Equipment authority control method and device based on network environment, equipment and medium

Abstract

The invention discloses an equipment authority control method and device based on a network environment, equipment and a medium. The method comprises the following steps: receiving network environment state information uploaded by terminal equipment; wherein the network environment state information comprises an exit IP address of the terminal equipment and lighthouse equipment connection information; determining the credibility of the terminal equipment based on the network environment state information and a preset trusted IP address; and executing a corresponding authority control operation based on the credibility. According to the technical scheme, differentiated authority control is implemented according to the network environment state information of the terminal equipment, so that the safety and the flexibility of remote operation authority control of the equipment are remarkably improved.

Description

Technical Field

[0001] This application belongs to the field of network security technology, specifically relating to a method, apparatus, device, and medium for device access control based on a network environment. Background Technology

[0002] In scenarios of remote work and cross-device reuse, remote control technology has become a key support for improving work efficiency. It allows employees to remotely access resources of enterprise servers or high-performance terminals through local devices, meeting the needs of remote collaboration and mobile office.

[0003] Existing technologies mostly employ a fixed permission allocation model, granting remote operation permissions solely based on authentication information such as account passwords. This results in devices having the same remote operation permissions in environments with different security levels, such as corporate intranets and public networks. When devices are on untrusted public networks, remote operation is vulnerable to man-in-the-middle attacks or data eavesdropping, leading to the leakage of sensitive information.

[0004] Therefore, how to further improve the security of remote operation permission control for devices is an urgent problem that needs to be solved by those in the field. Summary of the Invention

[0005] This application provides a method, apparatus, device, and medium for device access control based on a network environment. The purpose is to significantly improve the security and flexibility of remote operation access control by implementing differentiated access control based on the network environment status information of the terminal device.

[0006] In a first aspect, embodiments of this application provide a device access control method based on a network environment, the method comprising: Receive network environment status information uploaded by the terminal device; wherein, the network environment status information includes the exit IP address of the terminal device and the lighthouse device connection information; Based on the network environment status information and the preset trusted IP address, the trustworthiness of the terminal device is determined; Based on the stated level of trust, corresponding access control operations will be performed.

[0007] Optionally, determining the trustworthiness of the terminal device based on the network environment status information and the preset trusted IP address includes: If the preset trusted IP address includes the exit IP address, the trust level of the terminal device is determined to be the highest trust level. If the preset trusted IP address does not include the exit IP address, the trustworthiness of the terminal device is determined based on the lighthouse device connection information.

[0008] Optionally, the lighthouse device connection information includes the network environment identifier and connection status parameters corresponding to the lighthouse device whose connection verification by the terminal device is successful; Accordingly, determining the trustworthiness of the terminal device based on the lighthouse device connection information includes: When the number of network environment identifiers is zero, the trust level of the terminal device is determined to be the lowest trust level. If the number of network environment identifiers is not zero, the trustworthiness of the terminal device is determined based on the network environment identifiers and the connection status parameters.

[0009] Optionally, determining the trustworthiness of the terminal device based on the network environment identifier and the connection status parameters includes: Obtain the topology information of the lighthouse device, and determine the preset weight coefficient corresponding to the network environment identifier based on the topology information of the lighthouse device; The comprehensive trust score of the terminal device is calculated based on the preset weight coefficients and the connection status parameters, and the comprehensive trust score is mapped to the corresponding credibility.

[0010] Optionally, performing the corresponding access control operation based on the trust level includes: Generate a dynamic access token for the terminal device that matches the trust level; The resource access request initiated by the terminal device is verified in real time based on the dynamic access token, and the resource access session of the terminal device is interrupted if the verification result fails.

[0011] Optionally, the dynamic access token includes a set of resource identifiers that are allowed to be accessed and a corresponding list of operation permissions; Accordingly, the real-time verification of resource access requests initiated by the terminal device based on the dynamic access token includes: Parse the resource access request initiated by the terminal device to obtain the target resource identifier and the corresponding target operation type; If the target resource identifier is not included in the resource identifier set, or if the target operation type is not included in the operation permission list, the verification result is determined to be unsuccessful.

[0012] Optionally, the dynamic access token may also include the token issuance time and the token validity period; Accordingly, before parsing the resource access request initiated by the terminal device to obtain the target resource identifier and the corresponding target operation type, the method further includes: Obtain the system time, and calculate the token usage duration based on the system time and the token issuance time; If the token is used for a duration exceeding the token's validity period, the verification result is determined to be unsuccessful.

[0013] Secondly, embodiments of this application provide a device access control apparatus based on a network environment, the apparatus comprising: The network environment acquisition module is used to receive network environment status information uploaded by the terminal device; wherein, the network environment status information includes the exit IP address of the terminal device and the lighthouse device connection information; The credibility determination module is used to determine the credibility of the terminal device based on the network environment status information and the preset trusted IP address. The device management module is used to perform corresponding permission management operations based on the trust level.

[0014] Optionally, the credibility determination module is specifically used for: If the preset trusted IP address includes the exit IP address, the trust level of the terminal device is determined to be the highest trust level. If the preset trusted IP address does not include the exit IP address, the trustworthiness of the terminal device is determined based on the lighthouse device connection information.

[0015] Optionally, the lighthouse device connection information includes the network environment identifier and connection status parameters corresponding to the lighthouse device whose connection verification by the terminal device is successful; Accordingly, the credibility determination module is specifically used for: When the number of network environment identifiers is zero, the trust level of the terminal device is determined to be the lowest trust level. If the number of network environment identifiers is not zero, the trustworthiness of the terminal device is determined based on the network environment identifiers and the connection status parameters.

[0016] Optionally, the credibility determination module is specifically used for: Obtain the topology information of the lighthouse device, and determine the preset weight coefficient corresponding to the network environment identifier based on the topology information of the lighthouse device; The comprehensive trust score of the terminal device is calculated based on the preset weight coefficients and the connection status parameters, and the comprehensive trust score is mapped to the corresponding credibility.

[0017] Optionally, the device management module is specifically used for: Generate a dynamic access token for the terminal device that matches the trust level; The resource access request initiated by the terminal device is verified in real time based on the dynamic access token, and the resource access session of the terminal device is interrupted if the verification result fails.

[0018] Optionally, the dynamic access token includes a set of resource identifiers that are allowed to be accessed and a corresponding list of operation permissions; Accordingly, the device management module is specifically used for: Parse the resource access request initiated by the terminal device to obtain the target resource identifier and the corresponding target operation type; If the target resource identifier is not included in the resource identifier set, or if the target operation type is not included in the operation permission list, the verification result is determined to be unsuccessful.

[0019] Optionally, the dynamic access token may also include the token issuance time and the token validity period; Accordingly, the device management module is also used for: Obtain the system time, and calculate the token usage duration based on the system time and the token issuance time; If the token is used for a duration exceeding the token's validity period, the verification result is determined to be unsuccessful.

[0020] Thirdly, embodiments of this application provide an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the method described in the first aspect.

[0021] Fourthly, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the method described in the first aspect.

[0022] In this embodiment, network environment status information uploaded by a terminal device is received; wherein, the network environment status information includes the terminal device's egress IP address and lighthouse device connection information; based on the network environment status information and a preset trusted IP address, the trustworthiness of the terminal device is determined; and based on the trustworthiness, corresponding access control operations are performed. The above-described device access control method based on the network environment significantly improves the security and flexibility of remote device operation access control by implementing differentiated access control based on the terminal device's network environment status information. Attached Figure Description

[0023] Figure 1 This is a flowchart illustrating the device access control method based on a network environment provided in Embodiment 1 of this application; Figure 2 This is a flowchart illustrating the device access control method based on a network environment provided in Embodiment 2 of this application; Figure 3 This is a flowchart illustrating the device access control method based on a network environment provided in Embodiment 3 of this application; Figure 4 This is a schematic diagram of the device access control device based on a network environment provided in Embodiment 4 of this application; Figure 5 This is a schematic diagram of the structure of the electronic device provided in Embodiment 5 of this application. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this application clearer, specific embodiments of this application will be described in further detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are merely for explaining this application and not for limiting it. It should also be noted that, for ease of description, only the parts relevant to this application are shown in the drawings, not all of them. Before discussing exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe operations (or steps) as sequential processes, many of these operations can be performed in parallel, concurrently, or simultaneously. Furthermore, the order of the operations can be rearranged. The process can be terminated when its operation is completed, but may also have additional steps not included in the drawings. The process can correspond to a method, function, procedure, subroutine, subprogram, etc.

[0025] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0026] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0027] The following description, in conjunction with the accompanying drawings, details the device permission control method, apparatus, device, and medium based on the network environment provided in this application through specific embodiments and application scenarios.

[0028] First, this application is applicable to scenarios with high requirements for device access security, complex network environments, and remote / distributed access needs, such as enterprise intranet device access control, distributed office terminal permission management, and secure access for industrial internet devices. Based on these use cases, it is understood that the implementing entity of this application can be a permission management server deployed on an intranet gateway.

[0029] Example 1 Figure 1 This is a flowchart illustrating the device access control method based on a network environment provided in Embodiment 1 of this application. Figure 1 As shown, the specific steps include the following: S101, Receive network environment status information uploaded by the terminal device; wherein, the network environment status information includes the exit IP address of the terminal device and the lighthouse device connection information; Among them, terminal devices can be enterprise office equipment, industrial control equipment, mobile office equipment (such as laptops and smartphones), IoT sensing devices, remote access devices, and other devices that need to access intranet resources and be subject to access control; network environment status information can be a set of characteristic data used to characterize the current network location and connection status of terminal devices, which may include the terminal device's egress IP address and lighthouse device connection information.

[0030] Specifically, the exit IP address can be the network exit protocol address used by the terminal device when accessing public or intranet services; the lighthouse device connection information can be the communication interaction data between the terminal device and the preset lighthouse device. Among them, the lighthouse device can be a trusted reference device deployed at a key node of the intranet, with a fixed physical location and a unique device identifier, and can provide terminal devices with functions such as network location verification, identity reference comparison, and communication link status monitoring.

[0031] In one embodiment, the terminal device can obtain network environment status information by calling the underlying network interface of the operating system to obtain the exit IP address. If the terminal device recognizes that the preset trusted IP address issued by the permission control server does not include the exit IP address, it can initiate connection requests to each preset lighthouse device in the preset lighthouse device list issued by the permission control server to obtain the lighthouse device connection information.

[0032] In one embodiment, the method for receiving network environment status information uploaded by a terminal device can be that an access control server listens for information reporting requests from the terminal device through a preset communication port to obtain the network environment status information uploaded by the terminal device.

[0033] S102, Based on the network environment status information and the preset trusted IP address, determine the trustworthiness of the terminal device; The preset trusted IP address can be a pre-configured set of trusted network exit IP addresses, which may include the enterprise's fixed exit IP address, the branch office's dedicated exit IP address, and the exit IP address of a securely certified remote office VPN (Virtual Private Network).

[0034] The trustworthiness of the terminal device can be a quantitative evaluation value generated based on the degree of matching between the terminal device's current network environment status information and the preset trust benchmark. It is used to characterize the legitimacy of the terminal device's identity and the security of the network environment, and the value range can be [0,1].

[0035] In one embodiment, the credibility of a terminal device can be determined based on network environment status information and preset trusted IP addresses by calculating the similarity between the egress IP address and each preset trusted IP address, mapping the highest similarity to an IP matching score (if the similarity is 100%, the corresponding IP matching score is 100), determining the lighthouse device connection score based on the lighthouse device connection information, preset parameter range, and corresponding preset scoring criteria, and performing a weighted summation of the IP matching score and the lighthouse device connection score and mapping the result to the [0,1] interval to obtain the credibility of the terminal device.

[0036] S103, perform the corresponding access control operation based on the trust level.

[0037] In this context, access control operations can be differentiated access control measures implemented based on the trustworthiness of the terminal device.

[0038] In one embodiment, the method of performing corresponding access control operations based on trust level can be as follows: if the trust level of the terminal device exceeds a preset trust level threshold, no additional access restrictions are imposed; if the trust level of the terminal device does not exceed the preset trust level threshold, the resource access session of the terminal device is interrupted.

[0039] In this embodiment, network environment status information uploaded by a terminal device is received; wherein, the network environment status information includes the terminal device's egress IP address and lighthouse device connection information; based on the network environment status information and a preset trusted IP address, the trustworthiness of the terminal device is determined; and based on the trustworthiness, corresponding access control operations are performed. The above-described device access control method based on the network environment significantly improves the security and flexibility of remote device operation access control by implementing differentiated access control based on the terminal device's network environment status information.

[0040] Example 2 Figure 2 This is a flowchart illustrating the device access control method based on a network environment provided in Embodiment 2 of this application. Figure 2 As shown, the specific steps include the following: S201, Receive network environment status information uploaded by the terminal device; wherein, the network environment status information includes the exit IP address of the terminal device and the lighthouse device connection information; S202, if the preset trusted IP address includes the exit IP address, determine that the trust level of the terminal device is the highest trust level; The highest trust level can be a trust value of 1 (corresponding to the upper limit of the [0,1] interval), which indicates that the terminal device is in a completely trustworthy network environment.

[0041] The preset trusted IP address includes the exit IP address, indicating that the terminal device is either in the enterprise's internal network physical environment or accessed through a secure and certified dedicated channel. There is no risk of untrustworthiness in the network environment, so the trust level of the terminal device can be determined to be the highest level.

[0042] S203, if the preset trusted IP address does not include the exit IP address, determine the trustworthiness of the terminal device based on the lighthouse device connection information; The default trusted IP address does not include the exit IP address, which means that the terminal device may be in an unfamiliar public network environment, an unauthenticated branch network, or other untrusted access scenarios. The security of its access cannot be confirmed by the exit IP address alone. Therefore, it is necessary to further verify the identity legitimacy of the terminal device and the security of the network environment by using the connection status between the terminal device and the trusted benchmark device (i.e., the default lighthouse device).

[0043] In one embodiment, when determining the trustworthiness of a terminal device based on the lighthouse device connection information, it can be obtained by combining the lighthouse device connection information with a preset parameter range and a corresponding preset scoring standard (at this time, the upper limit of the trustworthiness of the terminal device is 0.8).

[0044] Optionally, the lighthouse device connection information includes the network environment identifier and connection status parameters corresponding to the lighthouse device whose connection verification by the terminal device is successful; Accordingly, determining the trustworthiness of the terminal device based on the lighthouse device connection information includes: When the number of network environment identifiers is zero, the trust level of the terminal device is determined to be the lowest trust level. If the number of network environment identifiers is not zero, the trustworthiness of the terminal device is determined based on the network environment identifiers and the connection status parameters.

[0045] Among them, the lighthouse device that the terminal device successfully connects to can be a trusted benchmark device that has successfully established a communication link after the terminal device initiates a connection request according to the preset lighthouse device list and has passed two-way identity authentication.

[0046] Among them, the network environment identifier corresponding to the lighthouse device can be a unique network location identifier pre-assigned to each preset lighthouse device by the access control server; the connection status parameter corresponding to the lighthouse device can be the communication quality indicator after the terminal device establishes a connection with the lighthouse device, which may include link packet loss rate, connection response time, etc.

[0047] The presence of zero network environment identifiers indicates that the terminal device has not completed connection verification with any preset beacon device. This means that the network environment in which the terminal device is located cannot be verified by the trusted benchmark device, and its identity legitimacy and access security cannot be confirmed at all. Therefore, the trust level of the terminal device can be determined to be the lowest trust level. The lowest trust level can be a trust value of 0 (corresponding to the lower limit of the [0,1] interval), which indicates that the terminal device is in a completely untrusted network environment and there are security risks such as illegal access and malicious attacks.

[0048] The fact that the number of network environment identifiers is not zero indicates that the terminal device has successfully completed connection verification with at least one preset lighthouse device. The network environment identifier of the lighthouse device can confirm the network partition affiliation of the terminal device. Combined with the connection status parameters, the security and stability of the communication link can be evaluated, providing a basis for further quantification of credibility.

[0049] In one embodiment, the method of determining the trustworthiness of a terminal device based on network environment identifiers and connection status parameters can be as follows: A base score is allocated based on the number of lighthouse devices successfully connected to the terminal device (e.g., 20 points for each successful connection to a preset lighthouse device, with a maximum score of 40 points). A connection status score is determined based on the connection status parameters and preset connection status parameter thresholds (e.g., if a single connection status parameter does not exceed its corresponding preset connection status parameter threshold, the connection status score for that single connection status parameter is determined to be full; otherwise, the difference between the single connection status parameter and its corresponding preset connection status parameter threshold is calculated, and points are deducted based on the difference using a linearly decreasing formula, where the sum of the connection status scores for all single connection status parameters does not exceed 40 points). The base score and the connection status score are summed, and the calculation result is mapped to the [0,1] interval to obtain the trustworthiness of the terminal device.

[0050] Optionally, determining the trustworthiness of the terminal device based on the network environment identifier and the connection status parameters includes: Obtain the topology information of the lighthouse device, and determine the preset weight coefficient corresponding to the network environment identifier based on the topology information of the lighthouse device; The comprehensive trust score of the terminal device is calculated based on the preset weight coefficients and the connection status parameters, and the comprehensive trust score is mapped to the corresponding credibility.

[0051] The lighthouse device topology information can include core configuration information such as the deployment level of the preset lighthouse devices, network partition affiliation, security protection level, and the relationships between preset lighthouse devices. Obtaining the lighthouse device topology information can be achieved by the access control server retrieving the topology information corresponding to the network environment identifier from a locally pre-configured lighthouse device configuration database, or by obtaining the latest lighthouse device topology information through real-time data interaction with the lighthouse device management platform.

[0052] Among them, the preset weight coefficient corresponding to the network environment identifier can be the trust weight value assigned to each preset lighthouse device based on the lighthouse device topology information.

[0053] In one embodiment, the method of determining the preset weight coefficient corresponding to the network environment identifier based on the lighthouse device topology information can be achieved by dividing each preset lighthouse device into three deployment layers: core layer, aggregation layer, and access layer. The preset weight coefficient corresponding to the preset lighthouse device in the core layer is 1, the preset weight coefficient corresponding to the preset lighthouse device in the aggregation layer is 0.6, and the preset weight coefficient corresponding to the preset lighthouse device in the access layer is 0.3. The deployment layer corresponding to the preset lighthouse device is queried through the network environment identifier to obtain the corresponding preset weight coefficient.

[0054] The overall trust score of the terminal device can be a weighted total score calculated by combining the preset weight coefficients of each lighthouse device that has successfully verified the connection of the terminal device with the corresponding connection status parameters.

[0055] In one embodiment, the method of calculating the comprehensive trust score of the terminal device based on preset weight coefficients and connection status parameters, and mapping the comprehensive trust score to the corresponding credibility, can be achieved by determining the connection status score based on the connection status parameters and preset connection status parameter thresholds (for example, if a single connection status parameter does not exceed the corresponding preset connection status parameter threshold, then the connection status score corresponding to that single connection status parameter is determined to be full; otherwise, the difference between the single connection status parameter and the corresponding preset connection status parameter threshold is calculated, and points are deducted based on the difference using a linear decreasing formula, wherein the sum of the connection status scores corresponding to all single connection status parameters does not exceed 80 points). The connection status score is multiplied by the preset weight coefficient to obtain the comprehensive trust score of the terminal device, and finally the comprehensive trust score of the terminal device is divided by 100 to obtain the corresponding credibility.

[0056] The advantage of this approach is that it establishes a differentiated weighted evaluation mechanism based on the topology of the lighthouse equipment, thereby improving the accuracy and scientific rigor of the terminal equipment credibility assessment.

[0057] The advantage of this scheme is that it confirms the trusted baseline connection of terminal devices by the number of network environment identifiers, and measures the security and stability of communication links by combining connection status parameters, thereby enabling fine-grained classification of device trustworthiness.

[0058] S204, Perform the corresponding access control operation based on the trust level.

[0059] The advantage of this solution is that it meets the need for rapid access for fixed devices on the intranet, while also supporting secure access for non-fixed IP scenarios such as remote offices and branch offices, and adapting to the complex network topologies of distributed offices and the industrial internet.

[0060] Example 3 Figure 3 This is a flowchart illustrating the device access control method based on a network environment provided in Embodiment 3 of this application. Figure 3 As shown, the specific steps include the following: S301, Receive network environment status information uploaded by the terminal device; wherein, the network environment status information includes the exit IP address of the terminal device and the lighthouse device connection information; S302, Based on the network environment status information and the preset trusted IP address, determine the trustworthiness of the terminal device; S303, Generate a dynamic access token for the terminal device that matches the trust level; Among them, the dynamic access token can be an access credential generated by the permission management server based on the trustworthiness of the terminal device, the unique identifier of the terminal device, and the timestamp.

[0061] In one embodiment, generating a dynamic access token matching the trust level for a terminal device can be achieved by generating a dynamic access token including a corresponding permission identifier based on the trust level of the terminal device. For example, for a terminal device with the highest trust level of 1 (trust level 1), a dynamic access token including a first permission identifier (corresponding to granting access to all resources) is generated; for a terminal device with a trust level in the range of (0.5, 0.8), a dynamic access token including a second permission identifier (corresponding to granting access to core business resources) is generated; for a terminal device with a trust level in the range of (0.3, 0.5), a dynamic access token including a third permission identifier (corresponding to granting access to only basic query resources) is generated; and for a terminal device with a trust level in the range of [0, 0.3], no dynamic access token is generated.

[0062] S304, perform real-time verification of the resource access request initiated by the terminal device based on the dynamic access token, and interrupt the resource access session of the terminal device if the verification result fails.

[0063] Among them, the resource access request initiated by the terminal device can be an operation application for a specific system resource submitted by the terminal device to the permission management server based on business needs.

[0064] In one embodiment, the method of real-time verification of resource access requests initiated by terminal devices based on dynamic access tokens can be achieved by parsing the resource access requests initiated by terminal devices to obtain the dynamic access token and the target resource identifier. If the dynamic access token does not exist, the verification result is directly determined to be unsuccessful. Furthermore, it is determined whether the accessible resource identifier corresponding to the permission identifier in the dynamic access token includes the target resource identifier. If it does, the verification result is determined to be successful; if it does not, the verification result is determined to be unsuccessful.

[0065] Optionally, the dynamic access token includes a set of resource identifiers that are allowed to be accessed and a corresponding list of operation permissions; Accordingly, the real-time verification of resource access requests initiated by the terminal device based on the dynamic access token includes: Parse the resource access request initiated by the terminal device to obtain the target resource identifier and the corresponding target operation type; If the target resource identifier is not included in the resource identifier set, or if the target operation type is not included in the operation permission list, the verification result is determined to be unsuccessful.

[0066] The set of resource identifiers that are allowed to be accessed can be a set of unique identifiers of all system resources that the terminal device has access to, which are pre-assigned by the permission control server based on the trustworthiness of the terminal device; the corresponding list of operation permissions can be the types of operations that the terminal device can perform on the corresponding resources, which are bound to each resource identifier in the resource identifier set.

[0067] The target resource identifier can be a unique identifier of the resource to be operated on, which is explicitly specified by the terminal device when it initiates a resource access request; the corresponding target operation type can be the specific operation type that the terminal device intends to perform on the target resource.

[0068] In one embodiment, the method of parsing the resource access request initiated by the terminal device to obtain the target resource identifier and the corresponding target operation type can be achieved by the permission control server receiving the resource access request message submitted by the terminal device, extracting the resource identifier field and operation type field from the message according to the preset request message parsing protocol, performing format verification and validity verification on the two fields, removing invalid characters and redundant information, and finally obtaining the standardized target resource identifier and target operation type.

[0069] If the resource identifier set does not include the target resource identifier, it indicates that the terminal device does not have the basic permissions to access the target resource. If the operation permission list does not include the target operation type, it indicates that although the terminal device has the permission to access the corresponding resource, it does not have the right to perform the operation requested for that resource. Therefore, if either of the above two situations occurs, it indicates that the terminal device's resource access request exceeds the permission scope corresponding to its trust level, posing a security risk of unauthorized access, and the verification result is directly determined as failing.

[0070] Optionally, the dynamic access token may also include the token issuance time and the token validity period; Accordingly, before parsing the resource access request initiated by the terminal device to obtain the target resource identifier and the corresponding target operation type, the method further includes: Obtain the system time, and calculate the token usage duration based on the system time and the token issuance time; If the token is used for a duration exceeding the token's validity period, the verification result is determined to be unsuccessful.

[0071] The token issuance time can be the specific time when the access control server successfully generates a dynamic access token for the terminal device and then issues the dynamic access token to the terminal device; the token validity period can be the effective usage period of the dynamic access token preset by the access control server based on the trustworthiness of the terminal device.

[0072] The system time can be a standard time that is locally synchronized with the access control server and has been time-calibrated.

[0073] In one embodiment, the system time can be obtained by having the access control server synchronize with the authoritative time server in real time via the network time protocol, obtain an accurate standard time, and store it in the local time module. When performing real-time verification of resource access requests initiated by terminal devices, the current system time can be retrieved directly from the local time module.

[0074] The token usage duration can be the time difference between the current system time and the token issuance time when the terminal device initiates a resource access request.

[0075] If the token usage time exceeds the token validity period, it means that the dynamic access token has expired and lost its validity as a credential for legitimate access rights. At this time, the dynamic access token may be subject to security risks of being illegally intercepted and reused, and the network environment status of the terminal device may have changed, and the permission configuration corresponding to the original trust level is no longer applicable. Therefore, in order to avoid system resource security risks caused by the abuse of expired tokens, the verification result is directly determined as failing.

[0076] The advantage of this solution is that by configuring different token validity periods for terminal devices with different levels of trust, it ensures convenient access for highly trusted devices (without needing to frequently reacquire tokens) while limiting the access window for less trusted devices through short validity periods, thereby reducing the security risks after token leakage.

[0077] The advantage of this solution is that by simultaneously verifying whether the target resource is within the authorized scope and whether the target operation matches the resource permissions, a two-layer security barrier is formed. This avoids the risk of terminal devices accessing unauthorized resources and prevents authorized resources from being subjected to unauthorized operations, thus significantly improving the security of system resource access.

[0078] A failure to pass the verification indicates that the terminal device has not been granted a dynamic access token or that the dynamic access token it carries has mismatched permissions or other abnormalities. This means that the terminal device may have security risks such as identity theft, unauthorized access, or token leakage and tampering. Therefore, it is necessary to immediately interrupt its resource access session to prevent unauthorized terminal devices from performing unauthorized operations on system resources and avoid core data leakage or malicious damage to system functions.

[0079] In one embodiment, interrupting a terminal device's resource access session can be achieved by the access control server sending a session interruption command to the terminal device, while simultaneously clearing the stored session identifier and token information corresponding to the terminal device, thus prohibiting the terminal device from initiating any resource access requests before it reacquires a valid dynamic access token.

[0080] The advantage of this solution is that by deeply binding the dynamic access token to the trustworthiness of the terminal device, it ensures convenient access for high-trust devices while strictly restricting the access behavior of low-trust devices.

[0081] Example 4 Figure 4 This is a schematic diagram of the device access control device based on a network environment provided in Embodiment 4 of this application. Figure 4 As shown, the device includes: The network environment acquisition module 410 is used to receive network environment status information uploaded by the terminal device; wherein, the network environment status information includes the exit IP address of the terminal device and the lighthouse device connection information; The credibility determination module 420 is used to determine the credibility of the terminal device based on the network environment status information and the preset trusted IP address. The device management module 430 is used to perform corresponding permission management operations based on the trust level.

[0082] Optionally, the credibility determination module 420 is specifically used for: If the preset trusted IP address includes the exit IP address, the trust level of the terminal device is determined to be the highest trust level. If the preset trusted IP address does not include the exit IP address, the trustworthiness of the terminal device is determined based on the lighthouse device connection information.

[0083] Optionally, the lighthouse device connection information includes the network environment identifier and connection status parameters corresponding to the lighthouse device whose connection verification by the terminal device is successful; Accordingly, the credibility determination module 420 is specifically used for: When the number of network environment identifiers is zero, the trust level of the terminal device is determined to be the lowest trust level. If the number of network environment identifiers is not zero, the trustworthiness of the terminal device is determined based on the network environment identifiers and the connection status parameters.

[0084] Optionally, the credibility determination module 420 is specifically used for: Obtain the topology information of the lighthouse device, and determine the preset weight coefficient corresponding to the network environment identifier based on the topology information of the lighthouse device; The comprehensive trust score of the terminal device is calculated based on the preset weight coefficients and the connection status parameters, and the comprehensive trust score is mapped to the corresponding credibility.

[0085] Optionally, the device management module 430 is specifically used for: Generate a dynamic access token for the terminal device that matches the trust level; The resource access request initiated by the terminal device is verified in real time based on the dynamic access token, and the resource access session of the terminal device is interrupted if the verification result fails.

[0086] Optionally, the dynamic access token includes a set of resource identifiers that are allowed to be accessed and a corresponding list of operation permissions; Accordingly, the device management module 430 is specifically used for: Parse the resource access request initiated by the terminal device to obtain the target resource identifier and the corresponding target operation type; If the target resource identifier is not included in the resource identifier set, or if the target operation type is not included in the operation permission list, the verification result is determined to be unsuccessful.

[0087] Optionally, the dynamic access token may also include the token issuance time and the token validity period; Accordingly, the device management module 430 is also used for: Obtain the system time, and calculate the token usage duration based on the system time and the token issuance time; If the token is used for a duration exceeding the token's validity period, the verification result is determined to be unsuccessful.

[0088] In this embodiment, a network environment acquisition module is used to receive network environment status information uploaded by a terminal device; wherein, the network environment status information includes the terminal device's egress IP address and lighthouse device connection information; a trustworthiness determination module is used to determine the trustworthiness of the terminal device based on the network environment status information and a preset trusted IP address; and a device management module is used to execute corresponding access control operations based on the trustworthiness. The above-described network environment-based device access control device significantly improves the security and flexibility of remote device operation access control by implementing differentiated access control based on the terminal device's network environment status information.

[0089] The device access control device based on the network environment in this application embodiment can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. For example, mobile electronic devices can be mobile phones, tablets, laptops, PDAs, in-vehicle electronic devices, wearable devices, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), etc., while non-mobile electronic devices can be servers, network-attached storage (NAS), personal computers (PCs), televisions (TVs), ATMs, or self-service machines, etc. This application embodiment does not impose specific limitations.

[0090] The device access control device based on the network environment in this application embodiment can be a device with an operating system. This operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit it.

[0091] The device access control device based on the network environment provided in this application embodiment can realize the various processes implemented in the above embodiments. To avoid repetition, it will not be described again here.

[0092] Example 5 like Figure 5 As shown, this application embodiment also provides an electronic device 500, including a processor 501, a memory 502, and a program or instructions stored in the memory 502 and executable on the processor 501. When the program or instructions are executed by the processor 501, they implement the various processes of the above-described device permission control method embodiment based on the network environment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0093] It should be noted that the electronic devices in the embodiments of this application include the mobile electronic devices and non-mobile electronic devices described above.

[0094] Example 6 This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described device access control method embodiments based on the network environment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0095] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0096] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0097] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0098] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

[0099] The above description is merely a preferred embodiment and the technical principles employed in this application. This application is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions that can be made by those skilled in the art will not depart from the scope of protection of this application. Therefore, although this application has been described in detail through the above embodiments, this application is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of this application, the scope of which is determined by the scope of the claims.

Claims

1. A device access control method based on a network environment, characterized in that, The method includes: Receive network environment status information uploaded by the terminal device; wherein, the network environment status information includes the exit IP address of the terminal device and the lighthouse device connection information; Based on the network environment status information and the preset trusted IP address, the trustworthiness of the terminal device is determined; Based on the stated level of trust, corresponding access control operations will be performed.

2. The device access control method based on a network environment according to claim 1, characterized in that, The step of determining the trustworthiness of the terminal device based on the network environment status information and the preset trusted IP address includes: If the preset trusted IP address includes the exit IP address, the trust level of the terminal device is determined to be the highest trust level. If the preset trusted IP address does not include the exit IP address, the trustworthiness of the terminal device is determined based on the lighthouse device connection information.

3. The device access control method based on a network environment according to claim 2, characterized in that, The lighthouse device connection information includes the network environment identifier and connection status parameters corresponding to the lighthouse device for which the terminal device has successfully connected and verified the connection. Accordingly, determining the trustworthiness of the terminal device based on the lighthouse device connection information includes: When the number of network environment identifiers is zero, the trust level of the terminal device is determined to be the lowest trust level. If the number of network environment identifiers is not zero, the trustworthiness of the terminal device is determined based on the network environment identifiers and the connection status parameters.

4. The device access control method based on a network environment according to claim 3, characterized in that, Determining the trustworthiness of the terminal device based on the network environment identifier and the connection status parameters includes: Obtain the topology information of the lighthouse device, and determine the preset weight coefficient corresponding to the network environment identifier based on the topology information of the lighthouse device; The comprehensive trust score of the terminal device is calculated based on the preset weight coefficients and the connection status parameters, and the comprehensive trust score is mapped to the corresponding credibility.

5. The device access control method based on a network environment according to claim 1, characterized in that, The execution of corresponding access control operations based on the trust level includes: Generate a dynamic access token for the terminal device that matches the trust level; The resource access request initiated by the terminal device is verified in real time based on the dynamic access token, and the resource access session of the terminal device is interrupted if the verification result fails.

6. The device access control method based on a network environment according to claim 5, characterized in that, The dynamic access token includes a set of resource identifiers that are allowed to be accessed and a corresponding list of operation permissions; Accordingly, the real-time verification of resource access requests initiated by the terminal device based on the dynamic access token includes: Parse the resource access request initiated by the terminal device to obtain the target resource identifier and the corresponding target operation type; If the target resource identifier is not included in the resource identifier set, or if the target operation type is not included in the operation permission list, the verification result is determined to be unsuccessful.

7. The device access control method based on a network environment according to claim 6, characterized in that, The dynamic access token also includes the token issuance time and the token validity period; Accordingly, before parsing the resource access request initiated by the terminal device to obtain the target resource identifier and the corresponding target operation type, the method further includes: Obtain the system time, and calculate the token usage duration based on the system time and the token issuance time; If the token is used for a duration exceeding the token's validity period, the verification result is determined to be unsuccessful.

8. A device access control device based on a network environment, characterized in that, The device includes: The network environment acquisition module is used to receive network environment status information uploaded by the terminal device; wherein, the network environment status information includes the exit IP address of the terminal device and the lighthouse device connection information; The credibility determination module is used to determine the credibility of the terminal device based on the network environment status information and the preset trusted IP address. The device management module is used to perform corresponding permission management operations based on the trust level.

9. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein when the program or instructions are executed by the processor, they implement the device access control method based on the network environment as described in any one of claims 1-7.

10. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions, which, when executed by a processor, implement the device access control method based on a network environment as described in any one of claims 1-7.

Images