A device attribute-based service data download control system

Abstract

The application discloses a kind of service data download control systems based on equipment attribute, and the equipment fingerprint information of terminal equipment is collected and trusted verification is carried out to generate equipment attribute determination result;Based on equipment attribute determination result, access traffic is routed to corresponding logical network channel and unique network exit address is distributed by traffic scheduling strategy;Access control list is configured with network exit address as the basis for discrimination at gateway;According to the access request of service data interface, real-time filtering and control are carried out, and only whitelist address set request is responded to.The application realizes the fine distinction management and control of the data download behavior of different attribute terminal equipment, effectively improves the security protection level of enterprise business data when accessed by external equipment, and at the same time, the normal data acquisition demand of legal equipment is considered.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a business data download control system based on device attributes. Background Technology

[0002] In today's enterprise network and information security field, with the increasing demand for remote work and mobile access, ensuring the security of internal business data under diverse terminal access environments has become a crucial issue. Existing technologies generally employ user authentication-based access control mechanisms, such as accessing internal enterprise systems via virtual private networks (VPNs) and granting corresponding data access functions based on account permissions. However, these methods typically fail to identify and differentiate the attributes of the terminal devices themselves, resulting in different devices receiving the same data operation permissions after authentication, making it impossible to implement differentiated control strategies based on device type. Due to the lack of dynamic perception and response capabilities regarding the trusted status of terminals, enterprises, while allowing external devices to access the system, struggle to accurately constrain high-risk data download behaviors, thus failing to effectively prevent the leakage of sensitive data through uncontrolled devices. This situation reflects a systemic problem in enterprises' current approach to external terminal access: insufficient policy granularity at the data flow control level, and an inability to balance access flexibility and data security. Summary of the Invention

[0003] In view of this, the purpose of this invention is to propose a business data download control system based on device attributes. By linking device trusted verification and differentiated traffic routing with gateway access control, it can achieve fine-grained management of data download according to device attributes and solve the problem of easy leakage of sensitive enterprise data when external terminals access the system.

[0004] To achieve the aforementioned technical objectives, this application provides a business data download control system based on device attributes, comprising:

[0005] Collect device fingerprint information of terminal devices requesting access to the business network, and perform trusted verification between the device fingerprint information and the registration information in the enterprise asset database to generate a unique device attribute determination result;

[0006] Based on the device attribute determination results, the access traffic of the terminal device is routed to the corresponding logical network channel through the traffic scheduling strategy, and a unique network exit address is assigned to each logical network channel.

[0007] Configure an access control list at the gateway of the business access path, based on the network egress address. The access control list includes a whitelist of addresses that are allowed to perform data download operations and a non-whitelist of addresses that are prohibited from performing data download operations.

[0008] Based on the access control list, the system performs real-time filtering and execution control on access requests flowing into the business data interface, and only responds to and returns business data to requests whose source address belongs to the whitelist address set.

[0009] In some embodiments, the device fingerprint information is reliably verified against the registration information in the enterprise asset database to generate a unique device attribute determination result, including:

[0010] Extract key hardware identifiers from device fingerprint information;

[0011] The similarity value is obtained by matching the key hardware identifier with the standard hardware identifiers pre-registered in the enterprise asset database.

[0012] Determine whether the similarity value is within the range of a preset trust threshold, and generate a device attribute determination result, which includes trusted internal devices and untrusted external devices;

[0013] If the similarity value is within the preset trust threshold range, the device attribute determination result is a trustworthy internal device;

[0014] If the similarity value is not within the preset trust threshold range, the device attribute determination result is an untrusted external device.

[0015] In some embodiments, based on the device attribute determination result, the access traffic of the terminal device is routed to the corresponding logical network channel through a traffic scheduling strategy, and a unique network egress address is assigned to each logical network channel, including:

[0016] Based on the device attribute determination result, the traffic of the terminal device determined to be a trusted internal device is routed to the first logical network channel, and a first network exit address is assigned to the first logical network channel.

[0017] Traffic from terminal devices identified as untrusted external devices is routed to the second logical network channel, and a second network exit address is assigned to the second logical network channel.

[0018] The first network exit address is different from the second network exit address.

[0019] In some embodiments, an access control list based on the network egress address is configured at the gateway of the service access path, including:

[0020] Create an access control list at the gateway of the business access path. The access control list includes access control rules:

[0021] The first rule is configured as follows: When a data packet with a source address of the first network egress address is detected, access to core business data is allowed;

[0022] The second rule is configured as follows: when a data packet with a source address of the second network egress address is detected, access to basic public data is only allowed;

[0023] The access control list is deployed at the gateway as a packet filtering module to perform real-time matching and access control on all business data access requests passing through the gateway.

[0024] In some embodiments, real-time filtering and execution control of access requests flowing into the business data interface are performed based on an access control list, including:

[0025] The data packet filtering module monitors incoming data packets to the business data interface in real time;

[0026] Extract the source address field of each inbound packet and match it with the network egress address in the access control list;

[0027] When the first rule is matched, allow the incoming data packet to access the core business data server;

[0028] When the second rule is matched, allow the incoming data packet but restrict it to accessing only the underlying public data server;

[0029] For incoming packets that do not match any rules, the default discard policy is applied.

[0030] In some embodiments, only requests whose source address belongs to the whitelist address set are responded to and business data is returned, including:

[0031] Configure a source address whitelist on the business data server side;

[0032] When a business data access request is received, the source address field of the request data packet is extracted;

[0033] Compare the source address field with the network exit address in the source address whitelist;

[0034] If the source address field exists in the whitelist address set, the request will be processed normally and the corresponding business data will be returned.

[0035] If the source address does not exist in the whitelist address set, the request packet is discarded and no business data is returned.

[0036] In some embodiments, collecting device fingerprint information of a terminal device requesting access to the service network includes:

[0037] When a terminal device initiates a service network access request for the first time, it is redirected to the device fingerprint authentication page.

[0038] The script on the device fingerprint authentication page collects raw environment parameters, including hardware and software parameters.

[0039] The collected raw environmental parameters are standardized and hashed to generate a unique device feature code;

[0040] Combine and sign the device's signature code to generate the device fingerprint information.

[0041] In some embodiments, the collected raw environmental parameters are standardized and hashed to generate a unique device feature code, including:

[0042] Convert parameters with different formats and units in the original environment parameters into standard strings;

[0043] A salted hash algorithm is used to calculate multiple salted hash values ​​for a standard string. The salt value is a one-time random number issued by the authentication server.

[0044] Multiple salted hash values ​​are concatenated in a predetermined order to generate a device feature code.

[0045] In some embodiments, the system further includes:

[0046] Dynamically set an expiration threshold for fingerprint information for each device;

[0047] When the terminal device initiates an access request again, verify whether the device fingerprint information of the terminal device is within the validity period threshold.

[0048] If the validity period threshold is exceeded, the terminal device is required to re-execute the device fingerprint information collection process for verification and update.

[0049] Furthermore, if a change in a preset key item of the device hardware configuration is detected within the validity period threshold, the current device fingerprint information will be immediately invalidated and a re-verification process will be triggered.

[0050] By adopting the above technical solution, the present invention has the following beneficial effects compared with the prior art: The present invention provides a business data download control system based on device attributes. It generates a device attribute determination result by collecting device fingerprint information of terminal devices and performing trusted verification; based on the device attribute determination result, it routes access traffic to the corresponding logical network channel and assigns a unique network egress address through a traffic scheduling strategy; it configures an access control list at the gateway based on the network egress address; and it performs real-time filtering and control of access requests to the business data interface according to the access control list, responding only to requests from the whitelisted address set. The present invention achieves refined differentiation and control of data download behavior of terminal devices with different attributes, effectively improving the security level of enterprise business data when accessed by external devices, while also taking into account the normal data acquisition needs of legitimate devices. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 This is a flowchart illustrating steps S101 to S104 as described in the specific implementation method;

[0053] Figure 2 This is a flowchart illustrating steps S201 to S203 as described in the specific implementation method. Detailed Implementation

[0054] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be particularly noted that the following embodiments are for illustrative purposes only and do not limit the scope of the invention. Similarly, the following embodiments are only some, not all, embodiments of the present invention, and all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0055] Please see Figure 1 This embodiment provides a service data download control system based on device attributes, including:

[0056] S101. Collect the device fingerprint information of the terminal device requesting access to the business network, and perform a trusted verification between the device fingerprint information and the registration information in the enterprise asset database to generate a unique device attribute determination result.

[0057] S102. Based on the device attribute determination result, the access traffic of the terminal device is routed to the corresponding logical network channel through the traffic scheduling strategy, and a unique network exit address is assigned to each logical network channel.

[0058] S103. Configure an access control list at the gateway of the business access path, based on the network egress address. The access control list includes a whitelist of addresses that are allowed to perform data download operations and a non-whitelist of addresses that are prohibited from performing data download operations.

[0059] S104. Based on the access control list, perform real-time filtering and execution control on access requests flowing into the business data interface, and only respond to and return business data to requests whose source address belongs to the whitelist address set.

[0060] In step S101, the device fingerprint information is a unique identifier generated by collecting the hardware characteristics and software environment parameters of the terminal device, used to distinguish the attribute characteristics of different devices. The device fingerprint information can be collected through a client program or browser script installed on the terminal device and includes parameters that cannot be easily tampered with, such as the hardware serial number, MAC address, and operating system version. The registration information in the enterprise asset database refers to the standard device information pre-registered and filed in the enterprise IT asset management system, used as a benchmark for trusted verification. Trusted verification refers to the process of determining the trusted status of a device by comparing the consistency between the device fingerprint information and the registration information, generating a unique device attribute determination result for subsequent access control decisions.

[0061] In step S102, the device attribute determination result is used to identify the trusted attribute status of the device. The traffic scheduling strategy is a network traffic allocation rule formulated based on the device attribute determination result, implemented through routing devices or an SDN controller. Logical network channels are independent data transmission paths divided using virtual network technology; traffic from devices with different attributes is isolated and transmitted in different logical channels. A unique network egress address refers to a unique public IP address assigned to each logical network channel, used to identify the device attribute source of the traffic at the gateway.

[0062] In step S103, the gateway for the business access path is a network security device, such as a firewall or WAF device, deployed at the entry point of the enterprise's business network. The access control list is a set of access permission rules set based on network egress addresses. The whitelisted address set contains network egress addresses that are allowed to perform data download operations, while the non-whitelisted address set contains network egress addresses that are prohibited from performing data download operations. The access control list is deployed through the gateway device's policy configuration interface to implement source address-based access control.

[0063] In step S104, real-time filtering and execution control refers to the process by which the gateway device performs packet-by-packet inspection and policy matching on incoming data packets. Requests whose source address belongs to the whitelist address set refer to access requests where the source IP address of the data packet matches the network egress address in the whitelist address set. These requests are allowed to access the business data interface and obtain a data response. For requests not in the whitelist address set, the gateway will perform discard or redirection operations to ensure that business data does not flow to unauthorized devices.

[0064] This embodiment achieves fine-grained data download control based on device attributes through the synergistic effect of device fingerprint recognition, traffic logical isolation, and gateway access control. Device fingerprints provide a trusted identity identifier, logical network channels achieve traffic isolation, unique network egress addresses provide identification criteria, and access control lists execute final permission control, forming a complete security protection chain. This embodiment effectively solves the problem of traditional VPN access failing to distinguish device attributes, ensuring normal access for legitimate devices while preventing the risk of data downloads by unauthorized devices.

[0065] Please see Figure 2 In some embodiments, the device fingerprint information is reliably verified against the registration information in the enterprise asset database to generate a unique device attribute determination result, including:

[0066] S201. Extract key hardware identifiers from the device fingerprint information;

[0067] S202. Perform similarity matching calculations between the key hardware identifiers and the standard hardware identifiers pre-registered in the enterprise asset database to obtain similarity values;

[0068] S203. Determine whether the similarity value is within the range of the preset trust threshold, and generate the device attribute determination result, which includes trusted internal devices and untrusted external devices.

[0069] If the similarity value is within the preset trust threshold range, the device attribute determination result is a trustworthy internal device;

[0070] If the similarity value is not within the preset trust threshold range, the device attribute determination result is an untrusted external device.

[0071] In step S201, the key hardware identifier is a core parameter extracted from the device fingerprint information that can uniquely identify the hardware characteristics of the device, including but not limited to hardware information that cannot be easily tampered with, such as the motherboard serial number, hard drive serial number, and MAC address. These identifiers are obtained through the device fingerprint acquisition process and are used for subsequent trusted verification and comparison.

[0072] In step S202, the standard hardware identifier is the device hardware feature information pre-registered and filed in the enterprise asset database, serving as a benchmark reference for trusted verification. The similarity matching calculation uses string matching algorithms or feature vector comparison algorithms to calculate the degree of matching between the key hardware identifier and the standard hardware identifier, outputting a quantified similarity value. The similarity value can be calculated using common algorithms such as edit distance and cosine similarity, reflecting the degree of consistency between the device fingerprint and the registration information.

[0073] In step S203, the preset trust threshold is a pre-defined numerical range used to determine the trustworthiness of devices, determined based on historical verification data and security requirements. Trusted internal devices are those whose similarity values ​​fall within the preset trust threshold range, indicating that the device is an internal device authorized and managed by the enterprise. Untrusted external devices are those whose similarity values ​​do not meet the preset trust threshold requirements, indicating that the device is a personal or external device not managed by the enterprise. The generation of device attribute determination results is based on the comparison between the similarity value and the preset trust threshold, providing a basis for subsequent access control decisions.

[0074] This embodiment achieves accurate device attribute determination through the extraction of key hardware identifiers and similarity matching calculations. The preset trusted threshold can be flexibly adjusted according to the enterprise's security policy, ensuring normal access to internal devices while effectively identifying and isolating untrusted external devices. Compared to traditional simple identity authentication, this hardware feature-based trusted verification method provides more reliable device attribute identification capabilities, laying a solid foundation for subsequent differentiated access control.

[0075] In some embodiments, based on the device attribute determination result, the access traffic of the terminal device is routed to the corresponding logical network channel through a traffic scheduling strategy, and a unique network egress address is assigned to each logical network channel, including:

[0076] Based on the device attribute determination result, the traffic of the terminal device determined to be a trusted internal device is routed to the first logical network channel, and a first network exit address is assigned to the first logical network channel.

[0077] Traffic from terminal devices identified as untrusted external devices is routed to the second logical network channel, and a second network exit address is assigned to the second logical network channel.

[0078] The first network exit address is different from the second network exit address.

[0079] In this embodiment, the traffic scheduling strategy achieves logical isolation of traffic from devices with different attributes through an SDN controller or routing device. The first logical network channel is a dedicated data transmission path allocated to trusted internal devices, preferably implemented using an enterprise intranet VPN tunnel or a dedicated virtual network to ensure the security and reliability of data transmission; the second logical network channel is a restricted network path allocated to untrusted external devices, typically implemented using a DMZ zone or a restricted access network to restrict their access to core services.

[0080] The first network egress address is a unique public IP address assigned to the first logical network channel, used to identify access traffic from trusted internal devices. The second network egress address is a unique public IP address, different from the first network egress address, assigned to the second logical network channel, used to identify access traffic from untrusted external devices. The allocation of network egress addresses is achieved through Network Address Translation (NAT) technology or a dedicated egress gateway, ensuring that traffic from different logical network channels has distinguishable source address characteristics.

[0081] This embodiment drives the execution of traffic scheduling strategies based on device attribute determination results, achieving complete isolation of network traffic between trusted internal devices and untrusted external devices. The division of different logical network channels and the allocation of unique network egress addresses provide accurate identification criteria for subsequent source address-based access control. This device attribute-based traffic routing mechanism ensures normal access to business data by internal devices while effectively preventing data security risks from external devices, forming a multi-layered security protection system.

[0082] In some embodiments, an access control list based on the network egress address is configured at the gateway of the service access path, including:

[0083] Create an access control list at the gateway of the business access path. The access control list includes access control rules:

[0084] The first rule is configured as follows: When a data packet with a source address of the first network egress address is detected, access to core business data is allowed;

[0085] The second rule is configured as follows: when a data packet with a source address of the second network egress address is detected, access to basic public data is only allowed;

[0086] The access control list is deployed at the gateway as a packet filtering module to perform real-time matching and access control on all business data access requests passing through the gateway.

[0087] In this embodiment, the gateway of the business access path is used to perform security control on all data flows entering and leaving the business system. The access control list is a set of access permission rules set based on the network egress address, and is created and managed through the policy configuration interface of the gateway device. The first rule is configured to allow data packets with the source address of the first network egress address to access core business data, which includes sensitive business functions such as file download interfaces and database query interfaces. The second rule is configured to allow data packets with the source address of the second network egress address to only access basic public data, which includes non-sensitive business functions such as page browsing and information query.

[0088] The packet filtering module is the core component of the gateway device responsible for enforcing access control policies. It uses deep packet inspection technology to analyze the source address, destination address, protocol type, and other characteristics of data packets in real time. Real-time matching is the process by which the packet filtering module matches each data packet passing through the gateway against policy rules and executes corresponding access control actions based on the matching results. Access control includes operations such as allowing access, denying access, or redirecting, ensuring that devices with different attributes can only access their authorized service resources.

[0089] This embodiment achieves fine-grained access control for devices with different attributes by configuring an access control list based on the network egress address at the gateway. Trusted internal devices corresponding to the first network egress address can obtain full access to business data, while untrusted external devices corresponding to the second network egress address can only access basic public data. This source address-based access control mechanism, combined with prior device attribute determination and traffic routing, forms a complete security protection chain, ensuring both enterprise data security and accommodating the access needs of different devices.

[0090] In some embodiments, real-time filtering and execution control of access requests flowing into the business data interface are performed based on an access control list, including:

[0091] The data packet filtering module monitors incoming data packets to the business data interface in real time;

[0092] Extract the source address field of each inbound packet and match it with the network egress address in the access control list;

[0093] When the first rule is matched, allow the incoming data packet to access the core business data server;

[0094] When the second rule is matched, allow the incoming data packet but restrict it to accessing only the underlying public data server;

[0095] For incoming packets that do not match any rules, the default discard policy is applied.

[0096] In this embodiment, real-time filtering and execution control refers to the process by which the packet filtering module analyzes and processes data packets flowing into the business data interface in real time, achieving millisecond-level response speeds through deep packet inspection technology. Incoming data packets are data messages that enter the business system through the network interface, containing header information such as source address, destination address, and protocol type, as well as payload data. The source address field refers to the source IP address information in the packet's IP header, used to identify the source network exit of the data packet, serving as a key basis for access control matching.

[0097] Core business data servers refer to server clusters that store and process sensitive business data for an enterprise, including database servers, file servers, and other systems that store critical business information. Basic public data servers refer to servers that provide non-sensitive business functions, such as web servers and query interface servers, which only contain publicly available information. The default discard policy is a security measure taken to handle data packets that fail to match any access control rules, directly rejecting their access requests and logging the incident in the security log.

[0098] This embodiment achieves fine-grained access control based on network egress addresses through real-time monitoring and matching of data packet filtering modules. When a data packet's source address matches the first rule, the system allows it to access the core business data server, ensuring complete business permissions for trusted internal devices. When it matches the second rule, the system restricts access to only the basic public data server, preventing untrusted external devices from obtaining sensitive information. Data packets that do not match any rules are directly discarded, effectively preventing access requests from unknown sources. This hierarchical control mechanism, combined with the earlier device attribute determination and traffic routing, forms a complete security protection system that ensures both the confidentiality of business data and the availability of the system.

[0099] In some embodiments, only requests whose source address belongs to the whitelist address set are responded to and business data is returned, including:

[0100] Configure a source address whitelist on the business data server side;

[0101] When a business data access request is received, the source address field of the request data packet is extracted;

[0102] Compare the source address field with the network exit address in the source address whitelist;

[0103] If the source address field exists in the whitelist address set, the request will be processed normally and the corresponding business data will be returned.

[0104] If the source address does not exist in the whitelist address set, the request packet is discarded and no business data is returned.

[0105] In this embodiment, the source address whitelist refers to a set of trusted network egress addresses pre-configured on the business data server, including authenticated trusted source addresses such as the first network egress address. The whitelist address set is maintained and updated through the system management interface to ensure that only trusted traffic that has undergone device attribute determination and traffic routing processing can access the business data. The source address field of the request packet refers to the source IP address information in the packet's IP header, used to identify the source network egress of the request.

[0106] When the business data server receives an access request, it performs a precise match between the extracted source address field and the network egress address in the whitelist. If the source address verification is successful, the server executes the corresponding business logic and returns the requested business data; if the source address is not in the whitelist, the server directly terminates the request processing flow, does not return any business data information, and records a security audit log.

[0107] This embodiment provides a final line of security for business data access by implementing source address whitelist verification on the business data server side. Even if a request passes the initial gateway filtering, final identity verification is still required on the server side. This dual verification mechanism ensures that only requests from trusted network exits can obtain business data, effectively preventing unauthorized access and data leakage risks. The whitelist mechanism is implemented based on existing network programming interfaces and firewall technologies, possessing high practicality and operability, and providing reliable security guarantees.

[0108] In some embodiments, collecting device fingerprint information of a terminal device requesting access to the service network includes:

[0109] When a terminal device initiates a service network access request for the first time, it is redirected to the device fingerprint authentication page.

[0110] The script on the device fingerprint authentication page collects raw environment parameters, including hardware and software parameters.

[0111] The collected raw environmental parameters are standardized and hashed to generate a unique device feature code;

[0112] Combine and sign the device's signature code to generate the device fingerprint information.

[0113] In this embodiment, the device fingerprint authentication page is a specially designed web interface used to perform device information collection and authentication processes when a user first accesses the service network. This page uses redirection technology to guide the initial access request to the authentication process, ensuring device identification is completed before allowing service access. The original environment parameters include hardware and software parameters. Hardware parameters include physical characteristics such as CPU model, memory configuration, and storage device serial number, while software parameters include system environment characteristics such as operating system version, browser type, and installed font list.

[0114] Standardization processing refers to unifying and standardizing the format of the collected raw parameters to eliminate data inconsistencies caused by system differences. A cryptographic hash algorithm is used to perform a one-way encrypted transformation on the standardized parameters, protecting user privacy and ensuring data irreversibility. The generated device signature code serves as a unique identifier, accurately representing the comprehensive environmental characteristics of the device. A digital certificate is used to encrypt and sign the combined device signature code, ensuring the integrity and immutability of the device fingerprint information.

[0115] This embodiment provides a reliable technical foundation for device attribute determination through a standardized device fingerprint collection and processing process. The use of hash obfuscation and digital signature technologies ensures both user privacy and security while guaranteeing the accuracy of device identification. This device fingerprint generation method effectively distinguishes different terminal devices, providing precise device identification for subsequent differentiated access control, and is a key implementation method in the device identification process.

[0116] In some embodiments, the collected raw environmental parameters are standardized and hashed to generate a unique device feature code, including:

[0117] Convert parameters with different formats and units in the original environment parameters into standard strings;

[0118] A salted hash algorithm is used to calculate multiple salted hash values ​​for a standard string. The salt value is a one-time random number issued by the authentication server.

[0119] Multiple salted hash values ​​are concatenated in a predetermined order to generate a device feature code.

[0120] In this embodiment, parameters with different formats and units in the original environment parameters are converted into a standardized text representation, i.e., a standardized string, using a unified encoding rule to ensure the uniformity and comparability of subsequent processing. The salted hash algorithm is an encryption method that appends a random salt value to the original data before performing the hash operation. The salt value is a one-time random number dynamically generated and issued by the authentication server to enhance the security and collision prevention capabilities of the hash process. Salted hash calculations are performed on the standardized parameters to obtain multiple encrypted results, i.e., salted hash values, each corresponding to a specific environment parameter characteristic.

[0121] The predetermined order is a predefined rule for concatenating hash values. Preferably, the hash values ​​are ordered according to their importance and stability to ensure the consistency and repeatability of the generated device signature. The device signature is formed by concatenating multiple salted hash values ​​in a predetermined order to create a comprehensive identifier that uniquely represents the device.

[0122] This embodiment achieves secure generation of device signatures through standardized parameter processing and a salted hash algorithm. Using a one-time random number as the salt effectively prevents replay attacks and rainbow table cracking, ensuring the security and reliability of device identification. The combination and concatenation of multiple hash values ​​enhances the uniqueness and stability of the signature, maintaining accuracy even if some parameters change. This processing method provides a reliable technical foundation for device attribute determination and is a crucial link in the entire device identification system.

[0123] In some embodiments, the method further includes:

[0124] Dynamically set an expiration threshold for fingerprint information for each device;

[0125] When the terminal device initiates an access request again, verify whether the device fingerprint information of the terminal device is within the validity period threshold.

[0126] If the validity period threshold is exceeded, the terminal device is required to re-execute the device fingerprint information collection process for verification and update.

[0127] Furthermore, if a change in a preset key item of the device hardware configuration is detected within the validity period threshold, the current device fingerprint information will be immediately invalidated and a re-verification process will be triggered.

[0128] In this embodiment, the validity period threshold refers to the time validity limit set for each device fingerprint information. Preferably, it is dynamically set according to the device's security level and usage frequency to ensure the timeliness and security of device authentication information. When the terminal device initiates an access request, it checks whether the creation time of the device fingerprint information is still within the validity period. This is an important step in maintaining continuous trusted access.

[0129] Preset key item changes refer to changes in core elements of the device's hardware configuration that affect device identification, such as replacement of critical hardware like the motherboard or hard drive, or alteration of major network identifiers. Re-executing the device fingerprint information collection process requires the device to complete the entire fingerprint authentication process again, including steps such as environmental parameter collection, standardization processing, and signature generation. Upon detecting a key change, the current device fingerprint information is proactively invalidated, and a forced re-verification is initiated to ensure the authenticity of the device's identity.

[0130] This embodiment achieves continuous and reliable verification of device fingerprint information through dynamic validity period management and a critical change detection mechanism. The validity period threshold prevents security risks that may arise from long-term unupdated device information, while critical change detection ensures timely re-authentication when device hardware changes. This dual-protection mechanism effectively improves the security and reliability of the entire device authentication system while maintaining user experience, providing more accurate and timely device identity evidence for subsequent access control.

[0131] In this embodiment, the device attribute-based business data download control system coordinates the collaborative operation of multiple functional modules to complete the entire process from device identification and attribute determination to access control. The system is suitable for enterprise network environments, especially business data access management scenarios under a zero-trust security architecture. It can effectively distinguish between company devices and personal devices and implement differentiated data download permission control.

[0132] The system acquires the hardware and software parameters of terminal devices through a device fingerprinting module, and generates standardized device signature codes via a data processing module. The attribute determination module compares these signature codes with the enterprise asset database to determine the device attribute type. The traffic scheduling module implements differentiated network path allocation based on device attributes, directing access traffic from devices with different attributes to their corresponding network exits. The policy enforcement module implements fine-grained access control policies at the gateway level based on source IP addresses, ultimately achieving differentiated management of data download permissions for company devices and personal devices.

[0133] This system, through its modular architecture, organically integrates device attribute identification, fine-grained traffic scheduling, and access policy enforcement, forming a complete closed-loop technical solution. During system implementation, the modules work collaboratively, using device fingerprint information as the basic identifier, attribute determination results as the control basis, and traffic scheduling to achieve path separation. Ultimately, precise access control is achieved at the application gateway level. This systematic integration makes device attribute identification and access control policies an organic whole, ensuring not only the security of enterprise data and the accuracy of access control but also improving system maintainability and scalability, providing reliable technical support for data security management in BYOD scenarios.

[0134] By adopting the above technical solutions, this invention differs from existing technologies and has the following beneficial effects: It achieves accurate device attribute differentiation through device fingerprint information collection and trusted verification. Based on the determination results, access traffic from devices with different attributes is routed to corresponding logical network channels and assigned unique network egress addresses. An access control list based on the network egress address is configured at the gateway, ultimately achieving refined filtering and control of business data access requests. This effectively solves the technical problem of traditional VPN access control, which relies solely on user authentication and cannot differentiate device attributes, forming a complete security protection chain from device identification and traffic scheduling to access control. Through the association mapping between device attribute determination and network egress addresses, it ensures the normal access needs of trusted internal devices for business data while effectively preventing data leakage risks from untrusted external devices. It safeguards enterprise data security while also considering the differentiated access experience of devices with different attributes, significantly improving the level of data security management in BYOD scenarios.

[0135] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0136] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods of various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0137] The above description is only a part of the embodiments of the present invention and does not limit the scope of protection of the present invention. Any equivalent device or equivalent process transformation made based on the content of the present invention specification and drawings, or direct or indirect application in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A device attribute-based service data download control system characterized by comprising: The application comprises: Collecting device fingerprint information of terminal equipment accessing the service network, and performing trusted verification of the device fingerprint information and registered information in the enterprise asset database to generate a unique device attribute determination result; Based on the device attribute determination result, routing access traffic of the terminal equipment to a corresponding logical network channel through a traffic scheduling strategy, and assigning a unique network exit address to each logical network channel; Configuring an access control list at a gateway of a service access path, with the network exit address as the basis for discrimination, the access control list including a whitelist address set allowing data download operation and a non-whitelist address set prohibiting data download operation; According to the access control list, filtering and performing control on access requests flowing into a service data interface in real time, and responding to and returning service data only to requests with source addresses belonging to the whitelist address set; Based on the device attribute determination result, routing access traffic of the terminal equipment to a corresponding logical network channel through a traffic scheduling strategy, and assigning a unique network exit address to each logical network channel, comprising: Routing traffic of terminal equipment determined as trusted internal equipment to a first logical network channel according to the device attribute determination result, and assigning a first network exit address to the first logical network channel; Routing traffic of terminal equipment determined as untrusted external equipment to a second logical network channel, and assigning a second network exit address to the second logical network channel; The first network exit address is different from the second network exit address; Configuring an access control list at a gateway of a service access path, with the network exit address as the basis for discrimination, comprising: Creating an access control list at a gateway of a service access path, the access control list including access control rules: The first rule is configured to allow access to core service data when a data packet with the first network exit address as the source address is detected; The second rule is configured to allow access to basic public data only when a data packet with the second network exit address as the source address is detected; Deploying the access control list to a data packet filtering module at the gateway for real-time matching and access control of all service data access requests passing through the gateway.

2. The device attribute-based service data download control system according to claim 1, wherein Performing trusted verification of the device fingerprint information and registered information in the enterprise asset database to generate a unique device attribute determination result, comprising: Extracting a key hardware identifier from the device fingerprint information; Performing similarity matching calculation of the key hardware identifier and standard hardware identifiers pre-registered in the enterprise asset database to obtain a similarity value; Determining whether the similarity value is within a preset trusted threshold range, and generating a device attribute determination result, the device attribute determination result including trusted internal equipment and untrusted external equipment; If the similarity value is within the preset trusted threshold range, the device attribute determination result is trusted internal equipment; If the similarity value is not within the preset trusted threshold range, the device attribute determination result is untrusted external equipment.

3. The device attribute-based service data download control system according to claim 1, wherein According to the access control list, real-time filtering and performing control on the access request of the inflow service data interface, comprising: The data packet filtering module real-time monitors the inflow data packet of the service data interface; Extracting the source address field of each inflow data packet, and matching it with the network exit address in the access control list; When the first rule is matched, the inflow data packet is released and allowed to access the core service data server; When the second rule is matched, the inflow data packet is released but limited to access the basic public data server only; For the inflow data packet that does not match any rule, the default discard strategy is executed.

4. The device attribute-based service data download control system according to claim 1, characterized by, Only the request response and business data return of the source address belonging to the whitelist address set, comprising: Configuring the source address whitelist on the service data server side; When receiving the service data access request, extracting the source address field of the request data packet; Comparing the source address field with the network exit address in the source address whitelist; If the source address field exists in the whitelist address set, normally processing the request and returning the corresponding business data; If the source address does not exist in the whitelist address set, discarding the request data packet and not returning any business data.

5. The device attribute-based service data download control system according to claim 1, wherein, Collecting the device fingerprint information of the terminal device requesting to access the service network, comprising: When the terminal device initiates the service network access request for the first time, redirecting it to the device fingerprint authentication page; Running the script in the device fingerprint authentication page to collect the original environment parameters, including hardware parameters and software parameters; Standardizing and hash obfuscating the collected original environment parameters to generate a unique device feature code; Combining and signing the device feature code to generate the device fingerprint information.

6. The device attribute-based service data download control system according to claim 5, wherein Standardizing and hash obfuscating the collected original environment parameters to generate a unique device feature code, comprising: Uniformly converting the parameters of different formats and units in the original environment parameters into standard strings; Using a salted hash algorithm to calculate the standard strings to obtain a plurality of salted hash values, and the salt value is a one-time random number issued by the authentication server; Splicing the plurality of salted hash values in a predetermined order to generate the device feature code.

7. The device attribute-based service data download control system according to claim 1, wherein The system further comprises: Dynamically setting an effective period threshold for each device fingerprint information; When the terminal device initiates the access request again, verifying whether the device fingerprint information of the terminal device is within the range of the effective period threshold; If the effective period threshold is exceeded, requiring the terminal device to re-execute the device fingerprint information collection process for verification update; And, if the device hardware configuration is changed in a preset key item within the range of the effective period threshold, the current device fingerprint information is invalidated immediately and the re-verification process is triggered.

Images