Business data downloading control system based on equipment attributes

Abstract

The invention discloses a service data downloading control system based on equipment attributes. The service data downloading control system comprises the following steps: acquiring equipment fingerprint information of terminal equipment and performing credibility verification to generate an equipment attribute judgment result; routing the access traffic to a corresponding logic network channel through a traffic scheduling strategy based on an equipment attribute judgment result, and allocating a unique network exit address; configuring an access control list taking a network exit address as a judgment basis at the gateway; and filtering and controlling the access request of the service data interface in real time according to the access control list, and only responding to the white list address set request. According to the method and the device, the data downloading behaviors of terminal equipment with different attributes are finely and differentially controlled, the safety protection level of enterprise business data when external equipment is accessed is effectively improved, and meanwhile, the normal data acquisition requirement of legal equipment is considered.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a business data download control system based on device attributes. BACKGROUND

[0002] In the field of enterprise network and information security today, with the increasing demand for remote office and mobile access, how to protect the security of internal business data in the diversified terminal access environment has become an important issue. The existing technology generally adopts an access control mechanism based on user identity authentication, such as accessing the enterprise internal system through a virtual private network, and opening the corresponding data access function according to the account permission. However, this kind of method usually does not identify and distinguish the attributes of the terminal device itself, resulting in that different devices obtain the same data operation permission after authentication, and cannot implement differentiated management and control strategies according to the device type. Due to the lack of dynamic perception and response ability of the terminal trusted state, while allowing external devices to access, it is difficult for enterprises to accurately restrict high-risk data download behavior, so as to effectively prevent sensitive data from being leaked through uncontrolled devices. This situation reflects that the current enterprise in response to external terminal access still has the problem of insufficient policy granularity in the data flow control level, and cannot balance the access flexibility and data security. SUMMARY

[0003] Therefore, the purpose of the present application is to provide a business data download control system based on device attributes, which realizes fine control of data download according to device attributes through device trusted verification and differentiated traffic routing gateway access control, and solves the problem of easy leakage of enterprise sensitive data when external terminal accesses.

[0004] In order to achieve the above technical purpose, the present application provides a business data download control system based on device attributes, comprising: Collecting the device fingerprint information of the terminal device requesting to access the business network, and performing trusted verification on the device fingerprint information and the registration information in the enterprise asset database to generate a unique device attribute determination result; Based on the device attribute determination result, the access traffic of the terminal device is routed to the corresponding logical network channel through the traffic scheduling strategy, and each logical network channel is allocated a unique network exit address; Configuring an access control list with network exit address as the basis at the gateway of the business access path, the access control list including a whitelist address set allowing data download operation and a non-whitelist address set prohibiting data download operation; According to the access control list, the access requests flowing into the business data interface are filtered and controlled in real time, and only the requests with source address belonging to the whitelist address set are responded and the business data is returned.

[0005] In some embodiments, the device fingerprint information is authenticated with the registered information in the enterprise asset database to generate a unique device attribute determination result, including: extracting a key hardware identifier in the device fingerprint information; performing a similarity matching calculation on the key hardware identifier and the pre-registered standard hardware identifier in the enterprise asset database to obtain a similarity value; determining whether the similarity value is within a preset trusted threshold range, and generating a device attribute determination result, including trusted internal devices and untrusted external devices; If the similarity value is within the preset trusted threshold range, the device attribute determination result is a trusted internal device; If the similarity value is not within the preset trusted threshold range, the device attribute determination result is an untrusted external device.

[0006] In some embodiments, based on the device attribute determination result, the access traffic of the terminal device is routed to the corresponding logical network channel through a traffic scheduling strategy, and each logical network channel is assigned a unique network exit address, including: According to the device attribute determination result, the traffic of the terminal device determined as a trusted internal device is routed to a first logical network channel, and the first logical network channel is assigned a first network exit address; The traffic of the terminal device determined as an untrusted external device is routed to a second logical network channel, and the second logical network channel is assigned a second network exit address; The first network exit address is different from the second network exit address.

[0007] In some embodiments, an access control list based on the network exit address is configured at the gateway of the business access path, including: An access control list is created at the gateway of the business access path, and the access control list includes access control rules: The first rule is configured as: when a data packet with a source address of the first network exit address is detected, access to core business data is allowed; The second rule is configured as: when a data packet with a source address of the second network exit address is detected, only access to basic public data is allowed; The access control list is deployed to the data packet filtering module at the gateway, which is used for real-time matching and access control of all business data access requests passing through the gateway.

[0008] In some embodiments, the access requests flowing into the business data interface are filtered and controlled in real time according to the access control list, including: The data packet filtering module listens to the incoming data packets of the business data interface in real time; extracting the source address field of each incoming data packet and matching it with network exit addresses in the access control list; when the first rule is matched, releasing the incoming data packet and allowing it to access the core service data server; when the second rule is matched, releasing the incoming data packet but limiting it to access the basic public data server only; for the incoming data packet that does not match any rule, performing a default discard policy.

[0009] In some embodiments, only requests with source addresses belonging to the whitelist address set are responded to and business data is returned, including: configuring a source address whitelist on the service data server side; when a service data access request is received, extracting the source address field of the request data packet; comparing the source address field with network exit addresses in the source address whitelist; if the source address field exists in the whitelist address set, normally processing the request and returning corresponding service data; if the source address does not exist in the whitelist address set, discarding the request data packet and not returning any service data.

[0010] In some embodiments, device fingerprint information of a terminal device requesting to access a service network is collected, including: when the terminal device initiates a service network access request for the first time, redirecting it to a device fingerprint authentication page; running a script in the device fingerprint authentication page to collect original environment parameters, including hardware parameters and software parameters; standardizing and hash obfuscating the collected original environment parameters to generate a unique device feature code; combining and signing the device feature code to generate device fingerprint information.

[0011] In some embodiments, the collected original environment parameters are standardized and hash obfuscated to generate a unique device feature code, including: uniformly converting parameters of different formats and units in the original environment parameters into standard strings; calculating the standard strings using a salted hash algorithm to obtain multiple salted hash values, the salt value being a one-time random number issued by an authentication server; concatenating the multiple salted hash values in a predetermined order to generate a device feature code.

[0012] In some embodiments, the system further includes: dynamically setting an effective period threshold for each device fingerprint information; When the terminal device initiates an access request again, whether the device fingerprint information of the terminal device is within the range of the validity threshold is verified; If the validity threshold is exceeded, the terminal device is required to re-perform the device fingerprint information collection process for verification update; And if the preset key item change of the device hardware configuration is detected within the range of the validity threshold, the current device fingerprint information is invalidated immediately and a re-verification process is triggered.

[0013] Compared with the prior art, the technical scheme has the beneficial effects that: the application provides a service data download control system based on device attributes, which collects device fingerprint information of a terminal device and performs trusted verification to generate a device attribute determination result; based on the device attribute determination result, access traffic is routed to a corresponding logical network channel and a unique network exit address is allocated through a traffic scheduling strategy; an access control list is configured at the gateway with the network exit address as the basis for discrimination; and access requests for service data interfaces are filtered and controlled in real time according to the access control list, and only white list address set requests are responded to. The application realizes fine differentiation and control of data download behavior of terminal devices with different attributes, effectively improves the security protection level of enterprise business data when accessed by external devices, and at the same time, meets the normal data acquisition needs of legal devices. BRIEF DESCRIPTION OF DRAWINGS

[0014] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description only constitute some embodiments of the application, and all other drawings obtained by those of ordinary skill in the art without creative effort based on these drawings are within the scope of the application.

[0015] Figure 1 is a step diagram of steps S101 to S104 described in the specific embodiment; Figure 2 is a step diagram of steps S201 to S203 described in the specific embodiment. DETAILED DESCRIPTION

[0016] The application will be described in further detail below with reference to the drawings and embodiments. It is particularly pointed out that the following embodiments are only used to illustrate the application, but do not limit the scope of the application. Similarly, the following embodiments are only some embodiments of the application, not all embodiments, and all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of the application.

[0017] Please refer to Figure 1The embodiment provides a service data download control system based on device attributes, comprising: S101, device fingerprint information of a terminal device requesting to access a service network is collected, and the device fingerprint information is trustedly verified with registered information in an enterprise asset database to generate a unique device attribute determination result; S102, based on the device attribute determination result, access traffic of the terminal device is routed to a corresponding logical network channel through a traffic scheduling strategy, and a unique network exit address is allocated to each logical network channel; S103, an access control list taking the network exit address as a judgment basis is configured at a gateway of a service access path, and the access control list comprises a whitelist address set allowing data download operation to be performed and a non-whitelist address set prohibiting data download operation to be performed; S104, access requests flowing into a service data interface are filtered and controlled in real time according to the access control list, and only requests with source addresses belonging to the whitelist address set are responded to and service data is returned.

[0018] In step S101, the device fingerprint information is a unique identity generated by collecting hardware features and software environment parameters of the terminal device, and is used to distinguish attribute characteristics of different devices. The device fingerprint information can be collected by a client program or a browser script installed on the terminal device, and contains parameters such as hardware serial number, MAC address and operating system version, which cannot be easily tampered with. The registered information in the enterprise asset database refers to the device standard information registered and recorded in advance in the enterprise IT asset management system, and is used as a benchmark for trusted verification. Trusted verification refers to a process of judging the trusted state of the device by comparing the consistency of the device fingerprint information and the registered information, and generating a unique device attribute determination result for subsequent access control decision.

[0019] In step S102, the device attribute determination result is used to identify the trusted attribute state of the device. The traffic scheduling strategy is a network traffic distribution rule formulated according to the device attribute determination result, and is realized through a routing device or an SDN controller; the logical network channel is an independent data transmission path divided through virtual network technology, and the traffic of devices with different attributes is isolated into different logical channels for transmission. The unique network exit address refers to a unique public network IP address allocated to each logical network channel, which is used to identify the device attribute source of the traffic at the gateway.

[0020] In step S103, the gateway of the service access path is a network security device such as a firewall or a WAF device deployed at the entrance of the enterprise service network. The access control list is a set of access permission rules set based on the network exit address, the white list address set contains network exit addresses allowed to perform data download operations, and the non-white list address set contains network exit addresses prohibited to perform data download operations. The access control list is deployed through the policy configuration interface of the gateway device, realizing the access control function based on the source address.

[0021] In step S104, real-time filtering and execution control refers to the process of packet-by-packet detection and policy matching of the gateway device on the incoming data packet. The request with the source address belonging to the white list address set refers to the access request with the data packet source IP address matching the network exit address in the white list address set, which will be allowed to access the service data interface and obtain data response. For requests in the non-white list address set, the gateway will perform discard or redirection operation to ensure that the service data will not flow to unauthorized devices.

[0022] The embodiment realizes fine-grained data download control based on device attributes through the synergistic effect of device fingerprint identification, traffic logical isolation and gateway access control. Device fingerprint provides a trusted identity, logical network channel realizes traffic isolation, unique network exit address provides identification basis, access control list performs the most right permission control, forming a complete security protection chain. The embodiment effectively solves the problem that the traditional VPN access cannot distinguish device attributes, while ensuring the normal access of legal devices, preventing the data download risk of unauthorized devices.

[0023] Please refer to Figure 2 In some embodiments, the device fingerprint information is trustedly verified with the registered information in the enterprise asset database to generate a unique device attribute determination result, including: S201, extracting the key hardware identifier in the device fingerprint information; S202, similarity matching calculation is performed between the key hardware identifier and the pre-registered standard hardware identifier in the enterprise asset database to obtain a similarity value; S203, judging whether the similarity value is within the range of the preset trusted threshold, and generating a device attribute determination result, the device attribute determination result including trusted internal devices and untrusted external devices; If the similarity value is within the range of the preset trusted threshold, the device attribute determination result is a trusted internal device; If the similarity value is not within the range of the preset trusted threshold, the device attribute determination result is an untrusted external device.

[0024] In step S201, the key hardware identifier is a core parameter extracted from the device fingerprint information that can uniquely identify the device hardware features, including but not limited to the motherboard serial number, hard disk serial number, and MAC address, and other hardware information that cannot be easily tampered with. These identifiers are obtained through the device fingerprint collection process and are used for subsequent trusted verification comparison.

[0025] In step S202, the standard hardware identifier is the device hardware feature information registered in the enterprise asset database in advance as a reference for trusted verification. Similarity matching calculation calculates the matching degree between the key hardware identifier and the standard hardware identifier through string matching algorithm or feature vector comparison algorithm, and outputs a quantitative similarity value. The similarity value can be calculated using common algorithms such as edit distance and cosine similarity, reflecting the consistency of the device fingerprint and the registered information.

[0026] In step S203, the preset trusted threshold is a numerical range preset for judging the trusted state of the device, determined based on historical verification data and security requirements. The trusted internal device is a device with a similarity value within the preset trusted threshold range, indicating that the device is an internal device authorized by the enterprise; the untrusted external device is a device with a similarity value that does not meet the preset trusted threshold requirement, indicating that the device is a personal or external device not managed by the enterprise. The generation of the device attribute determination result is based on the comparison result of the similarity value and the preset trusted threshold, providing a decision basis for subsequent access control.

[0027] This embodiment realizes accurate determination of device attributes through extraction of key hardware identifiers and similarity matching calculation. The preset trusted threshold can be adjusted flexibly according to the enterprise security policy, ensuring normal access of internal devices and effectively identifying and isolating untrusted external devices. This trusted verification method based on hardware features provides more reliable device attribute identification capability compared to traditional identity authentication, laying a solid foundation for subsequent differentiated access control.

[0028] In some embodiments, based on the device attribute determination result, the access traffic of the terminal device is routed to the corresponding logical network channel through a traffic scheduling strategy, and a unique network exit address is allocated to each logical network channel, including: According to the device attribute determination result, the traffic of the terminal device determined as a trusted internal device is routed to a first logical network channel, and a first network exit address is allocated to the first logical network channel; The traffic of the terminal device determined as an untrusted external device is routed to a second logical network channel, and a second network exit address is allocated to the second logical network channel; The first network exit address and the second network exit address are different.

[0029] In the embodiment, the traffic scheduling strategy realizes logical isolation of traffic of different attribute devices through an SDN controller or a routing device. A first logical network channel is a dedicated data transmission path allocated for trusted internal devices, and preferably, a corporate intranet VPN tunnel or a dedicated virtual network is used to realize the first logical network channel, so as to ensure the security and reliability of data transmission. A second logical network channel is a restrictive network path allocated for untrusted external devices, and the DMZ area or a restricted access network is usually used to realize the second logical network channel, so as to limit the access right of the untrusted external devices to the core service.

[0030] The first network exit address is a unique public network IP address allocated for the first logical network channel, and is used to identify access traffic from the trusted internal devices. The second network exit address is a unique public network IP address allocated for the second logical network channel and different from the first network exit address, and is used to identify access traffic from the untrusted external devices. The allocation of the network exit address is realized through network address translation (NAT) technology or a dedicated exit gateway, so as to ensure that the traffic of different logical network channels has distinguishable source address features.

[0031] The embodiment drives the execution of the traffic scheduling strategy through the device attribute determination result, and realizes complete isolation of network traffic of the trusted internal devices and the untrusted external devices. The division of different logical network channels and the allocation of unique network exit addresses provide accurate identification basis for subsequent access control based on source addresses. The traffic routing mechanism based on device attributes not only ensures normal access of the internal devices to service data, but also effectively prevents data security risks possibly caused by the external devices, and forms a multi-level security protection system.

[0032] In some embodiments, an access control list with the network exit address as the identification basis is configured at a gateway of a service access path, and the access control list includes: An access control list is created at a gateway of a service access path, and the access control list includes access control rules: The first rule is configured as: when a data packet with the first network exit address as the source address is detected, the access to core service data is allowed; The second rule is configured as: when a data packet with the second network exit address as the source address is detected, the access to basic public data is allowed; The access control list is deployed at a data packet filtering module of the gateway, and is used to perform real-time matching and access control on all service data access requests passing through the gateway.

[0033] In this embodiment, the gateway of the service access path is used for security control of all data flows in and out of the service system. The access control list is a set of access permission rules based on network exit addresses, which is created and managed through the policy configuration interface of the gateway device. The first rule is configured to allow access to core service data for data packets with a source address of the first network exit address, and the core service data includes file download interfaces, database query interfaces, and other sensitive business functions. The second rule is configured to allow only access to basic public data for data packets with a source address of the second network exit address, and the basic public data includes page browsing, information query, and other non-sensitive business functions.

[0034] The packet filtering module is a core component of the gateway device responsible for executing access control policies, and performs real-time analysis of the source address, destination address, protocol type, and other characteristics of data packets through deep packet inspection technology. Real-time matching is the process of matching each data packet passing through the gateway with the policy rules, and performing corresponding access control actions based on the matching results. Access control includes operations such as allowing passage, denying access, or redirecting, to ensure that devices with different attributes can only access the business resources they are authorized to access.

[0035] This embodiment achieves fine-grained access control for devices with different attributes by configuring an access control list based on network exit addresses at the gateway. Trusted internal devices corresponding to the first network exit address can have complete access to business data, while untrusted external devices corresponding to the second network exit address can only access basic public data. This source address-based access control mechanism, combined with the previous device attribute determination and traffic routing, forms a complete security protection chain, ensuring both enterprise data security and access requirements for different devices.

[0036] In some embodiments, access requests flowing into the service data interface are filtered and controlled in real time according to the access control list, including: The packet filtering module listens to the incoming data packets of the service data interface in real time; Extract the source address field of each incoming data packet and match it with the network exit addresses in the access control list; When the first rule is matched, the incoming data packet is released and allowed to access the core service data server; When the second rule is matched, the incoming data packet is released but limited to only accessing the basic public data server; For incoming data packets that do not match any rules, a default discard policy is executed.

[0037] In this embodiment, real-time filtering and execution control is the process of real-time analysis and processing of data packets flowing into the service data interface by the data packet filtering module, which achieves millisecond-level response speed through deep packet inspection technology. The incoming data packets are data messages entering the service system through the network interface, containing header information such as source address, destination address, protocol type, and payload data. The source address field refers to the source IP address information in the IP header of the data packet, which is used to identify the source network exit of the data packet and serves as a key basis for access control matching.

[0038] The core business data server refers to a server cluster that stores and processes enterprise sensitive business data, including database servers, file servers, and other systems that store critical business information. The basic public data server refers to a server that provides non-sensitive business functions, such as a web server, a query interface server, and other systems that only contain public information. The default discard policy is a security handling method for data packets that fail to match any access control rules, directly rejecting their access requests and recording security logs.

[0039] This embodiment realizes fine-grained access control based on network exit addresses through real-time monitoring and matching processing by the data packet filtering module. When the data packet source address matches the first rule, the system allows it to access the core business data server, ensuring the complete business rights of trusted internal devices. When it matches the second rule, the system restricts it to only access the basic public data server, preventing untrusted external devices from obtaining sensitive information. Data packets that do not match any rules are discarded directly, effectively preventing access requests from unknown sources. This hierarchical control mechanism is integrated with the previous device attribute determination and traffic routing, forming a complete security protection system that not only guarantees the confidentiality of business data but also maintains system availability.

[0040] In some embodiments, only requests with source addresses belonging to the whitelist address set are responded to and business data is returned, including: Configuring a source address whitelist on the service data server side; When receiving a service data access request, extracting the source address field of the request data packet; Comparing the source address field with the network exit addresses in the source address whitelist; If the source address field exists in the whitelist address set, the request is processed normally and the corresponding business data is returned; If the source address does not exist in the whitelist address set, the request data packet is discarded and no business data is returned.

[0041] In this embodiment, the source address whitelist refers to a set of trusted network egress addresses pre-configured on the service data server side, including the first network egress address and other authenticated trusted source addresses. The whitelist address set is maintained and updated through a system management interface, ensuring that only trusted traffic that has passed device attribute determination and traffic routing processing can access service data. The source address field of the request data packet refers to the source IP address information in the data packet IP header, used to identify the source network egress of the request.

[0042] When the service data server receives an access request, it performs an exact match verification of the extracted source address field with the network egress addresses in the whitelist address set. When the source address verification is passed, the server performs the corresponding business logic processing and returns the requested service data; when the source address is not in the whitelist, the server directly terminates the request processing flow and does not return any service data information, while recording a security audit log.

[0043] This embodiment provides a last line of defense for service data access by implementing source address whitelist verification on the service data server side. Even if the request passes the gateway filtering in the early stage, it still needs to be finally identified on the server side. This double verification mechanism ensures that only requests from trusted network egresses can obtain service data, effectively preventing illegal access and data leakage risks. The implementation of the whitelist mechanism is based on existing network programming interfaces and firewall technology, with high practicality and operability, providing reliable security protection.

[0044] In some embodiments, device fingerprint information of a terminal device accessing a service network is collected, including: When the terminal device first initiates a service network access request, it is redirected to a device fingerprint authentication page; Running a script in the device fingerprint authentication page to collect original environment parameters, including hardware parameters and software parameters; Standardizing and hash obfuscating the collected original environment parameters to generate a unique device feature code; Combining and signing the device feature code to generate the device fingerprint information.

[0045] In this embodiment, the device fingerprint authentication page is a specially designed web interface used to perform device information collection and authentication process when the user first accesses the service network. The page uses redirection technology to guide the initial access request to the authentication process, ensuring that device identification is completed before allowing service access. The original environment parameters include hardware parameters and software parameters, such as CPU model, memory configuration, storage device serial number, and other physical characteristic information, as well as operating system version, browser type, installed font list, and other system environment characteristics.

[0046] The standardization processing refers to the format unification and standardization of the collected original parameters, and eliminates the inconsistency of data caused by system differences. The standardized parameters are converted by one-way encryption using a cryptographic hash algorithm, which protects user privacy and ensures data irreversibility. The generated device feature code serves as a unique identifier and can accurately represent the comprehensive environmental characteristics of the device. The combined device feature code is encrypted and signed using a digital certificate to ensure the integrity and tamper resistance of the device fingerprint information.

[0047] The standardized device fingerprint collection and processing flow in this embodiment provides a reliable technical foundation for device attribute determination. The use of hash obfuscation and digital signature technology ensures user privacy and security, as well as the accuracy of device identification. This device fingerprint generation method can effectively distinguish different terminal devices and provide accurate device identification basis for subsequent differentiated access control, which is a key implementation method for device identification.

[0048] In some embodiments, the collected original environmental parameters are standardized and hash obfuscated to generate a unique device feature code, including: Converting parameters of different formats and units in the original environmental parameters into standard strings; Calculating the standard string using a salted hash algorithm to obtain multiple salted hash values, with the salt value being a one-time random number issued by an authentication server; Concatenating the multiple salted hash values in a predetermined order to generate a device feature code.

[0049] In this embodiment, different formats and units of parameters in the original environmental parameters are converted into standardized text representation forms, i.e., standard strings, through unified encoding rules, ensuring the uniformity and comparability of subsequent processing. The salted hash algorithm is an encryption method that performs hash operation after adding a random salt value to the original data. The salt value is a one-time random number generated and issued by the authentication server, which is used to enhance the security and anti-collision ability of the hash process. The salted hash algorithm is used to calculate the salted hash values of the standardized parameters, with each hash value corresponding to a specific environmental parameter feature.

[0050] The predetermined order is a pre-defined hash value concatenation rule. Preferably, the parameters are sorted according to their importance and stability to ensure the consistency and repeatability of the device feature code generation. The device feature code is formed by concatenating multiple salted hash values in a predetermined order to form a comprehensive identifier representing the unique identity of the device.

[0051] The embodiment realizes the secure generation of the device feature code through the standardized parameter processing and the salted hash algorithm. The one-time random number used as the salt value effectively prevents the replay attack and the rainbow table cracking, and ensures the security and reliability of the device identification. The combination and splicing of multiple hash values enhance the uniqueness and stability of the feature code, and even if part of the parameters change, the accuracy of the device identification can be maintained. This processing mode provides a reliable technical basis for the device attribute judgment, and is an important link in the entire device identification system.

[0052] In some embodiments, the method further comprises: dynamically setting a validity threshold for each device fingerprint information; when the terminal device initiates an access request again, verifying whether the device fingerprint information of the terminal device is within the range of the validity threshold; if the validity threshold is exceeded, requiring the terminal device to re-execute the device fingerprint information collection process for verification update; and, if the preset key item change of the device hardware configuration is detected within the range of the validity threshold, immediately invalidating the current device fingerprint information and triggering a re-verification process.

[0053] In the embodiment, the validity threshold refers to the time validity limit set for each device fingerprint information, which is preferably dynamically set according to the security level and use frequency of the device, to ensure the timeliness and security of the device authentication information. When the terminal device initiates an access request, it is checked whether the creation time of the device fingerprint information is still within the validity period, which is an important link in maintaining continuous trusted access.

[0054] The preset key item change refers to the change of the core elements affecting the device identity recognition in the device hardware configuration, such as the replacement of key hardware such as the motherboard and hard disk or the change of the main network identifier. Re-executing the device fingerprint information collection process means requiring the device to complete the complete fingerprint authentication process again, including the steps of environment parameter collection, standardized processing and feature code generation. When the key change is detected, the current device fingerprint information is actively invalidated, and re-verification is forcibly started to ensure the authenticity of the device identity.

[0055] The embodiment realizes the continuous and trusted verification of the device fingerprint information through the dynamic validity period management and key change detection mechanism. The validity threshold prevents the security risks that may be caused by the long-term non-updated device information, and the key item change detection ensures the timely re-authentication when the device hardware changes. This double protection mechanism maintains the user experience while effectively improving the security and reliability of the entire device authentication system, and provides a more accurate and timely device identity basis for subsequent access control.

[0056] In the embodiment, the service data download control system based on device attributes completes the complete process from device identification, attribute determination to access control by coordinating the collaborative operation of multiple functional modules. The system is suitable for enterprise network environment, especially the business data access management scene under the zero trust security architecture, can effectively distinguish between company devices and personal devices, and implement differentiated data download permission control.

[0057] The system obtains the hardware and software parameters of the terminal device through the device fingerprint collection module, and generates a standardized device feature code through the data processing module. The attribute determination module compares the device feature code with the enterprise asset database to determine the device attribute type. The traffic scheduling module implements differentiated network path allocation according to the device attribute, and guides the access traffic of devices with different attributes to the corresponding network exit. The policy execution module implements fine access control policies based on the source IP address at the gateway level, and finally realizes the differentiated management and control of company devices and personal devices in terms of data download permission.

[0058] The system integrates device attribute identification, traffic fine scheduling and access policy execution through modular architecture design, forming a complete technical solution closed loop. When the system is implemented, the modules work together, the device fingerprint information serves as the basic identifier, the attribute determination result serves as the control basis, the traffic scheduling realizes path separation, and finally the precise permission control is completed at the application gateway level. This systematic integration makes the device attribute identification and access control policy form an organic whole, not only ensures the security of enterprise data and the accuracy of access control, but also improves the maintainability and scalability of the system, providing reliable technical support for data security management in the BYOD scenario.

[0059] By adopting the above technical scheme, the present application is different from the prior art and has the following beneficial effects: accurate device attribute differentiation is realized through device fingerprint information collection and trusted verification, access traffic of devices with different attributes is routed to corresponding logical network channels and assigned with unique network exit addresses based on the determination result, an access control list is configured at the gateway with the network exit address as the basis for discrimination, and finally fine filtering and control of service data access requests are realized, effectively solving the technical problem that traditional VPN access control cannot distinguish device attributes based on user identity authentication only, forming a complete security protection chain from device identification, traffic scheduling to access control. Through the association and mapping of device attribute determination and network exit address, not only the normal access demand of trusted internal devices to service data is ensured, but also the data leakage risk caused by untrusted external devices is effectively prevented, the differentiated access experience of devices with different attributes is taken into account while ensuring the security of enterprise data, and the data security management level in the BYOD scenario is significantly improved.

[0060] In addition, each function unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software function unit.

[0061] If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application, essentially or in the form of a contribution to the prior art, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform all or part of the steps of the methods in each embodiment of the present application. The foregoing storage medium includes various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk.

[0062] The above only describes some embodiments of the present application, and does not limit the protection scope of the present application. Any equivalent device or equivalent flow transformation, or direct or indirect application in other related technical fields, which is made by using the content of the specification and drawings of the present application, is also included in the patent protection scope of the present application.

Claims

1. A device attribute-based service data download control system characterized by comprising: The method comprises the following steps: Collecting device fingerprint information of terminal equipment requesting to access a service network, and performing trusted verification on the device fingerprint information and registered information in an enterprise asset database to generate a unique device attribute determination result; Based on the device attribute determination result, routing access traffic of the terminal equipment to a corresponding logical network channel through a traffic scheduling strategy, and assigning a unique network exit address to each logical network channel; Configuring an access control list at a gateway of a service access path, with the network exit address as the basis for discrimination, the access control list including a whitelist address set that allows data download operations to be performed and a non-whitelist address set that prohibits data download operations from being performed; According to the access control list, filtering and performing control on access requests flowing into a service data interface in real time, and responding to and returning service data only to requests whose source addresses belong to the whitelist address set.

2. The device attribute-based service data download control system according to claim 1, wherein, The trusted verification of the device fingerprint information and the registered information in the enterprise asset database generates a unique device attribute determination result, which includes: Extracting a key hardware identifier from the device fingerprint information; Performing similarity matching calculation on the key hardware identifier and the pre-registered standard hardware identifier in the enterprise asset database to obtain a similarity value; Judging whether the similarity value is within a preset trusted threshold range, and generating a device attribute determination result, which includes trusted internal devices and untrusted external devices; If the similarity value is within the preset trusted threshold range, the device attribute determination result is a trusted internal device; If the similarity value is not within the preset trusted threshold range, the device attribute determination result is an untrusted external device.

3. The device attribute-based service data download control system according to claim 1, wherein Based on the device attribute determination result, routing access traffic of the terminal equipment to a corresponding logical network channel through a traffic scheduling strategy, and assigning a unique network exit address to each logical network channel, which includes: According to the device attribute determination result, routing traffic of terminal equipment determined as a trusted internal device to a first logical network channel, and assigning a first network exit address to the first logical network channel; Routing traffic of terminal equipment determined as an untrusted external device to a second logical network channel, and assigning a second network exit address to the second logical network channel; The first network exit address and the second network exit address are different.

4. The device attribute-based service data download control system according to claim 3, wherein Configuring an access control list at a gateway of a service access path, with the network exit address as the basis for discrimination, which includes: Creating an access control list at a gateway of a service access path, the access control list including access control rules: The first rule is configured to allow access to core service data when a data packet with the first network exit address as the source address is detected; The second rule is configured to allow access to only basic public data when a data packet with the second network exit address as the source address is detected; Deploying the access control list to a data packet filtering module at the gateway for real-time matching and access control on all service data access requests passing through the gateway.

5. The device attribute-based service data download control system according to claim 4, characterized by, According to the access control list, real-time filtering and performing control on the access request of the inflow service data interface, comprising: The data packet filtering module real-time monitors the inflow data packet of the service data interface; Extracting the source address field of each inflow data packet, and matching it with the network exit address in the access control list; When the first rule is matched, the inflow data packet is released and allowed to access the core service data server; When the second rule is matched, the inflow data packet is released but limited to access the basic public data server only; For the inflow data packet that does not match any rule, the default discard strategy is executed.

6. The device attribute-based service data download control system according to claim 1, wherein Only the request response and business data return of the source address belonging to the whitelist address set, comprising: Configuring the source address whitelist on the service data server side; When receiving the service data access request, extracting the source address field of the request data packet; Comparing the source address field with the network exit address in the source address whitelist; If the source address field exists in the whitelist address set, the request is normally processed and the corresponding business data is returned; If the source address does not exist in the whitelist address set, the request data packet is discarded and no business data is returned.

7. The device attribute-based service data download control system according to claim 1, wherein Collecting the device fingerprint information of the terminal device requesting to access the service network, comprising: When the terminal device initiates a service network access request for the first time, redirecting it to a device fingerprint authentication page; Running the script in the device fingerprint authentication page to collect original environment parameters, including hardware parameters and software parameters; Standardizing and hash obfuscating the collected original environment parameters to generate a unique device feature code; Combining and signing the device feature code to generate the device fingerprint information.

8. The device attribute-based service data download control system according to claim 7, wherein Standardizing and hash obfuscating the collected original environment parameters to generate a unique device feature code, comprising: Uniformly converting parameters of different formats and units in the original environment parameters into standard strings; Using a salted hash algorithm to calculate the standard strings to obtain a plurality of salted hash values, and the salt value is a one-time random number issued by the authentication server; Splicing the plurality of salted hash values in a predetermined order to generate the device feature code.

9. The device attribute-based service data download control system according to claim 1, wherein, The system further comprises: Dynamically setting an effective period threshold for each device fingerprint information; When the terminal device initiates an access request again, verifying whether the device fingerprint information of the terminal device is within the range of the effective period threshold; If the effective period threshold is exceeded, requiring the terminal device to re-execute the device fingerprint information collection process for verification update; And, if the device hardware configuration is changed in a preset key item within the range of the effective period threshold, the current device fingerprint information is invalidated immediately and the re-verification process is triggered.

Images