Equipment access control method and device, electronic equipment and computer program product

Abstract

The invention discloses an equipment access control method and device, electronic equipment and a computer program product. Relates to the field of financial science and technology, and the method comprises the steps: obtaining the equipment information of a to-be-identified device, obtaining M pieces of equipment information, and judging whether the to-be-identified device is an accessible device based on the M pieces of equipment information; under the condition that the to-be-identified equipment is accessible equipment, generating a network access request based on the M pieces of equipment information, sending the network access request to an equipment information server, and verifying the to-be-identified equipment based on the network access request and returning a verification result by the equipment information server; and under the condition that the verification result indicates that the to-be-identified equipment is allowed to access the network, extracting a network port from the network access request, and controlling the to-be-identified equipment to perform network access operation based on the network port. Through the network access verification method and device, the technical problems of low verification efficiency and low accuracy when network access verification is carried out on the equipment in related technologies are solved.

Description

Technical Field

[0001] This application relates to the field of financial technology, and more specifically, to a method, apparatus, electronic device, and computer program product for controlling device access. Background Technology

[0002] In the field of network management, the rational utilization of network resources is crucial to ensuring the healthy and stable operation of production, development, and testing environments. Currently, the conventional practice for device network access control relies on system registration or text registration. This means that network administrators must manually open or close specific network ports based on pre-registered device information to enable or disable devices from the enterprise network.

[0003] However, the above methods have certain limitations and risks: First, the lack of effective verification of the source and compliance of equipment can easily lead to unapproved devices accessing the network, thereby increasing network risks and security vulnerabilities. For situations such as the entry of new equipment or the departure or relocation of existing equipment, the above technical solutions often cannot achieve real-time adjustment of network permissions. Manual updates are not only inefficient but also prone to untimely and inaccurate allocation of network resources, affecting business continuity and security.

[0004] Furthermore, the lack of intelligent device information judgment by network administrators when handling device access not only increases the management burden but also limits the ability to respond quickly to network access decisions.

[0005] There is currently no effective solution to the technical problems of low verification efficiency and low accuracy in network access verification of devices in related technologies. Summary of the Invention

[0006] The main objective of this application is to provide a control method, device, electronic equipment, and computer program product for device access control, so as to solve the technical problems of low verification efficiency and low accuracy in the network access verification of devices in related technologies.

[0007] To achieve the above objectives, according to one aspect of this application, a device access control method is provided. The method includes: acquiring device information of a device to be identified, obtaining M pieces of device information; determining whether the device to be identified is an accessible device based on the M pieces of device information, wherein the device information refers to the hardware and appearance information of the device to be identified, and an accessible device refers to a device that is allowed to access the network of a financial institution, and M is a positive integer; if the device to be identified is an accessible device, generating a network access request based on the M pieces of device information and sending the network access request to a device information server, wherein the device information server verifies the device to be identified based on the network access request and returns a verification result; if the verification result indicates that the device to be identified is allowed to access the network, extracting a network port from the network access request and controlling the device to be identified to perform network access operations based on the network port.

[0008] Furthermore, before determining whether the device to be identified is an accessible device based on the M device information, the method further includes: obtaining the identification code of the device to be identified from the M device information, and determining whether the identification code matches the first device information stored in the device database, wherein the first device information includes the identification codes of multiple devices that have accessed the network; if the identification code does not match the first device information, performing the step of determining whether the device to be identified is an accessible device based on the M device information; if the identification code matches the first device information, ending the step of determining whether the device to be identified is an accessible device based on the M device information.

[0009] Furthermore, obtaining device information of the device to be identified includes: determining whether the device to be identified has a control plugin installed, wherein the control plugin is used to obtain device information; if the device to be identified does not have a control plugin installed, the step of obtaining device information of the device to be identified ends; if the device to be identified has a control plugin installed, the control plugin is controlled to obtain device information.

[0010] Furthermore, determining whether the device to be identified is an accessible device based on M pieces of device information includes: if the appearance information indicates that the device to be identified is a preset type of device, determining whether the hardware information in the M pieces of device information matches the second device information in the device database, wherein the second device information includes hardware information of multiple devices that are allowed to access the network; if the hardware information matches the second device information, the device to be identified is determined to be an accessible device.

[0011] Furthermore, controlling the device to be identified to access the network based on the network port includes: obtaining the application time period from the network access request and obtaining the operation time period for the device to be identified to access the network; if the operation time period is within the application time period, opening the network based on the network port and generating a first prompt message, wherein the first prompt message is used to indicate that the device to be identified is allowed to access the network; if the operation time period is not within the application time period, generating a second prompt message, wherein the second prompt message is used to prompt the device to be identified to submit a delayed access request, the delayed access request being used to request delayed access to the network.

[0012] Furthermore, before controlling the device to be identified to access the network based on the network port, the method further includes: determining whether there is a device change in the device to be identified based on M device information; if there is a device change in the device to be identified, obtaining the device information of N hardware devices that have changed, resulting in N device information, where N is a positive integer; if the N device information matches the second device information in the device database, executing the step of controlling the device to be identified to access the network based on the network port; if the N device information does not match the second device information, generating alarm information and storing the device to be identified in the abnormal device list in the device database.

[0013] Furthermore, generating a network access request based on M device information includes: receiving a network access request sent by the device to be identified; obtaining the port number to be opened from the M device information based on the network access request; and generating a network access request based on the port number to be opened.

[0014] To achieve the above objectives, according to another aspect of this application, a device access control apparatus is provided. The apparatus includes: a first acquisition unit, configured to acquire device information of a device to be identified, obtaining M pieces of device information, and determining whether the device to be identified is an accessible device based on the M pieces of device information, wherein the device information refers to the hardware and appearance information of the device to be identified, and an accessible device refers to a device that is allowed to access the network of a financial institution, and M is a positive integer; a first generation unit, configured to generate a network access request based on the M pieces of device information if the device to be identified is an accessible device, and send the network access request to a device information server, wherein the device information server verifies the device to be identified based on the network access request and returns a verification result; and an extraction unit, configured to extract a network port from the network access request if the verification result indicates that the device to be identified is allowed to access the network, and control the device to be identified to perform network access operations based on the network port.

[0015] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored executable program, wherein, when the executable program is running, it controls the device where the computer-readable storage medium is located to perform any of the above-described device access control methods.

[0016] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory storing an executable program, and the processor for running the program, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any of the above-described device access control methods.

[0017] According to another aspect of the present invention, a computer program product is also provided, the computer program product including a computer program, wherein when the computer program is executed by a processor, it implements any of the above-described device access control methods.

[0018] In this embodiment, a device access control method is adopted. Device information of the device to be identified is obtained, resulting in M ​​pieces of device information. Based on these M pieces of information, it is determined whether the device to be identified is an accessible device. Here, device information refers to the hardware and appearance information of the device to be identified, and an accessible device is a device that is allowed to access the financial institution's network. M is a positive integer. If the device to be identified is an accessible device, a network access request is generated based on the M pieces of device information and sent to the device information server. The device information server verifies the device to be identified based on the network access request and returns a verification result. If the verification result indicates that access is permitted... When a device to be identified is allowed to access the network, the network port is extracted from the network access request, and the device to be identified is controlled to perform network access operations based on the network port. This solves the technical problems of low verification efficiency and low accuracy in the network access verification of devices in related technologies. By using device information to determine whether the device to be identified is an accessible device, and when the device to be identified is an accessible device and is allowed to access the network, the network port is extracted from the network access request generated based on the device information, and the device to be identified is controlled to perform network access operations based on the network port. This achieves the technical effect of improving the verification efficiency and accuracy of network access verification of devices. Attached Figure Description

[0019] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0020] Figure 1 This is a hardware structure block diagram of a computer terminal (or mobile device) used to implement a control method for device access control;

[0021] Figure 2 This is a flowchart of a device access control method provided according to an embodiment of this application;

[0022] Figure 3 This is a flowchart of an optional device access control method provided according to an embodiment of this application;

[0023] Figure 4 This is a schematic diagram of a device access control device provided according to an embodiment of this application;

[0024] Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0025] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0027] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties. For example, this system has interfaces with relevant users or organizations to provide users with corresponding operation data for them to choose to agree to or refuse automated decision-making results. Before obtaining relevant information, a request for obtaining the information needs to be sent to the aforementioned user or organization through the interface, and the relevant information is obtained after receiving consent from the aforementioned user or organization; if the user chooses to refuse, the expert decision-making process is initiated. Users can view the purpose of data use in real time through authorization decoding and have the right to withdraw authorization or delete data at any time. After the authorization is withdrawn, the system will terminate the relevant data processing within 24 hours.

[0028] It should be noted that the information collected in this application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize use or refuse use.

[0029] Example 1

[0030] According to an embodiment of this application, a method embodiment for controlling device access is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0031] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 This is a hardware structure block diagram of a computer terminal (or mobile device) used to implement a control method for device access control, such as... Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1The processor 102 (which may include, but is not limited to, a microprocessor MCU (Microcontroller Unit) or a programmable gate array (FPGA)) is shown as 102a, 102b, ..., 102n. It also includes a memory 104 for storing data and a transmission device 106 for communication functions. In addition, it may include: a display, an input / output interface, a Universal Serial Bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a keyboard, a cursor control device, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0032] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0033] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the device access control method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned device access control method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0034] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network interface controller (NIC) and a network interface, which can be connected to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a radio frequency (RF) module, used for wireless communication with the Internet.

[0035] The display can be, for example, a touchscreen liquid crystal display (LCD), which allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0036] Under the aforementioned operating environment, this application provides the following: Figure 2 The device access control method shown is illustrated. Figure 2 This is a flowchart of a device access control method provided according to an embodiment of this application, such as... Figure 2 As shown, the method includes the following steps:

[0037] Step S201: Obtain device information of the device to be identified, resulting in M ​​pieces of device information. Based on the M pieces of device information, determine whether the device to be identified is an accessible device. Here, device information refers to the hardware information and appearance information of the device to be identified, and accessible device refers to a device that is allowed to access the network of a financial institution. M is a positive integer.

[0038] Specifically, the device to be identified refers to any device that needs to access the financial institution's network, which may include personal mobile devices, servers, etc. To ensure the security of the financial institution's network, the device needs to be verified before accessing the network. At this time, the device information of the device to be identified can be obtained and verified. The device information includes the hardware attributes and appearance characteristics of the device to be identified, which may include the hardware serial number, device model, hardware version information, MAC (Media Access Control Address, also known as physical address) address, and a photograph or description of the device. This information constitutes the unique identifier of the device and is used for subsequent comparison and verification.

[0039] After obtaining information on multiple devices, it can be determined whether the device to be identified meets the network access requirements of the financial institution. At this point, by comparing the information of the device to be identified with a preset list of accessible devices, it can be determined whether the device is qualified, and thus decide whether to allow it to access the financial institution's network resources.

[0040] Step S202: If the device to be identified is an accessible device, a network access request is generated based on M device information, and the network access request is sent to the device information server. The device information server verifies the device to be identified based on the network access request and returns the verification result.

[0041] Specifically, if the device information of the device to be identified completely matches the records of accessible devices in the database, the device is considered an "accessible device" and the corresponding network port can be automatically opened; otherwise, if the information does not match, it indicates that the device is a potential abnormal access attempt, and it is necessary to block the device access, trigger alarms, and other operations.

[0042] When the device to be identified is an accessible device, a formal network access request can be generated based on the device information. This request can contain all the key information of the device and can request network access rights from the device information server. The device information server is a server used to store and manage all network access device information. This server can receive the network access requests and perform detailed comparison and verification based on the stored device database.

[0043] After receiving a network access request, the device information server can check whether the device information in the request is completely consistent with the accessible device information stored in the database. Once the verification process is complete, the server can return a verification result, indicating whether the device has truly been approved for network access. This secondary verification of device information further confirms the device's identity, improving both the accuracy of network access and security.

[0044] Step S203: If the verification result indicates that the device to be identified is allowed to access the network, extract the network port from the network access request and control the device to be identified to perform network access operations based on the network port.

[0045] Specifically, if the device information server verifies that the device information matches completely, it can return a successful verification result, allowing the device to access the network; otherwise, it will return a failed verification result, preventing the abnormal device from accessing the network, and triggering an alarm to notify network administrators to take appropriate measures.

[0046] When the verification result indicates that the device to be identified is allowed to access the network, since the network access request contains information about the specific network ports that the device to be identified requests to access, this information enables the device to connect to the network and use specific services. At this time, the network ports can be extracted from the network access request, and the device to be identified can be controlled to open the specified network ports, thereby allowing the device to be identified to access network resources and services through these ports, realizing network access operations, precisely controlling the device's network access permissions, ensuring that it can only access authorized services and resources, and effectively preventing network intrusion by abnormal devices.

[0047] The device access control method provided in this application embodiment obtains device information of the device to be identified, resulting in M ​​pieces of device information. Based on the M pieces of device information, it determines whether the device to be identified is an accessible device. Here, device information refers to the hardware and appearance information of the device to be identified, and an accessible device refers to a device that is allowed to access the financial institution's network. M is a positive integer. If the device to be identified is an accessible device, a network access request is generated based on the M pieces of device information and sent to a device information server. The device information server verifies the device to be identified based on the network access request and returns a verification result. If the verification result indicates that access is permitted... When the device to be identified is connected to the network, the network port is extracted from the network access request, and the device to be identified is controlled to perform network access operations based on the network port. This solves the technical problems of low verification efficiency and low accuracy in the network access verification of devices in related technologies. By using device information to determine whether the device to be identified is an accessible device, and if the device to be identified is an accessible device and is allowed to access the network, the network port is extracted from the network access request generated based on the device information, and the device to be identified is controlled to perform network access operations based on the network port. This achieves the technical effect of improving the verification efficiency and accuracy when performing network access verification of devices.

[0048] Optionally, in the device access control method provided in this application embodiment, before determining whether the device to be identified is an accessible device based on M device information, the method further includes: obtaining the identification code of the device to be identified from the M device information, and determining whether the identification code matches the first device information stored in the device database, wherein the first device information includes the identification codes of multiple devices that have accessed the network; if the identification code does not match the first device information, performing the step of determining whether the device to be identified is an accessible device based on the M device information; if the identification code matches the first device information, ending the step of determining whether the device to be identified is an accessible device based on the M device information.

[0049] Specifically, to further optimize the device network access control process, a rapid screening of devices to be identified is performed before a comprehensive assessment of device information. Since each device has a unique identifier that integrates part or all of the device's serial number, MAC address, and other key hardware information, the unique identification code of the device to be identified can be obtained first, and then the device's identity can be quickly identified based on this identification code.

[0050] When using identification codes for identity verification, the system first retrieves device information from the device database that has successfully accessed the network within a historical time period, obtaining the first device information. Then, the identification code is compared with the identification code in the first device information to check for a match, thereby determining whether the device has previously accessed the network. If a match is found in the first device information, it indicates that the device has already been identified and verified, and subsequent detailed information comparisons can be skipped, saving time and computing resources, avoiding repeated verification of known devices, reducing the server load, and ensuring smooth and rapid network management.

[0051] When the identification code does not match the first device information, it indicates that the device is not the network access device it was before. At this time, a more detailed device information comparison process is required. That is, based on complete device information, including hardware serial number, MAC address, device appearance photo, etc., it is determined whether the device meets the conditions for access. This ensures that new devices or devices with slightly changed information will not be misjudged as abnormal devices, thus ensuring network security and availability.

[0052] This embodiment verifies devices based on identification codes, ensuring accurate identification of new devices or devices with changed information, preventing any risk of omission or misjudgment, enhancing system robustness, greatly improving user experience while ensuring network security, reducing the waiting time that connected devices may encounter during the access process, and improving the efficiency of network access control.

[0053] Optionally, in the device access control method provided in the embodiments of this application, obtaining device information of the device to be identified includes: determining whether the device to be identified has a control plug-in installed, wherein the control plug-in is used to obtain device information; if the device to be identified does not have a control plug-in installed, ending the step of obtaining device information of the device to be identified; and if the device to be identified has a control plug-in installed, controlling the control plug-in to obtain device information.

[0054] Specifically, in order to ensure the integrity of the device information of the device to be identified, it is first necessary to determine whether the device to be identified has a control plug-in installed. The control plug-in is a software component installed on the device to be identified, which is used to collect and report key information of the device, such as processor serial number, memory serial number, graphics card serial number, motherboard serial number, etc. If the control plug-in is not installed on the device, the device information cannot be reliably obtained, and thus effective network access control cannot be performed.

[0055] If the device to be identified does not have a control plugin installed, the attempt to obtain detailed device information will cease, and subsequent steps will be terminated. This avoids blindly collecting device information in the absence of a control plugin, effectively preventing unverified devices from accessing the network and enhancing overall network security. If the device to be identified has a control plugin installed, the plugin can be activated to collect hardware and appearance information. This not only reduces the need for manual intervention but also ensures the authenticity and integrity of the information, providing solid data support for the device's network access.

[0056] This embodiment verifies whether the device to be identified has a control plugin installed, ensuring the effectiveness and reliability of network access control. It effectively blocks devices without the plugin from entering the network, thus avoiding the risk of inaccurate information or malicious device access. For devices with the control plugin installed, it can efficiently and accurately obtain their device information, providing a crucial data foundation for subsequent network port opening and network access permission determination.

[0057] Optionally, in the device access control method provided in the embodiments of this application, determining whether the device to be identified is an accessible device based on M pieces of device information includes: if the appearance information indicates that the device to be identified is a preset type of device, determining whether the hardware information in the M pieces of device information matches the second device information in the device database, wherein the second device information includes multiple pieces of hardware information of devices that are allowed to access the network; if the hardware information matches the second device information, determining the device to be identified as an accessible device.

[0058] Specifically, when determining whether a device to be identified is an accessible device, the accuracy and security of network access control can be ensured through dual verification of the device's appearance and hardware information. First, the appearance information of the device to be identified can be checked to preliminarily determine whether it belongs to a preset type of legitimate device. If the appearance information indicates that the device belongs to a preset type, the hardware information in the device information can then be verified. The appearance information can include descriptions of the device's physical characteristics, such as photos and brand logos, which can intuitively identify the device's type and appearance. Preset type devices refer to the categories of devices allowed to access the network, such as server models or mobile devices of a specified brand. Verification of appearance information can quickly eliminate devices that clearly do not meet the preset standards, thereby accelerating the access speed of legitimate devices and reducing the risk of access by abnormal devices.

[0059] When verifying hardware information in device information, it can be determined whether the hardware information matches the second device information in the device database. The second device information refers to the collection of hardware information representing devices authorized to access the network, stored in the device database, and includes hardware details of all compliant devices of the financial institution. By comparing the hardware information of the device to be identified with the second device information in the database, the legitimacy of the device is further verified. Only when the hardware information matches completely can the device's network access permission be granted.

[0060] When the hardware information matches the second device information, it indicates that the device meets the preset access criteria in terms of both appearance and hardware. At this time, the device to be identified can be determined as an accessible device, thereby ensuring the healthy operation of the network environment and data security.

[0061] This embodiment effectively filters access attempts from non-compliant devices through dual verification of appearance and hardware information, ensuring consistency between the internal and external devices and effectively preventing abnormal access after hardware tampering or replacement. This not only significantly improves the efficiency of device access control but also significantly enhances network security.

[0062] Optionally, in the device access control method provided in this application embodiment, controlling the device to be identified to access the network based on the network port includes: obtaining the application time period from the network access request and obtaining the operation time period for the device to be identified to access the network; if the operation time period is within the range of the application time period, opening the network based on the network port and generating a first prompt message, wherein the first prompt message is used to indicate that the device to be identified is allowed to access the network; if the operation time period is not within the range of the application time period, generating a second prompt message, wherein the second prompt message is used to prompt the device to be identified to submit a delayed access request, and the delayed access request is used to request delayed access to the network.

[0063] Specifically, to further refine network access management and ensure the rational use and security of network resources, it is necessary to control the time dimension of the devices to be identified. Firstly, the requested time period can be obtained from the network access request. This time period is the time range specified by the device when submitting the request, i.e., the period during which the device hopes to obtain network access permissions. For example, some devices only need network access during working hours, or specific project devices have network needs during specific time periods. By clearly defining the requested time period, network access can be planned and controlled according to the time dimension, avoiding unplanned network occupation and ensuring the on-demand allocation of network resources, thus improving network utilization efficiency.

[0064] Simultaneously, it's necessary to obtain the actual time period during which the device to be identified intends to access the network, as well as the operation time period when requesting network access. These two time periods are then compared. The operation time period reflects the device's actual usage needs, helping the system dynamically adjust network resource allocation to ensure a close match between network access and actual demand, avoiding resource waste. When the operation time period falls within the requested time period, the network can be opened based on the network port, allowing the device to access the network. A first message is generated, including confirmation of successful network access, the valid access time period, and other important information. This ensures the device user understands the status of their network access permissions, enhances the transparency of network management, and improves user trust and satisfaction. By opening the network port, devices can use network resources normally within a predetermined time, satisfying business needs while ensuring an orderly and controllable network environment.

[0065] If the operation period is outside the scope of the applied time period, that is, when the device attempts to access the network within an unapproved time period, a second prompt message is generated to remind the device user that the current network access permission has expired or is outside the scope of the applied time period, and that an extension request needs to be submitted. After the request is approved, the user can continue to use the network through the network port, thereby ensuring the compliance and flexibility of network resource usage.

[0066] This embodiment detects the time dimension of the device to be identified, enabling more flexible and intelligent management of network resource access permissions. This can effectively prevent resource abuse and ensure network stability and security during peak periods.

[0067] Optionally, in the device access control method provided in this application embodiment, before controlling the device to be identified to access the network based on the network port, the method further includes: determining whether the device to be identified has undergone device changes based on M pieces of device information; if the device to be identified has undergone device changes, obtaining device information of N pieces of hardware that have undergone changes, resulting in N pieces of device information, where N is a positive integer; if the N pieces of device information match the second piece of device information in the device database, executing the step of controlling the device to be identified to access the network based on the network port; if the N pieces of device information do not match the second piece of device information, generating alarm information and storing the device to be identified in the abnormal device list in the device database.

[0068] Specifically, in order to further monitor the device to be identified and ensure the security and stability of the network environment, since the device information includes a complete set of device data, such as various hardware serial numbers, MAC addresses and other unique identification information, when the hardware in the device to be identified is replaced, the corresponding device information page will change. At this time, the device information can be used to determine whether there has been a device change, avoiding security vulnerabilities caused by abnormal changes to the device hardware. Here, device change refers to any modification at the hardware level, such as replacing the processor, upgrading the memory, adding or replacing the network card, etc.

[0069] When a device to be identified undergoes a change, it's necessary to focus on the specific hardware components that have been changed. This involves obtaining the device information of the changed hardware, such as the serial numbers and MAC addresses of all changed hardware components. This device information is then matched against second-level device information in the device database. The second-level device information refers to a set of hardware information stored in the database representing devices authorized to access the network, including details of previously verified hardware. If the changed hardware information matches the second-level device information in the database, it indicates that the device change has not affected its network access eligibility. In this case, network access control procedures can continue, including network port-based access operations, ensuring network security.

[0070] Conversely, if the device information does not match the second device information, it indicates that the device change involves the access of abnormal hardware or unexpected hardware replacement. In this case, an alarm message is generated to indicate that staff review is required, and the device to be identified is stored in the list of abnormal devices in the device database. This helps to track and manage these devices, ensures that their network access permissions are strictly reviewed and controlled, prevents unauthorized devices from entering the network, and enhances network security protection.

[0071] This embodiment detects and evaluates hardware changes to devices and makes corresponding network access decisions based on the specific circumstances of the changes, ensuring business continuity and user experience, and effectively balancing the relationship between network flexibility and security.

[0072] Optionally, in the device access control method provided in the embodiments of this application, generating a network access request based on M device information includes: receiving a network access request sent by a device to be identified; obtaining a port number to be opened from the M device information based on the network access request; and generating a network access request based on the port number to be opened.

[0073] Specifically, to generate a network access request for verification, when the device to be identified attempts to access the financial institution's network, it also needs to receive a network access request indicating the request for network access permission. Then, the device information in the request is parsed to extract the port number to be activated. This port number refers to the port number of the network connection required to activate a specific network service or application. Finally, a network access request is generated based on the port number to be activated and sent to the device information server for verification.

[0074] This embodiment obtains the port number to be opened based on specific business needs and security policies, and then generates a network access request based on the port number. This allows for targeted control of the opening and closing of network ports, avoiding unnecessary network resource consumption, enhancing network security and controllability, and improving the quality of network services and user experience.

[0075] This application also provides a device access control method. Figure 3 This is a flowchart of an optional device access control method provided according to an embodiment of this application, such as... Figure 3 As shown, the method includes:

[0076] To ensure the security of financial institutions' networks, security verification of devices is required before accessing the network. This involves determining whether the device to be identified has security control software installed. Only when the device has security control software installed can it perform network access operations. In this case, the security control software can send device information to the device database deployed on the device information server. If the device to be identified does not have security control software installed, the security control software management terminal will detect the device.

[0077] Furthermore, after obtaining the device information, it can be determined whether the device information matches the registration information (stored in the device database), that is, whether the device to be identified is an accessible device based on the access device information. If the device information matches the registration information, the device to be identified needs to input the port number to be opened on the security control software, generate and submit a network access request. After the device information server verifies and approves it, the corresponding network port is opened (i.e., network permission is granted). At this time, the device to be identified can perform network access operations based on the network port. If the device information does not match the registration information, an alarm message is sent to the security control software management terminal deployed on the device information server. The security control software management terminal then detects the device to be identified, that is, it confirms whether the device to be identified can access the network. If it can access the network, the device information is registered, and a network access request is generated and submitted. After the device information server verifies and approves it, the corresponding network port is opened (i.e., network permission is granted). At this time, the device to be identified can perform network access operations based on the network port. If it cannot access the network, an alarm message is triggered, and abnormal data is recorded in the corresponding log in the device database, and network access is denied.

[0078] This embodiment uses device information to determine whether the device to be identified is an accessible device. If the device to be identified is an accessible device and access to the network is permitted, the network port is extracted from the network access request generated based on the device information. The device to be identified is then controlled to perform network access operations based on the network port, thereby achieving the technical effect of improving the verification efficiency and accuracy when verifying network access for devices.

[0079] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0080] Example 2

[0081] This application also provides a device access control device. It should be noted that the device access control device of this application can be used to execute the device access control method provided in this application. The device access control device provided in this application is described below.

[0082] According to an embodiment of this application, an apparatus for implementing the above-described device access control method is also provided. Figure 4 This is a schematic diagram of a device access control device provided according to an embodiment of this application, such as... Figure 4 As shown, the device includes: a first acquisition unit 40, a first generation unit 41, and an extraction unit 42.

[0083] The first acquisition unit 40 is used to acquire device information of the device to be identified, obtain M pieces of device information, and determine whether the device to be identified is an accessible device based on the M pieces of device information. Here, device information refers to the hardware information and appearance information of the device to be identified, and accessible device refers to a device that is allowed to access the network of a financial institution. M is a positive integer.

[0084] The first generation unit 41 is used to generate a network access request based on M device information when the device to be identified is an accessible device, and send the network access request to the device information server. The device information server verifies the device to be identified based on the network access request and returns the verification result.

[0085] Extraction unit 42 is used to extract the network port from the network access request when the verification result indicates that the device to be identified is allowed to access the network, and to control the device to be identified to perform network access operations based on the network port.

[0086] The device access control device provided in this application embodiment acquires device information of the device to be identified through a first acquisition unit 40, obtaining M pieces of device information. Based on the M pieces of device information, it determines whether the device to be identified is an accessible device. Here, device information refers to the hardware and appearance information of the device to be identified, and an accessible device refers to a device that is allowed to access the network of a financial institution. M is a positive integer. If the device to be identified is an accessible device, the first generation unit 41 generates a network access request based on the M pieces of device information and sends the network access request to a device information server. The device information server verifies the device to be identified based on the network access request and returns the verification result. The extraction unit... 42. When the verification result indicates that the device to be identified is allowed to access the network, the network port is extracted from the network access request, and the device to be identified is controlled to perform network access operations based on the network port. This solves the technical problems of low verification efficiency and low accuracy in the network access verification of devices in related technologies. By using device information to determine whether the device to be identified is an accessible device, and when the device to be identified is an accessible device and is allowed to access the network, the network port is extracted from the network access request generated based on the device information, and the device to be identified is controlled to perform network access operations based on the network port. This achieves the technical effect of improving the verification efficiency and accuracy when performing network access verification of devices.

[0087] Optionally, in the device access control device provided in the embodiments of this application, the device further includes: a second acquisition unit, configured to acquire the identification code of the device to be identified from the M device information before determining whether the device to be identified is an accessible device based on the M device information, and determine whether the identification code matches the first device information stored in the device database, wherein the first device information includes the identification codes of multiple devices that have accessed the network; an execution unit, configured to execute the step of determining whether the device to be identified is an accessible device based on the M device information if the identification code does not match the first device information; and a termination unit, configured to terminate the step of determining whether the device to be identified is an accessible device based on the M device information if the identification code has matched the first device information.

[0088] Optionally, in the device access control device provided in the embodiments of this application, the first acquisition unit 40 includes: a first judgment module, used to judge whether the device to be identified has a control plug-in installed, wherein the control plug-in is used to acquire device information; an end module, used to end the step of acquiring device information of the device to be identified if the device to be identified does not have a control plug-in installed; and a control module, used to control the control plug-in to acquire device information if the device to be identified has a control plug-in installed.

[0089] Optionally, in the device access control device provided in the embodiments of this application, the first acquisition unit 40 includes: a second judgment module, used to determine whether the hardware information in M ​​device information matches the second device information in the device database when the appearance information indicates that the device to be identified is a preset type device, wherein the second device information includes multiple device hardware information that are allowed to access the network; and a determination module, used to determine the device to be identified as an accessible device when the hardware information matches the second device information.

[0090] Optionally, in the device access control device provided in this application embodiment, the extraction unit 42 includes: an acquisition module, used to acquire the application time period from the network access request and acquire the operation time period for the device to be identified to access the network; an opening module, used to open the network based on the network port when the operation time period is within the range of the application time period, and generate a first prompt message, wherein the first prompt message is used to indicate that the device to be identified is allowed to access the network; and a first generation module, used to generate a second prompt message when the operation time period is not within the range of the application time period, wherein the second prompt message is used to prompt the device to be identified to submit a delayed access request, and the delayed access request is used to apply for delayed access to the network.

[0091] Optionally, in the device access control device provided in the embodiments of this application, the device further includes: a judgment unit, used to determine whether there is a device change in the device to be identified based on M device information before controlling the device to be identified to access the network based on the network port; if there is a device change in the device to be identified, the unit obtains device information of N hardware devices that have changed, thereby obtaining N device information, where N is a positive integer; an execution unit, used to execute the step of controlling the device to be identified to access the network based on the network port if the N device information matches the second device information in the device database; and a second generation unit, used to generate alarm information if the N device information does not match the second device information, and store the device to be identified in the abnormal device list in the device database.

[0092] Optionally, in the device access control device provided in the embodiments of this application, the device includes: a receiving module, used to receive a network access request sent by a device to be identified, and obtain a port number to be opened from M device information based on the network access request; and a second generating module, used to generate a network access request based on the port number to be opened.

[0093] It should be noted that the first acquisition unit 40, the first generation unit 41, and the extraction unit 42 mentioned above correspond to steps S201 to S203 in Embodiment 1. The instances and application scenarios implemented by the above units and the corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above units can also be part of a device and can run in the computer terminal 10 provided in Embodiment 1.

[0094] Example 3

[0095] Embodiments of this application may provide a computer terminal, which may be any computer terminal device in a group of computer terminals. Optionally, in this embodiment, the aforementioned computer terminal may also be replaced with a mobile terminal or an electronic device, etc.

[0096] Optionally, in this embodiment, the computer terminal may be located in at least one of a plurality of network devices in a computer network.

[0097] In this embodiment, the computer terminal described above can execute the program code for the following steps in the device access control method: obtaining device information of the device to be identified, obtaining M pieces of device information, determining whether the device to be identified is an accessible device based on the M pieces of device information, wherein the device information refers to the hardware information and appearance information of the device to be identified, and an accessible device refers to a device that is allowed to access the network of a financial institution, and M is a positive integer; if the device to be identified is an accessible device, generating a network access request based on the M pieces of device information and sending the network access request to the device information server, wherein the device information server verifies the device to be identified based on the network access request and returns the verification result; if the verification result indicates that the device to be identified is allowed to access the network, extracting the network port from the network access request and controlling the device to be identified to perform network access operations based on the network port.

[0098] Optionally, the aforementioned computer terminal may execute the program code for the following steps in the device access control method: obtaining the identification code of the device to be identified from M device information, and determining whether the identification code matches the first device information stored in the device database, wherein the first device information includes the identification codes of multiple devices that have accessed the network; if the identification code does not match the first device information, performing the step of determining whether the device to be identified is an accessible device based on the M device information; if the identification code matches the first device information, ending the step of determining whether the device to be identified is an accessible device based on the M device information.

[0099] Optionally, the computer terminal described above can execute program code for the following steps in the device access control method: determining whether the device to be identified has a control plugin installed, wherein the control plugin is used to obtain device information; if the device to be identified does not have a control plugin installed, ending the step of obtaining device information of the device to be identified; if the device to be identified has a control plugin installed, controlling the control plugin to obtain device information.

[0100] Optionally, the computer terminal described above can execute the program code for the following steps in the device access control method: when the appearance information indicates that the device to be identified is a preset type device, determine whether the hardware information in the M device information matches the second device information in the device database, wherein the second device information includes multiple device hardware information that are allowed to access the network; if the hardware information matches the second device information, determine the device to be identified as an accessible device.

[0101] Optionally, the computer terminal described above can execute the program code for the following steps in the device access control method: obtaining the application time period from the network access request and obtaining the operation time period for the device to be identified to access the network; if the operation time period is within the range of the application time period, opening the network based on the network port and generating a first prompt message, wherein the first prompt message is used to indicate that the device to be identified is allowed to access the network; if the operation time period is not within the range of the application time period, generating a second prompt message, wherein the second prompt message is used to prompt the device to be identified to submit a delayed access request, the delayed access request being used to apply for delayed access to the network.

[0102] Optionally, the aforementioned computer terminal can execute the following steps in the device access control method: Based on M pieces of device information, determine whether the device to be identified has undergone device changes; if the device to be identified has undergone device changes, obtain the device information of N pieces of hardware that have undergone changes, resulting in N pieces of device information, where N is a positive integer; if the N pieces of device information match the second piece of device information in the device database, execute the step of controlling the device to be identified to access the network based on the network port; if the N pieces of device information do not match the second piece of device information, generate alarm information and store the device to be identified in the abnormal device list in the device database.

[0103] Optionally, the computer terminal described above can execute the program code for the following steps in the device access control method: receiving a network access request sent by the device to be identified, obtaining the port number to be opened from M device information based on the network access request, and generating a network access request based on the port number to be opened.

[0104] Optionally, Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (Only one is shown) processor 502, memory 504, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0105] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the device access control method and apparatus in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned device access control method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0106] The processor can invoke the information and application program stored in the memory through the transmission device to execute the steps described above in the device access control method.

[0107] Those skilled in the art will understand that Figure 5 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 5 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 5 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 5 The different configurations shown.

[0108] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0109] Example 4

[0110] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the device access control method provided in Embodiment 1.

[0111] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0112] Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: obtaining device information of the device to be identified, obtaining M pieces of device information, determining whether the device to be identified is an accessible device based on the M pieces of device information, wherein the device information refers to the hardware information and appearance information of the device to be identified, and an accessible device refers to a device that is allowed to access the network of a financial institution, and M is a positive integer; if the device to be identified is an accessible device, generating a network access request based on the M pieces of device information and sending the network access request to the device information server, wherein the device information server verifies the device to be identified based on the network access request and returns the verification result; if the verification result indicates that the device to be identified is allowed to access the network, extracting the network port from the network access request and controlling the device to be identified to perform network access operations based on the network port.

[0113] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing control method steps for device access.

[0114] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0115] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0116] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection of units or modules may be electrical or other forms.

[0117] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0118] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0119] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0120] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for controlling equipment access, characterized in that, include: Obtain device information of the device to be identified, resulting in M ​​pieces of device information. Based on the M pieces of device information, determine whether the device to be identified is an accessible device. Here, the device information refers to the hardware information and appearance information of the device to be identified, and the accessible device refers to a device that is allowed to access the network of a financial institution. M is a positive integer. If the device to be identified is the accessible device, a network access request is generated based on the M device information, and the network access request is sent to the device information server. The device information server verifies the device to be identified based on the network access request and returns the verification result. If the verification result indicates that the device to be identified is allowed to access the network, the network port is extracted from the network access request, and the device to be identified is controlled to perform network access operations based on the network port.

2. The method according to claim 1, characterized in that, Before determining whether the device to be identified is an accessible device based on the M device information, the method further includes: The identification code of the device to be identified is obtained from the M device information, and it is determined whether the identification code matches the first device information stored in the device database, wherein the first device information includes the identification codes of multiple devices that have accessed the network; If the identification code does not match the first device information, the step of determining whether the device to be identified is an accessible device based on the M device information is executed. If the identification code matches the first device information, the step of determining whether the device to be identified is an accessible device based on the M device information ends.

3. The method according to claim 1, characterized in that, The device information to be obtained for the device to be identified includes: Determine whether the device to be identified has a control plugin installed, wherein the control plugin is used to obtain device information; If the control plugin is not installed on the device to be identified, the step of obtaining the device information of the device to be identified ends. When the control plugin is installed on the device to be identified, the control plugin is controlled to obtain the device information.

4. The method according to claim 1, characterized in that, Determining whether the device to be identified is an accessible device based on the M device information includes: When the appearance information indicates that the device to be identified is a preset type of device, it is determined whether the hardware information in the M device information matches the second device information in the device database, wherein the second device information includes multiple device hardware information that allows access to the network; If the hardware information matches the second device information, the device to be identified is determined to be the accessible device.

5. The method according to claim 1, characterized in that, Controlling the device to be identified to access the network based on the network port includes: Obtain the application time period from the network access request, and obtain the operation time period during which the device to be identified requests access to the network; If the operation time period falls within the application time period, the network is opened based on the network port, and a first prompt message is generated, wherein the first prompt message is used to indicate that the device to be identified is allowed to access the network; If the operation time period is not within the scope of the application time period, a second prompt message is generated, wherein the second prompt message is used to prompt the device to be identified to submit a delayed access request, and the delayed access request is used to request delayed access to the network.

6. The method according to claim 1, characterized in that, Before controlling the device to be identified to access the network based on the network port, the method further includes: Based on the M device information, determine whether the device to be identified has undergone device changes. If the device to be identified has undergone device changes, obtain the device information of N hardware devices that have undergone changes, and obtain N device information, where N is a positive integer. If the N device information matches the second device information in the device database, the step of controlling the device to be identified to access the network based on the network port is executed. If the N device information does not match the second device information, an alarm message is generated, and the device to be identified is stored in the list of abnormal devices in the device database.

7. The method according to any one of claims 1 to 6, characterized in that, Generating a network access request based on the information of the M devices includes: Receive the network access request sent by the device to be identified, and obtain the port number to be opened from the M device information based on the network access request; The network access request is generated based on the port number to be opened.

8. A control device for equipment access, characterized in that, include: The first acquisition unit is used to acquire device information of the device to be identified, obtain M pieces of device information, and determine whether the device to be identified is an accessible device based on the M pieces of device information. Here, the device information refers to the hardware information and appearance information of the device to be identified, and the accessible device refers to a device that is allowed to access the network of a financial institution. M is a positive integer. The first generation unit is configured to, when the device to be identified is the accessible device, generate a network access request based on the M device information and send the network access request to the device information server, wherein the device information server verifies the device to be identified based on the network access request and returns the verification result; The extraction unit is configured to extract a network port from the network access request when the verification result indicates that the device to be identified is allowed to access the network, and to control the device to be identified to perform network access operations based on the network port.

9. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, executes the device access control method according to any one of claims 1 to 7.

10. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the steps of the device access control method according to any one of claims 1 to 7.

Images