Security authentication method and system for switch access terminal

Abstract

The invention provides a switch access terminal security authentication method and system, and the method comprises the steps: detecting a terminal access request through a switch, executing initial authentication based on a terminal hardware fingerprint and a user certificate, and generating and issuing a static key seed corresponding to a session after the authentication is passed; during the terminal access period, according to the track offset degree of the current behavior relative to the historical behavior, calculating the behavior abnormity membership degree; updating the dynamic trust value according to the abnormal behavior membership degree, and generating a security parameter containing a key strength parameter and a micro-isolation strategy identifier; and performing multiple rounds of hash derivation on the static key seed based on the key strength parameter to obtain a dynamic session key, retrieving an access control rule from a policy library in combination with the micro-isolation policy identifier, and issuing the access control rule to a switch to realize communication encryption and dynamic network access control. By adopting the scheme of the invention, adaptive regulation and control of the dynamic key and access control based on terminal behavior perception can be realized, so that the security protection response capability of the switch access environment is improved.

Description

Technical Field

[0001] This application relates to the field of security authentication technology, and more specifically, to a security authentication method and system for switch access terminals. Background Technology

[0002] As enterprise networks expand and terminal types diversify, switches, as core access layer devices, generally require unified security authentication and access control for a large number of terminals. Existing switch access authentication mechanisms mostly rely on static authentication methods based on account passwords, certificates, or hardware identifiers, and establish fixed communication keys and access control policies after authentication to ensure basic communication security and network isolation after terminal access. However, in complex network environments, terminal behavior has significant dynamism and uncertainty, and traditional static authentication and fixed policy models are no longer sufficient to meet the needs of refined and continuous security protection.

[0003] In existing technologies, after a terminal completes one-time authentication, it typically uses the same key strength and access control rules throughout the entire session. This lacks a continuous awareness and adjustment mechanism for changes in terminal behavior after access. When a terminal exhibits abnormal access behavior, abuses permissions, or is maliciously controlled during a session, existing solutions struggle to adjust communication keys and access permissions in a timely manner. This leads to delayed security policy responses, a persistent attack window, and increased risks of lateral movement and internal spread. Furthermore, key updates and access control adjustments often rely on manual triggering or centralized policy refreshes, failing to create a closed-loop linkage with the real-time behavior of the terminal, significantly limiting the proactiveness and granularity of security protection. Therefore, how to achieve dynamic key and access control adaptive adjustment based on terminal behavior awareness to improve the security response capabilities of switch access environments has become a challenging problem for the industry. Summary of the Invention

[0004] This application provides a method and system for secure authentication of switch access terminals, which can realize dynamic key and access control adaptive adjustment based on terminal behavior perception, thereby improving the security protection and response capabilities of the switch access environment.

[0005] Firstly, this application provides a method for secure authentication of a terminal accessing a switch, applied in a network environment where a terminal, a switch, and an authentication server collaborate. The method includes the following steps: In response to the switch detecting the terminal's access request, it performs initial authentication based on the terminal's hardware fingerprint and user credentials. After successful authentication, it generates and distributes a static key seed corresponding to the terminal session. During terminal access, the terminal's behavioral characteristics are collected, a behavioral baseline is adaptively determined based on historical sessions, and the membership degree of behavioral anomalies is calculated based on the trajectory offset of the current behavioral characteristics relative to the behavioral baseline. The dynamic trust value of the terminal is updated based on the abnormal behavior membership, and dynamic security parameters containing key strength parameters and micro-segmentation policy identifiers are generated based on the updated dynamic trust value. Based on the key strength parameter, the static key seed is hashed multiple times to obtain a dynamic session key, and access control rules are retrieved from the policy library according to the micro-segmentation policy identifier; The dynamic session key and the access control rules are sent to the switch, enabling the switch to use the dynamic session key for communication encryption and to dynamically adjust the network access permissions of the terminal according to the access control rules.

[0006] Preferably, in response to the switch detecting an access request from a terminal, the initial authentication based on the terminal hardware fingerprint and user credentials specifically includes: The switch collects the hardware fingerprint information and user login credentials submitted by the terminal; The hardware fingerprint information and user login credentials are forwarded to the authentication server for matching and verification. Receive the verification result returned by the authentication server, and decide whether to allow or deny the terminal's access based on the verification result.

[0007] Preferably, generating and issuing a static key seed corresponding to the terminal session after successful authentication specifically includes: The authentication server generates a random number uniquely associated with the current session and combines it with the current timestamp to generate the static key seed; The static key seed is encrypted using the public key of the terminal, and the encryption result is sent to the terminal. The static key seed is encrypted using a key shared with the switch, and the encryption result is sent to the switch. The terminal and the switch decrypt the received encrypted information and store the static key seed locally.

[0008] Preferably, calculating the membership degree of behavioral anomalies based on the trajectory deviation of the current behavioral characteristics relative to the behavioral baseline specifically includes: The real-time collected behavioral feature stream is divided into sliding time windows to construct continuous behavioral feature trajectories; The behavioral feature trajectory is input into a state evolution probability model trained based on historical normal behavior to calculate the generation likelihood of the behavioral feature trajectory; An offset penalty is introduced into the generated likelihood and a logarithmic domain mapping is performed to obtain the trajectory anomaly energy value; The trajectory anomaly energy value is normalized based on a nonlinear membership mapping function, and the behavioral anomaly membership degree is output in the range of 0 to 1.

[0009] Preferably, obtaining the dynamic session key by performing multiple rounds of hash derivation on the static key seed based on the key strength parameter specifically includes: Read the key strength parameter, where the value N represents the round of hash derivation; Using the static key seed as the initial input, perform the first round of hash operation; Use the output of the previous round of hashing as the input of the next round of hashing, and repeat this process until N rounds of hashing are completed; The output of the Nth round of hash operation is used as the final dynamic session key.

[0010] Preferably, retrieving access control rules from the policy library based on the micro-segmentation policy identifier specifically includes: In the preset policy library, an index search is performed according to the micro-segmentation policy identifier; Verify that the found policy entries are valid; Extract the access control list defined under this policy entry, which contains information on allowed or denied access protocols, ports, and network addresses.

[0011] Preferably, the process of sending the dynamic session key and the access control rules to the switch, enabling the switch to use the dynamic session key for communication encryption and dynamically adjust the network access permissions of the terminal according to the access control rules, specifically includes: The authentication server encapsulates the dynamic session key and the access control rules into a policy update instruction and sends it to the switch; The switch receives and parses the policy update instruction, and extracts the dynamic session key and access control rules; The switch uses the dynamic session key to replace the old encryption key used to communicate with the terminal; The switch configures its access control list according to the access control rules, dynamically restricting or allowing specific network traffic sent by the terminal.

[0012] Secondly, this application provides a security authentication system for switch access terminals, comprising: The initial authentication module is used to respond to the switch detecting the terminal's access request, perform initial authentication based on the terminal's hardware fingerprint and user credentials, and generate and issue a static key seed corresponding to the terminal session after successful authentication. The feature processing module is used to collect the behavioral features of the terminal during terminal access, adaptively determine the behavioral baseline based on historical sessions, and calculate the membership degree of behavioral anomalies based on the trajectory offset of the current behavioral features relative to the behavioral baseline. The feature processing module is further configured to update the dynamic trust value of the terminal based on the abnormal behavior membership, and generate dynamic security parameters including key strength parameters and micro-segmentation policy identifiers based on the updated dynamic trust value. The feature processing module is also used to perform multiple rounds of hash derivation on the static key seed based on the key strength parameter to obtain a dynamic session key, and to retrieve access control rules from the policy library according to the micro-segmentation policy identifier; The execution module is used to send the dynamic session key and the access control rules to the switch, so that the switch uses the dynamic session key for communication encryption and dynamically adjusts the network access permissions of the terminal according to the access control rules.

[0013] Thirdly, this application provides a computer device, the computer device including a memory and a processor, the memory storing code, and the processor being configured to acquire the code and execute the above-described switch access terminal security authentication method.

[0014] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described security authentication method for switch access terminals.

[0015] The technical solutions provided by the embodiments disclosed in this application have the following beneficial effects: This application proposes a closed-loop security protection mechanism centered on terminal behavior perception for switch access scenarios. This mechanism enables continuous assessment of access trustworthiness and real-time execution on the network side. First, initial authentication is completed by combining terminal hardware fingerprints and user credentials, establishing the uniqueness and trustworthiness of the access subject at both physical and identity attribute levels, providing a stable and traceable starting point for subsequent security control. Second, during terminal access, behavioral characteristics are continuously collected, and the deviation of the current behavioral trajectory is calculated using a behavioral baseline formed from historical sessions as a reference. This yields the behavioral anomaly membership degree, transforming the terminal's operational status from traditional static compliance judgment to a quantifiable and continuously evolving risk representation, enhancing the sensitivity and timeliness of anomaly identification. Furthermore, the dynamic trust value of the terminal is updated based on the behavioral anomaly membership degree, and this dynamic trust value is mapped to... This solution generates dynamic security parameters, including key strength parameters and micro-segmentation policy identifiers, enabling trust assessment results to directly drive adjustments to security capabilities, avoiding the problems of fixed trust levels and delayed responses in existing technologies. Then, based on the key strength parameters, a dynamic session key is generated by multi-round hashing of the static key seed. This, combined with the micro-segmentation policy identifier, selects appropriate access control rules from a policy library, ensuring that communication encryption strength and network access range are synchronously matched to the terminal's current risk level. Finally, the dynamic session key and access control rules are uniformly distributed to the switch for execution, allowing security decisions to take effect immediately at the network boundary, reducing latency and execution deviations caused by centralized control. In summary, this solution enables adaptive adjustment of dynamic keys and access control based on changes in terminal behavior, comprehensively improving the response efficiency and protection effectiveness of the switch access environment against security risks. Attached Figure Description

[0016] Figure 1 This is an exemplary flowchart of a switch access terminal security authentication method according to some embodiments of this application; Figure 2 This is a schematic diagram of the logical framework for initial authentication according to some embodiments of this application; Figure 3 This is a schematic diagram of the process for updating dynamic trust values ​​according to some embodiments of this application; Figure 4 This is a schematic diagram of the structure of a switch access terminal security authentication system according to some embodiments of this application; Figure 5 This is a schematic diagram of the structure of a computer device that implements a secure authentication method for a switch access terminal according to some embodiments of this application. Detailed Implementation

[0017] To better understand the technical solution of this application, the technical solution of this application will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0018] refer to Figure 1 The figure is an exemplary flowchart of a switch access terminal security authentication method according to some embodiments of this application. The switch access terminal security authentication method mainly includes the following steps: In step 101, in response to the switch detecting the terminal's access request, initial authentication based on the terminal's hardware fingerprint and user credentials is performed. After successful authentication, a static key seed corresponding to the terminal session is generated and distributed.

[0019] In some embodiments, reference Figure 2 As shown in the figure, this is a schematic diagram of the logical framework for initial authentication according to some embodiments of this application. In this embodiment, in response to the switch detecting the access request of the terminal, the initial authentication based on the terminal hardware fingerprint and user credentials can be implemented by the following steps: The switch collects the hardware fingerprint information and user login credentials submitted by the terminal; The hardware fingerprint information and user login credentials are forwarded to the authentication server for matching and verification. Receive the verification result returned by the authentication server, and decide whether to allow or deny the terminal's access based on the verification result.

[0020] It should be noted that the hardware fingerprint information in this application is a feature dataset used to uniquely identify the physical or inherent attributes of the terminal device; the user login credential is credential information used to verify the legitimacy of the operator's identity; and the matching verification is a security verification process used to check whether the authentication materials submitted by the terminal are consistent with the pre-registered authorization records.

[0021] In practical applications, firstly, when the physical port link state of the switch becomes active or a specific link layer discovery protocol message is received, an access request is detected. The switch then sends an Extensible Authentication Protocol (EAP) request message to the terminal. The terminal responds to this message by filling the payload of its EAP response frame with the Media Access Control address (MAC) as hardware fingerprint information and the username and password as user login credentials, thus completing credential collection. Then, the switch, acting as an authentication client, follows the Remote User Dial-up Authentication Service (RPDS) protocol, re-encapsulates the received EAP response frame into a RDS access request message, and sends it to the designated RDS authentication service using a pre-configured shared key and Internet Protocol (IP) address. The authentication server implements secure credential forwarding and verification requests. Upon receiving a request, the authentication server verifies the validity of the username, password, and media access control address binding based on its local database or the connected backend directory service, and generates a remote user dial-up authentication service access acceptance or denial message to reply to the switch. Finally, the switch parses the reply message: if the access is accepted, the corresponding port is assigned to a pre-defined virtual LAN with permitted access and data forwarding is enabled; if the access is denied, the port remains in a restricted state or is placed in an isolated virtual LAN, thus completing the decision to allow or deny terminal access. The entire process is based on the mature 802.1X, extensible authentication protocol, and remote user dial-up authentication service protocol stack, which will not be elaborated here.

[0022] In some embodiments, generating and issuing a static key seed corresponding to the terminal session after successful authentication can be achieved through the following steps: The authentication server generates a random number uniquely associated with the current session and combines it with the current timestamp to generate the static key seed; The static key seed is encrypted using the public key of the terminal, and the encryption result is sent to the terminal. The static key seed is encrypted using a key shared with the switch, and the encryption result is sent to the switch. The terminal and the switch decrypt the received encrypted information and store the static key seed locally.

[0023] It should be noted that the authentication server in this application is a dedicated server used to centrally verify the identity of the terminal and determine its network access permissions; the random number refers to a numerical sequence with a high entropy value that ensures the unpredictability of the generated key; the timestamp refers to a time marker that identifies the key generation time and ensures the key's timeliness and uniqueness; the static key seed is a basic cryptographic parameter that serves as a dynamically derived session key and remains fixed throughout the lifecycle of a single session; the terminal's public key refers to the public cryptographic key used for encryption operations and paired with the terminal's private key, which typically originates from the digital certificate submitted by the terminal during the authentication phase.

[0024] In practical application, firstly, after the authentication server determines that the authentication is successful, its built-in cryptographically secure pseudo-random number generator produces a high-entropy random number. Simultaneously, the server reads the current precise time from the system clock to generate a timestamp. The server concatenates the random number and timestamp byte-by-byte and inputs the result into a cryptographic hash function (such as SHA-256) for calculation. The resulting fixed-length hash value is determined as the static key seed for this session. Secondly, the server retrieves the digital certificate provided by the terminal during the authentication phase, extracts the terminal's public key, and uses an asymmetric encryption algorithm (such as RSA-OAEP) to encrypt the static key seed with this public key. Finally, the connection is established via a transport layer security protocol. The encryption result is sent to the terminal; then, the server reads the symmetric key (such as an AES-256 key) that has been pre-negotiated with the access switch from its local security configuration, and uses this key to encrypt the same static key seed. Then, the encrypted result is sent to the switch through a secure network management protocol (such as NETCONF based on SSH). Finally, the terminal uses its own private key to perform asymmetric decryption of the received ciphertext, and the switch uses the pre-shared symmetric key to perform symmetric decryption of the received ciphertext. After both successfully restore the static key seed, they securely store it in the protected key storage area on the device's local machine, thus completing the entire secure generation and distribution process of the key seed.

[0025] In step 102, during terminal access, the terminal's behavioral characteristics are collected, a behavioral baseline is adaptively determined based on historical sessions, and the membership degree of behavioral anomalies is calculated based on the trajectory offset of the current behavioral characteristics relative to the behavioral baseline.

[0026] It should be noted that during terminal access, collecting terminal behavior characteristics refers to the continuous monitoring and structured sampling of observable operational behavior of the terminal during network access by the switch side and the terminal agent module in collaboration after the terminal establishes a valid session with the switch. Specifically, this includes collecting behavioral elements such as the terminal's communication connection mode, session establishment and release frequency, message interaction timing characteristics, protocol usage distribution, access resource type and access order, etc., and normalizing and encoding the behavioral elements according to a preset sampling period and time window to form behavioral feature data for behavior modeling and anomaly assessment.

[0027] In some embodiments, adaptively determining a behavioral baseline based on historical sessions can be achieved through the following steps: Obtain a dataset of multiple session behavior features of the terminal within a preset historical period; Perform statistical analysis on the feature values ​​of each dimension in the behavioral feature dataset and calculate its normal distribution range; The core interval of the normal distribution range is defined as the behavioral baseline of the terminal.

[0028] It should be noted that the normal distribution range in this application is a statistical descriptive indicator used to quantify the fluctuation range of each behavioral characteristic value of the terminal under historical normal conditions; the behavioral baseline is an indicator that describes the typical range and pattern of the terminal's behavioral characteristics under normal session.

[0029] In practical applications, firstly, during terminal access and historical sessions, behavioral characteristic data of the terminal is continuously collected, including network traffic patterns, session frequency, resource access order, and port usage. This characteristic data is then structured and stored according to a unified time window. This step can be achieved using existing network monitoring and data acquisition technologies, such as traffic acquisition probes and system call log aggregation tools. Secondly, statistical analysis is performed on the stored historical behavioral characteristic dataset. The mean, variance, and confidence interval are calculated for each characteristic dimension to determine its normal distribution range. This step can use well-known statistical analysis methods. Finally, the normal distribution core intervals of each characteristic dimension are integrated to form a behavioral baseline representing the typical behavioral pattern of the terminal, which is then stored in the behavioral model database for real-time behavioral anomaly detection.

[0030] In some embodiments, calculating the membership degree of behavioral anomalies based on the trajectory offset of the current behavioral characteristics relative to the behavioral baseline can be achieved using the following steps: The real-time collected behavioral feature stream is divided into sliding time windows to construct continuous behavioral feature trajectories; The behavioral feature trajectory is input into a state evolution probability model trained based on historical normal behavior to calculate the generation likelihood of the behavioral feature trajectory; An offset penalty is introduced into the generated likelihood and a logarithmic domain mapping is performed to obtain the trajectory anomaly energy value; The trajectory anomaly energy value is normalized based on a nonlinear membership mapping function, and the behavioral anomaly membership degree is output in the range of 0 to 1.

[0031] It should be noted that the trajectory offset in this application is an indicator that measures the deviation and evolution trend of the terminal's real-time behavioral characteristics relative to the historical behavioral baseline; the feature trajectory describes the change trajectory of the terminal's behavioral characteristics over time during the access session; the state evolution probability model refers to a probability model used to describe the hidden state sequence of terminal behavior changes over time and the generation law of its observed features, specifically a hidden Markov model, Markov decision process, or other sequence probability model; the generation likelihood refers to the probability of the observed terminal behavioral feature trajectory appearing under the state evolution probability model; the trajectory anomaly energy value is a quantitative indicator that measures the degree to which the terminal's behavioral trajectory deviates from the normal behavioral pattern; and the behavioral anomaly membership degree is a normalized indicator that measures the degree to which the terminal's current behavior deviates from the normal behavioral baseline.

[0032] In practical applications, firstly, the real-time collected behavioral feature stream is segmented according to a sliding time window to construct a continuous behavioral feature trajectory. This can be achieved by segmenting the real-time collected multi-dimensional behavioral feature stream of the terminal according to a sliding time window to form a continuous sequence of behavioral feature vectors. The data within each time window may include session frequency, access resource type, port usage, and communication message characteristics, etc. This step can be achieved using known time series data processing methods and buffer queue technology. Secondly, the behavioral feature trajectory is input into a state evolution probability model trained based on historical normal behavior to calculate the generation of the behavioral feature trajectory. Likelihood can be achieved as follows: The continuous behavioral feature trajectory formed by the terminal during access can be input as an observation sequence into a state evolution probability model pre-trained using historical normal behavior data. This state evolution probability model can be a Hidden Markov Model (HMM), where each hidden state represents the typical behavior pattern of the terminal within a specific time period. Each state is associated with a multidimensional observation feature vector through an emission probability distribution, and the behavioral evolution law between states is described by a transition probability matrix. Then, a forward algorithm is used to recursively calculate the input observation sequence by accumulating the values ​​at each time step. The emission probability and state transition probability are used to obtain the overall generation likelihood of the trajectory under the model, i.e., the probability of the trajectory appearing under the historical normal behavior pattern. This generation likelihood is then used as a basic indicator to measure the deviation of the current behavior from the normal pattern. Next, an offset penalty is introduced into the generation likelihood, and a logarithmic domain mapping is performed to obtain the trajectory anomaly energy value. This can be achieved by taking the logarithm of the generation likelihood value calculated through the state evolution probability model to obtain the initial energy index, thus converting the product form of the probability into an additive form for easier subsequent calculation and weighting. The offset penalty is introduced to enhance the magnitude and duration of abnormal deviations in the behavior trajectory. The continuous impact makes sudden or persistent anomalies more obvious in the energy value. In specific implementation, the offset factor of each time window can be calculated based on the deviation magnitude and duration of each continuous time window in the behavioral feature trajectory relative to the historical behavioral baseline. This offset factor can be proportional to the standard deviation or confidence interval deviation of the historical behavioral baseline. It can also be combined with a weighting function to amplify the abnormal mutation segment. Then, the offset factor of each time window is linearly combined or accumulated with the initial logarithm to form a weighted anomaly energy value, which reflects the overall deviation of the entire behavioral trajectory. Finally, the accumulated weighted anomaly energy value is used as the trajectory anomaly energy value.Finally, the trajectory anomaly energy value is normalized based on a nonlinear membership mapping function. The behavioral anomaly membership degree, with an output range of 0 to 1, can be achieved as follows: The reason for introducing a nonlinear membership mapping function is that mapping anomaly energy values ​​of different amplitudes and distributions to a unified 0-1 range allows for nonlinear compression and amplification, smoothing out slightly deviating behaviors while providing higher membership values ​​for significantly anomalous behaviors. This enhances the ability to distinguish anomalous behaviors in subsequent trust assessments and security policy adjustments. Specifically, an S-shaped or logistic function can be selected as the membership mapping function. The input trajectory anomaly energy value undergoes a nonlinear transformation, and the mapping curve is adjusted using preset lower, upper, and slope parameters to strictly limit the output value to between 0 and 1. In engineering implementation, the anomaly energy value can be normalized to a standardized input within the function's domain. Then, the normalized behavioral anomaly membership degree is calculated using the function. This value directly reflects the degree to which the terminal's current behavior deviates from the normal behavior baseline and can be used for dynamic trust value updates and risk control strategy execution.

[0033] It should be noted that the proposed solution combines real-time behavioral feature trajectories with historical normal behavior models and introduces offset penalties and nonlinear membership mapping to quantify terminal behavioral deviations into continuous and normalized behavioral anomaly membership degrees. Compared with existing methods that rely solely on static thresholds or single probability models, this solution can accurately reflect the magnitude and persistence of behavioral deviations. It solves the problems of traditional methods being insensitive to sudden anomalies and gradual deviations, and having discontinuous anomaly quantification. At the same time, it provides accurate and quantifiable evidence for dynamic trust updates and fine-grained security policy control, significantly improving the real-time performance, accuracy, and adaptability of terminal risk identification. This demonstrates the innovation and technical depth of the solution in behavioral deviation quantification and risk control.

[0034] In step 103, the dynamic trust value of the terminal is updated according to the abnormal behavior membership, and dynamic security parameters including key strength parameters and micro-segmentation policy identifiers are generated according to the updated dynamic trust value.

[0035] In some embodiments, reference Figure 3 As shown in the figure, this is a schematic diagram of the process of updating the dynamic trust value in some embodiments of this application. In this embodiment, updating the dynamic trust value of the terminal according to the behavior anomaly membership degree can be achieved by the following steps: In step 1031, the prior probability distribution is determined based on the dynamic trust value of the historical period; In step 1032, a likelihood function characterizing the credibility of the current session is constructed based on the membership degree of the behavioral anomaly. In step 1033, Bayesian inference is applied to fuse the prior probability distribution with the likelihood function to calculate the posterior probability distribution; In step 1034, the expected value of the posterior probability distribution is taken as the updated dynamic trust value.

[0036] It should be noted that the prior probability distribution in this application refers to the initial probability distribution of terminal credibility based on historical behavioral data before considering the current observation; the likelihood function refers to the probability distribution function of the terminal occurring in each possible credibility state based on the current observation data; the posterior probability distribution refers to the probability distribution obtained by updating the terminal credibility after combining the current observation and prior information; and the expected value is a quantitative indicator that measures the average credibility of variables under the probability distribution.

[0037] In practical application, firstly, the prior probability distribution is determined based on the dynamic trust value of historical periods. This step can be achieved by using an exponentially weighted moving average (EWMA) or a discrete probability grid method to construct a smooth prior distribution. The decay coefficient is used to control the weight of historical session data, ensuring that the prior probability reflects the overall credibility of the terminal's past behavior. Secondly, based on the abnormal membership degree calculated in the current period, a likelihood function representing the credibility of the current session is constructed. Specifically, this can be achieved by mapping the membership degree to a probability value. For example, by setting a deviation sensitivity coefficient β, the abnormal membership degree R can be mapped to L(R) = exp(-β·R) or L(R) = 1 - R^β, thereby quantifying the impact of the deviation behavior on the trust value of the current period. Then, Bayesian inference is applied to fuse the prior probability distribution with the likelihood function to calculate the posterior probability distribution. This can be achieved using discrete grid or numerical integration methods, ensuring that the fused distribution reflects both historical behavior and current abnormal deviation. Finally, the expected value or weighted mean of the posterior probability distribution is taken as the updated dynamic trust value for the current period.

[0038] It should be noted that in this application's solution, updating the dynamic trust value combines historical dynamic trust information with real-time behavioral anomaly membership, achieving continuous quantification and dynamic adjustment of terminal trustworthiness. Compared to traditional fixed threshold or single-anomaly judgment methods, this solution utilizes prior probability distribution to capture historical behavioral trends, employs a likelihood function to accurately reflect the risk of current behavioral deviation, and fuses the two through Bayesian inference to generate a posterior probability distribution. The dynamic trust value is then output as an expected value, thus achieving smooth trustworthiness updates and adaptive responses. This method not only distinguishes and weights sudden anomalies and persistent deviations but also maintains the stability of dynamic trust when the degree of behavioral anomaly changes slightly, ensuring the rationality and accuracy of key strength adjustment and micro-segmentation strategy execution. This significantly improves the real-time performance, accuracy, and adaptability of security strategies in terminal risk identification.

[0039] In some embodiments, generating dynamic security parameters containing key strength parameters and micro-segmentation policy identifiers based on the updated dynamic trust value can be achieved through the following steps: Multiple dynamic trust value ranges are preset, and each range is mapped to a specific key derivation round number as a key strength parameter. Multiple dynamic trust value ranges are preset, and each range is mapped to a predefined micro-segmentation policy identifier; Based on the range to which the updated dynamic trust value belongs, determine the corresponding key strength parameters and micro-segmentation policy identifier, and combine them to generate dynamic security parameters.

[0040] It should be noted that the key strength parameter in this application refers to an indicator used to control the number of rounds of session key derivation and encryption complexity, in order to quantify the security level of terminal communication; the micro-segmentation policy identifier in this application refers to a fine-grained access control rule category or level that the terminal should execute in the network, so as to dynamically limit the resources and permissions it can access.

[0041] In practical applications, firstly, the system can preset several dynamic trust value ranges, each corresponding to a specific number of key derivation rounds to control the encryption strength of the session key. For example, a trust value of 0.8–1.0 can be mapped to four rounds of hash derivation, 0.5–0.8 to three rounds, and 0–0.5 to two rounds. This range mapping can be achieved through a known mapping table or lookup array. Secondly, for the micro-segmentation policy, several trust value ranges are also preset, each mapped to a corresponding access control policy identifier. For example, a high trust value enables the minimum isolation policy, a medium trust value enables the medium isolation policy, and a low trust value enables the strict isolation policy. This mapping can be achieved through a policy library index or a hash table. Finally, the system determines the range to which the dynamic trust value belongs based on the updated dynamic trust value of the current period, retrieves and obtains the corresponding number of key derivation rounds and micro-segmentation policy identifier, and combines the two to generate the dynamic security parameters for the current period.

[0042] In step 104, the static key seed is hashed multiple times based on the key strength parameter to obtain a dynamic session key, and access control rules are retrieved from the policy library according to the micro-segmentation policy identifier.

[0043] In some embodiments, obtaining a dynamic session key by performing multiple rounds of hash derivation on the static key seed based on the key strength parameter can be achieved using the following steps: Read the key strength parameter, where the value N represents the round of hash derivation; Using the static key seed as the initial input, perform the first round of hash operation; Use the output of the previous round of hashing as the input of the next round of hashing, and repeat this process until N rounds of hashing are completed; The output of the Nth round of hash operation is used as the final dynamic session key.

[0044] It should be noted that the dynamic session key in this application refers to a temporary key used to encrypt and protect terminal communication in the current session and to support adaptive adjustment of security policies; the hash operation refers to the calculation process of mapping input data of arbitrary length into a fixed-length, irreversible, and highly sensitive unique output digest through a deterministic algorithm.

[0045] In practical application, firstly, the system reads the key strength parameter N generated in this cycle. This parameter represents the number of rounds of hash derivation and is used to control the complexity and security level of the final dynamic session key. Then, the static key seed is used as the initial input for the first round of hash operation. A known hash algorithm, such as SHA-256 or SHA-3, is used to perform a hash operation on the input to obtain the first round of hash output. Next, the hash output of the previous round is used as the input for the next round of hash operation, and N rounds of hash operations are performed sequentially. Each round uses the same known hash function, and a round index or salt value can be added if necessary to enhance randomness. After completing the Nth round of hash operation, the output of this round is used as the final dynamic session key and updated locally or through a secure channel to the switch and terminal storage for use in subsequent encrypted communication.

[0046] In some embodiments, retrieving access control rules from the policy library based on the micro-segmentation policy identifier can be achieved using the following steps: In the preset policy library, an index search is performed according to the micro-segmentation policy identifier; Verify that the found policy entries are valid; Extract the access control list defined under this policy entry, which contains information on allowed or denied access protocols, ports, and network addresses.

[0047] It should be noted that the policy library in this application refers to a structured database used to store and manage various access control rules and micro-segmentation policy entries; the access control list refers to a set of rules defined on a network device for controlling packet forwarding and access permissions.

[0048] In practical application, firstly, in a pre-built policy library, each policy entry is indexed with its corresponding micro-segmentation policy identifier to achieve rapid location. This operation can be implemented through database indexing or hash mapping technology, which are common operations in network management systems. Secondly, the validity of the found policy entries is verified. This can be done by checking the policy entry's effective time, status flag, or signature verification to ensure that only currently valid policies are used. Finally, an access control list is extracted from the valid policy entries. The access control list contains the network protocols, port numbers, and Internet Protocol (IP) addresses or subnet information that allow or deny access, for switches or network devices to configure access control rules. Throughout the process, index lookup, status verification, and access control list extraction are all common operations in existing network management systems and will not be elaborated here.

[0049] In step 105, the dynamic session key and the access control rules are sent to the switch, so that the switch uses the dynamic session key for communication encryption and dynamically adjusts the network access permissions of the terminal according to the access control rules.

[0050] In some embodiments, the dynamic session key and the access control rules are distributed to the switch, enabling the switch to use the dynamic session key for communication encryption and dynamically adjust the network access permissions of the terminal according to the access control rules. This can be achieved through the following steps: The authentication server encapsulates the dynamic session key and the access control rules into a policy update instruction and sends it to the switch; The switch receives and parses the policy update instruction, and extracts the dynamic session key and access control rules; The switch uses the dynamic session key to replace the old encryption key used to communicate with the terminal; The switch configures its access control list according to the access control rules, dynamically restricting or allowing specific network traffic sent by the terminal.

[0051] It should be noted that the policy update instruction in this application refers to the control used to securely distribute dynamic session keys and access control rules to the switch in order to achieve terminal communication encryption and dynamic adjustment of access permissions.

[0052] In practical application, firstly, the authentication server encapsulates the generated dynamic session key and corresponding access control rules into a policy update instruction. This instruction can be encapsulated using existing network management protocols such as SNMP, NETCONF, or a custom security control message format, and sent to the switch through an encrypted transmission channel to ensure confidentiality and integrity during transmission. Secondly, after receiving the policy update instruction, the switch uses a known parsing mechanism to decapsulate the message, extract the dynamic session key and access control rules, and verify the integrity and validity of the instruction. Then, the switch replaces the old encryption key of the current session with the extracted dynamic session key and applies it to the data plane encryption process to achieve real-time encryption of terminal communication content. At the same time, the switch updates the local Access Control List (ACL) according to the access control rules. This list can be dynamically configured through standard network control commands, thereby finely restricting or allowing specific traffic of terminals, achieving network isolation and access control based on risk assessment.

[0053] It should be further explained that this application organically combines dynamic key management and micro-segmentation access control policies through terminal behavior perception and dynamic trust assessment to achieve end-to-end adaptive security protection. Specifically, this is reflected in the following aspects: First, a dynamic behavior baseline and trajectory offset calculation method based on historical session and real-time behavior characteristics is introduced to achieve quantitative assessment of abnormal terminal behavior, providing a quantifiable basis for dynamic trust value updates; second, the terminal trust value is dynamically updated based on Bayesian inference of abnormal behavior membership, enabling key strength and access control policies to be adjusted in real time according to the terminal's risk status; third, the dynamic trust value is mapped to key strength parameters and micro-segmentation policy identifiers, enabling multi-round hash-derived dynamic session key generation and dynamic selection of access control rules; finally, the dynamic session key and access control rules are sent to the switch in real time through policy update commands, enabling the switch to immediately replace communication keys and dynamically adjust terminal network access permissions according to the micro-segmentation policy. Through the above scheme, encryption strength and fine-grained access control can be enhanced in real time in response to changes in terminal behavior, improving overall network security, protection adaptability, and attack response capabilities, while ensuring the system's scalability and operability.

[0054] On the other hand, in some embodiments, this application provides a switch access terminal security authentication system, referencing Figure 4 The figure is a schematic diagram of the structure of a switch access terminal security authentication system 400 according to some embodiments of this application. The switch access terminal security authentication system 400 includes: an initial authentication module 401, a feature processing module 402, and an execution module 403, which are described below: The initial authentication module 401 in this application is mainly used to respond to the switch detecting the access request of the terminal, perform initial authentication based on the terminal hardware fingerprint and user credentials, and generate and issue a static key seed corresponding to the terminal session after successful authentication. The feature processing module 402 in this application is used to collect the behavioral features of the terminal during terminal access, adaptively determine the behavioral baseline based on historical sessions, and calculate the behavioral anomaly membership degree based on the trajectory offset of the current behavioral features relative to the behavioral baseline. In this application, the feature processing module 402 is also used to update the dynamic trust value of the terminal according to the abnormal behavior membership, and generate dynamic security parameters including key strength parameters and micro-segmentation policy identifiers according to the updated dynamic trust value. In this application, the feature processing module 402 is also used to perform multiple rounds of hash derivation on the static key seed based on the key strength parameter to obtain a dynamic session key, and to retrieve access control rules from the policy library according to the micro-segmentation policy identifier; The execution module 403 in this application is mainly used to send the dynamic session key and the access control rules to the switch, so that the switch uses the dynamic session key for communication encryption and dynamically adjusts the network access permissions of the terminal according to the access control rules.

[0055] In addition, this application also provides a computer device, the computer device including a memory and a processor, the memory storing code, and the processor being configured to acquire the code and execute the above-described switch access terminal security authentication method.

[0056] In some embodiments, reference Figure 5 This figure is a schematic diagram of the structure of a computer device implementing a switch access terminal security authentication method according to some embodiments of this application. The switch access terminal security authentication method in the above embodiments can... Figure 5 The computer device shown is used to implement this, and the computer device 500 includes at least one processor 501, a communication bus 502, a memory 503, and at least one communication interface 504.

[0057] Processor 501 can be a general-purpose central processing unit (CPU) or an application-specific integrated circuit (ASIC).

[0058] The communication bus 502 can be used to transmit information between the aforementioned components.

[0059] Memory 503 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile optical discs, Blu-ray discs, etc.), magnetic disks or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. Memory 503 may exist independently and be connected to processor 501 via communication bus 502. Memory 503 may also be integrated with processor 501.

[0060] The memory 503 stores program code for executing the scheme of this application, and its execution is controlled by the processor 501. The processor 501 executes the program code stored in the memory 503. The program code may include one or more software modules. In the above embodiment, the switch access terminal security authentication method can be implemented by the processor 501 and one or more software modules in the program code in the memory 503.

[0061] Communication interface 504 uses any transceiver-like device to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0062] In a specific implementation, as one example, a computer device may include multiple processors, each of which may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. Here, a processor may refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0063] The aforementioned computer device can be a general-purpose computer device or a special-purpose computer device. In specific implementations, the computer device can be a desktop computer, a portable computer, a network server, a handheld digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, or an embedded device. This application does not limit the type of computer device.

[0064] In addition, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described security authentication method for switch access terminals.

[0065] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0066] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for secure authentication of terminal access via a switch, applied in a network environment where a terminal, a switch, and an authentication server collaborate, characterized in that, The method includes the following steps: In response to the switch detecting the terminal's access request, it performs initial authentication based on the terminal's hardware fingerprint and user credentials. After successful authentication, it generates and distributes a static key seed corresponding to the terminal session. During terminal access, the terminal's behavioral characteristics are collected, a behavioral baseline is adaptively determined based on historical sessions, and the membership degree of behavioral anomalies is calculated based on the trajectory offset of the current behavioral characteristics relative to the behavioral baseline. The dynamic trust value of the terminal is updated based on the abnormal behavior membership, and dynamic security parameters containing key strength parameters and micro-segmentation policy identifiers are generated based on the updated dynamic trust value. Based on the key strength parameter, the static key seed is hashed multiple times to obtain a dynamic session key, and access control rules are retrieved from the policy library according to the micro-segmentation policy identifier; The dynamic session key and the access control rules are sent to the switch, enabling the switch to use the dynamic session key for communication encryption and to dynamically adjust the network access permissions of the terminal according to the access control rules.

2. The method as described in claim 1, characterized in that, In response to the switch detecting an access request from a terminal, the initial authentication based on the terminal hardware fingerprint and user credentials is performed, specifically including: The switch collects the hardware fingerprint information and user login credentials submitted by the terminal; The hardware fingerprint information and user login credentials are forwarded to the authentication server for matching and verification. Receive the verification result returned by the authentication server, and decide whether to allow or deny the terminal's access based on the verification result.

3. The method as described in claim 1, characterized in that, After successful authentication, generating and distributing a static key seed corresponding to the terminal session specifically includes: The authentication server generates a random number uniquely associated with the current session and combines it with the current timestamp to generate the static key seed; The static key seed is encrypted using the public key of the terminal, and the encryption result is sent to the terminal. The static key seed is encrypted using a key shared with the switch, and the encryption result is sent to the switch. The terminal and the switch decrypt the received encrypted information and store the static key seed locally.

4. The method as described in claim 1, characterized in that, The calculation of behavioral anomaly membership degree based on the trajectory deviation of the current behavioral characteristics relative to the behavioral baseline specifically includes: The real-time collected behavioral feature stream is divided into sliding time windows to construct continuous behavioral feature trajectories; The behavioral feature trajectory is input into a state evolution probability model trained based on historical normal behavior to calculate the generation likelihood of the behavioral feature trajectory; An offset penalty is introduced into the generated likelihood and a logarithmic domain mapping is performed to obtain the trajectory anomaly energy value; The trajectory anomaly energy value is normalized based on a nonlinear membership mapping function, and the behavioral anomaly membership degree is output in the range of 0 to 1.

5. The method as described in claim 1, characterized in that, The dynamic session key is obtained by performing multiple rounds of hash derivation on the static key seed based on the key strength parameter, specifically including: Read the key strength parameter, where the value N represents the round of hash derivation; Using the static key seed as the initial input, perform the first round of hash operation; Use the output of the previous round of hashing as the input of the next round of hashing, and repeat this process until N rounds of hashing are completed; The output of the Nth round of hash operation is used as the final dynamic session key.

6. The method as described in claim 1, characterized in that, Retrieving access control rules from the policy library based on the micro-segmentation policy identifier specifically includes: In the preset policy library, an index search is performed according to the micro-segmentation policy identifier; Verify that the found policy entries are valid; Extract the access control list defined under this policy entry, which contains information on allowed or denied access protocols, ports, and network addresses.

7. The method as described in claim 1, characterized in that, Sending the dynamic session key and the access control rules to the switch, enabling the switch to use the dynamic session key for communication encryption, and dynamically adjusting the network access permissions of the terminal according to the access control rules specifically includes: The authentication server encapsulates the dynamic session key and the access control rules into a policy update instruction and sends it to the switch; The switch receives and parses the policy update instruction, and extracts the dynamic session key and access control rules; The switch uses the dynamic session key to replace the old encryption key used to communicate with the terminal; The switch configures its access control list according to the access control rules, dynamically restricting or allowing specific network traffic sent by the terminal.

8. A security authentication system for switch access terminals, characterized in that, include: The initial authentication module is used to respond to the switch detecting the terminal's access request, perform initial authentication based on the terminal's hardware fingerprint and user credentials, and generate and issue a static key seed corresponding to the terminal session after successful authentication. The feature processing module is used to collect the behavioral features of the terminal during terminal access, adaptively determine the behavioral baseline based on historical sessions, and calculate the membership degree of behavioral anomalies based on the trajectory offset of the current behavioral features relative to the behavioral baseline. The feature processing module is further configured to update the dynamic trust value of the terminal based on the abnormal behavior membership, and generate dynamic security parameters including key strength parameters and micro-segmentation policy identifiers based on the updated dynamic trust value. The feature processing module is also used to perform multiple rounds of hash derivation on the static key seed based on the key strength parameter to obtain a dynamic session key, and to retrieve access control rules from the policy library according to the micro-segmentation policy identifier; The execution module is used to send the dynamic session key and the access control rules to the switch, so that the switch uses the dynamic session key for communication encryption and dynamically adjusts the network access permissions of the terminal according to the access control rules.

9. A computer device comprising a memory and a processor, the memory storing code, characterized in that, The processor is configured to acquire the code and execute the switch access terminal security authentication method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the switch access terminal security authentication method as described in any one of claims 1 to 7.

Images