CN108156157B

CN108156157B - Self-adaptive compatible method and device for monitoring equipment

Info

Publication number: CN108156157B
Application number: CN201711431636.1A
Authority: CN
Inventors: 王朋; 周迪
Original assignee: Zhejiang Uniview Technologies Co Ltd
Current assignee: Zhejiang Uniview Technologies Co Ltd
Priority date: 2017-12-26
Filing date: 2017-12-26
Publication date: 2021-06-01
Anticipated expiration: 2037-12-26
Also published as: CN108156157A

Abstract

The invention discloses a monitoring device self-adaptive compatibility method and a monitoring device self-adaptive compatibility device, which are used for realizing the compatibility of a first device with a safe version to a second device without being upgraded to the safe version, when the first device receives the access of the second device, whether a corresponding record exists in an access record table is searched according to an accessed source IP address and an accessed source MAC address, so that strange access or familiar access is judged, the strange access is responded in a compatible mode, whether the legal access is judged according to the interaction of services, the access record is deleted if the legal access is judged, and the access record is stored if the legal access is judged. For familiar accesses, however, an incompatible mode is configured, denying response to the access. The method and the device can realize the compatibility of the monitoring equipment which is not upgraded to the safe version in a compatible mode, simultaneously effectively prevent the hacker attack from the internet and ensure the network safety.

Description

Self-adaptive compatible method and device for monitoring equipment

Technical Field

The invention belongs to the technical field of equipment compatibility, and particularly relates to a monitoring equipment self-adaptive compatibility method and device.

Background

In a video monitoring network, a network video recorder NVR and a network camera IPC need to be matched for use. And under the condition that the NVR and the IPC are not synchronously upgraded with the security protection function, when the NVR with a lower security protection level accesses the IPC with a higher security protection level, the problem that the security protection function is incompatible can occur and the IPC cannot be accessed.

The phenomenon that the safety characteristics of the NVR and IPC products are asynchronous is caused by a plurality of reasons, for example, when a customer purchases the products in the market, the customer only pays attention to the matching use problem of the basic functions between the NVR and the IPC, and does not pay attention to the matching use relation of network safety. When the security characteristics of NVR and IPC products are asynchronous, for the old version NVR, the security protection level is lower, the IPC with the higher security protection level is accessed, if the IPC works in a secure mode, the IPC cannot be communicated with the NVR, and if the IPC works in an insecure mode, the IPC is easy to be attacked by hackers from the Internet.

To deal with the above situation, one feasible scheme adopted at present is that the IPC is working in a secure mode by default, when receiving an access from the NVR, the access mode of the NVR is determined, if the access mode is the unsecure mode, the IPC is working in the unsecure mode, and if the access mode is the secure mode, the IPC is working in the secure mode.

In this way, the risk still exists, and the remote visitor can simulate the unsafe access mode of the NVR, so that the IPC is driven to work in the unsafe mode, and further attack is carried out on the IPC. Hackers can mimic NVR behavior and become a new backdoor.

Disclosure of Invention

The invention aims to provide a monitoring device self-adaptive compatibility method and a monitoring device self-adaptive compatibility device, which are used for solving the problem of network risk caused by incompatible security modes of monitoring devices in the prior art.

In order to achieve the purpose, the technical scheme of the invention is as follows:

a monitoring device adaptive compatibility method is used for realizing compatibility of a first device to a second device, and comprises the following steps:

when receiving the access of the second device, the first device searches whether a corresponding access record exists in an access record table stored locally according to the source address of the access, if so, the first device judges the access as familiar, otherwise, the first device judges the access as strange;

for strange access, the first equipment adds a corresponding access record in an access record table, presets an interaction mode with the access as a compatible mode and responds; then, real-time monitoring is carried out on the accessed source address, if a request of any service instruction of the second equipment is not received in the specified time, the corresponding access record is set as invalid access, and the invalid access is stored in an access record table; if any service instruction request of the second equipment is received within the specified time, and the monitoring service capability set exchange and verification with the second equipment are successful, deleting the corresponding access record from the access record table, and if the monitoring service capability set exchange and verification with the second equipment are failed, setting the corresponding access record as invalid access and storing the invalid access in the access record table;

the first device configures an interaction mode with the access to be a non-compatible mode for a familiar access, and denies a response to the access.

Further, when the second device is not in the same two-layer network as the first device, the source address of the access includes a source IP address and a source MAC address.

The source MAC address is a MAC address of a gateway of the first device.

Further, when the second device is in the same two-layer network as the first device, the source address of the access includes the source MAC address, or includes both the source MAC address and the source IP address.

The source MAC address is a real MAC address of the second device.

The invention also provides a monitoring device adaptive compatible device, which is applied to first equipment to realize the compatibility of the first equipment to second equipment, and comprises:

the judging module is used for searching whether a corresponding access record exists in an access record table stored locally according to the source address of the access when the access of the second equipment is received, judging the access as familiar access if the corresponding access record exists, and judging the access as strange access if the corresponding access record does not exist;

the first access processing module is used for adding a corresponding access record in the access record table for strange access, presetting an interaction mode with the access as a compatible mode, and responding; then, real-time monitoring is carried out on the accessed source address, if a request of any service instruction of the second equipment is not received in the specified time, the corresponding access record is set as invalid access, and the invalid access is stored in an access record table; if any service instruction request of the second equipment is received within the specified time, and the monitoring service capability set exchange and verification with the second equipment are successful, deleting the corresponding access record from the access record table, and if the monitoring service capability set exchange and verification with the second equipment are failed, setting the corresponding access record as invalid access and storing the invalid access in the access record table;

and the second access processing module is used for configuring an interaction mode with the access as a non-compatible mode for the familiar access and refusing to respond to the access.

The invention provides a monitoring device self-adaptive compatibility method and device, which are used for realizing the compatibility of a first device with a safe version to a second device without being upgraded to the safe version, when the first device receives the access of the second device, whether a corresponding record exists in an access record table is searched according to an accessed source IP address and an accessed source MAC address, so that strange access or familiar access is judged, the strange access is responded in a compatible mode, whether the legal access is judged according to the interaction of services, the access record is deleted if the legal access is judged, and the access record is saved if the legal access is judged. For familiar accesses, however, an incompatible mode is configured, denying response to the access. The method and the device can realize the compatibility of the monitoring equipment which is not upgraded to the safe version in a compatible mode, simultaneously effectively prevent the hacker attack from the internet and ensure the network safety.

Drawings

FIG. 1 is a diagram illustrating a monitoring network structure according to an embodiment of the present invention;

fig. 2 is a flow chart of a monitoring device adaptive compatibility method according to the present invention.

Detailed Description

The technical solutions of the present invention are further described in detail below with reference to the drawings and examples, which should not be construed as limiting the present invention.

Fig. 1 shows a typical network structure diagram of the embodiment of the present technical solution, where IPC and NVR1 in a networking are in a two-layer network, a gateway of the IPC is GW1, a gateway of NVR2 and NVR3 is GWN, and a gateway of the NVRF is GWF. And the address information of each device is shown in table 1:

device name	Device MAC address	Equipment interface IP
			IPC	12345678900a	192.168.0.2
NVR1	12345678900b	192.168.0.3
			GWI	12345678900c	192.168.0.1
NVR2	12345678901a	192.168.1.2
			NVR3	12345678901b	192.168.1.3
GWN	12345678901c	192.168.1.1
			NVRF	12345678902a	192.168.2.1
GWF	12345678902b	192.168.2.2

TABLE 1

Because NVR2 and IPC are in two different layer networks, NVR2 needs to pass through gateway GW1 of IPC when accessing IPC, and sends the message access to IPC, the information in MAC address header field of the access message is processed by router GW1, the original source MAC address in MAC header field is modified into the gateway address through which the access message passes, when the access message passes through the gateway of IPC and reaches IPC, the source MAC address field information of the access message is modified into the MAC address of IPC gateway by the gateway of IPC. The MAC address header field and IP header field information of the converted access packet are shown in table 2:

source AMC	Destination MAC	Source IP	Destination IP
				12345678900c	12345678900a	192.168.1.2	192.168.0.2

TABLE 2

The adaptive compatible method for monitoring devices in this embodiment will be described by taking the basic networking as an example, as shown in fig. 2,

This embodiment takes as an example that NVR2 not in a secure version accesses IPC upgraded to a secure version, where IPC is a first device and NVR2 is a second device. It is easy to understand that, in the monitoring network, there may exist that the NVR is already upgraded to the secure version, and the IPC is also the old version, and is not upgraded to the secure version, and at this time, the IPC is used as the second device, and the NVR is used as the first device, which is still applicable to the present invention, and is not described herein again.

The following is described in detail by way of several examples:

embodiment one, NVR2 Access to IPC.

During NVR2 access to IPC, the IPC operates in the default operating mode with the highest security level. If the message is accessed for the first time by the NVR2, and the MAC address information in the message body of the access message does not carry the address of the MAC of the NVR2, the source MAC of the message is modified into the MAC address information of the IPC gateway GW1, as shown in Table 2. It can be seen that when the second device and the first device are not in the same two-layer network, the source MAC address of the packet that any second device accesses the first device is the MAC address of the gateway GW1, and therefore cannot be distinguished. Therefore, when the second device is not in the same two-layer network as the first device, the source IP address and the source MAC address of the access need to be recorded in the access record table for distinction.

At this time, for the IPC, the source MAC address that the IPC can see is the MAC address of the converted GW1, and since the initial access is performed, the corresponding access record is not found in the access record table, and it is determined that the access is strange, and the interaction mode with the initial access is preset to be the compatible mode.

At this time, an access record about the accessing party NVR2 to the IPC is added in the access record table of the IPC, wherein the record contains information of the IP address, the MAC address and the like of the accessing party. At this point, however, the IPC does not respond to the access of NVR 2.

The information in the access record table is shown in table 3:

TABLE 3

In table 3, the source MAC address is the MAC address of gateway GW1 of IPC, and the source IP address is the IP address of NVR 2.

IPC thereafter sends a message of successful access in response to the access of NVR 2. At this time, the IPC monitors the IP address and the converted MAC address in real time, and if a subsequent request of any service instruction in the monitoring service list of the NVR2 is not received within a specified time, the previous access is an invalid access, a corresponding identifier is made in an access record table local to the IPC, and an access validity identifier position in the access record is set to 1, that is, an invalid restricted access.

The access log table is now updated as shown in table 4:

TABLE 4

After the NVR2 receives the response message, because the access is for the monitoring business process initiating process, the NVR2 immediately issues the next monitoring business instruction. When the IPC receives the next monitoring service command of the NVR2, the IPC judges that the access is normal NVR2 login access, and then the IPC immediately performs monitoring service capability set exchange and verification with the NVR 2. The exchange and verification of the monitoring service capability set between the NVR and the IPC belong to the normal standard process for establishing the monitoring service between the NVR and the IPC, and are not described herein again.

After the monitoring service capability set is exchanged and verified successfully, the IPC deletes the access record of the NVR2 locally, and after the subsequent NVR2 initiates access, the converted combination information of the source MAC address and the IP address is an unfamiliar access. At this time, the IPC access record table to NVR2 is restored to the original state, i.e. there is no access record in the table.

It is easy to understand that if NVR2 is illegal access, in case of failure of exchange and verification of monitoring service capability set between NVR and IPC, the access validity flag position in the access record is set to 1, that is, the corresponding access record is set as invalid access and stored in the access record table.

Thereafter, if NVR2 accesses IPC again, if NVR2 has a network drop in the middle due to some abnormal reasons, when NVR2 is restored to the online state again, NVR2 re-initiates access to IPC. After receiving the access request of NVR2, IPC finds that the source MAC (the converted AMC address) of NVR2 is a strange MAC, but does not record the converted MAC address information and IP address information of NVR2 in the access record table, and confirms that the MAC is a strange MAC address. Assuming that the NVR2 performs service storage configuration on the IPC in the previous access process, when the IPC is accessed again after being off-line, the storage service recovery service is used as a drive for NVR2 to actively access the IPC, the authentication process in the access process is similar to the first time, but the next instruction received by the IPC after receiving the NVR2 is storage recovery, after receiving the task of storage recovery, the monitoring relation local to the IPC is checked, the storage task with the relevant IP address in the monitoring relation service table is found, the storage flow is immediately sent to the NVR2, and the service is quickly recovered.

And when the NVR is illegal access, after the message of the second access is received by the IPC, since the corresponding access record exists in the locally stored access record table, the message is judged to be familiar access, the interaction mode configured with the access is an incompatible mode, and the response to the access is refused, so that the illegal access is blocked.

Embodiment two, security control for simultaneous access to IPC from more than two NVRs.

The process of NVR3 interacting with IPC separately is the same as NVR2 and is not described here.

However, in the normal interaction process of NVR2 and IPC, when NVR3 also accesses IPC, at this time, when IPC receives an access message of NVR3, it is found that the source MAC address carried in the access message is the MAC address of IPC gateway GW 1. Therefore, in the technical scheme, the source MAC and the source IP address need to be recorded simultaneously in the access record table to distinguish the access of NVR2 and NVR 3.

At this time, for the initial access of the NVR3, because the source IP is different from the NVR2, the corresponding access record is not found in the access record table, the access is judged to be strange, and the interaction mode of the initial preset and the access is a compatible mode.

Thereafter, IPC sends a message of successful access in response to NVR3 access. The IPC monitors the IP address of the NVR3 and the converted MAC address in real time, if a request of any service instruction in a monitoring service list of the NVR3 is not received in a specified time subsequently, the previous access is invalid, corresponding identification is made in an access record table of the IPC, and the access validity identification position in the access record is set to be 1, namely invalid limited access.

After the NVR3 receives the response message, because the access is for the monitoring business process initiating process, the NVR3 immediately issues the next monitoring business instruction. After the IPC receives the next monitoring service instruction of the NVR3, the IPC judges that the access is normal NVR3 login access, the IPC immediately exchanges and verifies the monitoring service capability set with the NVR3, and after the exchange and verification of the monitoring service capability set are successful, the IPC locally deletes the access record of the NVR 3. This process is similar to the embodiment and will not be described herein.

Embodiment three, security control flow for NVR masker NVRF.

NVRF and IPC are in two different layers of networks, when NVRF accesses IPC, message access needs to be sent to IPC through gateway GW1 of IPC, and information in MAC address header field of access message is processed by router. The original MAC address in the MAC header field is modified into a gateway address through which the access message passes, when the access message passes through the gateway of the IPC and reaches the IPC, the source MAC address field information of the access message is modified into the MAC address 12345678900c of the IPC gateway GW1 by the gateway of the IPC, and the source IP is 192.168.2.1.

In the case that the NVRF access which is not a safe version is upgraded to the IPC of a safe version, the IPC works in the working mode with the highest default safety level in the IPC process of the NVRF access. If the NVRF is accessed for the first time, the MAC address information in the message body of the access message does not carry the MAC address of the NVRF, and the source MAC of the remote NVRF is modified into the MAC address information of the IPC gateway GW 1. At this time, for the IPC, the MAC address that the IPC can see is the converted MAC address, and the access record corresponding to the NVRF is not found in the access information record table of the IPC, and it is determined as strange access. The IPC preliminarily presets an interaction mode with strange access as a compatible mode.

At this time, an access record about the NVRF of the accessing party to the IPC is added in an access record table of the IPC, wherein the record contains information such as the IP address and the MAC address of the accessing party. At this time, however, the IPC does not respond to NVRF access.

IPC will respond to NVRF sending a message that access was successful. At this time, the IPC monitors the IP address and the converted MAC address in real time, and if a request of any service instruction in the NVRF monitoring service list is not received in a specified time, the previous access is an invalid access, and a corresponding identifier is made in an access record table local to the IPC.

After the NVRF receives the response message, because the access is not the access to the monitoring service flow initiation process, the NVRF does not immediately issue the next monitoring service instruction. When the IPC has not received the next monitoring service instruction of the NVRF, the IPC judges that the access is abnormal NVRF login access, and the IPC still needs to immediately perform monitoring service capability set exchange and verification with the NVRF. And if the verification fails, the corresponding access record is set as invalid access and is stored in the access record table. The IPC locally stores the access record of the NVRF for a long time in the IPC locally, and after the subsequent NVRF initiates access, the converted combined information of the source MAC address and the IP address is stored in the IPC locally for a long time.

When the NVRF does not acquire the essential information of the IPC due to some access abnormity, the NVRF initiates an access request to the IPC again, after the IPC receives the access request of the NVRF, the converted MAC address information and the IP address of the NVRF are recorded in an access record table, finally the IPC judges that the access of the NVRF is a familiar access, the IPC works in an incompatible mode aiming at the request of the NVRF, the response to the access request of the NVRF is refused, and the NVRF imitates the access of the IPC to fail.

And in the fourth embodiment, the NVR and the IPC are in the security control flow in the same two-layer network.

Aiming at the condition that the NVR and the IPC are in the same two-layer network, in the process of accessing the IPC by the NVR, as the IPC is accessed to the IPC for the first time, after receiving an access request, the IPC analyzes a source MAC in an MAC address header field of a message, finds that an MAC address is not the MAC address of an IPC gateway, does not find related information when looking up the MAC address in an access record table, and initially confirms that an interaction mode is a compatible mode access aiming at the NVR of the IP address if the IPC considers that the access request is strange access.

At this time, an access record about the NVR of the accessing party to the IPC is added in the access record table of the IPC, wherein the record contains information such as the IP address and the MAC address of the accessing party, and the real MAC address of the NVR is recorded in the converted MAC address field in the record. However, at this time, the IPC does not respond to the NVR access.

It should be noted that, in the same two-layer network, only the source MAC address may be recorded in the access record table, because the source MAC address is the real MAC address of the second device, the access of different devices may be distinguished.

IPC will respond to NVR sending a message that access was successful. And the IPC monitors the IP address and the converted MAC address in real time, if a request of any service instruction in a monitoring service list of the NVR is not received in the specified time subsequently, the previous access is invalid, and a corresponding identifier is made in an access record table local to the IPC.

The IPC waits for the information synchronization of the monitoring service capability set of the NVR at this time, and after receiving the monitoring service capability set synchronization information actively sent by the NVR, and after parameter verification and security verification confirmation, normally responds to the NVR, confirms that the access is normal access, and can perform related monitoring services. Meanwhile, the access records of the IPC local records are deleted, so that the NVR can conveniently log in and access the IPC for the second time.

And if the exchange and verification of the monitoring service capability set fail, setting the corresponding access record as invalid access and storing the invalid access in an access record table. The IPC locally stores the corresponding access records for a long time, judges the access as familiar access when receiving the corresponding access, configures an interaction mode with the access as an incompatible mode, and refuses to respond to the access.

According to the technical scheme, when the first device receives the access of the second device, whether a corresponding record exists in an access record table is searched according to the source IP address and the source MAC address of the access, so that strange access or familiar access is judged, the strange access is responded in a compatible mode, whether the strange access is legal is further judged according to service interaction, if the strange access is legal, the access record is deleted, and if the strange access is not legal, the access record is saved. For familiar accesses, however, an incompatible mode is configured, denying response to the access. The method and the device can realize the compatibility of the monitoring equipment which is not upgraded to the safe version in a compatible mode, simultaneously effectively prevent the hacker attack from the internet and ensure the network safety.

Corresponding to the above method, the present technical solution further provides a monitoring device adaptive compatible apparatus, which is applied to a first device to implement compatibility of the first device with a second device, and the monitoring device adaptive compatible apparatus includes:

In this embodiment, the operations implemented by the modules in the monitoring device adaptive compatible apparatus correspond to the steps of the method, and the interaction process between the first device and the second device has been described in detail in the description of the method, which is not described herein again.

The above embodiments are only for illustrating the technical solution of the present invention and not for limiting the same, and those skilled in the art can make various corresponding changes and modifications according to the present invention without departing from the spirit and the essence of the present invention, but these corresponding changes and modifications should fall within the protection scope of the appended claims.

Claims

1. A monitoring device adaptive compatibility method is used for realizing compatibility of a first device to a second device, and is characterized in that the monitoring device adaptive compatibility method comprises the following steps:

2. The monitoring device adaptive compatibility method of claim 1, wherein the source address of the access comprises a source IP address and a source MAC address when the second device is not in a same layer two network as the first device.

3. The monitoring device adaptive compatibility method of claim 2, wherein the source MAC address is a MAC address of a gateway of the first device.

4. The monitoring device adaptive compatibility method of claim 1, wherein the source address of the access comprises a source MAC address or both a source MAC address and a source IP address when the second device is in a same layer two network as the first device.

5. The monitoring device adaptive compatibility method of claim 4, wherein the source MAC address is a real MAC address of the second device.

6. A monitoring device adaptive compatible device is applied to first equipment to realize the compatibility of the first equipment to second equipment, and is characterized in that the monitoring device adaptive compatible device comprises:

7. The monitoring device adaptive compatibility apparatus of claim 6, wherein the source address of the access comprises a source IP address and a source MAC address when the second device is not in a same layer two network as the first device.

8. The monitoring device adaptive compatibility apparatus of claim 7, wherein the source MAC address is a MAC address of a gateway of the first device.

9. The monitoring device adaptive compatibility apparatus of claim 6, wherein the source address of the access comprises a source MAC address or both a source MAC address and a source IP address when the second device is in a same layer two network as the first device.

10. The monitoring device adaptive compatibility apparatus of claim 9, wherein the source MAC address is a real MAC address of the second device.