A multi-hole host identification and network access control method and device

Abstract

The application discloses a multi-hole host identification and network access control method and device, and relates to the technical field of network access control.The method comprises the following steps: collecting network messages corresponding to a target physical port; judging whether the target physical port has abnormal multi-address access behavior according to the network messages; when it is determined that the target physical port has abnormal multi-address access behavior, switching the target physical port to a limited access state, and generating a corresponding confirmation strategy parameter set; after receiving a temporary on-site confirmation authorization instruction bound with the target physical port, sending a confirmation request to an external authentication device through a management port; and updating a port credibility parameter corresponding to the target physical port according to a consistency comparison result, and adjusting a control strategy of subsequent abnormal multi-address access behavior based on the port credibility parameter.The on-site confirmation is completed by using the external authentication device, the standard network port body does not need to be modified, and the method is convenient to deploy and implement.

Description

Technical Field

[0001] This invention relates to the field of network access control technology, and in particular to a method and apparatus for multi-homed host identification and network access control. Background Technology

[0002] In the application of switches, edge access devices, or other network access devices, it is often necessary to identify and manage the terminal devices accessing physical ports. In some application scenarios, the network side prefers that only one terminal device can access a physical port, or only allow access methods that meet preset conditions. When multiple addresses are active simultaneously on the same physical port, address mapping relationships are abnormal, or session behavior is abnormal, it may indicate that the physical port is experiencing shared access, bridged access, forwarded access, or other unexpected access situations.

[0003] In existing technologies, such abnormal access behavior is typically handled using direct blocking, static whitelists, or simple alarms. While direct blocking can limit abnormal access to some extent, it can easily disrupt normal business operations in scenarios with genuine on-site maintenance, temporary debugging, or authorized extended access requirements. Static whitelists, while allowing access for some known access objects, struggle to adapt to temporary changes in the environment and lack sufficient support for real-time port-level confirmation. Simple alarms, while alerting administrators to the anomaly, still struggle to distinguish between authorized and unauthorized access without an effective confirmation mechanism.

[0004] On the other hand, if abnormal ports are allowed to pass only based on instructions issued by the remote management platform, it can usually only confirm that the remote management side intends to allow the passage, but it is difficult to further confirm whether the object being operated on-site is the actual access point corresponding to the target physical port. If the on-site confirmation function is directly integrated into the standard network port structure, it may involve the modification of the standard interface structure, resulting in poor adaptability and universality.

[0005] Therefore, it is necessary to provide a new multi-homed host identification and network access control scheme that, upon detecting abnormal multi-address access behavior, can combine remote authorization and on-site confirmation to perform hierarchical control of the target physical port, thereby improving the accuracy and practicality of network access control. Summary of the Invention

[0006] The purpose of this invention is to provide a method and apparatus for multi-homed host identification and network access control, so as to solve the problems of the existing technology in handling abnormal multi-address access behavior with a single approach, insufficient on-site confirmation capability, and difficulty in balancing security control and on-site operation and maintenance needs.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a method for multi-homed host identification and network access control, comprising:

[0008] Collect network packets corresponding to the target physical port;

[0009] Determine whether the target physical port exhibits abnormal multi-address access behavior based on the network packets;

[0010] When abnormal multi-address access behavior is detected, the target physical port is switched to restricted access state, and a set of confirmation policy parameters corresponding to the target physical port is generated.

[0011] Upon receiving a temporary on-site confirmation authorization instruction bound to the target physical port, a confirmation request is sent to the external authentication device through the management port;

[0012] Based on the authentication result returned by the external authentication device, determine whether to generate a valid local confirmation identifier;

[0013] After generating the valid local confirmation identifier, the target physical port is switched to the verification and release state, and the network behavior characteristics of the target physical port in the verification and release state are collected.

[0014] Based on the consistency comparison results between the network behavior characteristics and the expected behavior model, the target physical port is switched to normal forwarding state, or rolled back to restricted access state, or a blocking policy is implemented.

[0015] The port trustworthiness parameter corresponding to the target physical port is updated based on the consistency comparison result, and the control strategy for subsequent abnormal multi-address access behavior is adjusted based on the port trustworthiness parameter.

[0016] Preferably, determining whether the target physical port exhibits abnormal multi-address access behavior based on the network packets includes:

[0017] Establish a port address feature table and a port behavior feature model for the target physical port;

[0018] Determine the anomaly score and / or anomaly type based on the port address feature table and the port behavior feature model;

[0019] When the same physical port has two or more different source MAC addresses, two or more different source IP addresses, or an address mapping relationship that exceeds the threshold of the single terminal access model within a preset detection period, it is determined that the target physical port has abnormal multi-address access behavior.

[0020] Preferably, generating the acknowledgment policy parameter set corresponding to the target physical port includes:

[0021] The confirmation strategy parameter set is generated based on the anomaly score, anomaly type, and historical reliability parameters.

[0022] The confirmation strategy parameter set includes at least one or more of the following: confirmation request validity period, authentication waiting time, authentication method type, authentication result judgment condition, verification release time, post-release verification cycle, post-release expected behavior threshold, and post-failure blocking level.

[0023] The restricted access status includes at least one of the following: limiting the bandwidth of the target physical port, prohibiting the establishment of new service sessions, restricting access to a preset address, or switching the target physical port to an isolated network segment.

[0024] Preferably, sending a confirmation request to the external authentication device through the management port includes:

[0025] Verify the target physical port identifier, authorization session identifier, and authorization validity period in the temporary on-site confirmation authorization instruction;

[0026] After successful verification, the confirmation request is generated and sent to the external authentication device;

[0027] The confirmation request includes at least one or more of the following: target physical port identifier, exception type, request timestamp, authorized session identifier, and confirmation policy parameter set.

[0028] Preferably, determining whether to generate a valid local confirmation identifier based on the authentication result returned by the external authentication device includes:

[0029] After receiving the confirmation request, the external authentication device outputs a confirmation prompt message to the site.

[0030] After on-site personnel perform a preset confirmation operation, the external authentication device generates an authentication result and sends it to the control device corresponding to the target physical port through the management port;

[0031] The preset confirmation operation includes at least one of pressing the authentication button, inserting a USB token, and sending a confirmation command via a serial port;

[0032] When the authentication result meets the authentication result judgment conditions in the confirmation strategy parameter set, the valid local confirmation identifier is generated.

[0033] Preferably, after generating the valid local confirmation identifier, switching the target physical port to the verification-allowed state and collecting the network behavior characteristics of the target physical port in the verification-allowed state includes:

[0034] Restore some of the service forwarding capabilities of the target physical port according to the confirmation policy parameter set;

[0035] The aforementioned partial service forwarding capabilities include at least one of the following: restoring bandwidth configuration, allowing the establishment of a controlled number of new sessions, removing some access control list restrictions, and migrating ports from isolated network segments back to service network segments;

[0036] Within the second preset verification period, network behavior characteristics of the target physical port are collected. These network behavior characteristics include one or more of the following: number of source MAC addresses, number of source IP addresses, address mapping relationship, session establishment frequency, packet type distribution, transfer behavior characteristics, and data traffic model.

[0037] Preferably, the step of switching the target physical port to normal forwarding state, or falling back to restricted access state, or implementing a blocking policy based on the consistency comparison result between the network behavior characteristics and the expected behavior model includes:

[0038] The expected behavior model is determined based on the anomaly type, remote authorization information, and confirmation strategy parameter set during the anomaly identification phase.

[0039] When the network behavior characteristics are consistent with the expected behavior model, the target physical port is switched from the verification and release state to the normal forwarding state;

[0040] When the network behavior characteristics are inconsistent with the expected behavior model, the target physical port is reverted to a restricted access state or a blocking policy is implemented, and an alarm message is sent to the remote management platform.

[0041] Preferably, the step of updating the port trustworthiness parameter corresponding to the target physical port based on the consistency comparison result, and adjusting the control strategy for subsequent abnormal multi-address access behavior based on the port trustworthiness parameter, includes:

[0042] The port credibility parameter is updated based on at least one of the following: whether on-site confirmation has been passed, whether feedback verification has been passed, number of feedback verification failures, trend of anomaly type changes, and frequency of anomaly occurrence.

[0043] If abnormal multi-address access behavior is detected again on the target physical port in a subsequent instance, one or more of the following will be adjusted based on the port trustworthiness parameters: anomaly judgment threshold, restricted access level, confirmation request validity period, authentication waiting time, verification release cycle, and blocking level after failure.

[0044] The present invention also provides a multi-homed host identification and network access control device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method described above.

[0045] Preferably, it also includes a network packet acquisition unit, an external authentication communication unit, an access control execution unit, and a state storage unit;

[0046] The network packet acquisition unit is used to acquire network packets corresponding to the target physical port;

[0047] The external authentication communication unit is used to communicate with the external authentication device through the management port and receive the authentication result returned by the external authentication device;

[0048] The access control execution unit is used to switch the target physical port to a restricted access state, a verification-allowed state, or a normal forwarding state.

[0049] The state storage unit is used to store the confirmation policy parameter set, authorization session information and port trustworthiness parameters corresponding to the target physical port.

[0050] The technical effects and advantages of this invention are as follows:

[0051] 1. After identifying abnormal multi-address access behavior on the target physical port, this invention does not directly allow or block access in a single way. Instead, it first switches to a restricted access state and combines on-site confirmation with subsequent verification to achieve phased control. This is beneficial for balancing security control and on-site operation and maintenance needs. Furthermore, on-site confirmation is completed through an external authentication device that communicates with the management port. This does not rely on modifying the standard network port structure, has good adaptability, and is easy to deploy on existing switching equipment or access control equipment.

[0052] 2. After on-site confirmation, the present invention sets a verification release status and makes a second judgment based on the consistency between the network behavior characteristics during the release period and the expected behavior model, which helps to improve the accuracy of abnormal access handling. Attached Figure Description

[0053] Figure 1 This is a flowchart of the abnormal multi-address access identification and on-site confirmation request process of the present invention.

[0054] Figure 2 This is a flowchart of the on-site verification and access control policy adjustment process for this invention.

[0055] Figure 3 This is a structural diagram of the multi-homed host identification and network access control device of the present invention.

[0056] Figure 4 This is a system network diagram for on-site verification based on external authentication equipment, as presented in this invention.

[0057] Figure 5 This is a sequence diagram showing the interaction between the confirmation request and the authentication result in this invention. Detailed Implementation

[0058] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0059] In a typical application scenario, when multiple addresses are active simultaneously on the same physical port, address mapping relationships are abnormal, or session behavior is abnormal, control methods such as direct blocking, static whitelisting, simple alarms, or issuing access commands solely through a remote management platform are commonly used. While these methods can limit abnormal access behavior to some extent, they still have the following shortcomings: First, direct blocking or static control methods cannot meet the actual needs of on-site maintenance, temporary debugging, or authorized extended access; second, relying solely on the remote management platform's permission intention makes it difficult to further confirm whether the on-site operation target is the actual access point corresponding to the target physical port; third, if the on-site confirmation function is directly integrated into the standard network port itself, it may involve modifying the standard interface structure, resulting in poor adaptability and deployment convenience.

[0060] Based on this, this application provides a multi-homed host identification and network access control device.

[0061] In this embodiment, the execution device can be a switching device, an edge access device, an access control gateway, or other devices with network access control capabilities. The execution device has multiple service physical ports and at least one management port, used to collect network packets corresponding to the target physical port, identify abnormal multi-address access behavior, execute access control policies, and communicate with an external authentication device through the management port.

[0062] In this embodiment, the remote management platform is used to receive alarm information sent by the execution device, issue temporary on-site confirmation authorization instructions bound to the target physical port, and display the corresponding processing status.

[0063] In this embodiment, the external authentication device establishes a communication connection with the execution device through a management port. Upon receiving a confirmation request, it outputs a confirmation prompt message, and after on-site personnel perform a preset confirmation operation, it returns the authentication result to the execution device. The external authentication device can be a dedicated authentication button device, a USB token, a serial port authenticator, or other devices capable of communicating with the execution device and outputting authentication results.

[0064] In this embodiment, the external authentication device is a dedicated authentication button device. This dedicated authentication button device includes a communication interface, a button input section, and a prompt output section. The communication interface is used to communicate with the management port of the execution device, the button input section is used to receive button operations from on-site personnel, and the prompt output section is used to output confirmation prompt information.

[0065] In this embodiment, the external authentication device is a USB token. After receiving the confirmation request information, the USB token outputs authentication information corresponding to this authorization session, and the execution device receives the authentication information and performs a matching judgment.

[0066] In this embodiment, the external authentication device is a serial port authenticator. On-site personnel can input a confirmation command in a preset format via a serial port terminal. The serial port authenticator sends the confirmation command to the execution device, which then determines the authentication result.

[0067] It should be noted that the specific form of the aforementioned external authentication device is not limited to a dedicated button device, USB token, or serial port authenticator. As long as it can communicate with the management port of the execution device and output the authentication result after the on-site personnel perform the preset confirmation operation, it can be used as the external authentication device in this invention.

[0068] This embodiment describes the interaction process between the confirmation request and the authentication result.

[0069] First, after detecting abnormal multi-address access behavior on the target physical port, the execution device switches the target physical port to a restricted access state and records the target physical port identifier, abnormal type, request generation time, and confirmation policy parameter set.

[0070] Secondly, the remote management platform issues a temporary on-site confirmation authorization command bound to the target physical port to the execution device.

[0071] Then, the device verifies the validity of the authorization command and sends a confirmation request to the external authentication device.

[0072] After receiving the confirmation request, the external authentication device outputs the corresponding prompt information and waits for on-site personnel to perform the preset confirmation operation within the authentication waiting time.

[0073] If the on-site personnel complete the preset confirmation operation within the validity period, the external authentication device will return the authentication result to the execution device; if it is not completed within the validity period, an authentication failure result or a timeout result will be returned.

[0074] After receiving the authentication result, the executing device determines whether to generate a valid local confirmation identifier based on the confirmation policy parameter set, and further decides whether to switch the target physical port to the verification and release state.

[0075] In one specific example, a target physical port exhibits abnormal multi-address access behavior when three different source MAC addresses and multiple IP addresses alternately establish sessions within a continuous monitoring period. The executing device switches the port to restricted access, allowing access only to a preset management platform address. After remote administrators confirm the port requires on-site maintenance, they issue a temporary on-site confirmation authorization command. The executing device then sends a confirmation request to an external authentication device. On-site personnel press a dedicated authentication button within a specified time, and the external authentication device returns an authentication success result to the executing device. After generating a valid local confirmation identifier, the executing device switches the target physical port to a verification-allowed state and continues to monitor the number of addresses and session behavior on the port within the verification period. If the monitoring results match the expected behavior model, normal forwarding is restored; otherwise, it reverts to restricted access or implements a blocking policy.

[0076] In this embodiment, the device also includes a memory and a processor.

[0077] The memory contains computer programs;

[0078] When the processor executes a computer program, it implements a method for identifying multi-homed hosts and controlling network access.

[0079] In this embodiment, the device further includes a network packet acquisition unit, an external authentication communication unit, an access control execution unit, and a state storage unit.

[0080] The network packet acquisition unit is used to collect network packets corresponding to the target physical port.

[0081] The external authentication communication unit is used to communicate with the external authentication device through the management port and to receive the authentication results returned by the external authentication device.

[0082] The access control enforcement unit is used to switch the target physical port to a restricted access state, a verification-allowed state, or a normal forwarding state.

[0083] The state storage unit is used to store the acknowledgment policy parameter set, authorized session information, and port trustworthiness parameters corresponding to the target physical port.

[0084] For the device embodiment, since it belongs to the same inventive concept as the aforementioned method embodiment, the parts not described in detail can be referred to the aforementioned method embodiment, and will not be repeated here.

[0085] Based on the above-mentioned device, such as Figures 1-5As shown, this application also provides a method for multi-homed host identification and network access control. Upon detecting abnormal multi-address access behavior on a target physical port, the method first switches the target physical port to a restricted access state. Then, based on the temporary on-site confirmation authorization command issued by the remote management platform and the authentication result returned by the external authentication device, it determines whether to generate a valid local confirmation identifier. After generating a valid local confirmation identifier, the method switches the target physical port to a verification-allowed state. Based on the consistency comparison results between network behavior characteristics and expected behavior models, it performs hierarchical control on the target physical port, such as normal forwarding, rollback to restricted access, or blocking. Simultaneously, it updates the port trustworthiness parameter corresponding to the target physical port according to the consistency comparison results and adjusts the control strategy for subsequent abnormal multi-address access behavior accordingly. Thus, without modifying the standard network port itself, more accurate handling of abnormal access behavior is achieved.

[0086] Specifically, the following steps are included:

[0087] Step S101: Collect network packets corresponding to the target physical port.

[0088] In this step, the device collects inbound and / or outbound packets from each physical port. The collected information may include one or more of the following: source MAC address, destination MAC address, source IP address, destination IP address, protocol type, session establishment status, packet length, packet frequency, address mapping relationships, and traffic statistics.

[0089] For ease of analysis, a corresponding data record can be created for each physical port. For the target physical port, a port address characteristic table and a port behavior characteristic record can be maintained. The port address characteristic table records the address information of the physical port within a preset time range, while the port behavior characteristic record records session establishment frequency, packet type distribution, traffic changes, and other behavioral information.

[0090] Step S102: Determine whether there is abnormal multi-address access behavior on the target physical port based on network packets.

[0091] In this step, the collected network packets can be analyzed according to preset rules, statistical thresholds, or behavioral models. For example, when the same physical port has two or more different source MAC addresses, two or more different source IP addresses, or an address mapping relationship that exceeds the threshold of the single terminal access model within a preset detection period, it can be determined that the target physical port has abnormal multi-address access behavior.

[0092] The single-terminal access model can be configured according to the actual application scenario. For example, in the default scenario, a physical port usually connects only one terminal device. If multiple source MAC addresses are active alternately, multiple IP addresses establish connections at the same time, or there is an obvious many-to-many address mapping relationship during the continuous detection period, it can be determined that the target physical port has a risk of multi-address access.

[0093] In this embodiment, an anomaly score can be further calculated and the anomaly type determined. The anomaly score can be determined based on one or more of the following: number of addresses, address switching frequency, session establishment frequency, forwarding behavior characteristics, and traffic fluctuation. The anomaly type can include shared access, bridged access, forwarded access, temporary extended access, or other anomaly types. The anomaly score and anomaly type can be used to generate a set of confirmation policy parameters.

[0094] Step S103: When it is determined that there is abnormal multi-address access behavior, the target physical port is switched to restricted access state, and a corresponding confirmation policy parameter set is generated.

[0095] In this step, after detecting an anomaly, the executing device does not immediately block the target physical port completely, but first switches to a restricted access state. The restricted access state may include one or more of the following: limiting the bandwidth of the target physical port, prohibiting the establishment of new service sessions, allowing access only to a preset management platform address, allowing access only to a preset authentication address, or switching the target physical port to an isolated network segment.

[0096] The purpose of adopting restricted access status is to retain necessary management, authorization, and confirmation capabilities while controlling the further spread of the impact of abnormal access.

[0097] Simultaneously, a confirmation strategy parameter set corresponding to the target physical port is generated based on the anomaly score, anomaly type, and historical reliability parameters. This confirmation strategy parameter set is used to define the subsequent confirmation and verification process. For example, the confirmation strategy parameter set may include one or more of the following: confirmation request validity period, authentication waiting time, authentication method type, authentication result judgment conditions, verification release time, post-release verification cycle, expected behavior threshold after release, and blocking level after failure.

[0098] For example, for target physical ports with low anomaly scores and high historical reliability, a shorter restricted control time and a more lenient verification threshold can be set; for target physical ports with high anomaly scores or multiple historical verification failures, stricter authentication conditions and a higher level of post-failure blocking strategy can be set.

[0099] Step S104: After receiving the temporary on-site confirmation authorization instruction bound to the target physical port, send a confirmation request to the external authentication device through the management port.

[0100] In this step, after the operation and maintenance user's identity is authenticated, the remote management platform can issue a temporary on-site confirmation authorization command bound to the target physical port to the execution device. The authorization command may include at least the target physical port identifier, the authorization session identifier, the authorization validity period, and some or all of the parameters in the confirmation policy parameter set.

[0101] Upon receiving a temporary on-site confirmation and authorization command, the execution device first verifies the target physical port identifier, authorization session identifier, and authorization validity period. If the verification passes, it generates a confirmation request and sends it to the external authentication device via the management port.

[0102] The management port can be a serial management interface, a USB management interface, a dedicated control interface, or other interfaces used for management communication. The external authentication device can communicate with the management port via a wired connection or a short-distance dedicated connection.

[0103] In this embodiment, the confirmation request includes at least one or more of the following: target physical port identifier, exception type, request timestamp, authorized session identifier, and confirmation policy parameter set. By including the target physical port identifier and authorized session information in the confirmation request, the external authentication device can output prompts corresponding to this confirmation task, thereby reducing the possibility of discrepancies between the on-site confirmation object and the remote authorization object.

[0104] Step S105: Based on the authentication result returned by the external authentication device, determine whether to generate a valid local confirmation identifier.

[0105] In this step, after receiving the confirmation request, the external authentication device can output confirmation prompts to the site. These prompts can be one or more of the following: port number prompt, session prompt, exception type prompt, confirmation time limit prompt, or operation requirement prompt. The prompting method can be an indicator light, display screen, buzzer, serial port output information, or other methods that can prompt on-site personnel.

[0106] Upon receiving the confirmation prompt, on-site personnel perform a preset confirmation operation. This preset confirmation operation may include at least one of pressing an authentication button, inserting a USB token, or sending a confirmation command via a serial port. In this embodiment, the external authentication device can support multiple authentication methods and determines the permitted confirmation method based on the authentication method type specified in the confirmation policy parameter set.

[0107] For example, in one implementation, the external authentication device is a dedicated authentication button box, which communicates with the switching equipment via a management port. Upon receiving a confirmation request, the button box illuminates the corresponding indicator light and waits for the on-site personnel to press the confirmation button within the authentication waiting time. If the button press occurs within the validity period of the confirmation request, the button box returns a confirmation result to the executing device.

[0108] In another implementation, the external authentication device is a USB token. After the on-site personnel insert the USB token into the management interface connected to the execution device, the USB token outputs authentication information.

[0109] In another implementation, the external authentication device is a serial port authenticator. On-site personnel send a preset format confirmation command to the device via a serial port terminal, and the device receives the authentication result accordingly.

[0110] After receiving the authentication result from the external authentication device, the execution device matches the authentication result with the authentication result judgment conditions in the confirmation policy parameter set. These conditions may include whether the confirmation method is correct, whether the authentication was completed within the valid time, whether the authentication result is consistent with the current authorized session, and whether the authentication source is a trusted external authentication device. When the match is successful, a valid local confirmation identifier is generated.

[0111] The valid local confirmation identifier can be a status identifier established within the execution device, used to indicate that the target physical port has completed this on-site confirmation and can proceed to the subsequent verification and release stage.

[0112] Step S106: After generating a valid local confirmation identifier, switch the target physical port to the verification and release state, and collect the network behavior characteristics of the target physical port in the verification and release state.

[0113] In this step, after generating a valid local acknowledgment identifier, the executing device does not immediately restore the target physical port to a fully normal state, but instead switches to the verification and release state. The verification and release state is an intermediate state between the restricted access state and the normal forwarding state.

[0114] Once the verification is complete, some service forwarding capabilities of the target physical port are restored based on the confirmed policy parameter set. For example, this could include restoring bandwidth configuration, allowing a controlled number of new sessions, removing some access control list restrictions, and relocating the port from the isolated network segment back to the service network segment.

[0115] Meanwhile, network behavior characteristics of the target physical port are continuously collected during the second preset verification period. These network behavior characteristics may include one or more of the following: number of source MAC addresses, number of source IP addresses, address mapping relationships, session establishment frequency, packet type distribution, transfer behavior characteristics, and data traffic model.

[0116] By continuing to observe network behavior while it is in a verified and permitted state, the actual access behavior after on-site confirmation can be reassessed to avoid the risk of fully restoring all access permissions based on only one confirmation operation.

[0117] Step S107: Based on the consistency comparison results between network behavior characteristics and expected behavior models, perform subsequent state switching on the target physical port.

[0118] In this step, the executing device determines the expected behavior model based on the anomaly type, remote authorization information, and confirmation policy parameter set from the anomaly identification phase. This expected behavior model describes the range of behaviors allowed for the target physical port during the verification and release process after successful on-site confirmation.

[0119] For example, when the purpose of remote authorization is to allow temporary access to a maintenance terminal on-site, the expected behavior model can correspond to a limited number of addresses, a limited session establishment frequency, and a preset protocol range. If a large number of new addresses, continuous multi-session transfers, or communication behaviors exceeding the authorization range occur during the verification and release period, it can be determined that the network behavior characteristics are inconsistent with the expected behavior model.

[0120] When the network behavior characteristics are consistent with the expected behavior model, the target physical port is switched from the verification and release state to the normal forwarding state.

[0121] When the network behavior characteristics are inconsistent with the expected behavior model, the target physical port is reverted to a restricted access state or a blocking policy is implemented, and an alarm message is sent to the remote management platform.

[0122] The blocking strategy may include one or more of the following: closing the target physical port, maintaining isolation, prohibiting re-authentication, or raising the threshold for subsequent confirmation.

[0123] Step S108: Update the port trustworthiness parameter corresponding to the target physical port according to the consistency comparison result, and adjust the control strategy for subsequent abnormal multi-address access behavior based on the port trustworthiness parameter.

[0124] In this step, the port trustworthiness parameter corresponding to the target physical port can be updated based on at least one of the following: whether on-site confirmation has been passed, whether feedback verification has been passed, the number of feedback verification failures, the trend of anomaly type changes, and the frequency of anomaly occurrence.

[0125] For example, for target physical ports that have passed on-site verification multiple times and subsequent behavioral verifications, the corresponding port credibility parameter can be appropriately increased; for target physical ports that have failed multiple verifications, failed verifications, or have repeatedly exhibited abnormal behavior, the corresponding port credibility parameter can be decreased.

[0126] If abnormal multi-address access behavior is detected again on the target physical port in a subsequent instance, control strategies such as the abnormal judgment threshold, restricted access level, confirmation request validity period, authentication waiting time, verification release cycle, and blocking level after failure can be adjusted based on the port trustworthiness parameter, thereby achieving differentiated control over different ports.

[0127] Therefore, after identifying abnormal access, this embodiment implements phased control over the target physical port through processes such as restricted access, remote authorization, confirmation by external authentication devices, verification and release, and feedback adjustment.

[0128] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for identifying multi-homed hosts and controlling network access, characterized in that, include: Collect network packets corresponding to the target physical port; Determine whether the target physical port exhibits abnormal multi-address access behavior based on the network packets; When abnormal multi-address access behavior is detected, the target physical port is switched to restricted access state, and a set of confirmation policy parameters corresponding to the target physical port is generated. Upon receiving a temporary on-site confirmation authorization instruction bound to the target physical port, a confirmation request is sent to the external authentication device through the management port; Based on the authentication result returned by the external authentication device, determine whether to generate a valid local confirmation identifier; After generating the valid local confirmation identifier, the target physical port is switched to the verification and release state, and the network behavior characteristics of the target physical port in the verification and release state are collected. Based on the consistency comparison results between the network behavior characteristics and the expected behavior model, the target physical port is switched to normal forwarding state, or rolled back to restricted access state, or a blocking policy is implemented. The port trustworthiness parameter corresponding to the target physical port is updated based on the consistency comparison result, and the control strategy for subsequent abnormal multi-address access behavior is adjusted based on the port trustworthiness parameter.

2. The multi-homed host identification and network access control method as described in claim 1, characterized in that, The step of determining whether the target physical port has abnormal multi-address access behavior based on the network packets includes: Establish a port address feature table and a port behavior feature model for the target physical port; Determine the anomaly score and / or anomaly type based on the port address feature table and the port behavior feature model; When the same physical port has two or more different source MAC addresses, two or more different source IP addresses, or an address mapping relationship that exceeds the threshold of the single terminal access model within a preset detection period, it is determined that the target physical port has abnormal multi-address access behavior.

3. The multi-homed host identification and network access control method as described in claim 1, characterized in that, The generation of the confirmation policy parameter set corresponding to the target physical port includes: The confirmation strategy parameter set is generated based on the anomaly score, anomaly type, and historical reliability parameters. The confirmation strategy parameter set includes at least one or more of the following: confirmation request validity period, authentication waiting time, authentication method type, authentication result judgment condition, verification release time, post-release verification cycle, post-release expected behavior threshold, and post-failure blocking level. The restricted access status includes at least one of the following: limiting the bandwidth of the target physical port, prohibiting the establishment of new service sessions, restricting access to a preset address, or switching the target physical port to an isolated network segment.

4. The multi-homed host identification and network access control method as described in claim 1, characterized in that, Sending a confirmation request to the external authentication device through the management port includes: Verify the target physical port identifier, authorization session identifier, and authorization validity period in the temporary on-site confirmation authorization instruction; After successful verification, the confirmation request is generated and sent to the external authentication device; The confirmation request includes at least one or more of the following: target physical port identifier, exception type, request timestamp, authorized session identifier, and confirmation policy parameter set.

5. The multi-homed host identification and network access control method as described in claim 1, characterized in that, The step of determining whether to generate a valid local confirmation identifier based on the authentication result returned by the external authentication device includes: After receiving the confirmation request, the external authentication device outputs a confirmation prompt message to the site. After on-site personnel perform a preset confirmation operation, the external authentication device generates an authentication result and sends it to the control device corresponding to the target physical port through the management port; The preset confirmation operation includes at least one of pressing the authentication button, inserting a USB token, and sending a confirmation command via a serial port; When the authentication result meets the authentication result judgment conditions in the confirmation strategy parameter set, the valid local confirmation identifier is generated.

6. The multi-homed host identification and network access control method as described in claim 1, characterized in that, After generating the valid local confirmation identifier, the target physical port is switched to the verification-allowed state, and the network behavior characteristics of the target physical port in the verification-allowed state are collected, including: Restore some of the service forwarding capabilities of the target physical port according to the confirmation policy parameter set; The aforementioned partial service forwarding capabilities include at least one of the following: restoring bandwidth configuration, allowing the establishment of a controlled number of new sessions, removing some access control list restrictions, and migrating ports from isolated network segments back to service network segments; Within the second preset verification period, network behavior characteristics of the target physical port are collected. These network behavior characteristics include one or more of the following: number of source MAC addresses, number of source IP addresses, address mapping relationship, session establishment frequency, packet type distribution, transfer behavior characteristics, and data traffic model.

7. The multi-homed host identification and network access control method as described in claim 1, characterized in that, The step of switching the target physical port to normal forwarding state, or falling back to restricted access state, or implementing a blocking policy based on the consistency comparison result between the network behavior characteristics and the expected behavior model includes: The expected behavior model is determined based on the anomaly type, remote authorization information, and confirmation strategy parameter set during the anomaly identification phase. When the network behavior characteristics are consistent with the expected behavior model, the target physical port is switched from the verification and release state to the normal forwarding state; When the network behavior characteristics are inconsistent with the expected behavior model, the target physical port is reverted to a restricted access state or a blocking policy is implemented, and an alarm message is sent to the remote management platform.

8. The multi-homed host identification and network access control method as described in claim 1, characterized in that, The step of updating the port trustworthiness parameter corresponding to the target physical port based on the consistency comparison result, and adjusting the control strategy for subsequent abnormal multi-address access behavior based on the port trustworthiness parameter, includes: The port credibility parameter is updated based on at least one of the following: whether on-site confirmation has been passed, whether feedback verification has been passed, number of feedback verification failures, trend of anomaly type changes, and frequency of anomaly occurrence. If abnormal multi-address access behavior is detected again on the target physical port in a subsequent instance, one or more of the following will be adjusted based on the port trustworthiness parameters: anomaly judgment threshold, restricted access level, confirmation request validity period, authentication waiting time, verification release cycle, and blocking level after failure.

9. A multi-homed host identification and network access control device, characterized in that, The method includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method as described in any one of claims 1 to 8.

10. The multi-homed host identification and network access control device as described in claim 9, characterized in that, It also includes a network packet acquisition unit, an external authentication communication unit, an access control execution unit, and a state storage unit; The network packet acquisition unit is used to acquire network packets corresponding to the target physical port; The external authentication communication unit is used to communicate with the external authentication device through the management port and receive the authentication result returned by the external authentication device; The access control execution unit is used to switch the target physical port to a restricted access state, a verification-allowed state, or a normal forwarding state. The state storage unit is used to store the confirmation policy parameter set, authorization session information and port trustworthiness parameters corresponding to the target physical port.

Images