or a traffic verification scheme.

[0056] The determination module 202 is used to determine the first permission verification result of the device to be checked based on the link verification scheme and the access requirement information of the terminal device, and / or determine the second permission verification result of the device to be checked based on the traffic verification scheme and network traffic data.

[0057] The verification module 203 is used to control the device to be checked to access the intranet information and / or adjust the device parameters based on the first permission verification result and / or the second permission verification result.

[0058] Optionally, the acquisition module 201 is specifically used to utilize the information acquisition device deployed on the access verification server to acquire network traffic data and / or access requirement information of the terminal device; wherein the access requirement information of the terminal device is generated by the first device to be inspected, and the network traffic data is generated by the second device to be inspected; when the network access information is network traffic data, the access permission verification scheme is determined to be a traffic verification scheme; when the network access information is the access requirement information of the terminal device, the access permission verification scheme is determined to be a link verification scheme; when the network access information is the network traffic data and the access requirement information of the terminal device, the access permission verification scheme is determined to be a traffic verification scheme and a link verification scheme.

[0059] Optionally, the determination module 202 is specifically used to determine whether the access link of the access verification server is faulty; if the access link of the access verification server is normal, the access verification server is used to process the access requirement information of the terminal device to obtain a first permission verification result; if the access link of the access verification server is faulty, a self-test instruction is sent to the device to be inspected, so that the device to be inspected determines the first permission verification result based on the access requirement information of the terminal device and a pre-trained target permission prediction model.

[0060] Optionally, the network access device also includes a model training module, which is used to determine a target permission prediction model, that is, to obtain historical access verification information of the access verification server, wherein the historical access verification information includes terminal information, user information and log information; to train the initial permission prediction model based on the terminal information, user information and log information, and when the initial permission prediction model meets pre-set model convergence conditions, determine that the trained initial permission prediction model is the target permission prediction model.

[0061] Optionally, the determination module 202 is specifically configured to determine interface device detection information using predetermined device behavior data; and determine a second permission verification result based on the interface device detection information and network traffic data.

[0062] Optionally, the verification module 203 is specifically used to control the first device to be inspected to access intranet information when the first permission verification result is an authorized state; when the first permission verification result is an unauthorized state, control the first device to be inspected to perform a security check, and adjust the device parameters of the first device to be inspected according to the security check result of the first device to be inspected; and / or, when the second permission verification result is an authorized state, control the second device to be inspected to access intranet information; when the second permission verification result is an unauthorized state, generate a first warning message.

[0063] The network access device provided by the present invention can execute the network access method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0064] Figure 3 : is a schematic diagram of the structure of an electronic device provided by the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0065] like Figure 3 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (also called random access memory, RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, ROM 12 and RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0066] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0067] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a network admission method.

[0068] In some embodiments, the network admission method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the network admission method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the network admission method in any other appropriate manner (e.g., by means of firmware).

[0069] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0070] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0071] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0072] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0073] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server) or a computing system that includes middleware components (e.g., an application server) or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein) or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0074] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0075] In one embodiment, the present invention further includes a computer program product, the computer program product includes a computer program, and when the computer program is executed by a processor, the network access method of any embodiment of the present invention is implemented.

[0076] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0077] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0078] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A network access method, characterized in that: include: Acquire network access information, and determine an access rights verification scheme for the device to be inspected according to the network access information, wherein the network access information is network traffic data and / or access requirement information of the terminal device, and the access rights verification scheme is a link verification scheme and / or a traffic verification scheme; Determine a first permission verification result of the device to be verified based on the link verification scheme and the access requirement information of the terminal device, and / or determine a second permission verification result of the device to be verified based on the traffic verification scheme and the network traffic data; Based on the first permission verification result and / or the second permission verification result, the device to be inspected is controlled to access intranet information and / or adjust device parameters.

2. The method according to claim 1, characterized in that The device to be inspected includes a first device to be inspected and a second device to be inspected, and the obtaining of network access information and determining the access rights verification scheme of the device to be inspected according to the network access information include: Using an information acquisition device deployed on the access verification server, the network flow data and / or the access requirement information of the terminal device are acquired; wherein the access requirement information of the terminal device is generated by the first device to be inspected, and the network flow data is generated by the second device to be inspected; When the network access information is the network traffic data, determining that the access permission verification scheme is the traffic verification scheme; When the network access information is the access requirement information of the terminal device, determining that the access permission verification scheme is the link verification scheme; When the network access information is the network traffic data and the access requirement information of the terminal device, the access permission verification scheme is determined to be the traffic verification scheme and the link verification scheme.

3. The method according to claim 1, characterized in that The determining, based on the link verification scheme and the access requirement information of the terminal device, a first permission verification result of the device to be verified includes: Determining whether an admission link of the admission verification server is faulty; If the access link of the access verification server is normal, the access verification server is used to process the access requirement information of the terminal device to obtain the first authority verification result; If the access link of the access verification server fails, a self-test instruction is sent to the device to be tested, so that the device to be tested determines the first permission verification result based on the access requirement information of the terminal device and a pre-trained target permission prediction model.

4. The method according to claim 3, characterized in that Determining the target authority prediction model includes: Acquire historical access verification information of the access verification server, wherein the historical access verification information includes terminal information, user information and log information; The initial permission prediction model is trained based on the terminal information, the user information and the log information, and when the initial permission prediction model meets a pre-set model convergence condition, the trained initial permission prediction model is determined to be the target permission prediction model.

5. The method according to claim 1, characterized in that The determining, based on the traffic verification scheme and the network traffic data, a second permission verification result of the device to be verified includes: Determine interface device detection information using predetermined device behavior data; Based on the interface device detection information and the network traffic data, the second authority verification result is determined.

6. The method according to claim 2, characterized in that The controlling the device to be inspected to access intranet information and / or adjusting device parameters based on the first permission verification result and / or the second permission verification result includes: When the first permission verification result is an authorized state, control the first device to be inspected to access intranet information; when the first permission verification result is an unauthorized state, control the first device to be inspected to perform a security check, and adjust the device parameters of the first device to be inspected according to the security check result of the first device to be inspected; and / or, When the second permission verification result is an authorized state, the second device to be inspected is controlled to access the intranet information; when the second permission verification result is an unauthorized state, a first warning message is generated.

7. A network access device, characterized in that: Used to implement the network access method described in any one of claims 1 to 6, the network access device comprises: an acquisition module, used to acquire network access information, and determine an access rights verification scheme for the device to be inspected according to the network access information, wherein the network access information is network traffic data and / or access requirement information of the terminal device, and the access rights verification scheme is a link verification scheme and / or a traffic verification scheme; A determination module, configured to determine a first permission verification result of the device to be verified based on the link verification scheme and the access requirement information of the terminal device, and / or to determine a second permission verification result of the device to be verified based on the traffic verification scheme and the network traffic data; A verification module is used to control the device to be inspected to access intranet information and / or adjust device parameters based on the first permission verification result and / or the second permission verification result.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network access method described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network access method described in any one of claims 1 to 6 when executed.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the network admission method according to any one of claims 1 to 6.

Images