Traffic release method and device based on authentication white list, and processing equipment

Abstract

The invention provides a traffic release method and device based on an authentication white list, and processing equipment, and is used for designing a set of authentication traffic release judgment architecture, so that a targeted authentication service can be flexibly configured according to actual needs, a page can be normally accessed only after authentication is passed after authentication traffic is initiated, and the access efficiency is improved. Program vulnerabilities existing in an existing authentication mode are avoided, and the security risk of an enterprise network environment is reduced.

Description

Technical Field

[0001] The present application relates to the field of network security, and specifically to a traffic release method, device, and processing equipment based on an authentication whitelist. Background Art

[0002] In the network management work of an enterprise, some scenarios involve the application of authentication, such as WeChat authentication, enterprise WeChat authentication, DingTalk authentication and other specific authentication methods. During authentication, the terminal needs to communicate with the third-party authentication server. Therefore, the specific network equipment deployed in the network architecture to be responsible for traffic release needs to temporarily release this type of authentication traffic.

[0003] The existing authentication method is that the terminal sends a special message to the network device, the network device marks the online user (anonymous) and records the time. Each subsequent time the authentication policy is hit and executed, it checks whether it is within the traffic release time. If it is, it is released; otherwise, the authentication page (portal page) pops up.

[0004] However, the inventor of this application discovered that the above-mentioned existing traffic release judgment method is for all types of traffic, and some authentication methods (such as enterprise WeChat authentication) send special messages when the authentication page is opened. Users can release all traffic by continuously refreshing the authentication page, thereby achieving the purpose of bypassing user authentication to access the Internet. This obviously has certain program loopholes and certain security risks. Summary of the Invention

[0005] This application provides a traffic release method, device and processing equipment based on an authentication whitelist, which is used to design a set of authentication traffic release judgment architecture, so that the targeted authentication service can be flexibly configured according to actual needs, ensuring that the page can be accessed normally only after the authentication traffic is initiated and passed, avoiding the program loopholes existing in the existing authentication method and reducing the security risks of the enterprise network environment.

[0006] In a first aspect, the present application provides a method for releasing traffic based on an authentication whitelist, the method comprising:

[0007] The processing device obtains target network traffic to be released, wherein the target network traffic is specifically authentication traffic initiated by the corresponding terminal and used for authentication;

[0008] The processing device determines a target authentication method corresponding to the target network traffic;

[0009] The processing device calls a pre-configured authentication whitelist that describes different authentication methods corresponding to different traffic characteristics, and determines the target traffic characteristics corresponding to the target authentication method based on the authentication whitelist, wherein the authentication whitelist is specifically configured in the form of a cache list;

[0010] The processing device detects whether the target network traffic matches the target traffic characteristics;

[0011] If so, the processing device allows the target network traffic to pass.

[0012] In combination with the first aspect of the present application, in a first possible implementation of the first aspect of the present application, the target network traffic is specifically the traffic initiated by the redirected authentication page after the corresponding terminal fails to access the web page due to non-authentication.

[0013] In combination with the first aspect of the present application, in the second possible implementation method of the first aspect of the present application, different authentication methods correspond to traffic characteristics in different traffic characteristics. Specifically, based on the preset domain name, a preset IP address is also configured according to the situation.

[0014] In combination with the third possible implementation of the first aspect of the present application, in a fourth possible implementation of the first aspect of the present application, after the processing device releases the target network traffic, the method further includes:

[0015] The processing device monitors the corresponding DNS messages involved after releasing the target network traffic. If the third-party authentication server has a target IP address that is not recorded in the authentication whitelist and is resolved from the target preset domain name recorded in the authentication whitelist, the target IP address will be updated in the authentication whitelist to the target traffic characteristics corresponding to the target authentication method.

[0016] In conjunction with the first aspect of the present application, in a fourth possible implementation of the first aspect of the present application, the processing device releases the target network traffic, including:

[0017] The processing device detects whether the current time point is within the preset traffic release time range;

[0018] If so, the processing device allows the target network traffic to pass.

[0019] In conjunction with the first aspect of the present application, in a fifth possible implementation of the first aspect of the present application, the processing device releases the target network traffic, including:

[0020] The processing device redirects the target network traffic that was originally subject to release determination processing, so as to enable the processing device to normally access the third-party authentication server responsible for the authentication service and promote further authentication processing. The third-party authentication server is specifically the authentication server of the third-party social software or the third-party enterprise communication office software.

[0021] In combination with the first aspect of the present application, in the sixth possible implementation method of the first aspect of the present application, if there is an internal authentication service involving a server built in the internal network architecture of the enterprise, the specific authentication method corresponding to the internal authentication service does not involve a domain name in the authentication whitelist, only the corresponding IP address.

[0022] In a second aspect, the present application provides a traffic release device based on an authentication whitelist, the device comprising:

[0023] an acquiring unit, configured to acquire target network traffic currently to be released, wherein the target network traffic is specifically authentication traffic initiated by a corresponding terminal and used for authentication;

[0024] a determination unit, configured to determine a target authentication method corresponding to target network traffic;

[0025] a calling unit, configured to call a pre-configured authentication whitelist describing different authentication methods corresponding to different traffic characteristics, and determine a target traffic characteristic corresponding to a target authentication method based on the authentication whitelist, wherein the authentication whitelist is specifically configured in the form of a cache list;

[0026] A detection unit, configured to detect whether target network traffic matches target traffic characteristics;

[0027] The release unit is used to release the target network traffic if yes.

[0028] In combination with the second aspect of the present application, in a first possible implementation of the second aspect of the present application, the target network traffic is specifically the traffic initiated by the redirected authentication page after the corresponding terminal fails to access the web page due to non-authentication.

[0029] In combination with the second aspect of the present application, in the second possible implementation method of the second aspect of the present application, different authentication methods correspond to traffic characteristics in different traffic characteristics. Specifically, based on the preset domain name, a preset IP address is also configured according to the situation.

[0030] In conjunction with the third possible implementation of the second aspect of the present application, in a fourth possible implementation of the second aspect of the present application, the apparatus further includes an updating unit configured to:

[0031] Monitor the corresponding DNS messages involved after releasing the target network traffic. If the third-party authentication server has a target IP address that is not recorded in the authentication whitelist and is resolved from the target preset domain name recorded in the authentication whitelist, then update the target IP address in the authentication whitelist to the target traffic characteristics corresponding to the target authentication method.

[0032] In conjunction with the second aspect of the present application, in a fourth possible implementation of the second aspect of the present application, the release unit is specifically configured to:

[0033] Check whether the current time point is within the preset traffic release time range;

[0034] If yes, the target network traffic is allowed to pass.

[0035] In conjunction with the second aspect of the present application, in a fifth possible implementation of the second aspect of the present application, the release unit is specifically configured to:

[0036] The target network traffic originally undergoing release determination processing is redirected to enable the processing device to normally access the third-party authentication server responsible for the authentication service and promote further authentication processing. The third-party authentication server is specifically the authentication server of the third-party social software or the third-party enterprise communication office software.

[0037] In combination with the second aspect of the present application, in the sixth possible implementation method of the second aspect of the present application, if there is an internal authentication service involving a server built in the internal network architecture of the enterprise, the specific authentication method corresponding to the internal authentication service and the corresponding traffic characteristics in the authentication whitelist do not involve domain names, only corresponding IP addresses.

[0038] In a third aspect, the present application provides a processing device comprising a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method provided in the first aspect of the present application or any possible implementation of the first aspect of the present application is executed.

[0039] In a fourth aspect, the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the method provided in the first aspect of the present application or any possible implementation of the first aspect of the present application.

[0040] From the above content, it can be concluded that this application has the following beneficial effects:

[0041] For authentication processing, this application has designed a set of authentication traffic release judgment architecture, so that the targeted authentication service can be flexibly configured according to actual needs, ensuring that the page can be accessed normally only after the authentication traffic is initiated and passed, avoiding the program loopholes in the existing authentication methods and reducing the security risks of the enterprise network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0043] Figure 1 This is a flowchart of the traffic release method based on the authentication whitelist in this application;

[0044] Figure 2 A logical schematic diagram of an application example of this application scheme;

[0045] Figure 3 This is a structural diagram of a traffic release device based on an authentication whitelist in this application;

[0046] Figure 4 This is a structural diagram of the processing equipment for this application. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0048] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or that are inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can be changed in the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0049] The division of modules in this application is a logical division. In actual application, there may be other division methods. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. Moreover, the modules or submodules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed into multiple circuit modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this application.

[0050] Before introducing the traffic release method based on authentication whitelist provided by this application, we first introduce the background content involved in this application.

[0051] The traffic release method, device and computer-readable storage medium based on authentication whitelist provided in this application can be applied to processing equipment to design a set of authentication traffic release judgment architecture, so that the targeted authentication service can be flexibly configured according to actual needs, ensuring that the page can be accessed normally only after the authentication traffic is initiated and passed the authentication, avoiding the program loopholes existing in the existing authentication method and reducing the security risks of the enterprise network environment.

[0052] The traffic release method based on authentication whitelist mentioned in this application can be executed by a traffic release device based on authentication whitelist, or a network node, server, physical host or user equipment (UE) and other different types of processing devices that integrate the traffic release device based on authentication whitelist. Among them, the traffic release device based on authentication whitelist can be implemented in hardware or software. The UE can be a terminal device such as a smart phone, tablet computer, laptop computer, desktop computer or personal digital assistant (PDA). The processing device can be set up in the form of a device cluster.

[0053] It can be understood that the present application scheme focuses on the processing of authentication traffic involved in the internal network environment / network architecture of an enterprise. In this regard, the processing equipment that executes the traffic release method based on the authentication whitelist of the present application or is equipped with the corresponding application service of the traffic release method based on the authentication whitelist of the present application is usually a network node in the network architecture that is specifically responsible for traffic release determination, such as a firewall, security gateway, etc.

[0054] Of course, in actual situations, more flexible application methods / demands are not ruled out. Therefore, the processing device can also be a network node in the network architecture that is not specifically responsible for or temporarily responsible for traffic release determination, or even a device outside the network architecture. Although the probability is very small, this is also possible in actual applications.

[0055] Next, we will introduce the traffic release method based on the authentication whitelist provided by this application.

[0056] First, see Figure 1 , Figure 1 A flow chart of the traffic release method based on the authentication whitelist of the present application is shown. The traffic release method based on the authentication whitelist provided by the present application may specifically include the following steps S101 to S105:

[0057] Step S101: The processing device obtains target network traffic to be released, wherein the target network traffic is specifically authentication traffic initiated by the corresponding terminal and used for authentication;

[0058] It can be understood that the present application solution is a technical solution proposed for terminal authentication processing in an enterprise network environment. Therefore, the present application can obtain the current network traffic to be released from the processing device.

[0059] For the convenience of explanation, the network traffic currently to be released or processed is recorded as target network traffic, and the subsequent naming is similar.

[0060] At the same time, the target network traffic is specifically the authentication traffic initiated by the corresponding terminal in the internal network architecture of the enterprise where the processing device is located. The authentication traffic is used to initiate authentication processing to the external related authentication server.

[0061] As an example, the external related authentication server may specifically be an authentication server corresponding to social software / enterprise communication office software such as WeChat, Enterprise WeChat, and DingTalk.

[0062] At the same time, it is understandable that in addition to considering the more common social software / enterprise communication office software in the authentication scenarios, the authentication party may also consider other software platforms that are not social software / enterprise communication office software, and even some authentication scenarios involve mini-programs or specific software program (code) services, so as to meet diverse and potential solution application needs.

[0063] Step S102: The processing device determines a target authentication method corresponding to the target network traffic;

[0064] It is understandable that from the enterprise perspective, the authentication processing involved in the terminal usually does not have only one authentication method or authentication object, that is, there may be multiple social software / enterprise communication office software.

[0065] In this regard, this application can determine the corresponding target authentication method based on the analyzed content after network traffic analysis.

[0066] In terms of details, network traffic usually exists in the form of corresponding traffic messages. For this, the specific authentication method can be determined by checking whether there is specific content in a specific field in the message or directly checking whether there is a specific string in the message.

[0067] In step S103, the processing device calls a pre-configured authentication whitelist that describes different authentication methods corresponding to different traffic characteristics, and determines the target traffic characteristics corresponding to the target authentication method based on the authentication whitelist, wherein the authentication whitelist is specifically configured in the form of a cache list;

[0068] It can be understood that this application specially configures an authentication whitelist in the form of a cache list, which can support manual update and maintenance. It records the correspondence between different authentication methods and different traffic characteristics, or the correspondence between different authentication methods and different traffic characteristics in the form of a list. In this way, in the subsequent calling process, if it is found that the network traffic matches the traffic characteristics corresponding to the corresponding authentication method recorded in the authentication whitelist, it can be considered that it has passed the verification of the authentication whitelist, and its traffic can be released to access the corresponding authentication server of the corresponding social software / enterprise communication office software for further authentication processing.

[0069] As for the details, it is understandable that for different authentication methods, or different social software / enterprise communication office software, the corresponding configuration lists can be configured separately or independently, and managed separately, rather than directly putting all content in one table. Under this setting, it helps to form a more efficient and convenient list management and list application effect.

[0070] Among them, for the configuration list of independent configuration, in terms of details, TTL aging can also be performed based on the relevant DNS response message. TTL, namely Time To Live, is called the life cycle in the network. It is mainly used to control the survival time of data packets in the network or the cache length of domain name resolution records.

[0071] In this way, under the above settings, this application can call the pre-configured authentication whitelist to determine the target traffic characteristics corresponding to the target authentication method of the current target network traffic. It should be noted that this characteristic is not the traffic characteristic of the current target network traffic itself.

[0072] Step S104: The processing device detects whether the target network traffic matches the target traffic characteristics;

[0073] It is understandable that after determining the target traffic characteristics that the target network traffic should have when it can be released under the current circumstances, matching / comparison processing can be carried out based on the traffic characteristics of the target network traffic itself.

[0074] The traffic characteristics of the target network traffic itself can be obtained by parsing in step S104 here, or can be obtained by parsing before step S104, which is actually possible.

[0075] Step S105: If yes, the processing device releases the target network traffic.

[0076] When it is determined that the current target traffic matches the target traffic characteristics that should be possessed when released, the processing device can obviously release the target network traffic and allow it to perform the corresponding authentication processing normally.

[0077] On the contrary, if there is no match, there is no need to release it. The target network traffic will be redirected to the existing authentication (which may involve corresponding redirection operations), ignored or deleted. Adaptive configuration can be performed here according to actual needs. The key point is not to release it directly and not to bypass the release judgment / authentication strategy specially designed for this application.

[0078] from Figure 1 As can be seen from the illustrated embodiments, for authentication processing, this application has designed a set of authentication traffic release judgment architecture, so that the targeted authentication service can be flexibly configured according to actual needs, ensuring that the page can be accessed normally only after the authentication traffic is initiated and passed the authentication, avoiding the program loopholes existing in the existing authentication methods and reducing the security risks of the enterprise network environment.

[0079] Continue to the above Figure 1 Each step of the illustrated embodiment and its possible implementation in practical applications are described in detail.

[0080] As an exemplary embodiment, the target network traffic obtained in step S101 may specifically be traffic initiated by the redirected authentication page after the corresponding terminal fails to access the webpage due to non-authentication.

[0081] As an example, when the terminal on the user side accesses a certain web page, an authentication page pops up. The user does not perform authentication first and continues to open a new browser tab to access another web page. At this time, the website access fails (access traffic is not released) and automatically jumps to the authentication page of a certain enterprise communication office software. At this time, a series of subsequent processing of this application can be used to promote the successful authentication of the enterprise communication office software. At this point, the terminal on the user side can access the relevant web pages normally.

[0082] As for the traffic characteristics in the different traffic characteristics corresponding to the different authentication methods involved in step S103, as an exemplary embodiment, a preset IP address can be configured according to the situation based on the preset domain name.

[0083] It is important to understand that not all authentication methods and corresponding traffic characteristics are configured based on a combination of domain names and IP addresses. For some authentication methods, the current authentication whitelist may only include domain names, or only partial IP addresses based on domain names, which means that IP addresses are temporarily unavailable.

[0084] In response to the aforementioned situation where there may be a temporary lack of an IP address, as an exemplary embodiment, after the processing device in step S104 releases the target network traffic, the method of the present application may further include:

[0085] The processing device monitors the corresponding DNS messages involved after releasing the target network traffic. If the third-party authentication server has a target IP address that is not recorded in the authentication whitelist and is resolved from the target preset domain name recorded in the authentication whitelist, the target IP address will be updated in the authentication whitelist to the target traffic characteristics corresponding to the target authentication method.

[0086] It can be understood that the DNS messages monitored are the messages involved in the authentication process of the user-side terminal accessing the corresponding third-party authentication server. If the relevant IP address of the authentication server appears in the message and is not registered in the authentication whitelist, the authentication whitelist can be updated, and the IP address can be updated / synchronized into the correspondence between different authentication methods and different traffic characteristics. This setting corresponds to the dynamic application level, which plays a role in improving and supplementing the authentication whitelist.

[0087] At the same time, this application can also continue to introduce limiting conditions for the traffic release time range to better control access traffic in actual situations.

[0088] In this regard, as an exemplary embodiment, step S104 of the processing device releasing the target network traffic may specifically include:

[0089] The processing device detects whether the current time point is within the preset traffic release time range;

[0090] If so, the processing device allows the target network traffic to pass.

[0091] It is understandable that the traffic release time range can be flexibly configured according to actual conditions in specific applications.

[0092] As an example, the time period from 8:00 to 24:00 can be used as the traffic release time range.

[0093] At the same time, in the specific process of releasing traffic, redirection processing is involved. Accordingly, as an exemplary embodiment, step S104 of the processing device releasing the target network traffic may specifically include:

[0094] The processing device redirects the target network traffic that was originally subject to release determination processing, so as to enable the processing device to normally access the third-party authentication server responsible for the authentication service and promote further authentication processing. The third-party authentication server is specifically the authentication server of the third-party social software or the third-party enterprise communication office software.

[0095] In layman's terms, after the terminal passes the matching authentication process of the network device, it triggers traffic release by redirecting to the authentication page (portal page) (the terminal sends a special message).

[0096] Specifically, for the above solutions, you can also combine Figure 2 A logical schematic diagram of an application example of the present application solution is shown for a more vivid understanding.

[0097] At the same time, in addition to conventional external enterprise authentication scenarios (corresponding to the actual situation where social software / enterprise communication office software is a third-party platform), this application also further considers authentication scenarios that may also be involved within the enterprise itself.

[0098] Correspondingly, as an exemplary embodiment, if there is an internal authentication service involving a server built in the enterprise's internal network architecture, the traffic characteristics corresponding to the specific authentication method corresponding to the internal authentication service in the authentication whitelist do not involve domain names, only corresponding IP addresses.

[0099] It can be understood that under the design of this application solution, in the internal network architecture of an enterprise or in an enterprise LAN environment, this application can specifically directly promote the corresponding matching judgment processing based on the IP address, which will help to achieve a lighter, more convenient and efficient processing effect.

[0100] At the same time, considering that within the enterprise, relevant authentication services can be flexibly configured according to real-time needs in actual situations, compared with third-party fixed social software / enterprise communication office software, this application also introduces an indirect identification mechanism to facilitate the management and maintenance of the corresponding authentication whitelist.

[0101] Specifically, the original authentication whitelist is based on the specific actual authentication method to record the corresponding domain name and IP address. This application here does not use the relevant platform name / server name / domain name (typically such as social software name / enterprise communication office software name) as the specific authentication method recorded in the cache list, but is configured with special identifiers such as specific numbers, specific number combinations, specific letter combinations, specific, pre-randomly determined strings, etc. The corresponding internal enterprise authentication can also initiate corresponding authentication processing based on the corresponding configured address based on these special identifiers when initiating the corresponding authentication traffic.

[0102] Among them, the more common linked list processing is to use the authentication method name or the platform name / server name / domain name related to the authentication method (typically such as the social software name / enterprise communication office software name) as the beginning or index to identify the domain name and IP address in sequence.

[0103] It can be understood that the setting of this special identifier can not only play a certain role in information confidentiality because it does not reveal the specific authentication object corresponding to the application service, but also helps to directly replace the special identifier in the background, and it is very convenient and efficient to replace, increase or decrease between different internal enterprise authentication methods. When the internal enterprise authentication service itself remains unchanged, a more flexible authentication service adjustment effect can be formed in the authentication traffic release judgment link. At the same time, due to the increased complexity, the information security of the internal enterprise network environment is further improved.

[0104] The above is an introduction to the traffic release method based on the authentication whitelist provided by this application. In order to facilitate better implementation of the traffic release method based on the authentication whitelist provided by this application, this application also provides a traffic release device based on the authentication whitelist from the perspective of functional modules.

[0105] See Figure 3 , Figure 3 This is a schematic diagram of the structure of a traffic release device based on an authentication whitelist in this application. In this application, the traffic release device 300 based on an authentication whitelist may specifically include the following structure:

[0106] The acquisition unit 301 is configured to acquire target network traffic to be released, wherein the target network traffic is specifically authentication traffic initiated by a corresponding terminal and used for authentication;

[0107] A determination unit 302 is configured to determine a target authentication method corresponding to target network traffic;

[0108] The calling unit 303 is configured to call a pre-configured authentication whitelist that describes different authentication methods corresponding to different traffic characteristics, and determine the target traffic characteristics corresponding to the target authentication method based on the authentication whitelist, wherein the authentication whitelist is specifically configured in the form of a cache list;

[0109] A detection unit 304 is used to detect whether the target network traffic matches the target traffic characteristics;

[0110] The release unit 305 is configured to release the target network traffic if yes.

[0111] In an exemplary embodiment, the target network traffic is specifically traffic initiated by a redirected authentication page after a corresponding terminal fails to access a webpage due to non-authentication.

[0112] In another exemplary embodiment, different authentication methods correspond to traffic characteristics in different traffic characteristics. Specifically, based on the preset domain name, a preset IP address is also configured according to the situation.

[0113] In another exemplary embodiment, the apparatus further includes an updating unit 306, configured to:

[0114] Monitor the corresponding DNS messages involved after releasing the target network traffic. If the third-party authentication server has a target IP address that is not recorded in the authentication whitelist and is resolved from the target preset domain name recorded in the authentication whitelist, then update the target IP address in the authentication whitelist to the target traffic characteristics corresponding to the target authentication method.

[0115] In another exemplary embodiment, the release unit 305 is specifically configured to:

[0116] Check whether the current time point is within the preset traffic release time range;

[0117] If yes, the target network traffic is allowed to pass.

[0118] In another exemplary embodiment, the release unit 305 is specifically configured to:

[0119] The target network traffic originally undergoing release determination processing is redirected to enable the processing device to normally access the third-party authentication server responsible for the authentication service and promote further authentication processing. The third-party authentication server is specifically the authentication server of the third-party social software or the third-party enterprise communication office software.

[0120] In another exemplary embodiment, if there is an internal authentication service involving a server built in the enterprise's internal network architecture, the traffic characteristics corresponding to the specific authentication method corresponding to the internal authentication service in the authentication whitelist do not involve domain names, only corresponding IP addresses.

[0121] This application also provides a processing device from the perspective of hardware structure, see Figure 4 , Figure 4 The schematic diagram of the structure of the processing device of the present application is shown. Specifically, the processing device of the present application may include a processor 401, a memory 402 and an input / output device 403. The processor 401 is used to execute the computer program stored in the memory 402 to implement the following Figure 1 The steps of the traffic release method based on the authentication whitelist in the corresponding embodiment; or, when the processor 401 is used to execute the computer program stored in the memory 402, the following is implemented Figure 3 The memory 402 is used to store the functions of each unit in the embodiment corresponding to the processor 401. Figure 1 The computer program required for the traffic release method based on the authentication whitelist in the corresponding embodiment.

[0122] For example, the computer program may be divided into one or more modules / units, one or more of which are stored in memory 402 and executed by processor 401 to implement the present application. One or more modules / units may be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program in a computer device.

[0123] The processing device may include, but is not limited to, a processor 401, a memory 402, and an input / output device 403. Those skilled in the art will appreciate that the illustrations are merely examples of processing devices and do not limit the processing device. The processing device may include more or fewer components than shown, or a combination of certain components, or different components. For example, the processing device may also include a network access device, a bus, etc., and the processor 401, the memory 402, the input / output device 403, etc. are connected via the bus.

[0124] The processor 401 may be a central processing unit (CPU), or other general-purpose processors, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor. The processor is the control center of the processing device and connects various parts of the entire device using various interfaces and lines.

[0125] Memory 402 can be used to store computer programs and / or modules. Processor 401 implements various functions of the computer device by running or executing computer programs and / or modules stored in memory 402 and accessing data stored in memory 402. Memory 402 may primarily include a program storage area and a data storage area. The program storage area may store an operating system, at least one application required for a function, and the like; the data storage area may store data created based on the use of the processing device. Furthermore, memory may include high-speed random access memory and non-volatile memory, such as a hard disk, internal memory, a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other volatile solid-state storage device.

[0126] When the processor 401 is used to execute the computer program stored in the memory 402, it can specifically implement the following functions:

[0127] Obtaining the target network traffic currently to be released, wherein the target network traffic is specifically authentication traffic initiated by the corresponding terminal and used for authentication;

[0128] Determine the target authentication method corresponding to the target network traffic;

[0129] Calling a pre-configured authentication whitelist that describes different authentication methods corresponding to different traffic characteristics, and determining the target traffic characteristics corresponding to the target authentication method based on the authentication whitelist, wherein the authentication whitelist is specifically configured in the form of a cache list;

[0130] Detect whether the target network traffic matches the target traffic characteristics;

[0131] If yes, the target network traffic is allowed to pass.

[0132] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working process of the traffic release device, processing equipment and corresponding units based on the authentication whitelist described above can refer to the following. Figure 1 The description of the traffic release method based on the authentication whitelist in the corresponding embodiment will not be repeated here.

[0133] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be accomplished by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0134] To this end, the present application provides a computer-readable storage medium, which stores a plurality of instructions, which can be loaded by a processor to execute the present application as follows: Figure 1 For the steps of the traffic release method based on the authentication whitelist in the corresponding embodiment, the specific operations can be referred to as follows: Figure 1 The description of the traffic release method based on the authentication whitelist in the corresponding embodiment will not be repeated here.

[0135] The computer-readable storage medium may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0136] Due to the instructions stored in the computer readable storage medium, the present application can be executed as follows: Figure 1 The steps of the traffic release method based on the authentication whitelist in the corresponding embodiment, therefore, the present application can be implemented as follows Figure 1 The beneficial effects that can be achieved by the traffic release method based on the authentication whitelist in the corresponding embodiment are detailed in the previous description and will not be repeated here.

[0137] The above is a detailed introduction to the traffic release method, device, processing equipment and computer-readable storage medium based on the authentication whitelist provided by this application. Specific examples are used in this article to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the core idea of ​​this application; at the same time, for technical personnel in this field, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on this application.

Claims

1. A traffic release method based on an authentication whitelist, characterized in that: The method comprises: The processing device obtains target network traffic currently to be released, wherein the target network traffic is specifically authentication traffic initiated by the corresponding terminal and used for authentication; The processing device determines a target authentication mode corresponding to the target network traffic; The processing device calls a pre-configured authentication whitelist that describes different authentication methods corresponding to different traffic characteristics, and determines the target traffic characteristics corresponding to the target authentication method based on the authentication whitelist, wherein the authentication whitelist is specifically configured in the form of a cache list; The processing device detects whether the target network traffic matches the target traffic characteristics; If so, the processing device allows the target network traffic to pass.

2. The method according to claim 1, characterized in that The target network traffic is specifically the traffic initiated by the redirected authentication page after the corresponding terminal fails to access the webpage due to non-authentication.

3. The method according to claim 1, characterized in that The different authentication methods correspond to traffic characteristics in different traffic characteristics. Specifically, based on the preset domain name, a preset IP address is also configured according to the situation.

4. The method according to claim 3, characterized in that After the processing device releases the target network traffic, the method further includes: The processing device monitors the corresponding DNS messages involved after releasing the target network traffic. If the third-party authentication server has a target IP address that is not recorded in the authentication whitelist and is resolved from the target preset domain name recorded in the authentication whitelist, then the target IP address is updated in the authentication whitelist to the target traffic characteristics corresponding to the target authentication method.

5. The method according to claim 1, wherein The processing device releasing the target network traffic includes: The processing device detects whether the current time point is within a preset traffic release time range; If so, the processing device allows the target network traffic to pass.

6. The method according to claim 1, wherein The processing device releasing the target network traffic includes: The processing device redirects the target network traffic that was originally undergoing release determination processing, so as to enable the processing device to normally access the third-party authentication server responsible for the authentication service and promote further authentication processing, wherein the third-party authentication server is specifically an authentication server for a third-party social software or a third-party enterprise communication office software.

7. The method according to claim 1, characterized in that If there is an internal authentication service involving a server built in the enterprise's internal network architecture, the traffic characteristics corresponding to the specific authentication method corresponding to the internal authentication service in the authentication whitelist do not involve domain names, only corresponding IP addresses.

8. A traffic release device based on an authentication whitelist, characterized in that: The device comprises: an acquiring unit, configured to acquire target network traffic currently to be released, wherein the target network traffic is specifically authentication traffic initiated by a corresponding terminal and used for authentication; a determination unit, configured to determine a target authentication method corresponding to the target network traffic; a calling unit, configured to call a pre-configured authentication whitelist describing different authentication methods corresponding to different traffic characteristics, and determine a target traffic characteristic corresponding to the target authentication method based on the authentication whitelist, wherein the authentication whitelist is specifically configured in the form of a cache list; A detection unit, configured to detect whether the target network traffic matches the target traffic characteristics; The release unit is configured to release the target network traffic if yes.

9. A processing device, characterized in that: The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method according to any one of claims 1 to 7 is executed.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 7.

Images