CN110753039B - Method and device for remote login safety protection - Google Patents

Abstract

The invention relates to a remote login security protection method and device, wherein the method includes: generating a network topology according to network information of a client; in response to a network abnormality alarm issued by the client, marking the abnormality level of the abnormal client in the network topology; The abnormal level radiates the specified protection range from the abnormal client along the network topology; all clients within the radiation protection range of the abnormal client start corresponding temporary control according to the abnormal level to restrict all remote login behaviors within the specified time. The method of the invention provides unified centralized management and protection for remote login of a large number of clients in a complex network environment, so that the defense strategy can be actively adjusted according to the situational awareness of the security real-time state of the whole network to achieve the purpose of effective protection.

Description

Method and device for remote login security protection

technical field

The invention relates to the technical field of network security. The present invention further relates to a method and device for remote login security protection.

Background technique

As the network environment of various organizations becomes more and more complex, the incidents of remote login to the operating system and hacking by means of stealing system accounts, brute force cracking, etc. have become more and more serious. The means of login include but are not limited to SSH, remote connection, etc.

Therefore, protection against logins, especially remote logins, is becoming more and more important. The general login protection function is only for the single action of login, and cannot be associated with the security status of the entire network, and can only provide passive defense. Or by checking login failure logs, etc., to identify network violence and notify network administrators for prevention and treatment.

Based on the above situation, it is necessary to propose a security protection strategy especially for a large number of client logins, taking into account passive defense, and automatically adjusting the defense strategy according to the situational awareness of the security real-time state of the entire network, so as to achieve the purpose of effective protection.

SUMMARY OF THE INVENTION

On the one hand, the present invention provides a method for remote login security protection based on the above objects, wherein the method includes:

Generate network topology according to client's network information;

In response to the client issuing a network abnormality alarm, marking the abnormality level of the abnormal client in the network topology;

According to the exception level, the specified protection range is radiated from the abnormal client to the outside along the network topology;

Enables all clients within the radiation protection range of abnormal clients to initiate corresponding temporary control according to the abnormal level to restrict all remote login behaviors within a specified time.

According to an embodiment of the remote login security protection method of the present invention, the method further comprises:

In response to the client receiving the control release instruction, the temporary control is turned off to allow the remote login behavior.

According to the embodiment of the remote login security protection method of the present invention, in response to the client receiving the control release instruction, closing the temporary control to allow the remote login behavior further includes:

In response to the temporary shutdown of the abnormal client, the radiation protection scope of the abnormal client is cancelled.

According to the embodiment of the remote login security protection method of the present invention, enabling all clients located within the radiation protection range of abnormal clients to initiate corresponding temporary management and control according to the abnormal level to restrict all remote login behaviors within a specified time, further comprising:

In response to the client being located within the radiation protection range of the at least one abnormal client, a lock identifier is set for the client according to the abnormality level of the at least one abnormal client, and temporary control is activated or released according to the state of the lock identifier.

According to an embodiment of the remote login security protection method of the present invention, the method further comprises:

Set up a whitelist for clients in the network topology to allow remote logins from specified IP addresses and/or IP address ranges; and/or

Set a blacklist for clients in the network topology to restrict remote logins initiated by specified IP addresses and/or IP address ranges.

On the other hand, the present invention also provides a remote login security protection device, wherein the device includes:

at least one processor; and

a memory storing program instructions executable by the processor, the program instructions performing the following steps when executed by the processor:

Generate network topology according to client's network information;

In response to the client issuing a network abnormality alarm, marking the abnormality level of the abnormal client in the network topology;

According to the exception level, the specified protection range is radiated from the abnormal client to the outside along the network topology;

Enables all clients within the radiation protection range of abnormal clients to initiate corresponding temporary control according to the abnormal level to restrict all remote login behaviors within a specified time.

According to the embodiment of the remote login security protection device of the present invention, the method further comprises:

In response to the client receiving the control release instruction, the temporary control is turned off to allow the remote login behavior.

According to the embodiment of the remote login security protection device of the present invention, in response to the client receiving the control release instruction, closing the temporary control to allow the remote login behavior further includes:

In response to the temporary shutdown of the abnormal client, the radiation protection scope of the abnormal client is cancelled.

According to the embodiment of the remote login security protection device of the present invention, enabling all clients located within the radiation protection range of abnormal clients to initiate corresponding temporary management and control according to the abnormality level to restrict all remote login behaviors within a specified time, further comprising:

In response to the client being located within the radiation protection range of the at least one abnormal client, a lock identifier is set for the client according to the abnormality level of the at least one abnormal client, and temporary control is activated or released according to the state of the lock identifier.

According to the embodiment of the remote login security protection device of the present invention, the method further comprises:

Set up a whitelist for clients in the network topology to allow remote logins from specified IP addresses and/or IP address ranges; and/or

Set a blacklist for clients in the network topology to restrict remote logins initiated by specified IP addresses and/or IP address ranges.

By adopting the above technical scheme, the present invention has at least the following beneficial effects: realizing a security protection strategy for a large number of client logins, providing unified centralized management and protection for remote login of a large number of clients in a complex network environment, and performing login protection according to the policy configuration , and by detecting the security status of the entire network, self-adjustment according to the situational awareness of security risks, and prompting risks, so that the defense strategy can be actively adjusted according to the situational awareness of the security real-time status of the entire network to achieve the purpose of effective protection.

The present invention provides aspects of the embodiments, which should not be used to limit the scope of protection of the present invention. Other embodiments are conceivable in light of the techniques described herein, which will be apparent to those of ordinary skill in the art upon study of the following drawings and detailed description, and are intended to be included within the scope of this application .

Embodiments of the present invention are explained and described in more detail below with reference to the accompanying drawings, but they should not be construed as limiting the present invention.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings that are used in the description of the prior art and the embodiments. The components in the drawings are not necessarily drawn to scale, and relevant related drawings may be omitted. elements, or in some instances the proportions may have been exaggerated in order to emphasize and clearly illustrate the novel features described herein. Additionally, the structural order may be arranged differently, as is known in the art.

FIG. 1 shows a schematic block diagram of an embodiment of a remote login security protection method according to the present invention.

Detailed ways

While the invention may be embodied in various forms, some exemplary and non-limiting embodiments are shown in the drawings and will be described hereinafter, it being understood that this disclosure is to be considered as an example of the invention and not The intention is to limit the invention to the specific embodiments described.

FIG. 1 shows a schematic block diagram of an embodiment of a remote login security protection method according to the present invention. In the embodiment shown in the figure, the method includes at least the following steps:

S1: Generate a network topology according to the network information of the client;

S2: In response to the client sending a network abnormality alarm, mark the abnormality level of the abnormal client in the network topology;

S3: According to the abnormal level, the designated protection range is radiated from the abnormal client to the outside along the network topology;

S4: Make all clients within the radiation protection range of abnormal clients to initiate corresponding temporary control according to the abnormal level to restrict all remote login behaviors within a specified time.

Specifically, first, step S1 generates a network topology based on the network information, IP address, etc. fed back by the client. Each node in the topology represents a client. Subsequently, when a network of a client generates an abnormal alarm, step S2 marks the abnormal level of the abnormal client in the network topology. For example, preferably but not limited to, different levels are marked according to the high, medium and low levels of the alarm, such as high risk->red level; medium risk->yellow level; low risk->orange level. Then step S3 radiates the specified protection range outward from the abnormal client along the network topology according to the abnormal level. For example, when a client is marked as abnormal in the network topology, that is, when an abnormal node is marked, the radiation range of the abnormal node is determined according to the abnormal level of the abnormal node, that is, the risk level. Preferably, the red level radiates 3 layers outward along the topology map. , 2 layers of yellow radiation, and 1 layer of orange radiation. Finally, in step S4, all clients located within the radiation protection range of the abnormal client start corresponding temporary management and control according to the abnormal level to restrict all remote login behaviors within a specified time. For example, according to the abnormal level, that is, the risk level, on the topology map, the temporary management and control of the clients within the radiation protection range is activated. The temporary control proposed here aims to enable the remote login protection function to limit all remote login behaviors, so that there is no operation and maintenance personnel to deal with the exception in a timely manner and/or it is inconvenient to deal with it in a timely manner and/or cannot be repaired in the first time. Temporarily enforced protection for clients in the network in the case of a network environment. The above steps S1 to S4 are used to provide unified and centralized management and protection for the remote login of a large number of clients in a complex network environment, which affects all clients in the entire group, and achieves the purpose of batch management. Real-time situational awareness to actively adjust defense strategies to achieve effective protection.

Further embodiments of the present invention will be described below. It should be noted that the numbers of the steps mentioned therein are only used to conveniently and clearly indicate the steps without special instructions, and do not limit the sequence of the steps.

In some embodiments of the remote login security protection method of the present invention, the method further comprises:

S5: In response to the client receiving the control release instruction, close the temporary control to allow remote login behavior.

Under normal circumstances, once a network abnormality alarm is issued by the client, the operation and maintenance personnel will deal with it as soon as possible. After the processing is completed, the operation and maintenance personnel can manually revoke the temporary control function. For example, in step S5, the client is notified to close the temporary control by sending a control release instruction to the client to allow the remote login behavior.

In a further embodiment of the remote login security protection method of the present invention, step S5 in response to the client receiving the control release instruction, closing the temporary control to allow the remote login behavior further includes: in response to the abnormal client closing the temporary control, canceling the abnormality Radiation protection coverage of the client. In these embodiments, after the operation and maintenance personnel have processed the abnormal situation and closed the temporary management and control of the abnormal client, it is not necessary for the operation and maintenance personnel to close the temporary management and control of other clients within the radiation protection range one by one. directly cancel the radiation protection scope of the abnormal client, and the client within the radiation protection scope can adjust the protection strategy accordingly according to its own situation, such as closing the temporary control; and/or when When there is an abnormality in itself, only the temporary control corresponding to its own abnormality level is performed; and/or, when it is still within the radiation protection range of other abnormal clients, temporary control corresponding to the abnormality level of other abnormal clients is performed, etc. .

In several embodiments of the remote login security protection method of the present invention, step S4 enables all clients located within the radiation protection range of abnormal clients to initiate corresponding temporary control according to the abnormal level to limit all remote login behaviors within a specified time. Further Including: in response to the client being located within the radiation protection range of at least one abnormal client, setting a lock identifier for the client according to the abnormal level of the at least one abnormal client, and starting or releasing temporary control according to the state of the lock identifier. Specifically, when the client is within the radiation protection range of at least one abnormal client, the temporary control is activated or deactivated according to the state of the lock flag, which is determined according to the abnormal level of all the above at least one abnormal client, for example, locked The identifier E=SUM(n), where n is the abnormal level of the radiation source (ie, abnormal client). In the case where multiple abnormal clients radiate to a client at the same time, when an abnormal client closes the abnormal control due to the disappearance of the abnormal state or the temporary control arrives, the lock flag E will be reduced accordingly. When E>0, the client is temporarily controlled to restrict all remote logins; when E is 0, the temporary control on the client is canceled to allow remote logins.

In one or more embodiments of the remote login security protection method of the present invention, the method further includes:

S6: Set a whitelist for clients in the network topology to allow remote logins initiated by specified IP addresses and/or IP address segments; and/or

S7: Set a blacklist for clients in the network topology to restrict remote logins initiated by specified IP addresses and/or IP address segments.

In order to take into account passive defense strategies, and also to perform long-term management and control of extremely high-risk remote logins and reduce unnecessary triggering of active protection, whitelist rules and/or blacklist rules are proposed in these embodiments of the present invention. When the whitelist rule is enabled, the effective condition of the rule is that only the remote login initiated by the specified IP address and/or IP address segment in the rule is allowed. When the blacklist rule is enabled, the condition for the rule to take effect is that the remote login initiated by the specified IP address and/or IP address segment in the blacklist rule is not allowed, while the remote login initiated by other IP addresses and/or IP address segment is not allowed. allowed. Thereby, unnecessary active protection processes can be reduced by blacklisting IP addresses and/or IP address segments that have been at risk for a long time. Or, when the overall network environment is quite bad and extremely insecure, the corresponding designated IP addresses and/or IP address segments are put into the whitelist to maintain the normal operation of the necessary few remote logins.

In another aspect, the present invention also provides an apparatus for remote login security protection, wherein the apparatus includes: at least one processor; and a memory, where the memory stores program instructions executable by the processor, and the program instructions are executed by the processor when the program instructions are executed. perform the following steps:

S1: Generate a network topology according to the network information of the client;

S2: In response to the client sending a network abnormality alarm, mark the abnormality level of the abnormal client in the network topology;

S3: According to the abnormal level, the designated protection range is radiated from the abnormal client to the outside along the network topology;

S4: Make all clients within the radiation protection range of abnormal clients to initiate corresponding temporary control according to the abnormal level to restrict all remote login behaviors within a specified time.

In some embodiments of the remote login security protection device of the present invention, the method further comprises:

S5: In response to the client receiving the control release instruction, close the temporary control to allow remote login behavior.

In a further embodiment of the remote login security protection device of the present invention, step S5, in response to the client receiving the control release instruction, closing the temporary control to allow the remote login behavior further includes: in response to the abnormal client closing the temporary control, canceling the abnormality Radiation protection coverage of the client.

In several embodiments of the remote login security protection device of the present invention, step S4 enables all clients located within the radiation protection range of abnormal clients to initiate corresponding temporary control according to the abnormal level to limit all remote login behaviors within a specified time. Further Including: in response to the client being located within the radiation protection range of at least one abnormal client, setting a lock identifier for the client according to the abnormal level of the at least one abnormal client, and starting or releasing temporary control according to the state of the lock identifier.

In one or more embodiments of the remote login security protection device of the present invention, the method further includes:

S6: Set a whitelist for clients in the network topology to allow remote logins initiated by specified IP addresses and/or IP address segments; and/or

S7: Set a blacklist for clients in the network topology to restrict remote logins initiated by specified IP addresses and/or IP address segments.

The apparatuses, devices, etc. disclosed in the embodiments of the present invention may be various electronic terminal devices, such as mobile phones, personal digital assistants (PDAs), tablet computers (PADs), smart TVs, etc., or large-scale terminal devices, such as servers, etc. Therefore, the protection scope disclosed by the embodiments of the present invention should not be limited to a certain type of apparatus or equipment. The clients disclosed in the embodiments of the present invention may be applied to any of the foregoing electronic terminal devices in the form of electronic hardware, computer software, or a combination of the two.

Computer-readable storage media (eg, memory) described herein can be volatile memory or nonvolatile memory, or can include both volatile and nonvolatile memory. By way of example and not limitation, nonvolatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory memory. Volatile memory may include random access memory (RAM), which may act as external cache memory. By way of example and not limitation, RAM is available in various forms such as Synchronous RAM (DRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), and Direct Rambus RAM (DRRAM). The storage devices of the disclosed aspects are intended to include, but not be limited to, these and other suitable types of memory.

By adopting the above technical scheme, the present invention has at least the following beneficial effects: realizing a security protection strategy for a large number of client logins, providing unified centralized management and protection for remote login of a large number of clients in a complex network environment, and performing login protection according to the policy configuration , and by detecting the security status of the entire network, self-adjustment according to the situational awareness of security risks, and prompting risks, so that the defense strategy can be actively adjusted according to the situational awareness of the security real-time status of the entire network to achieve the purpose of effective protection.

It should be understood that, where technically feasible, the technical features listed above for different embodiments can be combined with each other to form additional embodiments within the scope of the present invention. Furthermore, the specific examples and embodiments described herein are non-limiting and corresponding modifications may be made to the structures, steps, and sequences set forth above without departing from the scope of the present invention.

In this application, the use of the antisense connective is intended to include the connective. The use of definite or indefinite articles is not intended to indicate a cardinality. Specifically, references to "the" object or "a" and "an" objects are intended to mean at least one possible one of such objects. However, although elements disclosed in the embodiments of the present invention may be described or claimed in an individual form, unless expressly limited to the singular, they may also be construed to mean at least one. Also, the conjunction "or" can be used to convey concurrent features rather than a mutually exclusive scheme. In other words, the conjunction "or" should be read to include "and/or." The term "comprising" is inclusive and has the same scope as "comprising."

The above-described embodiments, particularly any "preferred" embodiments, are possible examples of implementations, and are presented merely for a clear understanding of the principles of the invention. Numerous changes and modifications may be made to the above-described embodiments without substantially departing from the spirit and principles of the technology described herein. All modifications are intended to be included within the scope of this disclosure.

Claims (10)

1. A method for remote login security protection, wherein the method comprises: Generate network topology according to client's network information; In response to the client sending out a network abnormality alarm, marking the abnormality level of the abnormal client in the network topology; According to the exception level, the specified protection range is radiated outward from the abnormal client along the network topology; All clients located within the radiation protection range of the abnormal client can initiate corresponding temporary management and control according to the abnormality level to restrict all remote login behaviors within a specified time. 2. The method according to claim 1, wherein the method further comprises: In response to the client receiving the control release instruction, the temporary control is turned off to allow remote login behavior. 3 . The method according to claim 2 , wherein, in response to the client receiving a control release instruction, closing the temporary control to allow remote login further comprises: 3 . In response to the abnormal client closing the temporary control, the radiation protection range of the abnormal client is cancelled. 4 . The method according to claim 1 , characterized in that all the clients located within the radiation protection range of the abnormal client start corresponding temporary control according to the abnormal level to restrict all remote clients within a specified time. 5 . Login actions further include: In response to the client being located within the radiation protection range of at least one abnormal client, a lock flag is set for the client according to the abnormal level of the at least one abnormal client, and the temporary control is activated or released according to the state of the lock flag. 5. The method of claim 1, wherein the method further comprises: whitelisting clients in said network topology to allow remote logins initiated by specified IP addresses and/or IP address segments; and/or A blacklist is set for the clients in the network topology to restrict remote login initiated by the specified IP address and/or IP address segment. 6. A device for remote login security protection, wherein the device comprises: at least one processor; and a memory storing program instructions executable by the processor, the program instructions performing the following steps when executed by the processor: Generate network topology according to client's network information; In response to the client sending out a network abnormality alarm, marking the abnormality level of the abnormal client in the network topology; According to the exception level, the specified protection range is radiated outward from the abnormal client along the network topology; All clients located within the radiation protection range of the abnormal client can initiate corresponding temporary management and control according to the abnormality level to restrict all remote login behaviors within a specified time. 7. The apparatus of claim 6, wherein the processor is further configured to perform the following steps based on the program instructions: In response to the client receiving the control release instruction, the temporary control is turned off to allow remote login behavior. 8 . The apparatus according to claim 7 , wherein, in response to the client receiving a control release instruction, closing the temporary control to allow remote login further comprises: 8 . In response to the abnormal client closing the temporary control, the radiation protection range of the abnormal client is cancelled. 9 . The device according to claim 6 , characterized in that all clients located within the radiation protection range of the abnormal client are activated to initiate corresponding temporary control according to the abnormal level to restrict all remote clients within a specified time. 10 . Login actions further include: In response to the client being located within the radiation protection range of at least one abnormal client, a lock flag is set for the client according to the abnormal level of the at least one abnormal client, and the temporary control is activated or released according to the state of the lock flag. 10. The apparatus of claim 6, wherein the processor is further configured to perform the following steps based on the program instructions: whitelisting clients in said network topology to allow remote logins initiated by specified IP addresses and/or IP address segments; and/or A blacklist is set for the clients in the network topology to restrict remote login initiated by the specified IP address and/or IP address segment.

Images