Equipment networking control method and device, medium and equipment

Abstract

The invention discloses an equipment networking control method and device, a medium and equipment, and the method comprises the steps: adding an equipment address of first terminal equipment to a monitoring list when a wrong networking password of the first terminal equipment is received, and then removing the equipment address of the first terminal equipment from the monitoring list when the terminal equipment meets a removal condition. And when the terminal device satisfies the blacklist adding condition, adding the device address of the first terminal device to the blacklist. In this way, the monitoring list undertakes the functions of'temporary buffering 'and'attack recognition', and only the confirmed malicious equipment meeting the blacklist adding condition is included in the blacklist, so that the situation that the equipment address is added into the blacklist once a password error occurs is avoided. And meanwhile, the monitoring list can be cleaned after meeting the removal condition, so that the dependence on the blacklist capacity can be further reduced. According to the scheme, the problem that the blacklist is fully occupied by invalid addresses quickly when an attacker initiates an attack by using a plurality of forged device addresses can be effectively avoided.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and in particular to a device networking control method and device, a medium and a device. BACKGROUND

[0002] The access device can provide wireless network services for terminal devices, and a single blacklist mechanism is enabled to prevent brute force attacks by terminal devices. The blacklist mechanism includes: when a terminal device continuously inputs an incorrect password for a preset number of times, the access device adds the device address of the terminal device to the blacklist and prohibits the terminal device from connecting to the network for a period of time.

[0003] However, the capacity of the blacklist is limited. If an attacker uses multiple fake device addresses to launch an attack, the blacklist will be quickly filled with invalid addresses, making it impossible to identify and intercept subsequent new attack devices. SUMMARY

[0004] Therefore, it is necessary to provide a device networking control method and device, a medium and a device to solve the problem that the capacity of the blacklist is limited and the blacklist is quickly filled with invalid addresses when attacked in the prior art.

[0005] In a first aspect, an embodiment of the present application provides a device networking control method applied to an access device, and the method includes: adding a device address of a first terminal device to a monitoring list when an incorrect networking password of the first terminal device is received; removing the device address of the first terminal device from the monitoring list if the first terminal device meets removal conditions; adding the device address of the first terminal device to a blacklist if the first terminal device meets blacklist addition conditions.

[0006] In some embodiments of the present application, after the device address of the first terminal device is added to the monitoring list, the method further includes: determining that the first terminal device meets the removal conditions if a correct networking password of the first terminal device is received; determining that the first terminal device meets the removal conditions if no incorrect networking password of the first terminal device is received within a first preset time period; determining that the first terminal device meets the removal conditions if the number of times of receiving incorrect networking passwords of the first terminal device within a second preset time period is less than a first number threshold.

[0007] In some embodiments of the present application, after the device address of the first terminal device is added to the monitoring list, the method further includes: If the number of times of receiving the incorrect networking password of the first terminal device in the second preset time period is greater than or equal to a first number threshold, it is determined that the first terminal device satisfies the blacklist adding condition.

[0008] In some embodiments of the present application, after the device address of the first terminal device is added to the blacklist, the method further comprises: determining a removal waiting time period based on the number of times; If the incorrect networking password of the first terminal device is not received in the removal waiting time period, the device address of the first terminal device is removed from the blacklist and the monitoring list.

[0009] In some embodiments of the present application, the determination of the removal waiting time period based on the number of times comprises: If the number of times is greater than or equal to a second number threshold, the removal waiting time period is determined as a third preset time period; wherein the second number threshold is greater than the first number threshold. If the number of times is less than the second number threshold, the removal waiting time period is determined as a fourth preset time period; wherein the third preset time period is greater than the fourth preset time period.

[0010] In some embodiments of the present application, after the device address of the first terminal device is added to the monitoring list, the method further comprises: If the number of device addresses added to the monitoring list in a preset period is greater than a first preset number threshold, the first number threshold is reduced; wherein the preset period is a fifth preset time period before the device address of the first terminal device is added to the monitoring list. If the number of device addresses added to the monitoring list in a preset period is less than a second preset number threshold, the first number threshold is increased; wherein the second preset number threshold is less than the first preset number threshold.

[0011] In some embodiments of the present application, after the device address of the first terminal device is added to the blacklist, the method further comprises: If a correct networking password of a second terminal device is received, a connection with the second terminal device is established, on the premise that the device address of the terminal device added in the monitoring list and / or the blacklist reaches a maximum capacity.

[0012] In a second aspect, the embodiments of the present application further provide a device networking control apparatus applied to an access device, the device networking control apparatus comprising: a first adding module, configured to add a device address of a first terminal device to a monitoring list when an incorrect networking password of the first terminal device is received; a removing module, configured to remove the device address of the first terminal device from the monitoring list if the first terminal device meets a removing condition; a second adding module, configured to add the device address of the first terminal device to a blacklist if the first terminal device meets a blacklist adding condition.

[0013] In a third aspect, an electronic device is provided, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program, when executed by the processor, implements the steps of the device networking control method.

[0014] In a fourth aspect, a computer readable storage medium is provided, which stores a computer program, and the computer program, when executed by a processor, implements the steps of the device networking control method.

[0015] In a fifth aspect, a computer program product or computer program is provided, which includes computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method provided in various optional implementation manners of the embodiments of the present application.

[0016] The present application provides a device networking control method, device, medium and device. When a first terminal device error networking password is received, the device address of the first terminal device is added to a monitoring list. Subsequently, when a terminal device meets a removing condition, the device address of the first terminal device is removed from the monitoring list. When the terminal device meets a blacklist adding condition, the device address of the first terminal device is added to a blacklist. In this way, the monitoring list assumes the functions of temporary buffering and attack identification. Only confirmed malicious devices meeting the blacklist adding condition are included in the blacklist, so that the situation that the device address is added to the blacklist due to a password error is avoided. Meanwhile, the monitoring list can be cleaned up when the removing condition is met, so that the dependence on the capacity of the blacklist is further reduced. It can be seen that the present application can effectively avoid the problem that the blacklist is rapidly occupied by invalid addresses when an attacker uses multiple fake device addresses to launch an attack. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0018] wherein: Figure 1 is a schematic diagram of a device networking control system; Figure 2 is a schematic diagram of a device networking control method provided by an embodiment of the present application; Figure 3 is a schematic diagram of a device networking control method; Figure 4 is a schematic diagram of a device networking control apparatus; Figure 5 is a structural block diagram of an electronic device. DETAILED DESCRIPTION

[0019] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0020] The terms "first", "second", and the like in the specification of the present application and the above-described drawings are used to distinguish different objects, rather than to describe a particular order. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally include other steps or units not listed or can optionally include other steps or units inherent to the process, method, product or device.

[0021] In this document, reference to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of one another. It is expressly understood that the embodiments described herein can be combined with each other in their various permutations and combinations.

[0022] Please refer to Figure 1 , Figure 1The scene schematic diagram of the device networking control system provided by the present application can include an access device 100 and a terminal device 200. The main function of the access device 100 (AP, Access Point) is to provide wireless signal coverage and receive the network access request of the terminal device 200 (STA, Station). The access device 100 can be a router. The terminal device 200 can be a mobile phone, a tablet computer, a smart Bluetooth device, a notebook computer, a personal computer or a server, etc. The server can be a single server or a server cluster composed of multiple servers.

[0023] Please refer to Figure 2 , Figure 2 The flowchart of the device networking control method provided by the present application is shown in the figure. Although the logical order is shown in the flowchart, in some cases, the steps shown or described can be performed in an order different from that shown in the figure. Specifically, the device networking control method is applied to an access device, The specific process of the device networking control method is as follows: S201, when an error networking password of a first terminal device is received, adding the device address of the first terminal device to a monitoring list.

[0024] The first terminal device is a device attempting to connect to the network through the access device, which can be a mobile phone, a tablet computer, a smart Bluetooth device, a notebook computer, a personal computer or a server, etc. The device address is a unique identifier used by the terminal device to identify its network interface, which can be a media access control (Media Access Control Address, MAC) address, an Internet Protocol (Internet Protocol Address, IP) address, or other addresses, which are not limited herein. The monitoring list is a dynamic list maintained by the access device, which is used to temporarily record the terminal device addresses that may have risks.

[0025] Optionally, the way to identify the error networking password can be to monitor the connection attempt of the terminal device to the access device in real time, and then determine the output networking password as the error networking password when it is determined that the input networking password does not match the target networking password. It is worth noting that in different encryption modes, the specific way to detect the mismatch of the password is different: for WPA and WPA2 encryption modes, the handshake process is used to detect whether the password is mismatched; for WPA3 encryption mode, the SAE (Simultaneous Authentication of Equals, simultaneous authentication of equals) protocol is used to detect whether the password is mismatched.

[0026] Optionally, when an error networking password of a certain terminal device is received for n times in succession (for example, 1 time, of course, more times are also possible), the device address of the terminal device is added to the monitoring list. The maximum capacity of the monitoring list is configured, and the default value can be set to 1000. The administrator can adjust this value according to the performance of the access device and the size of the network to avoid the failure of the monitoring list due to insufficient capacity. The device address added to the monitoring list is used for further judgment of whether to remove, keep or add to the blacklist.

[0027] S202, if the first terminal device meets the removal condition, the device address of the first terminal device is removed from the monitoring list.

[0028] The removal condition refers to a condition in which the access device determines that a certain terminal device no longer has an attack risk according to a preset rule, and the corresponding device address can be deleted from the monitoring list.

[0029] Optionally, the first terminal device meeting the removal condition can be determined by a user according to the actual scene, or can be automatically determined based on a first preset strategy of the system. The first preset strategy includes a time-based strategy, a networking failure number-based strategy or a networking success number-based strategy, which is not limited herein.

[0030] It can be understood that if the first terminal device meets the removal condition, the device address of the first terminal device is removed from the monitoring list, thereby releasing the space of the monitoring list, and it can be ensured that the access device can still effectively monitor new devices in a high-load scenario. At the same time, the cleaning of the monitoring list further reduces the risk of the subsequent blacklist being quickly occupied.

[0031] S203, if the first terminal device meets the blacklist addition condition, the device address of the first terminal device is added to the blacklist.

[0032] The blacklist addition condition refers to a condition in which the access device determines that a certain terminal device has an attack risk according to a preset rule, and the corresponding device address is added to the blacklist. The blacklist refers to a list maintained by the access device, which is used to record the terminal device addresses that are confirmed to have attack behaviors.

[0033] Optionally, the first terminal device meeting the blacklist addition condition can be determined by a user according to the actual scene, or can be automatically determined based on a second preset strategy of the system. The second preset strategy includes a time-based strategy, a networking failure number-based strategy or a networking success number-based strategy, which is not limited herein.

[0034] Optionally, the blacklist has a configurable maximum capacity, and a default value can be set as 128. The administrator can adjust this value according to the performance of the access device and the size of the network to avoid the problem of invalidation of the blacklist due to insufficient capacity.

[0035] Optionally, once the address of the terminal device is added to the blacklist, the access device will prohibit the device from initiating any network connection request, including new password verification attempts and other network operations, within a preset prohibited time period (such as 1 hour), until the end of the ban time or the administrator manually removes it from the blacklist, thereby effectively blocking confirmed malicious attack behavior.

[0036] In the above embodiment, when the first terminal device inputs an incorrect network connection password, the device address of the first terminal device is added to the monitoring list. When the terminal device meets the removal condition, the device address of the first terminal device is removed from the monitoring list. When the terminal device meets the blacklist addition condition, the device address of the first terminal device is added to the blacklist. In this way, the monitoring list assumes the functions of "temporary buffer" and "attack identification", and only confirmed malicious devices that meet the blacklist addition condition are added to the blacklist, thereby avoiding the situation where the device address is added to the blacklist when an incorrect password is input. At the same time, the monitoring list can be cleaned up when the removal condition is met, which can further reduce the dependence on the capacity of the blacklist. It can be seen that the present solution can effectively avoid the problem that the blacklist is quickly occupied by invalid addresses when the attacker uses multiple fake device addresses to launch an attack.

[0037] In some embodiments of the present application, the way to determine whether the first terminal device meets the removal condition in S202 can be: if a correct network connection password of the first terminal device is received, it is determined that the first terminal device meets the removal condition. If no incorrect network connection password of the first terminal device is received within a first preset time period, it is determined that the first terminal device meets the removal condition. If the number of times of receiving incorrect network connection passwords of the first terminal device within a second preset time period is less than a first number threshold, it is determined that the first terminal device meets the removal condition.

[0038] It can be understood that the judgment of the removal condition can be realized in the following specific ways: The first way is that if the access device receives a correct network connection password input by the first terminal device and successfully establishes a network connection, it means that the previous error is probably caused by user operation mistake rather than malicious attack behavior, and the device directly meets the removal condition.

[0039] The second way is that if the first terminal device does not appear again to input an incorrect network connection password within a first preset time period (for example, 180 seconds) after joining the monitoring list, it means that it has no signs of continuously attempting brute force cracking, and the access device automatically determines that it meets the removal condition.

[0040] The third way is that if the cumulative number of times of inputting the wrong network password by the first terminal device does not reach the first number threshold (e.g., 50 times) within the set second preset time length (e.g., 60 seconds), it is indicated that the frequency of the wrong attempts does not reach the standard of suspicious attack, and it is also determined that the first terminal device meets the removal condition.

[0041] The above determination manners consider the actual network behavior, time interval, and error frequency of the device from multiple dimensions, which can not only remove the normal device with misoperation from the monitoring list in time to avoid unnecessary occupation of monitoring resources, but also ensure that the device with a real attack suspicion is continuously concerned.

[0042] In some embodiments of the present application, the way of determining that the first terminal device meets the addition condition in S203 can be that if the number of errors of the first terminal device within the second preset time length is greater than or equal to the first number threshold, it is determined that the first terminal device meets the blacklist addition condition.

[0043] Similar to the principle of the above embodiments, the addition condition can be determined by the following specific way: if the cumulative number of times of inputting the wrong network password by the first terminal device is greater than or equal to the first number threshold (e.g., 50 times) within the set second preset time length (e.g., 60 seconds), it is indicated that the frequency of the wrong attempts has reached the standard of suspicious attack, and it is determined that the blacklist addition condition is met at this time.

[0044] In some embodiments of the present application, after the device address of the first terminal device is added to the blacklist in S203, the following step is further performed: determining a removal waiting time length based on the number of errors. If the error network password of the first terminal device is not received within the removal waiting time length, the device address of the first terminal device is removed from the blacklist and the monitoring list.

[0045] The removal waiting time length refers to a time period set by the access device for the first terminal device in the blacklist based on the number of errors, which is used to observe whether the first terminal device continues to attempt to input the wrong password within the time period.

[0046] Optionally, the error number and the removal waiting duration are in a positive correlation, that is, the more the error attempt number of the first terminal device is, the higher the possibility of malicious attack or the greater the attack intensity is, and the longer the corresponding removal waiting duration is. For example, if the removal waiting duration is 1 hour when the error number is 50 times, the removal waiting duration can be extended to 3 hours when the error number reaches 100 times, so as to realize differentiated treatment for different attack degrees. Subsequently, the access device continuously monitors the networking behavior of the first terminal device within the set removal waiting duration. If no attempt of inputting the wrong networking password of the device is received again within the entire removal waiting duration, it is indicated that the attack behavior of the device can have stopped, and the access device automatically removes the address of the device from the blacklist and the monitoring list, and allows the device to re-initiate a normal networking request.

[0047] The above embodiment can apply corresponding restrictions according to the severity of the attack behavior based on the mechanism of dynamically adjusting the ban duration according to the error number.

[0048] In some embodiments of the present application, the removal waiting duration is determined based on the error number, specifically including the following steps: if the error number is greater than or equal to a second number threshold, the removal waiting duration is determined as a third preset duration. If the error number is less than the second number threshold, the removal waiting duration is determined as a fourth preset duration.

[0049] The second number threshold is greater than the first number threshold. The third preset duration is greater than the fourth preset duration.

[0050] It can be understood that the access device can pre-set two key parameters: the second number threshold (which is greater than the first number threshold used when determining the blacklist addition condition), and the corresponding third preset duration and fourth preset duration (wherein the third preset duration is greater than the fourth preset duration). When the error number of the first terminal device is greater than or equal to the second number threshold, it is indicated that the attack behavior of the first terminal device is more serious or malicious, and the access device determines the removal waiting duration of the first terminal device as the third preset duration to impose more stringent restrictions. If the error number is less than the second number threshold (but has reached the first number threshold, meeting the blacklist addition condition), the removal waiting duration is determined as the relatively shorter fourth preset duration.

[0051] For example, assuming that the first number threshold is 50 times (triggering the blacklist addition), the second number threshold is 100 times, the fourth preset duration is 2 hours, and the third preset duration is 8 hours. If the error number reaches 120 times (more than 100 times), the removal waiting duration is 8 hours. If the error number of the first terminal device is 70 times (more than 50 times but less than 100 times), the removal waiting duration is shortened to 2 hours.

[0052] It should be noted that the above method of removing the waiting time through two levels of division is only an example, and in actual application, more fine-grained classification can be performed according to network security requirements, such as setting more number of threshold values and corresponding time length gradients, so that the judgment of removing the waiting time is more suitable for the actual situation of different attack intensities, and the flexibility of the protection strategy is further improved.

[0053] In some embodiments of the present application, after adding the device address of the first terminal device to the monitoring list in S203, the following step is further performed: if the number of device addresses added to the monitoring list within a preset period is greater than a first preset number threshold, the first number threshold is reduced. If the number of device addresses added to the monitoring list within the preset period is less than a second preset number threshold, the first number threshold is increased.

[0054] The preset period is a fifth preset time length before the device address of the first terminal device is added to the monitoring list. The second preset number threshold is less than the first preset number threshold.

[0055] It can be understood that the access device will first set a preset period (the period is a fifth preset time length before the first terminal device is added to the monitoring list, for example, the previous 1 hour), and count the total number of device addresses added to the monitoring list within the period, and then adaptively adjust the first number threshold according to the counting result: If the number of device addresses newly added to the monitoring list within the preset period is greater than the first preset number threshold (for example, 100), it indicates that there are high-frequency connections of terminal devices in the network within this period, and many connection failures, which may exist concentrated attacks or abnormal fluctuations. At this time, the access device will reduce the first number threshold, including reducing by a fixed percentage or by a fixed value. By lowering the threshold for triggering the blacklist, potential attacking devices can be identified and intercepted more quickly, and the sensitivity of network protection is enhanced.

[0056] If the number of device addresses newly added to the monitoring list within the preset period is less than the second preset number threshold (wherein the second preset number threshold is less than the first preset number threshold, for example, 10), it indicates that the current network connection success rate is high, and the overall environment is more stable. At this time, the access device will increase the first number threshold, including increasing by a fixed percentage or by a fixed value. By appropriately increasing the triggering standard, the probability of misjudgment of normal devices can be reduced, and the balance between security protection and user experience is achieved.

[0057] The above embodiments, based on the dynamic adjustment strategy of the recent monitoring list addition amount, can make the first number threshold flexibly change with the actual situation of the network environment, so that the blacklist mechanism can maintain a reasonable judgment standard when facing different network situations.

[0058] In some embodiments of the present application, after adding the device address of the first terminal device to the monitoring list at S203, the following step is further performed: if a correct network connection password of a second terminal device is received, a connection is established with the second terminal device, on the premise that the device address of the terminal device added in the monitoring list and / or the black list reaches the maximum capacity.

[0059] The maximum capacity refers to the upper limit of the number of device addresses that the monitoring list and / or the black list can store, for example, the maximum capacity of the monitoring list is 1000, and the maximum capacity of the black list is 128. The second terminal device refers to other client devices that attempt to connect to the network through the access device in addition to the first terminal device.

[0060] It can be understood that when the number of terminal device addresses added in the monitoring list and / or the black list reaches the respective maximum capacity, if a correct network connection password of a second terminal device is received at this time, the system will still normally establish a network connection with the second terminal device, and is not affected by the list capacity limit. For example, when the monitoring list has reached the maximum capacity of 1000 addresses and the black list has reached the upper limit of 128 addresses, as long as a new second terminal device inputs a correct password, it can still successfully connect to the network.

[0061] The above embodiments guarantee the normal access rights of legitimate users and avoid unnecessary connection hindrance to normal devices due to list capacity limits.

[0062] Optionally, in order to clearly present the overall scheme logic, the overall flowchart shown in Figure 3 is combined, and the following is described by taking a specific execution flow as an example. The flow starts with "starting a connection attempt listening process of a terminal device (STA)", the access device (AP) enters a continuous listening mode, and whether a STA initiates a WiFi connection request is detected in real time. If no connection attempt is detected, the flow maintains the listening state; if a connection request of a STA is detected, the subsequent determination link is entered, and core control parameters including a password error number threshold (x=50 times), an error number counting duration (y=60 seconds), and a black list automatic clearing period (z=180 seconds) are loaded, to provide a unified standard basis for the determination of each link.

[0063] First step: black list attribution judgment.

[0064] The access device preferentially queries whether the device address (such as the MAC address) of the STA currently initiating the connection exists in the black list: if the device address is in the black list, it indicates that the device has been previously determined to have malicious attack behavior, and the access device directly performs a "denial of service" operation to block its current network request; if the device address is not in the black list, the next step of "password correctness verification" is entered.

[0065] Second step: password correctness verification.

[0066] The access device matches the received networking password input by the STA with the preset target WiFi password: if the password matches successfully (i.e., the input is correct): the "authentication passed" process is directly completed, the STA is allowed to access the network, the current processing flow for the STA is terminated, and the access device returns to the listening state and waits for the next connection request; if the password matching fails (i.e., the input is incorrect): further management needs to be combined with the state of the monitoring list, and the "monitoring list attribution and capacity determination" link is entered.

[0067] Third step: monitoring list attribution and capacity determination.

[0068] First, it is determined whether the device address of the STA already exists in the monitoring list: if it already exists in the monitoring list: the "password error times" of the device are directly added (i.e., error times + 1), and after updating the error record, the "error times threshold determination" link is entered; if it does not exist in the monitoring list: it is first checked whether the monitoring list has reached the maximum storage capacity (the default configuration is 1000 device addresses): if the monitoring list is full: the device address is not added to the monitoring list, and the flow returns to the listening state; if the monitoring list is not full: the device address of the STA is added to the monitoring list, and its "password error times" are initialized to 1, and after the record is completed, the "error times threshold determination" link is entered.

[0069] Fourth step: error times threshold determination.

[0070] The cumulative password error times of the STA within the set error times statistical duration (y=60 seconds) are counted, and it is determined whether the cumulative error times reach the password error times threshold (x=50 times): if the cumulative error times do not reach the threshold: the blacklist addition process is not triggered, and the device address enters the "monitoring list aging waiting" state. If the subsequent error times do not reach x times within the y-second statistical period or the blacklist automatic cleaning period (z=180 seconds) ends, the device address will be removed from the monitoring list and its normal networking request right is restored; if the cumulative error times reach or exceed the threshold: it indicates that the device has a high-frequency error attempt behavior, and is suspected of initiating a brute force attack, and further judgment of the blacklist capacity is needed, and the "blacklist capacity determination" link is entered.

[0071] Fifth step: blacklist capacity determination.

[0072] Check if the blacklist has reached the maximum storage capacity (default configuration is 128 device addresses): if the blacklist is full: do not add the device address of the STA to the blacklist, and the process returns to the monitoring state; if the blacklist is not full: add the device address of the STA to the blacklist, and record the time when it is added to the blacklist, and then enter the "blacklist aging removal" link.

[0073] Step 6: Blacklist aging removal.

[0074] The device address that has been added to the blacklist automatically enters the "blacklist aging waiting" state. When the survival time of the device address in the blacklist reaches the preset automatic blacklist removal period (z=180 seconds), the system automatically performs the removal operation: synchronously removes the device address from the blacklist and the monitoring list, removes the networking restriction on it, and allows the device to re-initiate a normal networking request. At this point, the complete processing flow for the suspected attack device ends, and the access device returns to the initial monitoring state and waits for the next connection attempt of the STA.

[0075] In order to better implement the device networking control method of the present application, the present application further provides a device networking control device based on the above-mentioned device networking control method. The meanings of the terms are the same as in the above-mentioned device networking control method, and the specific implementation details can be referred to the description in the method embodiment.

[0076] Please refer to Figure 4 , Figure 4 is a structural schematic diagram of the device networking control device provided by the embodiment of the present application, and can specifically include: The first adding module 410 is configured to add the device address of the first terminal device to the monitoring list when an incorrect networking password of the first terminal device is received. The removing module 420 is configured to remove the device address of the first terminal device from the monitoring list if the first terminal device meets the removal condition. The second adding module 430 is configured to add the device address of the first terminal device to the blacklist if the first terminal device meets the blacklist adding condition.

[0077] The aforementioned device network control device has a first adding module 410 that adds the device address of the first terminal device to the monitoring list upon receiving an incorrect network password. A removal module 420 removes the device address of the first terminal device from the monitoring list when the terminal device meets the removal conditions. A second adding module 430 adds the device address of the first terminal device to the blacklist when the terminal device meets the blacklist addition conditions. This approach allows the monitoring list to function as a "temporary buffer" and "attack identification" mechanism, only including confirmed malicious devices that meet the blacklist addition conditions, thus avoiding the situation where a device address is added to the blacklist immediately upon receiving an incorrect password. Furthermore, the monitoring list can be cleaned up after meeting the removal conditions, further reducing reliance on blacklist capacity. Therefore, this solution effectively prevents the blacklist from quickly becoming full of invalid addresses when attackers launch attacks using multiple forged device addresses.

[0078] In some embodiments of this application, the device network control device further includes a determination module, used for: If the correct network password of the first terminal device is received, the first terminal device is determined to meet the removal conditions. If no incorrect network password is received from the first terminal device within the first preset time period, the first terminal device is determined to meet the removal conditions. If the number of incorrect network passwords received from the first terminal device within the second preset time period is less than the first threshold, then the first terminal device is determined to meet the removal condition.

[0079] In some embodiments of this application, the determination module is further configured to: If, within the second preset time period, the number of incorrect network passwords received from the first terminal device is greater than or equal to the threshold number received the first time, then the first terminal device is determined to meet the conditions for adding to the blacklist.

[0080] In some embodiments of this application, the second adding module 430 is further configured to: The removal wait time is determined based on the number of errors. If an incorrect network password is not received from the first terminal device within the waiting period, the device address of the first terminal device will be removed from the blacklist and monitoring list.

[0081] In some embodiments of this application, the second adding module 430 is further configured to: If the number of errors is greater than or equal to the second threshold, the removal waiting time will be determined as the third preset time; where the second threshold is greater than the first threshold. If the number of errors is less than the second threshold, the removal waiting time will be set as the fourth preset time; where the third preset time is longer than the fourth preset time.

[0082] In some embodiments of the present application, the second adding module 430 is further configured to: If the number of device addresses added to the monitoring list in a preset period is greater than a first preset number threshold, the first number threshold is reduced; wherein the preset period is a fifth preset time period before the device address of the first terminal device is added to the monitoring list. If the number of device addresses added to the monitoring list in a preset period is less than a second preset number threshold, the first number threshold is increased; wherein the second preset number threshold is less than the first preset number threshold.

[0083] In some embodiments of the present application, the device networking control apparatus further comprises a connecting module configured to: If the correct networking password of the second terminal device is received, the connection with the second terminal device is established, on the premise that the device address of the terminal device added in the monitoring list and / or the blacklist reaches the maximum capacity.

[0084] In addition, the present application also provides an electronic device, as shown in Figure 5 The electronic device structure involved in the present application is shown in the figure, and specifically: The electronic device can include a processor 501 with one or more processing cores, a memory 502 with one or more computer readable storage media, a power supply 503, an input unit 504, and the like. Those skilled in the art can understand that Figure 5 The electronic device structure shown in the figure does not constitute a limitation on the electronic device, and can include more or fewer components than the figure, or combine certain components, or different component arrangements. Among them: The processor 501 is the control center of the electronic device, which connects all parts of the electronic device through various interfaces and lines, executes the software programs and / or modules stored in the memory 502 and the data stored in the memory 502, and processes various functions and data of the electronic device, so as to monitor the whole electronic device. Optionally, the processor 501 can include one or more processing cores; preferably, the processor 501 can integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface and application program, etc., and the modem processor mainly processes wireless communication. It can be understood that the above-mentioned modem processor can also not be integrated into the processor 501.

[0085] The memory 502 can be used to store software programs and modules, and the processor 501 executes various function applications and data processing by running the software programs and modules stored in the memory 502. The memory 502 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, application programs required by at least one function, and the like; and the data storage area can store data created according to the use of the electronic device, and the like. In addition, the memory 502 can include a high-speed random access memory, and can also include a non-volatile memory such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state memory device. Accordingly, the memory 502 can also include a memory controller to provide the processor 501 with access to the memory 502.

[0086] The electronic device also includes a power supply 503 for supplying power to various components. Preferably, the power supply 503 can be logically connected to the processor 501 through a power management system, so as to realize functions such as management of charging, discharging, and power consumption management through the power management system. The power supply 503 can also include one or more direct current or alternating current power supplies, a recharging system, a power supply device debugging circuit, a power supply converter or inverter, a power supply state indicator, and the like.

[0087] The electronic device can also include an input unit 504, which can be used to receive input digital or character information, and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0088] Although not shown, the electronic device can also include a display unit and the like, which will not be described here. Specifically, in the present embodiment, the processor 501 in the electronic device will load the executable file corresponding to the process of one or more application programs into the memory 502 according to the following instructions, and run the application programs stored in the memory 502 by the processor 501, so as to realize the steps in any device networking control method provided by the embodiments of the present application: when an error networking password of a first terminal device is received, adding the device address of the first terminal device to a monitoring list; if the first terminal device satisfies removal conditions, removing the device address of the first terminal device from the monitoring list; and if the first terminal device satisfies blacklist addition conditions, adding the device address of the first terminal device to a blacklist.

[0089] The above embodiment adds the device address of the first terminal device to the monitoring list when the first terminal device receives an incorrect networking password, and then removes the device address of the first terminal device from the monitoring list when the terminal device meets the removal condition, and adds the device address of the first terminal device to the blacklist when the terminal device meets the blacklist addition condition. In this way, the monitoring list assumes the functions of "temporary buffering" and "attack identification", and only the confirmed malicious device meeting the blacklist addition condition is added to the blacklist, thereby avoiding the case of adding the device address to the blacklist when the password is incorrect. Meanwhile, the monitoring list can be cleaned up when the removal condition is met, which can further reduce the dependence on the capacity of the blacklist. It can be seen that the present solution can effectively avoid the problem that the blacklist is quickly occupied by invalid addresses when the attacker uses multiple fake device addresses to launch an attack.

[0090] The specific implementation of each operation can be referred to the foregoing embodiments, which will not be described here.

[0091] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructions, or by related hardware controlled by the instructions, which can be stored in a computer readable storage medium and loaded and executed by a processor.

[0092] Therefore, the present application provides a computer readable storage medium, which stores a computer program capable of being loaded by a processor to execute the steps in any device networking control method provided by the present application.

[0093] The specific implementation of each operation can be referred to the foregoing embodiments, which will not be described here.

[0094] The computer readable storage medium can include a read only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0095] Since the instructions stored in the computer readable storage medium can execute the steps in any device networking control method provided by the present application, the beneficial effects of any device networking control method provided by the present application can be achieved, which will be described in detail in the foregoing embodiments, and will not be described here.

[0096] The above describes in detail the device networking control method and device, the electronic device and the computer readable storage medium provided by the application. The principles and implementation manners of the application are described by using specific examples. The above description of the embodiments is only used to help understand the method and core idea of the application. Meanwhile, for those skilled in the art, the specific implementation manners and application ranges can be changed according to the idea of the application. In conclusion, the content of the specification should not be understood as a limitation of the application.

Claims

1. A method for networked control of devices, characterized in that, Applied to access devices, the method includes: Upon receiving an incorrect network password from the first terminal device, add the device address of the first terminal device to the monitoring list; If the first terminal device meets the removal conditions, then the device address of the first terminal device is removed from the monitoring list; If the first terminal device meets the blacklist addition criteria, then the device address of the first terminal device is added to the blacklist.

2. The device network control method according to claim 1, characterized in that, After adding the device address of the first terminal device to the monitoring list, the process further includes: If the correct network password of the first terminal device is received, it is determined that the first terminal device meets the removal condition; If no incorrect network password is received from the first terminal device within the first preset time period, the first terminal device is determined to meet the removal condition. If the number of incorrect network passwords received from the first terminal device within the second preset time period is less than the first threshold, then the first terminal device is determined to meet the removal condition.

3. The device network control method according to claim 1, characterized in that, After adding the device address of the first terminal device to the monitoring list, the process further includes: If, within a second preset time period, the number of incorrect network passwords received from the first terminal device is greater than or equal to the first threshold number, then the first terminal device is determined to meet the blacklist addition conditions.

4. The device networking control method according to claim 3, characterized in that, After adding the device address of the first terminal device to the blacklist, the method further includes: The removal waiting time is determined based on the number of errors. If no incorrect network password is received from the first terminal device within the removal waiting time, the device address of the first terminal device is removed from the blacklist and the monitoring list.

5. The device networking control method according to claim 4, characterized in that, The process of determining the removal waiting time based on the number of errors includes: If the number of errors is greater than or equal to the second threshold, the removal waiting time is determined as the third preset time; wherein, the second threshold is greater than the first threshold. If the number of errors is less than the second threshold, the removal waiting time is determined as the fourth preset time; wherein the third preset time is longer than the fourth preset time.

6. The device networking control method according to claim 2 or 3, characterized in that, After adding the device address of the first terminal device to the monitoring list, the process further includes: If the number of device addresses added to the monitoring list within a preset period is greater than a first preset number threshold, then the first number threshold is reduced; wherein, the preset period is the fifth preset time before the device address of the first terminal device is added to the monitoring list; If the number of device addresses added to the monitoring list within a preset period is less than the second preset number threshold, then the first number threshold is increased; wherein the second preset number threshold is less than the first preset number threshold.

7. The device network control method according to claim 1, characterized in that, After adding the device address of the first terminal device to the blacklist, the method further includes: Provided that the device addresses of the terminal devices added to the monitoring list and / or the blacklist have reached the maximum capacity, if the correct network password of the second terminal device is received, a connection is established with the second terminal device.

8. A device network control device, characterized in that, The device network control device, applied to access devices, includes: The first addition module is used to add the device address of the first terminal device to the monitoring list when an incorrect network password of the first terminal device is received. The removal module is used to remove the device address of the first terminal device from the monitoring list if the first terminal device meets the removal conditions. The second adding module is used to add the device address of the first terminal device to the blacklist if the first terminal device meets the blacklist adding conditions.

9. A computer-readable storage medium, characterized in that, The device stores a computer program that, when executed by a processor, causes the processor to perform the steps of the method as described in any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes a memory and a processor, the memory storing a computer program that, when executed by the processor, causes the processor to perform the steps of the method as described in any one of claims 1 to 7.

Images