Equipment networking behavior management method

Abstract

The invention belongs to the technical field of network security, and particularly provides an equipment networking behavior management method, which is characterized in that terminal equipment is monitored through a terminal security management platform, the installation and operation states of security software are known, and networking behavior management equipment controls network access limitation of the terminal equipment according to the installation and operation states of the security software. Through the setting, the strong binding of the network access permission and the terminal security state is realized, the management vulnerability depending on the consciousness of employees is eliminated from the technical level, and the security policy is ensured to be executed. And for the non-compliant terminal equipment, only the intranet resources are allowed to be accessed, so that the security risk caused by random access to the Internet is blocked. And when the access is intercepted, a repair guide page is set, so that a user clearly knows a problem source and a solution. And after the terminal equipment completes security repair and updates the security compliance state information, the Internet access behavior management equipment relieves the network access restriction on the terminal equipment.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a device networking behavior management method. BACKGROUND

[0002] Insurance companies have high requirements for network security. In order to protect the safety of terminal devices, the insurance companies usually install security protection software on the terminal devices for access control. The software integrates functions such as virus detection, vulnerability protection and active defense, and can effectively intercept various network attacks and reinforce system security. However, the existing terminal device security management scheme has obvious defects. Whether the security protection software is running completely depends on the self-consciousness and execution of employees, and there may be security loopholes in local network protection. SUMMARY

[0003] Based on the above technical problems, the application provides a device networking behavior management method to solve the technical problems that whether the security protection software of the terminal device is running depends on the self-consciousness and execution of employees, and the technical problem that there may be security loopholes in local network protection.

[0004] To achieve the above-mentioned purpose, the technical scheme adopted by the application is as follows: a device networking behavior management method is provided, comprising the following steps: S1: monitoring the installation and running state of the security software of the terminal device through a terminal security management platform, and generating security compliance state information; S2: synchronizing the security compliance state information to an online behavior management device; S3: based on the security compliance state information, implementing a network access control policy on the non-compliant terminal device, limiting the non-compliant terminal device to access the network except for the preset intranet resources and repair resources, intercepting the access request and returning a redirection page containing repair instructions; S4: after the terminal device completes security repair and updates the security compliance state information, the online behavior management device automatically removes the network access restriction thereon.

[0005] In a possible implementation manner, the terminal security management platform in step S1 can obtain the unique identifier of the terminal device, and send the unique identifier to the online behavior management device. The unique identifier includes at least one of an IP address and a MAC address. The online behavior management device sets the network access permission of the terminal device according to the unique identifier.

[0006] In a possible implementation manner, the security compliance state information includes version information of the security software, installation state of the security software and running state of the security software.

[0007] In a possible implementation, the preset intranet resource in step S3 includes an enterprise internal business system domain name or an IP address segment.

[0008] In a possible implementation, the repair resource in step S3 includes a security software download server address.

[0009] In a possible implementation, in step S1, the security software running state data of the terminal device is acquired in real time or periodically through an API interface or a file.

[0010] In a possible implementation, in step S1, the update frequency of the security compliance state information is 15 minutes / once.

[0011] Compared with the prior art, the device networking behavior management method provided in the application has the following beneficial effects: The terminal security management platform monitors the security software installation and running state of the terminal device, and the online behavior management device controls the network access restriction of the terminal device according to the security software installation and running state. In this way, the network access permission and the terminal security state are strongly bound, the management loophole depending on the employee's self-consciousness is eliminated from the technical level, and the security policy can be enforced. For non-compliant terminal devices, only intranet resources are allowed to be accessed, which not only guarantees the basic internal business access demand, but also completely blocks the security risks caused by random access to the Internet. The repair guide page is set, so that the user knows the problem source and solution, and can complete the repair by himself, improving the user experience and reducing the service pressure of the IT support department. After the terminal device completes the security repair and updates the security compliance state information, the online behavior management device automatically removes the network access restriction on the terminal device, forming a full-automatic closed-loop management process of detection-restriction-guidance-repair-recovery. BRIEF DESCRIPTION OF DRAWINGS

[0012] In order to more clearly illustrate the technical solutions in the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description only some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0013] Figure 1 The method flowchart of the device networking behavior management method provided by the embodiments of the application; DETAILED DESCRIPTION

[0014] To make the technical problems, technical solutions, and beneficial effects to be solved by this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the scope of this application.

[0015] It should be noted that when a component is referred to as being "fixed to" or "set on" another component, it can be directly on or indirectly on that other component. When a component is referred to as being "connected to" another component, it can be directly connected to or indirectly connected to that other component.

[0016] It should be understood that the terms "length", "width", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.

[0017] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" or "several" means two or more, unless otherwise explicitly specified.

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0019] Please refer to the following: Figure 1 The following describes a device networking behavior management method provided by an embodiment of this application.

[0020] A method for managing device network behavior includes the following steps: S1: Monitor the installation and operation status of security software on endpoint devices through an endpoint security management platform to generate security compliance status information; the endpoint security management platform can be a centrally deployed enterprise-level endpoint security management system. The endpoint security management platform periodically (e.g., every 15 minutes) collects process information and service status of the security software through agent programs installed on the endpoint devices to determine the installation and operation status of the security software and generate security compliance status information.

[0021] The generated security compliance status information can be stored in the database of the endpoint security management platform. The record entries should include at least: the version information of the security software, the installation status of the security software (yes / no), the running status of the security software (online / offline), the identifier of the endpoint device (such as IP, hostname), the name of the security software, and the last detection time.

[0022] S2: Synchronize security compliance status information to the Internet behavior management device; the synchronized information must at least include terminal identifiers such as IP address and their corresponding compliance status, such as compliant or non-compliant.

[0023] S3: Network access control policies are configured and executed on the internet access management device. Based on security compliance status information, network access control policies are implemented on non-compliant terminal devices, restricting their access to the network except for preset intranet resources and repaired resources. Access requests are intercepted, and a redirect page containing repair instructions is returned. The redirect page must clearly inform the user of the reason for the access restriction (e.g., "Your computer does not have the company's required endpoint security software installed"), and provide clear repair instructions and a direct download link for the correct security software installation package.

[0024] S4: After the terminal device completes the security repair and updates the security compliance status information, the Internet access management device automatically removes the network access restrictions on it.

[0025] Compared with the prior art, the beneficial effects of the device networking behavior management method provided in this application embodiment are: The device network behavior management method provided in this application is applicable to the network control of terminal devices in companies with confidentiality requirements, such as insurance companies. It can effectively reduce the risk of terminal devices being intruded into the network and improve network security.

[0026] This application embodiment monitors the installation and running status of security software on terminal devices through a terminal security management platform. The internet access management device controls network access restrictions on terminal devices based on the security software's installation and running status. This setup strongly binds network access permissions to the terminal's security status, eliminating management loopholes that rely on employee self-discipline and ensuring the enforcement of security policies. For non-compliant terminal devices, access to internal network resources is only permitted, ensuring basic internal business access needs while completely blocking the security risks posed by unrestricted internet access. A repair guidance page is provided, clearly explaining the root cause of the problem and the solution, enabling users to complete the repair themselves, improving user experience and reducing the service burden on IT support departments. After the terminal device completes security repair and updates its security compliance status information, the internet access management device automatically removes network access restrictions, forming a fully automated closed-loop management process of detection-restriction-guidance-repair-recovery.

[0027] In some possible embodiments, in step S1, the terminal security management platform can obtain the unique identifier of the terminal device and send the unique identifier to the Internet access behavior management device. The unique identifier includes at least one of IP address and MAC address, or both of the above. The Internet access behavior management device sets the network access permissions of the terminal device according to the unique identifier, which has a clear direction.

[0028] In some possible embodiments, step S3 presets internal network resources including domain names or IP address ranges of internal business systems to enable them to conduct internal business. The resources to be repaired include the address of a security software download server.

[0029] The remediation resources provide download or update links for security software, offering a unique, clear, and accessible remediation path for non-compliant endpoint devices, thus creating a complete closed loop in the entire control process. Users can obtain remediation tools themselves without needing IT support.

[0030] The system automatically redirects to the repair resource download interface, ensuring a smooth download channel for the installation package and avoiding a deadlock caused by network restrictions. By controlling which repair resource is downloaded, it ensures that the terminal downloads and installs the official version verified or designated by the company, avoiding secondary security risks that may arise from downloading from unofficial channels.

[0031] In some possible embodiments, in step S1, the security software runtime status data of the terminal device is acquired in real time or periodically via an API interface or file. The update frequency can be a configurable parameter, which the IT department can adjust according to actual needs. Common update frequencies range from 1 minute to 60 minutes.

[0032] Understandably, the choice between low-frequency and high-frequency updates can be made based on actual needs, ensuring that the system load remains within a reasonable range. The endpoint security management platform can assign appropriate update frequencies to different endpoint devices as needed.

[0033] It is understood that the parts in the above embodiments can be freely combined or deleted to form different combined embodiments. The specific contents of each combined embodiment will not be repeated here. After this description, it can be considered that the present invention specification has recorded each combined embodiment and can support different combined embodiments.

[0034] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for managing device network behavior, characterized in that, Includes the following steps: S1: Monitor the installation and operation status of security software on terminal devices through the terminal security management platform, and generate security compliance status information; S2: Synchronize the security compliance status information to the Internet access behavior management device; S3: Based on the security compliance status information, implement network access control policies for non-compliant terminal devices, restrict non-compliant terminal devices from accessing the network except for preset intranet resources and repair resources, intercept access requests and return a redirect page containing repair instructions; S4: After the terminal device completes the security repair and updates the security compliance status information, the Internet access management device automatically removes the network access restrictions on it.

2. The device network behavior management method according to claim 1, characterized in that, In step S1, the terminal security management platform can obtain the unique identifier of the terminal device and send the unique identifier to the Internet access behavior management device. The unique identifier includes at least one of IP address and MAC address. The Internet access behavior management device sets the network access permissions of the terminal device according to the unique identifier.

3. The device network behavior management method according to claim 1, characterized in that, The security compliance status information includes the security software version information, the security software installation status, and the security software running status.

4. The device network behavior management method according to claim 1, characterized in that, The preset intranet resources mentioned in step S3 include the domain names or IP address ranges of the enterprise's internal business systems.

5. The device network behavior management method according to claim 1, characterized in that, The resources to be repaired in step S3 include the address of a security software download server.

6. The device network behavior management method according to claim 1, characterized in that, In step S1, the security software running status data of the terminal device is obtained in real time or periodically through API interface or file.

7. The device network behavior management method according to claim 1, characterized in that, In step S1, the security compliance status information is updated every 15 minutes.

Images