A dynamic asset access control method, device and equipment based on an operation and maintenance audit system and a medium
By generating mirrored traffic copies for in-depth analysis and real-time comparison, and dynamically intercepting access requests, the system addresses the shortcomings of traditional static solutions in terms of real-time performance and security, and achieves dynamic asset access control for the operation and maintenance audit system.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- HANGZHOU DBAPPSECURITY CO LTD
- Filing Date
- 2026-03-30
- Publication Date
- 2026-06-09
AI Technical Summary
Traditional asset access control methods rely on static rules, making it difficult to detect changes in asset status in real time. This results in security blind spots and incomplete audit links, failing to meet the real-time, security, and compliance requirements of operations and maintenance audits.
By generating mirrored traffic copies for in-depth analysis, comparing asset registration status in real time, and dynamically intercepting access requests based on preset policies, a complete audit loop is formed.
It achieves dynamic response capabilities and security protection in complex network environments, improves real-time performance and security, and meets the compliance requirements of operation and maintenance audits.
Smart Images
Figure CN122179214A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer technology, and in particular to a dynamic asset access control method, device, equipment, and medium based on an operation and maintenance audit system. Background Technology
[0002] In operations and maintenance auditing scenarios, controlling client access requests is typically necessary to ensure secure access to core assets. However, traditional asset access control methods often rely on predefined static rules, such as fixed IP addresses, ports, or permission lists. This static control model struggles to detect changes in asset registration status in real time. In actual business operations, the access of temporary assets, the adjustment of existing asset permissions, or the deregistration of assets occur frequently. Static rules often create security blind spots due to update delays, leading to unauthorized access to unregistered high-risk assets and unauthorized operations on registered assets. Furthermore, traditional solutions generally lack deep analysis capabilities for access request traffic, failing to accurately extract target asset information and perform real-time verification with the asset registration database. Moreover, existing auditing processes mostly only record simple operation results, making it difficult to form a complete traceability chain from request capture and status judgment to policy execution. This fails to meet the compliance requirements of operations and maintenance auditing for full traceability of operations and maintenance processes, and also struggles to address the dynamic security control needs of asset access in complex network environments. Currently, there are three main types of existing technologies related to these issues. One type is the full-traffic mandatory bastion host proxy solution. This solution requires all traffic to be forwarded through the bastion host proxy, which can easily create performance bottlenecks and cannot differentiate based on asset importance, making the operation and maintenance of even low-sensitivity assets complex. Another type is the passive logging solution using a bypass audit system. This solution only logs traffic through mirroring and lacks the ability to actively block illegal direct connection requests. A third type is the static access control list-based solution. This solution has fixed policies, requiring manual updates to access control rules whenever an asset is added or changed, resulting in low operational efficiency and a high risk of errors. Overall, existing technologies generally suffer from poor real-time performance, coarse-grained control, incomplete auditing chains, and a difficulty in balancing performance and security.
[0003] As can be seen from the above, how to solve the shortcomings of traditional static solutions in terms of real-time performance, security and audit integrity is an urgent problem to be solved. Summary of the Invention
[0004] In view of this, the purpose of this invention is to provide a dynamic asset access control method, device, equipment, and medium based on an operation and maintenance audit system, which can solve the shortcomings of traditional static solutions in terms of real-time performance, security, and audit integrity. The specific solution is as follows: Firstly, this application provides a dynamic asset access control method based on an operation and maintenance audit system, including: If a client initiates an access request for a target asset, a corresponding mirrored traffic copy is generated based on the currently transmitted original traffic using a preset switch, and the mirrored traffic copy is parsed using a preset operation and maintenance audit system to obtain the target asset information; the mirrored traffic copy is completely consistent with the original traffic. The target asset information is compared with the data in the preset asset registration database using the preset operation and maintenance audit system to obtain the corresponding asset registration status; If the asset registration status is "registered", then the preset operation and maintenance audit system will issue a blocking command to the preset switch based on the preset access control policy, so that the preset switch can intercept the access request based on the blocking command.
[0005] Optionally, after intercepting the access request using the preset switch based on the blocking command, the method further includes: The preset operation and maintenance audit system records audit logs of interception operations, and reviews and analyzes the audit logs in order to evaluate the effectiveness of the preset access control policy based on the review and analysis results.
[0006] Optionally, the audit log includes the time of the interception, the client information, the target asset information, the reason for the interception, the system information that performed the interception operation, and the personnel information that performed the interception operation.
[0007] Optionally, the preset access control policy is a control policy formulated based on the security level of the asset, the access permissions of the asset, the current network security situation, the user's identity authentication level, and the risk assessment results of the access behavior.
[0008] Optionally, the step of using the preset switch to intercept the access request based on the blocking command includes: The preset switch uses the blocking command to identify traffic data packets related to the access request to be intercepted from the currently transmitted raw traffic, and prevents the transmission of the traffic data packets to the target asset. A notification message is returned to the client, which includes an interception notification and / or an explanation of the reason for the interception.
[0009] Optionally, after comparing the target asset information with data in the preset asset registration database using the preset operation and maintenance audit system to obtain the corresponding asset registration status, the method further includes: If the asset registration status is unregistered or registered, and the access request initiated by the client is within the authorized scope, then the traffic is allowed based on the preset access control policy, and the audit log of this operation is recorded using the preset operation and maintenance audit system.
[0010] Optionally, the preset asset registration database is used to centrally store detailed information about the company's internal assets. The detailed information includes the asset's name, model, purchase time, responsible person, registration validity period, and access permissions on the network.
[0011] Secondly, this application provides a dynamic asset access control device based on an operation and maintenance audit system, comprising: The traffic parsing module is used to generate a corresponding mirrored traffic copy based on the currently transmitted original traffic using a preset switch when it receives an access request for a target asset from a client. The mirrored traffic copy is then parsed using a preset operation and maintenance audit system to obtain the target asset information. The mirrored traffic copy is completely identical to the original traffic. The status determination module is used to compare the target asset information with the data in the preset asset registration database using the preset operation and maintenance audit system to obtain the corresponding asset registration status. The traffic interception module is used to send a blocking command to the preset switch based on the preset access control policy using the preset operation and maintenance audit system if the asset registration status is "registered", so that the preset switch can intercept the access request based on the blocking command.
[0012] Thirdly, this application provides an electronic device, comprising: Memory, used to store computer programs; A processor is used to execute the computer program to implement the aforementioned dynamic asset access control method based on the operation and maintenance audit system.
[0013] Fourthly, this application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned dynamic asset access control method based on an operation and maintenance audit system.
[0014] This application provides a dynamic asset access control method based on an operation and maintenance audit system. If an access request for a target asset is received from a client, a preset switch generates a corresponding mirrored traffic copy based on the currently transmitted original traffic. The preset operation and maintenance audit system then parses the mirrored traffic copy to obtain the target asset information; the mirrored traffic copy is completely identical to the original traffic. The preset operation and maintenance audit system compares the target asset information with data in a preset asset registration database to obtain the corresponding asset registration status. If the asset registration status is "registered," the preset operation and maintenance audit system issues a blocking command to the preset switch based on a preset access control policy, so that the preset switch can intercept the access request based on the blocking command.
[0015] As can be seen from the above, this application generates a mirrored traffic copy when a client initiates an access request via a pre-set switch. The pre-set operation and maintenance audit system then parses this mirrored traffic copy to extract target asset information. This achieves accurate capture of key target asset information from access requests without interfering with the normal transmission of the original traffic, providing a complete and accurate data foundation for subsequent accurate asset status determination. This overcomes the shortcomings of traditional solutions, which lack refined traffic analysis capabilities and cannot accurately locate access objects. By comparing the parsed target asset information with a pre-set asset registration database in real time, the registration status of assets is dynamically determined, enabling timely identification of access requests for unregistered assets and avoiding the risk of asset abuse due to delayed updates of static rules. When it is confirmed that the target asset is registered, the operation and maintenance audit system issues a blocking command to the switch based on a pre-set access control policy. The switch then executes the interception operation, achieving a complete closed-loop control from request capture and status determination to policy execution. This significantly improves the dynamic response capability and security protection level of the operation and maintenance audit system in complex network environments. Therefore, it addresses the shortcomings of traditional static solutions in terms of real-time performance, security, and audit completeness. Attached Figure Description
[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0017] Figure 1 This is a flowchart of a dynamic asset access control method based on an operation and maintenance audit system disclosed in this invention; Figure 2 This is a framework diagram of a dynamic asset access control system based on an operation and maintenance audit system disclosed in this invention; Figure 3 This invention discloses a specific flowchart of a dynamic asset access control method based on an operation and maintenance audit system. Figure 4 This is a schematic diagram of a dynamic asset access control device based on an operation and maintenance audit system disclosed in this invention; Figure 5 This is a structural diagram of an electronic device disclosed in this invention. Detailed Implementation
[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0019] In operation and maintenance auditing scenarios, it is typically necessary to control client access requests to ensure secure access to core assets. However, traditional asset access control methods often rely on predefined static rules, such as fixed IP addresses, ports, or permission lists. This static control model struggles to detect changes in asset registration status in real time. Furthermore, traditional solutions generally lack deep analysis capabilities for access request traffic, failing to accurately extract target asset information and perform real-time linkage verification with the asset registration database. In addition, existing auditing processes mostly only record simple operation results, making it difficult to form a complete traceability chain from request capture and status judgment to policy execution. This fails to meet the compliance requirements of operation and maintenance auditing for full traceability of operations and maintenance processes, and also struggles to address the dynamic security control needs of asset access in complex network environments. Therefore, this application provides a dynamic asset access control method, device, equipment, and medium based on an operation and maintenance auditing system, which can solve the shortcomings of traditional static solutions in terms of real-time performance, security, and audit completeness.
[0020] See Figure 1 As shown in the figure, this application discloses a dynamic asset access control method based on an operation and maintenance audit system, including: Step S11: If an access request for the target asset is received from the client, a corresponding mirrored traffic copy is generated based on the currently transmitted original traffic using a preset switch, and the mirrored traffic copy is parsed using a preset operation and maintenance audit system to obtain the target asset information.
[0021] In this embodiment, when a client initiates an access request for a target asset, the default switch first receives the access request. This access request includes the target address (such as the IP address of the target asset), the protocol used, and the authentication data carried. Figure 2 As shown, the default switch, while forwarding the original traffic normally, activates the traffic mirroring function to copy the currently transmitted original traffic, generating a mirrored traffic copy that is completely identical to the original traffic. This mirrored traffic copy does not affect the normal transmission of the original traffic, and the communication link between the client and the target asset remains uninterrupted.
[0022] Furthermore, such as Figure 2 As shown, the pre-configured operation and maintenance audit system obtains a copy of the mirrored traffic through port mirroring and performs deep analysis on the mirrored traffic copy. The analysis process includes parsing the packet header and identifying the payload content to extract the target asset information. The target asset information may specifically include the asset's network identifier, such as IP address and MAC address, and may further include key fields such as service affiliation and port information, used to uniquely identify the target asset requested by the client. This embodiment accurately captures the key information of the target asset in the access request without interfering with the normal transmission of the original traffic, providing a complete and accurate data foundation for the subsequent accurate judgment of the asset status.
[0023] Step S12: Use the preset operation and maintenance audit system to compare the target asset information with the data in the preset asset registration database to obtain the corresponding asset registration status.
[0024] In this embodiment, the preset asset registration database is a pre-established repository for centrally storing detailed information on all assets within the enterprise. This database contains various types of asset information, specifically including the asset's name, model, purchase date, responsible party, registration validity period, and network access permissions. Figure 3 As shown, the pre-defined operation and maintenance audit system uses the target asset information (such as IP address or MAC address) parsed in the aforementioned steps as the query key, and compares and queries it with the data in the pre-defined asset registration database. If the query result shows that the target asset exists in the pre-defined asset registration database, and all its registration information meets the current valid standards and rules (e.g., the registration validity period has not expired, the asset status is normal, etc.), then the asset is determined to be in a registered state. If the query result shows that the target asset is not in the pre-defined asset registration database, or although it exists, the registration information has expired (e.g., the registration has expired), then the asset is determined to be in an unregistered state. Through the above real-time comparison mechanism, this embodiment can dynamically identify the registration status of assets, overcoming the security blind spots caused by the lag in updates of traditional static rules.
[0025] Step S13: If the asset registration status is "registered", then the preset operation and maintenance audit system sends a blocking instruction to the preset switch based on the preset access control policy, so that the preset switch can intercept the access request based on the blocking instruction.
[0026] In this embodiment, the preset access control policy is a pre-defined set of rules. This policy can be formulated based on multiple factors, specifically including the asset's security level, asset access permissions, current network security posture, user authentication level, and risk assessment results of access behavior, etc. Figure 3 As shown, after determining that the target asset is in a registered state, the preset operation and maintenance audit system further makes a decision based on the preset access control policy. Specifically, if the preset access control policy indicates that access requests to registered assets need to be controlled, the preset operation and maintenance audit system issues a blocking instruction to the preset switch. This blocking instruction contains identification information of the access request to be blocked, such as matching conditions such as source IP address, destination IP address, and protocol type. After receiving the blocking instruction, the preset switch blocks the client's access request according to the requirements of the blocking instruction. The blocking process specifically includes: the preset switch identifies the traffic data packet related to the access request to be blocked from the currently transmitted raw traffic based on the blocking instruction, and prevents the transmission of the traffic data packet to the target asset; at the same time, the preset switch returns a prompt message to the client, which may include a blocking notification and / or an explanation of the blocking reason, such as "Access denied: Target asset not registered" or "Current asset access permissions insufficient," etc. Figure 3 As shown, after completing the interception operation and returning a prompt, the default operation and maintenance audit system records an audit log for this interception operation. The audit log may include the time the interception occurred, client information (such as source IP address, username, etc.), target asset information, reason for the interception, system information that performed the interception operation, and personnel information that performed the interception operation. Subsequently, the audit log can be periodically reviewed and analyzed to identify potential security threats and abnormal access behaviors, evaluate the effectiveness of the default access control policies, and adjust and optimize them according to actual conditions.
[0027] Furthermore, such as Figure 3 As shown, if the asset registration status is unregistered, traffic is allowed according to the pre-set policy; if the asset registration status is registered, but further inspection reveals that the access request initiated by the client is within the authorized scope (i.e., the client has legitimate permission to access the asset), traffic is also allowed. In the above allowed scenarios, the preset operation and maintenance audit system also records the audit log of this operation to form a complete operation traceability chain.
[0028] As can be seen from the above, this embodiment first utilizes a preset switch to generate a mirrored traffic copy when the client initiates an access request. A preset operation and maintenance audit system then performs deep analysis on the mirrored traffic copy to accurately extract target asset information. This achieves accurate capture of key asset identifiers in the access request without interfering with the normal transmission of the original traffic, providing a complete and authentic data foundation for reliable judgment of subsequent asset status. This overcomes the shortcomings of traditional solutions that lack refined traffic analysis capabilities and cannot accurately locate the access object. Based on this, by comparing and verifying the parsed target asset information with a preset asset registration database in real time, the registration status of assets is dynamically identified. This not only promptly intercepts illegal access requests to unregistered or expired assets, avoiding the risk of abuse of zombie or shadow assets due to delayed static rule updates, but also allows for flexible handling according to preset strategies when assets are legally registered and the information is valid. This achieves a shift from a one-size-fits-all approach to differentiated and dynamic management. When the target asset is confirmed to be in a registered state, the operation and maintenance audit system issues a blocking command to the switch based on the preset access control policy. The switch accurately executes the interception operation and returns a prompt. With the full-link audit log recording, a complete closed loop is formed from request capture, status judgment, policy execution to audit traceability. This not only meets the compliance requirements of operation and maintenance audit for traceability and verifiability of the entire operation process, but also provides detailed data support for security management personnel to trace abnormal access and optimize control policies. Thus, it comprehensively solves the shortcomings of traditional static solutions in terms of real-time performance, security and audit integrity.
[0029] See Figure 4 As shown in the figure, this application discloses a dynamic asset access control device based on an operation and maintenance audit system, including: The traffic parsing module 11 is used to generate a corresponding mirrored traffic copy based on the original traffic currently being transmitted using a preset switch if it receives an access request for the target asset initiated by a client, and to parse the mirrored traffic copy using a preset operation and maintenance audit system to obtain the target asset information; the mirrored traffic copy is completely consistent with the original traffic.
[0030] The status determination module 12 is used to compare the target asset information with the data in the preset asset registration database using the preset operation and maintenance audit system to obtain the corresponding asset registration status. The preset asset registration database is used to centrally store detailed information of internal assets of the enterprise. The detailed information includes the asset name, model, purchase time, responsible person, registration validity period and access permission scope in the network.
[0031] Traffic interception module 13 is used to send a blocking instruction to the preset switch based on the preset operation and maintenance audit system and the preset access control policy if the asset registration status is "registered". The preset switch will then intercept the access request based on the blocking instruction. The preset access control policy is a control policy formulated based on the asset's security level, asset access permissions, current network security status, user authentication level, and risk assessment results of access behavior.
[0032] In some specific embodiments, the traffic interception module 13 may specifically include: The traffic identification unit is used to identify traffic data packets related to the access request to be intercepted from the currently transmitted raw traffic based on the blocking command using the preset switch, and to prevent the transmission of the traffic data packets to the target asset. The feedback unit is used to return a prompt message to the client, the prompt message including an interception notification and / or an explanation of the reason for the interception.
[0033] In some specific embodiments, the dynamic asset access control device based on the operation and maintenance audit system may further include: The log recording unit is used to record audit logs of the interception operation using the preset operation and maintenance audit system, and to review and analyze the audit logs in order to evaluate the effectiveness of the preset access control policy based on the review and analysis results; the audit logs include the time of the interception, the client information, the target asset information, the reason for the interception, the system information of the interception operation, and the personnel information of the interception operation; The traffic release unit is used to release traffic based on the preset access control policy if the asset registration status is unregistered or registered, and the access request initiated by the client is within the authorized range, and to record the audit log of this operation using the preset operation and maintenance audit system.
[0034] Furthermore, embodiments of this application also disclose an electronic device, Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the dynamic asset access control method based on an operation and maintenance audit system disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be a computer.
[0035] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.
[0036] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.
[0037] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the dynamic asset access control method based on the operation and maintenance audit system executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.
[0038] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned dynamic asset access control method based on an operation and maintenance audit system. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.
[0039] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.
[0040] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0041] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.
[0042] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0043] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.
Claims
1. A dynamic asset access control method based on an operation and maintenance audit system, characterized in that, include: If a client requests access to a target asset, a corresponding mirrored traffic copy is generated based on the currently transmitted original traffic using a preset switch, and the mirrored traffic copy is parsed using a preset operation and maintenance audit system to obtain the target asset information. The mirrored traffic copy is completely identical to the original traffic; The target asset information is compared with the data in the preset asset registration database using the preset operation and maintenance audit system to obtain the corresponding asset registration status; If the asset registration status is "registered", then the preset operation and maintenance audit system will issue a blocking command to the preset switch based on the preset access control policy, so that the preset switch can intercept the access request based on the blocking command.
2. The dynamic asset access control method based on an operation and maintenance audit system according to claim 1, characterized in that, After the preset switch intercepts the access request based on the blocking command, the method further includes: The preset operation and maintenance audit system records audit logs of interception operations, and reviews and analyzes the audit logs in order to evaluate the effectiveness of the preset access control policy based on the review and analysis results.
3. The dynamic asset access control method based on an operation and maintenance audit system according to claim 2, characterized in that, The audit log includes the time of the interception, the client information, the target asset information, the reason for the interception, the system information that performed the interception operation, and the personnel information that performed the interception operation.
4. The dynamic asset access control method based on an operation and maintenance audit system according to claim 1, characterized in that, The preset access control policy is a control policy formulated based on the security level of the asset, the access permissions of the asset, the current network security situation, the user's identity authentication level, and the risk assessment results of the access behavior.
5. The dynamic asset access control method based on an operation and maintenance audit system according to claim 1, characterized in that, The method of using the preset switch to intercept the access request based on the blocking command includes: The preset switch uses the blocking command to identify traffic data packets related to the access request to be intercepted from the currently transmitted raw traffic, and prevents the transmission of the traffic data packets to the target asset. A notification message is returned to the client, which includes an interception notification and / or an explanation of the reason for the interception.
6. The dynamic asset access control method based on an operation and maintenance audit system according to claim 1, characterized in that, After comparing the target asset information with the data in the preset asset registration database using the preset operation and maintenance audit system to obtain the corresponding asset registration status, the method further includes: If the asset registration status is unregistered or registered, and the access request initiated by the client is within the authorized scope, then the traffic is allowed based on the preset access control policy, and the audit log of this operation is recorded using the preset operation and maintenance audit system.
7. The dynamic asset access control method based on an operation and maintenance audit system according to claim 1, characterized in that, The preset asset registration database is used to centrally store detailed information about the company's internal assets. This detailed information includes the asset's name, model, purchase date, responsible person, registration validity period, and access permissions on the network.
8. A dynamic asset access control device based on an operation and maintenance audit system, characterized in that, include: The traffic parsing module is used to generate a corresponding mirrored traffic copy based on the currently transmitted original traffic using a preset switch if it receives an access request for the target asset initiated by the client, and to parse the mirrored traffic copy using a preset operation and maintenance audit system to obtain the target asset information. The mirrored traffic copy is completely identical to the original traffic; The status determination module is used to compare the target asset information with the data in the preset asset registration database using the preset operation and maintenance audit system to obtain the corresponding asset registration status. The traffic interception module is used to send a blocking command to the preset switch based on the preset access control policy using the preset operation and maintenance audit system if the asset registration status is "registered", so that the preset switch can intercept the access request based on the blocking command.
9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor is configured to execute the computer program to implement the dynamic asset access control method based on an operation and maintenance audit system as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, Used to store computer programs, wherein the computer programs, when executed by a processor, implement the dynamic asset access control method based on an operation and maintenance audit system as described in any one of claims 1 to 7.