GMRP extension security control method, apparatus and device, and medium

Abstract

The invention relates to a GMRP extension security control method, device and equipment and a medium, and relates to the technical field of network communication security, the method is applied to a switch supporting a GMRP protocol and integrating a security policy engine, the switch is linked with an authentication server and premaintains a terminal state database, and the method comprises the following steps: after the switch receives a GMRP message through any port, sending the GMRP message to a server; extracting an identity label and a destination multicast address in the message by a security policy engine; the authentication state of the identity label is obtained, if the identity label is not authenticated, an authentication process is triggered, authorization multicast information returned by the authentication server is received, and a database is updated; and the security policy engine carries out matching verification on the destination multicast address and the authorized multicast information, and message compliance processing is completed after verification is passed. The problems that a traditional GMRP protocol does not have identity authentication and port-level authentication is extensive are solved, refined security control is achieved, illegal access and unauthorized access are effectively prevented, and the security of multicast communication and the flexibility of network management are improved.

Description

Technical Field

[0001] This invention relates to the field of network communication security technology, and in particular to a GMRP extended security control method, apparatus, device, and medium. Background Technology

[0002] GMRP (Multicast Registration Protocol) is a network protocol used for terminal devices to dynamically join or leave multicast groups, widely used in scenarios such as video surveillance and data distribution. The existing GMRP protocol lacks a terminal authentication mechanism, allowing any device to send forged GMRP messages to join a multicast group, leading to security issues such as sensitive data eavesdropping and malicious occupation of multicast resources. Although some security measures employ port-level authentication, they cannot distinguish between multiple devices on the same port and are ill-suited to dynamic network environments with frequent device movement, resulting in rudimentary access control and high maintenance costs. Summary of the Invention

[0003] This invention provides a GMRP extended security control method to solve the problems of lack of identity authentication and insufficient flexibility of port-level authentication in the existing GMRP protocol.

[0004] In a first aspect, the present invention provides a GMRP extended security control method, applied to a switch that supports the GMRP protocol and integrates a security policy engine, wherein the switch is linked with an authentication server and the switch pre-maintains a terminal status database, the method comprising: GMRP messages are received through any port, and the identity identifier and destination multicast address are extracted from the GMRP messages through the security policy engine. The security policy engine queries the terminal status database to obtain the authentication status of the identity identifier, which is either authenticated or unauthenticated. If the authentication status is unauthenticated, an authentication process for that identity identifier is triggered: an authentication request carrying the identity identifier is sent to the authentication server, and the authorization multicast information for the identity identifier is received from the authentication server. After successful authentication, the security policy engine updates the authentication status of the identity identifier to authenticated and associates the authorization multicast information with the identity identifier in the terminal status database. The security policy engine matches and verifies the destination multicast address with the authorized multicast information. Once the verification is successful, the switch completes the compliance processing of the GMRP message.

[0005] Secondly, the present invention provides a GMRP extended security control device, comprising: The extraction unit is used to receive GMRP messages through any port and extract the identity identifier and destination multicast address from the GMRP messages through the security policy engine. The authentication unit is used to query the terminal status database through the security policy engine to obtain the authentication status of the identity identifier, which is either authenticated or unauthenticated. If the authentication status is unauthenticated, an authentication process for the identity identifier is triggered: an authentication request carrying the identity identifier is sent to the authentication server, and the authorization multicast information for the identity identifier is received from the authentication server. After successful authentication, the security policy engine updates the authentication status of the identity identifier to authenticated and associates the authorization multicast information with the identity identifier and stores it in the terminal status database. The verification unit is used to match and verify the destination multicast address with the authorized multicast information through the security policy engine. After the verification is successful, the switch completes the compliance processing of the GMRP message.

[0006] Thirdly, an electronic device is provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; When a processor executes a program stored in memory, it implements the steps of the GMRP extended security control method according to any embodiment of the first aspect.

[0007] Fourthly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the GMRP extended security control method as described in any embodiment of the first aspect.

[0008] The technical solutions provided in the embodiments of the present invention have the following advantages compared with the prior art: This invention achieves a secure extension of the GMRP protocol by introducing an authentication and authorization mechanism based on terminal identity in the switch: only authenticated terminals can obtain access to specific multicast groups, effectively preventing unauthorized devices from accessing and exceeding their privileges; by dynamically maintaining the terminal authentication status and aging mechanism, it adapts to device mobility scenarios and reduces the risk of residual permissions; compared with port-level authentication, it achieves fine-grained control at the terminal level, reduces network management complexity, and significantly improves the security and flexibility of multicast communication. Attached Figure Description

[0009] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0010] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 A flowchart illustrating a GMRP extended security control method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of a sub-process of a GMRP extended security control method provided in an embodiment of the present invention; Figure 3 A schematic diagram of the structure of a GMRP extended security control device provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0012] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] Example The GMRP extended security control method provided in this embodiment of the invention is applied to a switch that supports the GMRP protocol and integrates a security policy engine. The switch is linked with an authentication server and has a pre-maintained terminal status database.

[0014] GMRP is a multicast registration protocol, a network protocol used by terminal devices to dynamically apply to join or leave a multicast group.

[0015] The security policy engine is a functional module integrated into the switch, responsible for security control logic such as terminal identity extraction, authentication triggering, and authorization verification.

[0016] The terminal status database is a pre-maintained database of the switch, which stores associated data such as terminal identity identifiers, authentication status (authenticated / unauthenticated), and authorized multicast information.

[0017] An identity identifier is information used to uniquely identify a terminal device; in this embodiment, it is a MAC address.

[0018] Authorized multicast information is a list of multicast groups that the authentication server allows terminals to join.

[0019] Figure 1 This is a flowchart illustrating a GMRP extended security control method provided in an embodiment of the present invention. The present invention proposes a GMRP extended security control method; specifically, see [link to documentation]. Figure 1 The GMRP extended security control method includes the following steps S101-S103.

[0020] S101, receive GMRP messages through any port, and extract the identity identifier and destination multicast address from the GMRP messages through the security policy engine.

[0021] S102, the security policy engine queries the terminal status database to obtain the authentication status of the identity identifier, which is either authenticated or unauthenticated. If the authentication status is unauthenticated, an authentication process for the identity identifier is triggered: an authentication request carrying the identity identifier is sent to the authentication server, and the authorization multicast information for the identity identifier is received from the authentication server. After successful authentication, the security policy engine updates the authentication status of the identity identifier to authenticated and associates the authorization multicast information with the identity identifier in the terminal status database.

[0022] S103, the security policy engine matches and verifies the destination multicast address with the authorized multicast information. After the verification is successful, the switch completes the compliance processing of the GMRP message.

[0023] In a specific embodiment, after the switch starts up, it pre-maintains the terminal state database and establishes communication with the authentication server. When a terminal device sends a GMRP message (e.g., requesting to join multicast group 224.0.0.1), the switch receives the message through any port. The security policy engine extracts the terminal's identity identifier (e.g., MAC address 00:1A:2B:3C:4D:5E) and destination multicast address (224.0.0.1) from the message. The security policy engine queries the terminal state database. If the authentication status of the identity identifier is unauthenticated, the authentication process is triggered: an authentication request carrying the MAC address is sent to the authentication server; after the authentication server verifies that the MAC address is a legitimate terminal, it returns authorized multicast information (e.g., allowing joining 224.0.0.1, 224.0.0.2); the security policy engine updates the authentication status of the identity identifier in the database to authenticated and stores the authorized multicast information accordingly. Subsequently, the security policy engine matches the destination multicast address 224.0.0.1 with the authorized multicast information. After the verification is successful, the switch completes the compliance processing of the GMRP message (such as allowing the terminal to join the multicast group).

[0024] It achieves end-to-end security control of "identity authentication - authorization verification - compliance processing", upgrading the unauthenticated access of the GMRP protocol to fine-grained management based on terminal identity, fundamentally preventing unauthorized devices from accessing the multicast group, and realizing dynamic association storage of permissions through the terminal status database, providing a rapid verification basis for subsequent access.

[0025] In one embodiment, the identity identifier is the terminal MAC address, and the security policy engine obtains the identity identifier by extracting the source MAC address of the GMRP packet.

[0026] In a specific embodiment, the terminal MAC address is the physical address of the terminal device's network interface, which is globally unique and can serve as the terminal's identity identifier. The source MAC address refers to the MAC address of the sending terminal carried in the GMRP message.

[0027] When a terminal device sends a GMRP message, the message header includes the source MAC address (e.g., 00:1A:2B:3C:4D:5E). The switch's security policy engine extracts this source MAC address as the terminal's identity identifier, queries the terminal status database for the authentication status corresponding to this MAC address, and subsequent authentication and authorization processes are all performed based on this MAC address.

[0028] By leveraging the uniqueness of MAC addresses, the accuracy and irreplaceability of terminal identification are ensured, avoiding permission confusion caused by identity conflicts. At the same time, no additional terminal identification information needs to be configured, reducing deployment complexity.

[0029] In one embodiment, the authentication server is a RADIUS server, which returns the authorized multicast information to the switch through preset fields.

[0030] In this specific embodiment, the RADIUS server is a remote authentication dial-up user service server, commonly used for identity authentication and authorization management of network devices. The preset field refers to a specific data field in the RADIUS protocol used to transmit authorization information; in this embodiment, it is the Filter-id field.

[0031] The switch and RADIUS server are pre-configured with communication parameters. When the terminal's identity (MAC address 00:1A:2B:3C:4D:5E) triggers the authentication process, the switch sends an authentication request containing that MAC address to the RADIUS server. After successful verification, the RADIUS server returns authorized multicast information (such as "224.0.0.1,224.0.0.2") to the switch via the Filter-id field. The switch parses this field and stores it in the terminal state database.

[0032] By leveraging the mature RADIUS protocol for authentication and authorization, the compatibility and standardization of the solution are improved. At the same time, authorization multicast information is accurately transmitted through preset fields, ensuring the clarity and scalability of the authorization logic.

[0033] In one embodiment, if the authentication process fails, the currently received GMRP message is discarded.

[0034] In a specific embodiment, if the authentication process fails, it means that the authentication server verifies that the terminal's identity is invalid (e.g., not in the list of legitimate terminals) and returns an authentication failure response.

[0035] If the terminal's identity (MAC address 00:AA:BB:CC:DD:EE) is an unregistered and illegal device, the switch sends an authentication request to the authentication server and receives an authentication failure response. At this point, the security policy engine directly discards the currently received GMRP packets and does not allow the terminal to join any multicast groups.

[0036] Messages from unauthenticated terminals are discarded, blocking multicast access requests from unauthorized devices at the entry point, thus strengthening the first line of security for multicast communication.

[0037] In one embodiment, if the matching verification fails, the currently received GMRP message is discarded and a security event is recorded. The security event includes the identity of the unauthorized multicast group and the corresponding unauthorized destination multicast address.

[0038] In a specific embodiment, a failed match verification indicates that the destination multicast address requested by the terminal is not within the range of authorized multicast information returned by the authentication server. Security events are log information recording unauthorized access behavior by the terminal, used for subsequent auditing and alerting.

[0039] The authorized multicast information for the terminal identity (MAC address 00:1A:2B:3C:4D:5E) is 224.0.0.1. If it sends a GMRP message requesting to join 224.0.0.3, the security policy engine will find a mismatch after matching and verification, discard the message, and record a security event (the content of which is "Identity 00:1A:2B:3C:4D:5E attempted to access the unauthorized multicast group 224.0.0.3").

[0040] By verifying and preventing unauthorized access by legitimate terminals, "least privilege" control is achieved; security incident logs provide a basis for network security audits and facilitate the tracing of abnormal behavior.

[0041] Figure 2 This is a schematic diagram of a sub-process of a GMRP extended security control method provided in an embodiment of the present invention. The present invention proposes a GMRP extended security control method; specifically, see [link to documentation]. Figure 2The GMRP extended security control method further includes steps S201-S202: S201, each time any message sent by the identity identifier is received, update the last active time of the identity identifier in the terminal state database.

[0042] S202, Configure an aging timer. If an authenticated identity does not send any messages within the preset duration of the aging timer, reset its authentication status to unauthenticated and clear the associated authorized multicast information.

[0043] In a specific embodiment, the last active time refers to the time when the terminal last sent a message, used to determine whether the terminal is online. The aging timer refers to a timer of preset duration, used to automatically reset the authentication status of terminals that have been inactive for a long time. The preset duration is an aging time configured according to the network scenario (e.g., 5 minutes).

[0044] After successful authentication of the terminal's identity (MAC address 00:1A:2B:3C:4D:5E), the switch updates its last active time every time it sends a message (including GMRP messages or other data packets). If the terminal does not send any messages for more than 5 minutes, the aging timer is triggered, the security policy engine resets its authentication status to unauthenticated, and clears the associated authorized multicast information.

[0045] Automatically clean up permissions of inactive terminals that have been idle for a long time, avoiding security risks caused by residual permissions after the terminal goes offline, while reducing manual maintenance costs and adapting to dynamic network environments.

[0046] In one embodiment, the method further includes the step of: clearing the authentication status and associated authorized multicast information corresponding to the specified identity in the terminal status database by means of a management command or an instruction issued by the authentication server.

[0047] In a specific embodiment, management commands refer to operation instructions issued by the network administrator through the switch management interface. Instructions issued by the authentication server refer to permission clearing instructions actively sent by the authentication server to the switch (e.g., when a terminal device becomes obsolete).

[0048] When a terminal device (MAC address 00:1A:2B:3C:4D:5E) needs to have its permissions revoked due to obsolescence, the administrator issues a "clear terminal permissions" command through the switch's CLI interface, or the authentication server sends a clear command containing the MAC address to the switch; upon receiving the command, the switch immediately deletes the authentication status and authorized multicast information corresponding to the identity in the terminal status database.

[0049] It supports manual or automatic proactive permission clearing, making up for the lack of real-time performance of the aging mechanism, ensuring that terminal permissions can be quickly revoked as needed, and improving the flexibility and security of permission management.

[0050] The application scenarios of this invention are as follows: In the corporate campus network, multiple departments transmit sensitive data via multicast (such as the financial statement multicast group 224.1.1.1 for the finance department and the video conferencing multicast group 224.2.2.2 for the marketing department).

[0051] The Finance Department terminal (MAC address 00:11:22:33:44:55) sends a GMRP message to request to join 224.1.1.1. The switch extracts its MAC address and triggers authentication. The RADIUS server verifies that it is a legitimate terminal and returns the authorized multicast information 224.1.1.1. After the verification is successful, the terminal successfully joins the multicast group.

[0052] An external device (MAC address 00:AA:BB:CC:DD:EE) attempted to join 224.1.1.1, but its GMRP message was dropped due to authentication failure.

[0053] If a terminal in the finance department attempts to join 224.2.2.2, the message will be discarded and a security event will be logged because the authorization information does not include the multicast group.

[0054] If a terminal is offline for more than 5 minutes, its authentication status will be automatically reset, and it will need to be re-authenticated to reconnect. If the terminal is disabled, the administrator can immediately remove its permissions using a command.

[0055] The embodiments of the present invention can achieve the following advantages: This invention achieves a secure extension of the GMRP protocol by introducing an authentication and authorization mechanism based on terminal identity in the switch: only authenticated terminals can obtain access to specific multicast groups, effectively preventing unauthorized devices from accessing and exceeding their privileges; by dynamically maintaining the terminal authentication status and aging mechanism, it adapts to device mobility scenarios and reduces the risk of residual permissions; compared with port-level authentication, it achieves fine-grained control at the terminal level, reduces network management complexity, and significantly improves the security and flexibility of multicast communication.

[0056] Through this solution, enterprises have achieved on-demand allocation and strict control of multicast resources, effectively ensuring the security of sensitive data transmission.

[0057] See Figure 3 This invention also provides a GMRP extended security control device 400, which includes an extraction unit 401, an authentication unit 402, and a verification unit 403.

[0058] Extraction unit 401 is used to receive GMRP messages through any port and extract the identity identifier and destination multicast address from the GMRP messages through the security policy engine.

[0059] The authentication unit 402 is used to query the terminal status database through the security policy engine to obtain the authentication status of the identity identifier, which is either authenticated or unauthenticated. If the authentication status is unauthenticated, an authentication process for the identity identifier is triggered: an authentication request carrying the identity identifier is sent to the authentication server, and the authorization multicast information for the identity identifier is received from the authentication server. After successful authentication, the security policy engine updates the authentication status of the identity identifier to authenticated and associates the authorization multicast information with the identity identifier and stores it in the terminal status database.

[0060] The verification unit 403 is used to match and verify the destination multicast address with the authorized multicast information through the security policy engine. After the verification is successful, the switch completes the compliance processing of the GMRP message.

[0061] In one embodiment, the identity identifier is the terminal MAC address, and the security policy engine obtains the identity identifier by extracting the source MAC address of the GMRP packet.

[0062] In one embodiment, the authentication server is a RADIUS server, which returns the authorized multicast information to the switch through preset fields.

[0063] In one embodiment, if the authentication process fails, the currently received GMRP message is discarded.

[0064] In one embodiment, if the matching verification fails, the currently received GMRP message is discarded and a security event is recorded. The security event includes the identity of the unauthorized multicast group and the corresponding unauthorized destination multicast address.

[0065] In one embodiment, the GMRP extended security control device further includes an update unit and a clear unit.

[0066] The update unit is used to update the last active time of the identity identifier in the terminal state database each time any message sent by the identity identifier is received.

[0067] The clear unit is used to configure the aging timer. If an authenticated identity does not send any messages within the preset duration of the aging timer, its authentication status is reset to unauthenticated, and the associated authorized multicast information is cleared.

[0068] In one embodiment, clearing the associated authorized multicast information includes: clearing the authentication status and associated authorized multicast information corresponding to the specified identity in the terminal status database through management commands or instructions issued by the authentication server.

[0069] like Figure 4 As shown, Figure 4 This is a schematic block diagram of a computer device provided in an embodiment of this application. The computer device 500 can be a terminal or a server. The terminal can be an electronic device with communication functions, such as a smartphone, tablet, laptop, desktop computer, personal digital assistant, or wearable device. The server can be a standalone server or a server cluster composed of multiple servers.

[0070] The computer device 500 includes a processor 502, a memory, and a network interface 505 connected via a system bus 501. The memory may include a non-volatile storage medium 503 and internal memory 504.

[0071] The non-volatile storage medium 503 may store an operating system 5031 and a computer program 5032. When the computer program 5032 is executed, it causes the processor 502 to execute a GMRP extended security control method.

[0072] The processor 502 provides computing and control capabilities to support the operation of the entire computer device 500.

[0073] The internal memory 504 provides an environment for the execution of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a GMRP extended security control method.

[0074] The network interface 505 is used for network communication with other devices. Those skilled in the art will understand that the above structure is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device 500 to which the present application is applied. A specific computer device 500 may include more or fewer components than shown in the figures, or combine certain components, or have different component arrangements.

[0075] It should be understood that in the embodiments of this application, the processor 502 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0076] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program may be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0077] Therefore, the present invention also provides a storage medium. This storage medium can be a computer-readable storage medium. The storage medium stores a computer program.

[0078] The storage medium is a physical, non-transient storage medium, such as a USB flash drive, external hard drive, read-only memory (ROM), magnetic disk, or optical disk, or any other physical storage medium capable of storing program code. The computer-readable storage medium can be non-volatile or volatile.

[0079] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0080] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0081] The steps in the method of this invention can be adjusted, merged, or reduced in order according to actual needs. The units in the device of this invention can be merged, divided, or reduced according to actual needs. Furthermore, the functional units in the various embodiments of this invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0082] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0083] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0084] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Since these modifications and variations fall within the scope of the claims and their equivalents, this invention also intends to include these modifications and variations.

[0085] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A GMRP extended security control method, applied to a switch that supports the GMRP protocol and integrates a security policy engine, wherein the switch is linked with an authentication server, and the switch pre-maintains a terminal status database, characterized in that, The method includes the following steps: GMRP messages are received through any port, and the identity identifier and destination multicast address are extracted from the GMRP messages through the security policy engine. The security policy engine queries the terminal status database to obtain the authentication status of the identity identifier, which is either authenticated or unauthenticated. If the authentication status is unauthenticated, an authentication process for that identity identifier is triggered: an authentication request carrying the identity identifier is sent to the authentication server, and the authorization multicast information for the identity identifier is received from the authentication server. After successful authentication, the security policy engine updates the authentication status of the identity identifier to authenticated and associates the authorization multicast information with the identity identifier in the terminal status database. The security policy engine matches and verifies the destination multicast address with the authorized multicast information. Once the verification is successful, the switch completes the compliance processing of the GMRP message.

2. The method according to claim 1, characterized in that, The identity identifier is the terminal MAC address, and the security policy engine obtains the identity identifier by extracting the source MAC address of the GMRP packet.

3. The method according to claim 1, characterized in that, The authentication server is a RADIUS server, which returns the authorized multicast information to the switch through preset fields.

4. The method according to claim 1, characterized in that, If the authentication process fails, the currently received GMRP message is discarded.

5. The method according to claim 1, characterized in that, If the matching verification fails, the currently received GMRP message is discarded and a security event is recorded. The security event includes the identity of the unauthorized multicast group and the corresponding unauthorized destination multicast address.

6. The method according to claim 1, characterized in that, Also includes: Each time any message sent by the identity is received, the last active time of the identity in the terminal state database is updated; Configure an aging timer. If an authenticated identity does not send any messages within the preset duration of the aging timer, reset its authentication status to unauthenticated and clear the associated authorized multicast information.

7. The method according to claim 6, characterized in that, Also includes: The authentication status and associated authorized multicast information corresponding to the specified identity in the terminal status database are cleared by management commands or instructions issued by the authentication server.

8. A GMRP extended security control device, characterized in that, include: The extraction unit is used to receive GMRP messages through any port and extract the identity identifier and destination multicast address from the GMRP messages through the security policy engine. The authentication unit is used to query the terminal status database through the security policy engine to obtain the authentication status of the identity identifier, which is either authenticated or unauthenticated. If the authentication status is unauthenticated, an authentication process for the identity identifier is triggered: an authentication request carrying the identity identifier is sent to the authentication server, and the authorization multicast information for the identity identifier is received from the authentication server. After successful authentication, the security policy engine updates the authentication status of the identity identifier to authenticated and associates the authorization multicast information with the identity identifier and stores it in the terminal status database. The verification unit is used to match and verify the destination multicast address with the authorized multicast information through the security policy engine. After the verification is successful, the switch completes the compliance processing of the GMRP message.

9. A computer device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the steps of the method according to any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1-7.

Images