A network device background access control method, program product, device and medium

Abstract

The embodiment of the application provides a network device background access control method, program product, device and medium, and relates to the technical field of network security. The network device background access control method is applied to a target network device, and the target network device is provided with a Web UI interface; the method comprises the following steps: obtaining a background access control instruction input by a first user through the Web UI interface; wherein the background access control instruction is obtained according to a background operation command selected by a second user; performing security check on the background access control instruction, and executing the background operation command to obtain a command execution result in the case that the background access control instruction passes the security check. The embodiment of the application can effectively guarantee the technical effect of network device background access security.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network device background access control method, program product, device and medium. BACKGROUND

[0002] In order to prevent users from randomly accessing the background system of the network device, ensure the normal operation of the network device, and avoid the leakage of technical secrets of the background system, most manufacturers will hide the real background access interface of the network device. When the network device has an emergency failure and the manufacturer's engineers cannot arrive at the scene in time to handle it, the manufacturer's engineers often need to remotely guide the user to enter the background system to execute the corresponding operation command for troubleshooting, which will expose the real background access interface of the network device to the user, and cannot limit the operation command executed by the user, making it difficult to effectively ensure the security of the network device background access. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a network device background access control method, program product, device and medium, which can effectively ensure the security of the network device background access.

[0004] In a first aspect, the embodiments of the present application provide a network device background access control method applied to a target network device, wherein the target network device is provided with a Web UI interface; the method comprises the following steps:

[0005] obtaining a background access control instruction input by a first user through the Web UI interface; wherein the background access control instruction is obtained according to a background operation command selected by a second user;

[0006] performing a security check on the background access control instruction, and executing the background operation command to obtain a command execution result in the case that the background access control instruction passes the security check.

[0007] In the implementation process, the target network device is set to open a Web UI interface to the first user, so that the first user can input the background access control instruction to the target network device through the Web UI interface after obtaining the background access control instruction according to the background operation command selected by the second user, the target network device obtains the background access control instruction input by the first user through the Web UI interface, performs security check on the background access control instruction, and executes the background operation command to obtain a command execution result when the background access control instruction passes the security check. This not only enables the first user to directly execute a specific background operation command on the target network device through the Web UI interface, without exposing the real background access interface of the target network device to the first user, but also ensures that the selection right of the background operation command is reserved for the second user, effectively limiting the background operation command executed by the first user on the target network device, thereby effectively ensuring the security of network device background access.

[0008] Further, the background access control instruction is obtained by performing the following processing on the background operation command:

[0009] The background operation command is encapsulated according to a preconfigured message encapsulation structure to generate a first target message;

[0010] The first target message is encrypted using a preconfigured encryption algorithm to obtain an encrypted message;

[0011] The encrypted message is encoded using a preconfigured encoding method to obtain the background access control instruction.

[0012] In the implementation process, the background access control instruction is obtained by sequentially encapsulating, encrypting and encoding the background operation command selected by the second user according to the preconfigured message encapsulation structure, encryption algorithm and encoding method, which can effectively avoid exposing the real background access interface of the target network device, and further ensure the security of network device background access.

[0013] Further, the background access control instruction is obtained by performing the following processing on the background operation command:

[0014] A message encapsulation program is run to obtain input information input by the second user on a user interface of the message encapsulation program, and the input information is filled in the message encapsulation structure to generate the first target message; wherein the message content of the first target message includes one or more of the background operation command, a standard message start marker in the message encapsulation structure, device identification information of the target network device, task identification information of the current background access control task, and a message generation time of the first target message.

[0015] In the implementation process, the first target message is generated by encapsulating the background operation command through the running message encapsulation program, obtaining the input information input by the second user on the user interface of the message encapsulation program, and filling the input information in the message encapsulation structure, so that the message encapsulation efficiency is improved.

[0016] Further, the encryption algorithm includes an asymmetric encryption algorithm, and the encoding mode includes a base64 encoding mode.

[0017] In the implementation process, the first target message is encrypted by the asymmetric encryption algorithm to obtain an encrypted message, which can hide the structure of the first target message on one hand to avoid the leakage of the background operation command, and on the other hand can ensure the decryption success in the case of holding a correct key to avoid the forgery of the background operation command, and the encrypted message is encoded by the base64 encoding mode to obtain the background access control instruction, which can be printed to facilitate the subsequent display on the Web UI of the target network device.

[0018] Further, the background access control instruction is obtained by sequentially encapsulating, encrypting and encoding the background operation command;

[0019] The security check on the background access control instruction includes:

[0020] The background access control instruction is decoded to obtain a to-be-decrypted message;

[0021] The to-be-decrypted message is decrypted to obtain a second target message;

[0022] The message content of the second target message is verified to be correct;

[0023] According to the verification result, it is determined whether the background access control instruction passes the security check.

[0024] In the implementation process, the security of the background access control instruction is checked by sequentially decoding, decrypting and content verifying the background access control instruction on the premise that the background access control instruction is obtained by sequentially encapsulating, encrypting and encoding the background operation command, so that the security of the background access control instruction can be quickly and accurately checked, and the security of the network device background access is further ensured.

[0025] Further, the message content of the second target message includes the background operation command, and the message start marker of the second target message, the device identification information of the to-be-accessed network device, the task identification information of the current background access control task, and the message generation time of the second target message.

[0026] the verifying whether the message content of the second target message is correct comprises:

[0027] comparing whether the message starting mark is consistent with a pre-configured standard message starting mark;

[0028] comparing whether the device identification information of the network device to be accessed is consistent with the device identification information of the target network device;

[0029] comparing whether the task identification information of the current background access control task is consistent with the task identification information of the historical background access control task;

[0030] counting an interval duration between the message generation moment and a current moment, and judging whether the interval duration reaches an interval duration threshold value;

[0031] the determining whether the background access control instruction passes the security check according to the verification result comprises:

[0032] if the message starting mark is consistent with the standard message starting mark, the device identification information of the network device to be accessed is consistent with the device identification information of the target network device, the task identification information of the current background access control task is inconsistent with the task identification information of the historical background access control task, and the interval duration does not reach the interval duration threshold value, it is determined that the background access control instruction passes the security check;

[0033] otherwise, it is determined that the background access control instruction does not pass the security check.

[0034] In the implementation process, by the target network device, in the case that the message content of the obtained second target message includes a background operation command, and the message starting mark of the second target message, the device identification information of the network device to be accessed, the task identification information of the current background access control task, and the message generation time of the second target message, it is compared whether the message starting mark is consistent with the standard message starting mark, whether the device identification information of the network device to be accessed is consistent with the device identification information of the target network device, whether the task identification information of the current background access control task is consistent with the task identification information of the historical background access control task, and whether the interval duration between the message generation time and the current time reaches the interval duration threshold. If the message starting mark is consistent with the standard message starting mark, the device identification information of the network device to be accessed is consistent with the device identification information of the target network device, the task identification information of the current background access control task is inconsistent with the task identification information of the historical background access control task, and the interval duration does not reach the interval duration threshold, it is determined that the background access control instruction passes the security check, otherwise it is determined that the background access control instruction does not pass the security check. The message content of the second target message can be comprehensively checked, and the security check of the background access control instruction can be comprehensively and accurately performed.

[0035] Further, the method further comprises:

[0036] returning the command execution result; and / or,

[0037] storing the command execution result, and returning a download link of the command execution result.

[0038] In the implementation process, by the target network device, after obtaining the command execution result, returning the command execution result, and / or storing the command execution result and returning a download link of the command execution result, one or more ways of providing the command execution result to the first user can be flexibly selected, and the first user can quickly obtain the command execution result.

[0039] In a second aspect, the embodiments of the present application provide a network device background access control device, applied to a target network device, the target network device is provided with a Web UI interface; the device comprises:

[0040] An instruction receiving module is configured to obtain a background access control instruction input by a first user through the Web UI interface; wherein the background access control instruction is obtained according to a background operation command selected by a second user;

[0041] An access control module is configured to perform security check on the background access control instruction, and execute the background operation command to obtain a command execution result in the case that the background access control instruction passes the security check.

[0042] In a third aspect, an embodiment of the present application provides a computer program product, which comprises instructions, which, when executed by a computer, cause the computer to implement the method described above.

[0043] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; the processor implements the method described above when executing the computer program.

[0044] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, which comprises a stored computer program; wherein the computer-readable storage medium controls a device where the computer-readable storage medium is located to execute the method described above when the computer program runs. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation to the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0046] Figure 1 A flowchart of a network device background access control method provided by the first embodiment of the present application;

[0047] Figure 2 A flowchart of a network device background access control method provided by the first embodiment of the present application;

[0048] Figure 3 A structural diagram of a network device background access control device provided by the second embodiment of the present application;

[0049] Figure 4 A structural diagram of an electronic device provided by the third embodiment of the present application. DETAILED DESCRIPTION

[0050] The technical solutions of the embodiments of the present application will be described below in combination with the drawings in the embodiments of the present application.

[0051] It should be noted that in the description of the present application, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance. At the same time, the step numbers in the text are only for the convenience of the explanation of the embodiments of the present application, and do not serve as a limitation to the execution sequence of the steps.

[0052] In order to prevent users from accessing the background system of the network device at will, ensure the normal operation of the network device, and avoid the leakage of technical secrets of the background system, most manufacturers will hide the real background access interface of the network device. When the network device has an emergency failure and the manufacturer's engineers cannot arrive at the scene in time to handle it, the manufacturer's engineers often need to remotely guide the user to enter the background system to execute the corresponding operation command for troubleshooting, which will expose the real background access interface of the network device to the user, and cannot limit the operation command executed by the user, and it is difficult to effectively ensure the security of the background access of the network device.

[0053] Therefore, an embodiment of the present application provides a network device background access control method, by setting a target network device to open a Web UI interface to a first user, so that the first user can input a background access control instruction to the target network device through the Web UI interface after obtaining the background access control instruction according to a background operation command selected by a second user, the target network device obtains the background access control instruction input by the first user through the Web UI interface, performs a security check on the background access control instruction, and executes the background operation command to obtain a command execution result in the case that the background access control instruction passes the security check. Not only can the first user directly execute a specific background operation command of the target network device through the Web UI interface, without exposing the real background access interface of the target network device to the first user, but also can ensure that the selection right of the background operation command is reserved to the second user, effectively limiting the background operation command executed by the first user on the target network device, thereby effectively ensuring the security of the background access of the network device.

[0054] The method provided by the embodiment of the present application can be executed by a related terminal device, and the following will be described by taking the network device as an execution subject.

[0055] Please refer to Figure 1 , Figure 1 A flowchart of a network device background access control method provided by the first embodiment of the present application. The first embodiment of the present application provides a network device background access control method, applied to a target network device, and the target network device is provided with a Web UI interface; the method comprises steps S101-S102:

[0056] S101, obtaining a background access control instruction input by a first user through a Web UI interface; wherein the background access control instruction is obtained according to a background operation command selected by a second user;

[0057] S102, performing a security check on the background access control instruction, and executing the background operation command to obtain a command execution result in the case that the background access control instruction passes the security check.

[0058] As an example, a Web UI interface is set in advance for each network device deployed with a system developed by a vendor. The Web UI (Website User Interface) interface allows a user to interact with the background system of the network device. The user, i.e., a first user, can select any network device as a target network device according to actual application requirements, and the target network device is provided with the Web UI interface, so that the first user can directly input a background access control instruction to the target network device through the Web UI interface after obtaining the background access control instruction. The background access control instruction is obtained according to a background operation command selected by a management user, i.e., a second user, so that the second user can delegate the first user to execute a specific background operation command on the target network device according to the background access requirements of the first user on the target network device.

[0059] In actual applications, the second user can select a background operation command, such as a CPU viewing command, a service running condition viewing command, a configuration modification command, and a process viewing command, which is allowed to be executed by the first user according to the background access requirements of the first user on the target network device, process the selected background operation command accordingly to obtain the background access control instruction, and send the background access control instruction to the first user, so that the first user can directly obtain the background access control instruction.

[0060] It can be understood that by allowing the first user to directly obtain the background access control instruction, the first user can be prevented from changing the background operation command selected by the second user, and the background operation command executed by the first user on the target network device can be effectively limited.

[0061] After the first user inputs the background access control instruction to the target network device through the Web UI interface, the target network device obtains the background access control instruction input by the first user through the Web UI interface of the target network device.

[0062] The target network device performs a security check on the background access control instruction to determine whether the background access control instruction passes the security check.

[0063] If it is determined that the background access control instruction passes the security check, it means that the background access control instruction is a legal and safe instruction, the target network device determines the background operation command in the background access control instruction, executes the background operation command, and obtains a command execution result.

[0064] If it is determined that the background access control instruction does not pass the security check, it means that the background access control instruction is illegal and unsafe, and in this case, the background operation command will not be executed, and an error prompt information can be directly returned.

[0065] The embodiment of the present application sets the target network device to open a Web UI interface to the first user, so that the first user can input the background access control instruction to the target network device through the Web UI interface after obtaining the background access control instruction according to the background operation command selected by the second user, the target network device obtains the background access control instruction input by the first user through the Web UI interface, performs security check on the background access control instruction, and executes the background operation command to obtain the command execution result in the case that the background access control instruction passes the security check, which can not only enable the first user to directly execute the specific background operation command of the target network device through the Web UI interface, and does not expose the real background access interface of the target network device to the first user, but also can ensure that the selection right of the background operation command is reserved to the second user, effectively limits the background operation command executed by the first user to the target network device, thereby effectively ensuring the background access security of the network device.

[0066] In the optional embodiment, the background access control instruction is obtained by performing the following processing on the background operation command: encapsulating the background operation command according to a preconfigured message encapsulation structure to generate a first target message, encrypting the first target message by using a preconfigured encryption algorithm to obtain an encrypted message, and encoding the encrypted message by using a preconfigured encoding mode to obtain the background access control instruction.

[0067] As an example, in order to constrain the data supported by the Web UI interface to be transmitted, prevent other users from randomly accessing the background of the target network device through the Web UI interface, and more effectively avoid exposing the real background access interface of the target network device, the message encapsulation structure, the encryption algorithm and the encoding mode can be preconfigured on the terminal device for obtaining the background access control instruction according to the background operation command selected by the second user, and the terminal device can sequentially encapsulate, encrypt and encode the background operation command according to the preconfigured message encapsulation structure, encryption algorithm and encoding mode to obtain the background access control instruction after obtaining the background operation command selected by the second user, specifically: encapsulating the background operation command according to the preconfigured message encapsulation structure to generate a first target message, encrypting the first target message by using a preconfigured encryption algorithm to obtain an encrypted message, and encoding the encrypted message by using a preconfigured encoding mode to obtain the background access control instruction, so as to provide the background access control instruction to the first user.

[0068] In actual application, the message packaging structure, the encryption algorithm and the encoding mode can be configured in advance on a terminal device held by the second user, i.e., a second user terminal. The second user selects a background operation command allowed to be executed by the first user according to the background access demand of the first user to the target network device, inputs the selected background operation command into the second user terminal, and the second user terminal encapsulates, encrypts and encodes the background operation command in sequence according to the pre-configured message packaging structure, encryption algorithm and encoding mode to obtain the background access control instruction. The message packaging structure, the encryption algorithm and the encoding mode can also be configured in advance on a terminal device held by a third party, i.e., a third party terminal, such as a server. The second user selects a background operation command allowed to be executed by the first user according to the background access demand of the first user to the target network device, inputs the selected background operation command into the third party terminal, and the third party terminal encapsulates, encrypts and encodes the background operation command in sequence according to the pre-configured message packaging structure, encryption algorithm and encoding mode to obtain the background access control instruction.

[0069] The embodiment of the present application can effectively avoid exposing the real background access interface of the target network device by adopting the processing mode of encapsulating, encrypting and encoding the background operation command selected by the second user in sequence according to the pre-configured message packaging structure, encryption algorithm and encoding mode to obtain the background access control instruction, thereby further ensuring the security of the background access of the network device.

[0070] In the optional embodiment, the encapsulating the background operation command according to the pre-configured message packaging structure to generate the first target message comprises: running a message packaging program, obtaining input information input by the second user on a user interface of the message packaging program, and filling the input information in the message packaging structure to generate the first target message; wherein the message content of the first target message comprises one or more of the background operation command, the standard message starting mark in the message packaging structure, the device identification information of the target network device, the task identification information of the current background access control task and the message generation time of the first target message.

[0071] As an example, in the scenario of selecting the second user terminal to execute the operation of obtaining the background access control instruction according to the background operation command selected by the second user, in order to improve the message packaging efficiency, a message packaging program can be developed in advance and deployed on the second user terminal.

[0072] The second user terminal triggers a running message packaging program, presents a user interface of the message packaging program to the second user, so that the second user can select a background operation command for the first user's background access requirement of the target network device, and directly input corresponding input information on the user interface of the message packaging program, such as input information including the background operation command and the target network device.

[0073] After the second user terminal obtains the input information input by the second user on the user interface of the message packaging program, the input information is filled in the message packaging structure to generate a first target message, wherein the message content of the first target message includes the background operation command, and one or more of the standard message starting mark in the message packaging structure, the device identification information of the target network device, the task identification information of the current background access control task, and the message generation time of the first target message. Subsequently, a preconfigured encryption algorithm is continuously used to encrypt the first target message to obtain an encrypted message, and a preconfigured encoding method is used to encode the encrypted message to obtain a background access control instruction, so as to provide the background access control instruction to the first user.

[0074] For example, assuming that the message packaging structure is as follows, the message content of the first target message includes the background operation command, and one or more of the standard message starting mark in the message packaging structure, the device identification information of the target network device, the task identification information of the current background access control task, and the message generation time of the first target message:

[0075] “Magic 4 byte / / standard message starting mark, which is a fixed value, used to mark the beginning of the message

[0076] Length 4 byte / / an integer, used to indicate the effective length of the entire message

[0077] Devid 8 byte / / device identification information of the network device

[0078] Time 8 byte / / message generation time of the entire message

[0079] Taskid 4 byte / / task identification information of the background access control task, which is incremental

[0080] Number 4 byte / / number N of background operation commands

[0081] Oplen 14 byte / / length of the background operation command 1

[0082] Op1 / / content of the background operation command 1, which is not a fixed value

[0083] Oplen 24 byte / / length of the background operation command 2

[0084] Op2 / / content of the background operation command 2, not a fixed value ......

[0085] Oplen1N4byte / / length of the background operation command N

[0086] OpN / / content of the background operation command N, not a fixed value

[0087] In actual applications, in the scenario of selecting a third-party terminal to execute the operation of obtaining the background access control instruction according to the background operation command selected by the second user, the pre-developed message packaging program can be deployed on the third-party terminal.

[0088] The third-party terminal triggers the running of the message packaging program, and presents the user interface of the message packaging program to the third party, so that the third party can directly input corresponding input information on the user interface of the message packaging program according to the background operation command selected by the second user for the background access demand of the first user to the target network device, and the input information includes the background operation command and the target network device.

[0089] After the third-party terminal obtains the input information input by the third party on the user interface of the message packaging program, the input information is filled in the message packaging structure to generate a first target message, wherein the message content of the first target message includes the background operation command, and one or more of the standard message starting mark in the message packaging structure, the device identification information of the target network device, the task identification information of the current background access control task, and the message generation time of the first target message. Subsequently, a pre-configured encryption algorithm is used to encrypt the first target message to obtain an encrypted message, and a pre-configured encoding method is used to encode the encrypted message to obtain the background access control instruction, so as to provide the background access control instruction to the first user.

[0090] The embodiments of the present application can improve the message packaging efficiency by using the message packaging program to obtain the input information input by the second user on the user interface of the message packaging program, and filling the input information in the message packaging structure to package the background operation command to generate the first target message.

[0091] In optional embodiments, the encryption algorithm includes an asymmetric encryption algorithm, and the encoding method includes a base64 encoding method.

[0092] As an example, according to actual application requirements, the asymmetric encryption algorithm and the base64 encoding method can be selected, and the asymmetric encryption algorithm and the base64 encoding method are pre-configured on the terminal device for obtaining the background access control instruction according to the background operation command selected by the second user.

[0093] The asymmetric encryption algorithm needs two keys for encryption and decryption, and has higher security. The base64 encoding mode is one of the most common encoding modes for transmitting 8-bit byte codes on the network, which is a method of representing binary data based on 64 printable characters. Through Base64 encoding, the background access control instruction can be displayed on the web subsequently.

[0094] In actual application, the encryption algorithm can also select a symmetric encryption algorithm, and the encoding mode can select a URL encoding mode or other encoding modes.

[0095] The first target message is encrypted by the asymmetric encryption algorithm in the embodiment of the application to obtain an encrypted message, which can hide the structure of the first target message on the one hand, avoid the leakage of the background operation command, and ensure the decryption success in the case of holding the correct key on the other hand, avoid the forgery of the background operation command. In addition, the encrypted message is encoded by the base64 encoding mode to obtain the background access control instruction, which can make the background access control instruction printable and facilitate the subsequent display on the Web UI of the target network device.

[0096] In the optional embodiment, the background access control instruction is obtained by sequentially encapsulating, encrypting and encoding the background operation command; the security check on the background access control instruction includes: decoding the background access control instruction to obtain a decrypted message; decrypting the decrypted message to obtain a second target message; verifying whether the message content of the second target message is correct; and determining whether the background access control instruction passes the security check according to the verification result.

[0097] As an example, after the target network device obtains the background access control instruction input by the first user, the security check is performed on the background access control instruction. Since the background access control instruction is obtained by sequentially encapsulating, encrypting and encoding the background operation command, the security check process can sequentially decode, decrypt and content verify the background access control instruction. Specifically, the background access control instruction is decoded to obtain a decrypted message, the decrypted message is decrypted to obtain a second target message, and whether the message content of the second target message is correct is verified. If the verification result is that all the message content of the second target message is correct, it is considered that the background access control instruction is a legal and safe instruction, and it is determined that the background access control instruction passes the security check. If the verification result is that at least part of the message content of the second target message is incorrect, it is considered that the background access control instruction is illegal and unsafe, and it is determined that the background access control instruction does not pass the security check.

[0098] In actual application, if an error occurs in the process of decoding the background access control instruction, it is directly determined that the background access control instruction fails to pass the security check, and if an error occurs in the process of decrypting the message to be decrypted, it is directly determined that the background access control instruction fails to pass the security check.

[0099] The embodiments of the present application can quickly and accurately check the security of the background access control instruction by adopting the processing mode of sequentially decoding, decrypting and content verifying the background access control instruction under the premise that the background access control instruction is obtained by sequentially encapsulating, encrypting and encoding the background operation command, thereby further ensuring the background access security of the network device.

[0100] In optional embodiments, the message content of the second target message includes a background operation command, and the message start marker of the second target message, the device identification information of the network device to be accessed, the task identification information of the current background access control task and the message generation time of the second target message; the step of verifying whether the message content of the second target message is correct includes: comparing whether the message start marker is consistent with the standard message start marker configured in advance; comparing whether the device identification information of the network device to be accessed is consistent with the device identification information of the target network device; comparing whether the task identification information of the current background access control task is consistent with the task identification information of the historical background access control task; counting the interval duration between the message generation time and the current time, and determining whether the interval duration reaches the interval duration threshold; the step of determining whether the background access control instruction passes the security check according to the verification result includes: if the message start marker is consistent with the standard message start marker, the device identification information of the network device to be accessed is consistent with the device identification information of the target network device, the task identification information of the current background access control task is inconsistent with the task identification information of the historical background access control task, and the interval duration does not reach the interval duration threshold, it is determined that the background access control instruction passes the security check; otherwise, it is determined that the background access control instruction fails to pass the security check.

[0101] As an example, the target network device, after obtaining the second target message, verifies whether each message content of the second target message is correct in the case that the message content of the second target message includes a background operation command, and the message starting mark of the second target message, the device identification information of the network device to be accessed, the task identification information of the current background access control task, and the message generation time of the second target message. Specifically, it is compared whether the message starting mark is consistent with the standard message starting mark pre-configured, that is, the standard message starting mark in the message encapsulation structure; it is compared whether the device identification information of the network device to be accessed is consistent with the device identification information of the target network device; it is compared whether the task identification information of the current background access control task is consistent with the task identification information of the historical background access control task; the interval duration between the message generation time and the current time is counted, and it is judged whether the interval duration reaches the pre-set interval duration threshold to obtain a verification result. If the message starting mark is consistent with the standard message starting mark, the device identification information of the network device to be accessed is consistent with the device identification information of the target network device, the task identification information of the current background access control task is inconsistent with the task identification information of the historical background access control task, and the interval duration does not reach the interval duration threshold, then the verification result is that all the message contents of the second target message are correct, it is considered that the background access control instruction is a legal and safe instruction, it is determined that the background access control instruction passes the security check, and if the message starting mark is inconsistent with the standard message starting mark, the device identification information of the network device to be accessed is inconsistent with the device identification information of the target network device, the task identification information of the current background access control task is consistent with the task identification information of the historical background access control task, or the interval duration reaches the interval duration threshold, then the verification result is that at least part of the message contents of the second target message is incorrect, it is considered that the background access control instruction is illegal and unsafe, at this time it is determined that the background access control instruction does not pass the security check, and an error prompt information can be returned.

[0102] It can be understood that by comparing whether the message starting mark is consistent with the pre-configured standard message starting mark, it can be verified whether the second target message is a message encapsulating a background operation command, ensuring that the second target message is valid and available; by comparing whether the device identification information of the network device to be accessed is consistent with the device identification information of the target network device, it can be verified whether the network device targeted by the second target message is the network device that the first user wants to access, ensuring accurate access to the network device that the first user wants to access; by comparing whether the task identification information of the current background access control task is consistent with the task identification information of the historical background access control task, it can be verified whether the current background access control task has been executed, avoiding repeated execution of previously executed background access control tasks; by counting the interval time between the message generation time and the current time, it can be determined whether the interval time reaches the pre-set interval time threshold, which can verify whether the first user inputs the background access control instruction overtime, and the background access control instruction input by the first user overtime is regarded as an invalid instruction, strictly ensuring the security of network device background access.

[0103] In actual application, the task identification information can be represented by a numerical value, and the numerical value is positively correlated with the execution order, that is, the larger the numerical value, the later the execution order of the task. For example, the historical background access control tasks have task 1 and task 2, and the target network device previously executes task 1 first and then task 2.

[0104] If the task identification information is represented by a numerical value, considering that the target network device will not execute an illegal or invalid task, for example, the historical background access control tasks have task 1, task 2 and task 4, the target network device can verify the task identification information of the current background access control task in the second target message in the following way: determining whether the task identification information (numerical value) of the current background access control task is greater than the task identification information (numerical value) of the historical background access control task. If yes, it is considered that the task identification information of the current background access control task is inconsistent with the task identification information of the historical background access control task, otherwise, it is considered that the task identification information of the current background access control task is consistent with the task identification information of the historical background access control task.

[0105] In actual application, when the target network device determines that the background access control instruction passes the security check, it determines the background operation command in the background access control instruction, executes the background operation commands in sequence, such as executing background operation command 1, background operation command 2,..., and background operation command N in turn, obtains the command execution result, and stores the task identification information of the current background access control task, so that the task identification information of the current background access control task becomes the task identification information of the historical background access control task.

[0106] In actual application, the target network device can verify whether each message content of the second target message is correct according to the corresponding mode in the above content verification process in the case that the message content of the second target message includes the background operation command, and one or more of the message start marker of the second target message, the device identification information of the network device to be accessed, the task identification information of the current background access control task and the message generation time of the second target message. For example, assuming that the message content of the second target message includes the background operation command, and the message start marker of the second target message and the device identification information of the network device to be accessed, the target network device verifies the content of the second target message by comparing whether the message start marker is consistent with the standard message start marker configured in advance, and whether the device identification information of the network device to be accessed is consistent with the device identification information of the target network device.

[0107] The embodiment of the present application can comprehensively check the message content of the second target message by comparing whether the message start marker is consistent with the standard message start marker configured in advance, whether the device identification information of the network device to be accessed is consistent with the device identification information of the target network device, whether the task identification information of the current background access control task is consistent with the task identification information of the historical background access control task, and whether the interval duration between the message generation time and the current time reaches the interval duration threshold, if the message start marker is consistent with the standard message start marker, the device identification information of the network device to be accessed is consistent with the device identification information of the target network device, the task identification information of the current background access control task is inconsistent with the task identification information of the historical background access control task, and the interval duration does not reach the interval duration threshold, it is determined that the background access control instruction passes the security check, otherwise it is determined that the background access control instruction does not pass the security check, which can ensure that the background access control instruction is comprehensively and accurately checked.

[0108] In the optional embodiment, the method further includes step S103:

[0109] S103, return the command execution result; and / or, store the command execution result, and return the download link of the command execution result.

[0110] As an example, the target network device can provide the command execution result to the first user in the following ways after obtaining the command execution result: returning the command execution result, so that the first user can quickly view the command execution result; storing the command execution result and returning a download link of the command execution result, so that the first user can download the command execution result for viewing; returning the command execution result and storing the command execution result, and returning the command execution result, so that the first user can quickly view the command execution result and select whether to download the command execution result for archiving.

[0111] In actual application, if the execution duration of the background operation command reaches the execution duration threshold, the query portal of the command execution result can also be returned, so that the first user can query the execution progress of the background operation command and obtain the command execution result.

[0112] The embodiments of the present application can flexibly select one or more ways to provide the command execution result to the first user by returning the command execution result and / or storing the command execution result and returning a download link of the command execution result after obtaining the command execution result, so as to facilitate the first user to quickly obtain the command execution result.

[0113] In order to more clearly illustrate the network device background access control method provided by the first embodiment of the present application, it is assumed that the background operation command is selected by the second user, the background operation command is encapsulated, encrypted and encoded in sequence by the second user terminal according to the pre-configured message encapsulation structure, encryption algorithm and encoding mode to obtain the background access control instruction, the background access control instruction is provided to the first user, and the first user inputs the background access control instruction to the target network device. The flowchart of the network device background access control method is shown in Figure 2 .

[0114] Please refer to Figure 3 , Figure 3 The structure diagram of a network device background access control device provided by the second embodiment of the present application is shown. The second embodiment of the present application provides a network device background access control device, which is applied to a target network device, and the target network device is provided with a Web UI interface; the device comprises: an instruction receiving module 201, configured to obtain the background access control instruction input by the first user through the Web UI interface; wherein the background access control instruction is obtained according to the background operation command selected by the second user; an access control module 202, configured to perform security check on the background access control instruction, and execute the background operation command to obtain the command execution result in the case that the background access control instruction passes the security check.

[0115] In an optional embodiment, the background access control instruction is obtained by performing the following processing on the background operation command: encapsulating the background operation command according to a preconfigured message encapsulation structure to generate a first target message; encrypting the first target message by using a preconfigured encryption algorithm to obtain an encrypted message; and encoding the encrypted message by using a preconfigured encoding mode to obtain the background access control instruction.

[0116] In an optional embodiment, the encapsulating the background operation command according to the preconfigured message encapsulation structure to generate the first target message comprises: running a message encapsulation program, obtaining input information input by the second user on a user interface of the message encapsulation program, and filling the input information in the message encapsulation structure to generate the first target message; wherein the message content of the first target message comprises the background operation command, and one or more of a standard message start tag in the message encapsulation structure, device identification information of the target network device, task identification information of the current background access control task, and a message generation time of the first target message.

[0117] In an optional embodiment, the encryption algorithm comprises an asymmetric encryption algorithm, and the encoding mode comprises a base64 encoding mode.

[0118] In an optional embodiment, the background access control instruction is obtained by sequentially performing encapsulation, encryption and encoding on the background operation command; and the security check on the background access control instruction comprises: decoding the background access control instruction to obtain a to-be-decrypted message; decrypting the to-be-decrypted message to obtain a second target message; verifying whether the message content of the second target message is correct; and determining whether the background access control instruction passes the security check according to the verification result.

[0119] In optional embodiments, the message content of the second target message includes a background operation command, and the message start tag of the second target message, device identification information of a network device to be accessed, task identification information of a current background access control task, and a message generation time of the second target message; the verifying whether the message content of the second target message is correct includes: comparing whether the message start tag is consistent with a pre-configured standard message start tag; comparing whether the device identification information of the network device to be accessed is consistent with device identification information of the target network device; comparing whether the task identification information of the current background access control task is consistent with task identification information of a historical background access control task; counting an interval duration between the message generation time and a current time, and judging whether the interval duration reaches an interval duration threshold; the determining whether the background access control instruction passes the security check according to the verification result includes: if the message start tag is consistent with the standard message start tag, the device identification information of the network device to be accessed is consistent with the device identification information of the target network device, the task identification information of the current background access control task is inconsistent with the task identification information of the historical background access control task, and the interval duration does not reach the interval duration threshold, it is determined that the background access control instruction passes the security check; otherwise, it is determined that the background access control instruction does not pass the security check.

[0120] In optional embodiments, the apparatus further includes:

[0121] The result processing module is configured to return the command execution result, and / or store the command execution result and return a download link of the command execution result.

[0122] The functions and effects of the modules in the apparatus are described above, and the implementation process is specifically described in the implementation process of the corresponding steps in the above method, which will not be described here.

[0123] The third embodiment of the present application provides a computer program product, which includes instructions. When the instructions are executed by a computer, the computer implements the method described in the first embodiment of the present application and achieves the same beneficial effects.

[0124] The method described in the first embodiment of the present application can be implemented by software, hardware, firmware or any combination thereof, in whole or in part. When implemented by software, the computer program or instructions can be implemented in the form of a computer program product, in whole or in part. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, a core network device, an OAM (Open Application Model) or other programmable devices.

[0125] The computer program or instructions can be stored in or transferred from one computer-readable medium to another computer-readable medium, such as from one website, computer, server, or data center to another website, computer, server, or data center, through wired or wireless ways. The computer-readable medium can be any available medium accessible by the computer or data storage device such as a server, data center, or the like, which integrates one or more available media. The available media can be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; an optical medium, such as a digital video disc; or a semiconductor medium, such as a solid-state disk. The computer-readable medium can be a volatile or non-volatile storage medium, or can include both volatile and non-volatile storage media.

[0126] Please refer to Figure 4 , Figure 4 A structural schematic diagram of an electronic device provided by the fourth embodiment of the present application. The fourth embodiment of the present application provides an electronic device 30, which includes a processor 301, a memory 302, and a computer program stored in the memory 302 and configured to be executed by the processor 301; the processor 301 implements the method described in the first embodiment of the present application when executing the computer program, and can achieve the same beneficial effects.

[0127] The processor 301 can implement the method described in the first embodiment of the present application by reading the computer program from the memory 302 through the bus 303 and executing the computer program.

[0128] The processor 301 can process digital signals and can include various computing structures. For example, a complex instruction set computer structure, a reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, the processor 301 can be a microprocessor.

[0129] The memory 302 can be used to store instructions executed by the processor 301 or data related to the execution process of the instructions. These instructions and / or data can include code for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 301 of the embodiments of the present disclosure can be used to execute instructions in the memory 302 to implement the method described in the first embodiment of the present application. The memory 302 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memories well known to those skilled in the art.

[0130] The fifth embodiment of the present application provides a computer readable storage medium, which comprises a stored computer program; wherein the computer program, when running, controls a device where the computer readable storage medium is located to perform the method according to the first embodiment of the present application and achieve the same beneficial effects.

[0131] To sum up, the embodiments of the present application provide a network device background access control method, program product, device and medium, the network device background access control method is applied to a target network device, the target network device is provided with a Web UI interface; the method comprises: obtaining a background access control instruction input by a first user through the Web UI interface; wherein the background access control instruction is obtained according to a background operation command selected by a second user; performing security check on the background access control instruction, and executing the background operation command to obtain a command execution result in the case that the background access control instruction passes the security check. The embodiments of the present application set the Web UI interface of the target network device to be open to the first user, so that the first user can input the background access control instruction to the target network device through the Web UI interface after obtaining the background access control instruction obtained according to the background operation command selected by the second user, the target network device obtains the background access control instruction input by the first user through the Web UI interface, performs security check on the background access control instruction, and executes the background operation command to obtain a command execution result in the case that the background access control instruction passes the security check. The embodiments of the present application not only enable the first user to execute the specific background operation command of the target network device through the Web UI interface directly, without exposing the real background access interface of the target network device to the first user, but also ensure that the selection right of the background operation command is reserved for the second user, effectively limit the background operation command executed by the first user on the target network device, thereby effectively ensuring the network device background access security.

[0132] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can also be implemented by other manners. The apparatus embodiments described above are merely illustrative, for example, the flowcharts and block diagrams in the drawings show the possible implementation architecture, function and operation of the apparatus, method and computer program product according to the embodiments of the present application. In this regard, each block in the flowchart or block diagram can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logic function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different orders from those described in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and they can also be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for executing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0133] In addition, the functional modules in the embodiments of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0134] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0135] The above merely provides specific implementation of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of changes or replacements within the technical range disclosed in the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for controlling backend access to a network device, characterized in that, Applied to a target network device, the target network device being provided with a web user interface (Web UI); the method includes: The background access control instruction input by the first user is obtained through the Web UI interface; wherein, the background access control instruction is obtained by processing the background operation command selected by the second user as follows: the background operation command is encapsulated according to a pre-configured message encapsulation structure to generate a first target message; the first target message is encrypted using a pre-configured encryption algorithm to obtain an encrypted message; the encrypted message is encoded using a pre-configured encoding method to obtain the background access control instruction; The background access control command is subjected to a security check, and if the background access control command passes the security check, the background operation command is executed to obtain the command execution result; The security check on the background access control command includes: The background access control command is decoded to obtain the message to be decrypted; The message to be decrypted is decrypted to obtain the second target message; Verify that the message content of the second target message is correct; The verification results determine whether the background access control command passes the security check.

2. The method according to claim 1, characterized in that, The step of encapsulating the background operation command according to the pre-configured message encapsulation structure to generate the first target message includes: Run the message encapsulation program, obtain the input information entered by the second user on the user interface of the message encapsulation program, and fill the input information into the message encapsulation structure to generate the first target message; wherein, the message content of the first target message includes the background operation command, as well as one or more of the following in the message encapsulation structure: standard message start marker, device identification information of the target network device, task identification information of the current background access control task, and message generation time of the first target message.

3. The method according to claim 1, characterized in that, The encryption algorithm includes an asymmetric encryption algorithm, and the encoding method includes base64 encoding.

4. The method according to claim 1, characterized in that, The message content of the second target message includes the background operation command, as well as the message start marker of the second target message, the device identification information of the network device to be accessed, the task identification information of the current background access control task, and the message generation time of the second target message; The verification of whether the message content of the second target message is correct includes: Compare whether the message start marker is consistent with the pre-configured standard message start marker; Compare whether the device identification information of the network device to be accessed is consistent with the device identification information of the target network device; Compare whether the task identifier information of the current background access control task is consistent with the task identifier information of the historical background access control task; Calculate the time interval between the message generation time and the current time, and determine whether the time interval reaches the time interval threshold. The step of determining whether the background access control command passes the security check based on the verification result includes: If the message start marker is consistent with the standard message start marker, the device identifier information of the network device to be accessed is consistent with the device identifier information of the target network device, the task identifier information of the current background access control task is inconsistent with the task identifier information of the historical background access control task, and the interval duration does not reach the interval duration threshold, then the background access control instruction is determined to have passed the security check. Otherwise, it is determined that the background access control command failed the security check.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: Return the result of the command execution; and / or, Store the command execution result and return a download link for the command execution result.

6. A computer program product, characterized in that, The computer program product includes instructions that, when executed by a computer, cause the computer to perform the method as described in any one of claims 1 to 5.

7. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; when the processor executes the computer program, it implements the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program; wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the method according to any one of claims 1 to 5.

Images