WO2016206227A1

WO2016206227A1 - Access control method and device

Info

Publication number: WO2016206227A1
Application number: PCT/CN2015/091304
Authority: WO
Inventors: 孟苑
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-06-25
Filing date: 2015-09-30
Publication date: 2016-12-29
Also published as: CN106302373A

Abstract

An access control method and device, the method includes: receiving an access request sent by an MAC address; if receiving the access request out of a preset fixed time area, matching the MAC address sending the access request with the MAC addresses in a preset static white list; when the MAC address matches an MAC address in the static white list, permitting the MAC address to access; when there is no matching item for the MAC address in the static white list, shielding the access request; if receiving the access request in the preset fixed time area, filtering the MAC address without authority according to the static white list, and putting all MAC addresses without authority in the fixed time area into a quasi white list, and setting temporary use authority for MAC addresses in the quasi white list. The above technical solution improves utilization of a wireless network.

Description

Access control method and device

Technical field

This document relates to the field of wireless access control, and more particularly to an access control method and apparatus.

Background technique

Infinity Fidelity (Wireless-Fidelity, WI-FI for short) is a network transmission standard for improving the interoperability between IEEE802.11-based wireless network products. It converts wired signals into high-frequency radio signals, and wirelessly connects terminals such as personal computers and handheld devices such as IPAD and MOBILE PHONE to each other. Although it has the advantages of fast transmission speed, low transmission signal power and no restrictions on wiring conditions, it meets the needs of social information, but it also has the disadvantages of poor transmission quality and low data security performance.

Objectively speaking, since the current standard neglects the protection of infinite management frames, the security performance of wireless links in public places is very low. In this case, the access control system of the wireless router that provides the shared resource is easily subject to the forged address resolution protocol, that is, the Address Resolution Protocol (ARP). ARP spoofing first modifies the media access control address, that is, the Media Access Control, which is referred to as the MAC address, and then cracks the key of the wired equivalent cryptographic protocol, namely Wired Equivalent Privacy (WEP). In this way, unauthorized unauthorized users can use ARP. The spoofing technology bypasses the MAC address filtering access control system, illegally obtains the wireless sub-network independent identity verification, and successfully enters the whitelist of the access control system to achieve the purpose of the network.

Instead of blindly controlling the use of illegal users, it is better to provide certain illegal users with "opportunities".

Summary of the invention

The technical problem to be solved by the present invention is to provide an access control method and apparatus to improve the usage rate of a wireless network.

In order to solve the above technical problems, the following technical solutions are adopted:

An access control method includes:

Receiving an access request issued by a MAC address;

If the access request is received outside the fixed time zone that has been set, the MAC address of the access request is matched with the MAC address in the static whitelist that has been set, when the MAC address is If the MAC address in the static whitelist matches, the MAC address is allowed to access; when the MAC address has no matching item in the static whitelist, the access request is blocked;

If the access request is received in the fixed time zone that has been set, and the MAC address without permission is filtered according to the static whitelist, all MAC addresses without permission in the fixed time zone are included in the whitelist. , set temporary usage rights for the MAC address in the quasi-white list.

Optionally, the step of setting temporary usage rights for the MAC address in the quasi-white list includes:

The maximum number of allowed access times and the maximum usage duration are set for the MAC address in the quasi-white list.

Optionally, the storage format of the MAC address information in the quasi-white list may be expressed as: identifier + access time + disconnection time + access times + cumulative network access duration.

Optionally, the method further includes: when the number of accesses of a MAC address reaches the maximum number of allowed accesses, or the usage duration reaches the maximum usage duration, or the access times reach the maximum number of allowed accesses, and When the usage duration reaches the maximum usage duration, the temporary use permission of the MAC address is canceled or the MAC address is directly deleted.

Optionally, the method further includes: setting a minimum usage value of the access times;

The number of times the MAC address is used in the whitelist is monitored. When the number of accesses of a MAC address is less than the minimum usage value of the access number in a preset time, the temporary use permission of the MAC address is cancelled or the MAC address is directly deleted.

Optionally, the method further includes: when a MAC address is canceled for temporary use permission, reporting to the administrator that the temporary use right of the MAC address is canceled, and the administrator activates the MAC address according to the usage of the MAC address, that is, The MAC address is set as a legitimate user, or the MAC address is continued as an illegal user.

Optionally, the step of canceling the temporary use right of the MAC address includes:

Change the identifier of the MAC address from permit. to deny.

An access control device, comprising: a receiving unit, a determining unit, and a whitelist matching list Meta, quasi-white list processing unit and rights management unit, wherein

The receiving unit is configured to: receive an access request sent by a MAC address;

The determining unit is configured to: determine whether the time when the receiving unit receives the access request is within a fixed time zone that has been set, and if not, notify the whitelist matching unit; if yes, notify the standard Whitelist processing unit;

The whitelist matching unit is configured to: match an access MAC address that sends the access request with a MAC address in a static whitelist that has been set, and match the MAC address in the static whitelist when the access MAC address is matched. Allowing the MAC address to be accessed; when the access MAC address has no match in the static whitelist, the access request of the MAC address is blocked;

The whitelist processing unit is configured to: filter out the MAC address without authority according to the static whitelist, and include all MAC addresses that are not authorized in the fixed time zone in the whitelist;

The rights management unit is configured to: set a temporary use right for the MAC address in the quasi-white list.

Optionally, the rights management unit is configured to set a temporary use right for the MAC address in the quasi-white list according to the following manner: setting a maximum number of allowed access times and a maximum use time for the MAC address in the quasi-white list.

Optionally, the rights management unit is further configured to: represent, in the whitelist, a storage format of the MAC address information as: identifier + access time + disconnection time + access times + cumulative network access time.

Optionally, the rights management unit is further configured to: when the number of accesses of a MAC address reaches the maximum number of allowed accesses, or the usage duration reaches the maximum usage duration, or the access times reach the allowed access The maximum number of times, and when the usage duration reaches the maximum usage duration, cancel the temporary use permission of the MAC address or directly delete the MAC address.

Optionally, the rights management unit is further configured to: set a minimum usage value of the access times;

The rights management unit monitors the number of times the MAC address is used in the whitelist. When the number of accesses of the MAC address is less than the minimum usage value of the access times in a preset time, the temporary use permission of the MAC address is cancelled or directly Delete the MAC address.

Optionally, the rights management unit is configured to cancel the temporary use rights of the MAC address as follows:

Change the identifier of the MAC address from permit. to deny.

Optionally, the device may further include an unauthorized alarm unit, wherein

The unauthorized alarm unit is configured to: when a MAC address is cancelled, the temporary use right of the MAC address is cancelled.

A computer program comprising program instructions that, when executed by a computer, cause the computer to perform any of the above described access control methods.

The embodiment of the present invention only opens the right to the legitimate user during the working time period and the important time period, and sets the temporary open permission to the user other than the legitimate user in other time periods, so that the utilization rate of the network can be improved.

BRIEF abstract

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is an overall architectural view of an embodiment of the present invention;

2 is a flowchart of an access control method according to an embodiment of the present invention;

3 is a flowchart of processing for a quasi-white list according to an application example of the present invention;

4 is a flowchart of a process after a MAC address in a quasi-white list is canceled for temporary use according to an application example of the present invention;

FIG. 5 is a schematic structural diagram of an access control apparatus according to an embodiment of the present invention.

Preferred embodiment of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

The invention will be further described in detail below with reference to the accompanying drawings. The technology of the present invention will be described below with reference to the accompanying drawings.

FIG. 1 is a schematic diagram of an overall architecture of a wireless access control system according to the present invention.

As shown in FIG. 2, the method for processing the fixed list authority judgment, statistics, and sending the MAC address information data in the embodiment of the present invention is as follows:

Step 201: The wireless routing device receives an access request sent by the terminal MAC address.

Step 202: If the wireless routing device receives the access request, the access routing request sends the access MAC address of the access request to the MAC address in the static whitelist that has been set. Match, when the access MAC address matches the MAC address in the static whitelist, the MAC address is allowed to access, the access right of the MAC address is automatically recognized and its usage record is always ignored; when the access MAC address is If there is no match in the static whitelist, it is identified as an illegal MAC address in the blacklist, and the access request is blocked.

Step 203: If the wireless routing device receives the access request in the fixed time zone that has been set, the MAC address of the privileged MAC address is filtered according to the static whitelist, and the MAC address of the privileged MAC address is recorded and counted. Enter the information and all the MAC addresses without permissions in the fixed time zone will be listed in the whitelist.

Optionally, the fixed time zone that has been set generally refers to a time period other than work or an unimportant time zone; otherwise, the fixed time zone that has been set refers to the working time zone or refers to an important time zone, during working hours. Segments and important time periods only open permissions for legitimate users, while in other time periods, temporary open permissions are set for users other than legitimate users, which can improve network utilization.

After step 203, the method further includes: setting a temporary use right for the MAC address in the quasi-white list.

Optionally, the step of setting a temporary use right for the MAC address in the quasi-white list includes: setting a maximum number of allowed access times and a maximum use duration for the MAC address in the quasi-white list.

Because some terminals are connected to the wireless router, they will not be accessed again for a long time. If they are stored for a long time, the storage space of the database and the data are greatly wasted. Find time. In the embodiment of the present invention, the number of MAC address access times in a certain time range is smaller than a preset value of the permission change module, and the permission change module can automatically clear the MAC address to improve the use efficiency of the database.

Optionally, the step of canceling the temporary use permission of the MAC address includes:

Change the identifier of the MAC address from permit. to deny.

In the above steps, according to the static whitelist and fixed time set in advance, it automatically matches and determines whether the MAC address that sends the access request may be a fixed legal user, and at the same time identifies an illegal user who does not have any permission, so as to take shielding measures. . The third step is to generate a relatively dynamic whitelist to facilitate temporary access to potential legitimate users.

The following is a description of the processing of the quasi-white list in the embodiment of the present invention and the processing after the MAC address in the quasi-white list is cancelled.

As shown in FIG. 3, the method for processing a quasi-white list in the embodiment of the present invention is as follows:

Step 301: According to the maximum number of allowed access times and the maximum duration value, the rights management unit determines whether there is a MAC address information record exceeding the preset limit in the whitelist, and the data of the access times and the maximum duration are preset. The MAC address in the limit has temporary access rights. If one or two MAC addresses that exceed the preset limit will cancel the temporary use permission of the MAC address.

A MAC address access times and a single access time will gradually accumulate.

Step 302: When a MAC address in the quasi-white list is first granted temporary permission (permit.), the rights management unit considers the data of the access times to be 1, and as the data is continuously updated, The value will be closer and closer to the critical point monitored by the rights management unit, as will the cumulative network access time. At the same time, it can be set to a faster reading format when the unit reads the called data.

Step 303: When one of the two pieces of data reaches the preset value first, the rights management unit changes the identifier of the MAC address from permit. to deny., and temporarily prohibits the access request and the use permission of the MAC address.

In step 304, the rights management unit may also monitor the number of times the MAC address is used. When the number of accesses of the MAC address is less than the minimum value of the preset access times in a predetermined time, the temporary use permission of the MAC address is cancelled or directly Delete the MAC address.

In the above four steps, according to the preset of the MAC address access times and the accumulated duration, the active attack strategy is used to defend against the attacks of potential illegal users. In practice, the loopholes of the network users and the access control system can be effectively found. Improvements in technical standards provide an opportunity. The two units created in this process are connected to each other and the division of labor is clear. The privilege identification module is used to determine and identify the privilege of the MAC address, and has the functions of data statistics and storage, and the privilege change module is responsible for monitoring the data and performing the action of changing the privilege and freezing the privilege, and automatically clearing the long-term non-use of the wireless service. The function of losing the MAC address information record.

As shown in FIG. 4, after the MAC address in the whitelist of the embodiment of the present invention is cancelled, the processing method is as follows:

Step 401: When the rights management unit changes the authority of the MAC address from permit. to deny., the unauthorized alarm unit is notified at the same time, and the unauthorized alarm unit can determine the status and location of the MAC address according to the received simple reminder, and go to the rights management unit. The information of the MAC address required for the extraction can be expressed as an identifier /deny.

Step 402: The unauthorized alarm unit further sorts the extracted information, and the edit is sent to the administrator as a short message, and the format may be: freeze MAC address/freeze time+processing opinion (the short message reply number 1 indicates thaw, and the number 0 indicates mask) .

Step 403: If the administrator believes that the MAC address user is legal, the activation notification unit will receive a short message with a reply of 1. After receiving the instruction, the activation notification unit immediately deletes the unauthorized record of the MAC address and activates the access permission. . If the administrator believes that the MAC address user is still illegal, continue to use the MAC address as an illegal user.

The above three steps achieve the effect of the maneuvering permission change event, in order to determine the individual MAC The question of address legitimacy provides evidence, choice, and time. At the same time, it also provides a quick way to reply to the short message and solve the problem of the legality of individual MAC addresses with one key, which greatly facilitates the actual operation and reduces the probability of misjudgment of the access control system.

As shown in FIG. 5, it is a schematic structural diagram of an access control apparatus according to an embodiment of the present invention. The apparatus includes: a receiving unit 501, a determining unit 502, a whitelist matching unit 503, a whitelisting processing unit 504, and a rights management unit 505.

The receiving unit 501 is configured to: receive an access request sent by a terminal MAC address;

The determining unit 502 is configured to: determine whether the time when the receiving unit receives the access request is within a fixed time zone that has been set, and if not, notify the whitelist matching unit; if yes, notify the Whitelist processing unit;

The whitelist matching unit 503 is configured to match the access MAC address that sends the access request with the MAC address in the static whitelist that has been set, when the access MAC address is the same as the MAC address in the static whitelist. Matching, allowing the MAC address to be accessed; when the access MAC address has no match in the static whitelist, determining the MAC address as an illegal MAC address, and masking the access request of the MAC address;

The quasi-white list processing unit 504 is configured to: filter out the MAC address without the authority according to the static white list, record and count the access information of the MAC address without the authority, and all the MACs without the authority in the fixed time zone. The address is included in the quasi-white list;

The rights management unit 505 is configured to set a temporary use right for the MAC address in the quasi-white list.

Optionally, the rights management unit 505 is configured to set a temporary use right for the MAC address in the quasi-white list according to the following manner: setting a maximum number of allowed access times and a maximum use time for the MAC address in the quasi-white list .

Optionally, the rights management unit 505 is further configured to: represent, in the whitelist, the storage format of the MAC address information as: identifier/access time/disconnection time/access times/accumulated network access duration.

Optionally, the rights management unit 505 is further configured to: when the number of accesses of a MAC address reaches the maximum number of allowed accesses, or the usage duration reaches the maximum usage duration, or access times When the number reaches the maximum number of allowed accesses and the usage duration reaches the maximum usage duration, the temporary use permission of the MAC address is cancelled or the MAC address is directly deleted.

Optionally, the rights management unit 505 is further configured to: set a minimum usage value of the access times;

The rights management unit 505 monitors the number of times the MAC address is used in the whitelist. When the number of accesses of the MAC address is less than the minimum usage value of the access times within a preset time, the temporary use permission of the MAC address is cancelled or directly deleted. The MAC address.

Optionally, the device may further include an override alarm unit 506.

Optionally, the method further includes: after a MAC address is cancelled, the unauthorized use alarm unit 506 reports to the administrator that the temporary use right of the MAC address is canceled, and the administrator uses the MAC address according to the usage of the MAC address. The address is set to a valid user, or the MAC address is continued as an illegal user.

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

The embodiment of the invention also discloses a computer program, comprising program instructions, which when executed by a computer, enable the computer to execute any of the above access control methods.

The embodiment of the invention also discloses a carrier carrying the computer program.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

Industrial applicability

The embodiment of the present invention only opens the right to the legitimate user during the working time period and the important time period, and sets the temporary open permission to the user other than the legitimate user in other time periods, so that the utilization rate of the network can be improved. Therefore, the present invention has strong industrial applicability.

Claims

An access control method includes:

Receiving an access request issued by a MAC address;

If the access request is received outside the fixed time zone that has been set, the MAC address of the access request is matched with the MAC address in the static whitelist that has been set, when the MAC address is If the MAC address in the static whitelist matches, the MAC address is allowed to access; when the MAC address has no matching item in the static whitelist, the access request is blocked;

If the access request is received in the fixed time zone that has been set, and the MAC address without permission is filtered according to the static whitelist, all MAC addresses without permission in the fixed time zone are included in the whitelist. , set temporary usage rights for the MAC address in the quasi-white list.
The access control method according to claim 1, wherein the step of setting a temporary use right for the MAC address in the quasi-white list comprises:

The maximum number of allowed access times and the maximum usage duration are set for the MAC address in the quasi-white list.
The access control method according to claim 2, wherein the storage format of the MAC address information in the quasi-white list can be expressed as: identifier + access time + disconnection time + access times + cumulative network access time.
The access control method according to claim 2 or 3, further comprising: when the number of accesses of a MAC address reaches the maximum number of allowed accesses, or the usage duration reaches the maximum usage duration, or the number of accesses When the maximum number of allowed accesses is reached, and the usage duration reaches the maximum usage duration, the temporary use permission of the MAC address is cancelled or the MAC address is directly deleted.
The access control method according to claim 2 or 3, further comprising: setting a minimum usage value of the access times;

The number of times the MAC address is used in the whitelist is monitored. When the number of accesses of a MAC address is less than the minimum usage value of the access number in a preset time, the temporary use permission of the MAC address is cancelled or the MAC address is directly deleted.
The access control method according to claim 5, further comprising: when a MAC address is canceled for temporary use permission, reporting to the administrator that the temporary use right of the MAC address is canceled, and the administrator uses the MAC address according to the use. The situation will activate the MAC address, ie, set the MAC address as a legitimate user, or continue to use the MAC address as an illegal user.
The access control method according to claim 6, wherein the step of canceling the temporary use right of the MAC address comprises:

Change the identifier of the MAC address from permit. to deny.
An access control device, comprising: a receiving unit, a judging unit, a white list matching unit, a quasi-white list processing unit, and a rights management unit, wherein

The receiving unit is configured to: receive an access request sent by a MAC address;

The determining unit is configured to: determine whether the time when the receiving unit receives the access request is within a fixed time zone that has been set, and if not, notify the whitelist matching unit; if yes, notify the standard Whitelist processing unit;

The whitelist matching unit is configured to: match an access MAC address that sends the access request with a MAC address in a static whitelist that has been set, and match the MAC address in the static whitelist when the access MAC address is matched. Allowing the MAC address to be accessed; when the access MAC address has no match in the static whitelist, the access request of the MAC address is blocked;

The whitelist processing unit is configured to: filter out the MAC address without authority according to the static whitelist, and include all MAC addresses that are not authorized in the fixed time zone in the whitelist;

The rights management unit is configured to: set a temporary use right for the MAC address in the quasi-white list.
The access control device according to claim 8, wherein the authority management unit is configured to set a temporary use right for the MAC address in the quasi-white list as follows: setting the MAC address in the quasi-white list Maximum number of accesses allowed and maximum duration of use.
The access control device according to claim 9, wherein the authority management unit is further configured to: express a storage format of the MAC address information in the quasi-white list as: identifier + access time + disconnection time + access Number of times + cumulative network access time.
The access control device according to claim 9 or 10, wherein the authority management unit is further configured to: when the number of accesses of a MAC address reaches the maximum number of allowed accesses, or the usage duration reaches the maximum usage When the duration, or the number of accesses reaches the maximum number of allowed accesses, and the usage duration reaches the maximum usage duration, cancel the temporary use permission of the MAC address or directly delete the MAC address.
The access control device according to claim 9 or 10, wherein the rights management unit is further configured to: set a minimum usage value of the access times;

The rights management unit monitors the number of times the MAC address is used in the whitelist. When the number of accesses of the MAC address is less than the minimum usage value of the access times in a preset time, the temporary use permission of the MAC address is cancelled or directly Delete the MAC address.
The access control device according to claim 12, wherein said authority management unit is configured to cancel the temporary use authority of the MAC address as follows:

Change the identifier of the MAC address from permit. to deny.
The access control device according to claim 12, further comprising an unauthorized alarm unit, wherein

The unauthorized alarm unit is configured to: when a MAC address is cancelled, the temporary use right of the MAC address is cancelled.
A computer program comprising program instructions which, when executed by a computer, cause the computer to perform the access control method of any of claims 1-7.