CN112202711B - Network access control method and device of terminal, electronic equipment and storage medium - Google Patents

Abstract

The embodiment of the invention provides a network access control method and device of a terminal, electronic equipment and a storage medium. The network access control method of the terminal comprises the following steps: selecting a target access rule from a plurality of preset access rules according to a target network to be accessed, wherein each access rule in the plurality of access rules is respectively associated with one network in the plurality of networks, and each access rule is configured with the access authority of the associated network; and switching the access rule which is currently operated into the target access rule so as to switch the network card of the terminal from the network which is currently connected to the target network according to the target access rule, so that the terminal accesses the target network. According to the embodiment of the invention, the purpose that the terminal only allows access to one network at the same time can be realized through one network card, the hardware cost is reduced, and the terminal is effectively ensured not to be connected with a plurality of networks at the same time.

Description

Terminal network access control method, device, electronic device and storage medium

technical field

The present invention relates to the technical field of computer networks, in particular to a terminal network access control method, device, electronic equipment and storage medium.

Background technique

There may be multiple networks in the network environment of the enterprise, such as: business network, research and development network, etc., due to security considerations, usually the terminals in the enterprise are not allowed to access multiple networks at the same time. The limitation of configuring multiple network cards in the terminal to access multiple networks at the same time requires a large hardware cost.

Contents of the invention

To solve the problems in the prior art, embodiments of the present invention provide a terminal network access control method, device, electronic equipment, and storage medium.

Specifically, the embodiments of the present invention provide the following technical solutions:

In a first aspect, an embodiment of the present invention provides a terminal network access control method, including:

According to the target network to be accessed, a target access rule is selected from a plurality of preset access rules, wherein each access rule in the plurality of access rules is respectively associated with one of the plurality of networks, and each access rule configures have access rights to associated networks;

Switching the currently running access rule to the target access rule, so as to switch the network card of the terminal from the currently connected network to connect to the target network according to the target access rule, so that the terminal can access the target network.

Further, it also includes the step of creating the multiple access rules, specifically including:

Obtain network information for each of the plurality of networks;

According to the network information of each network, the access authority of each network is configured through the operating system of the terminal, and an access rule is created according to the access authority of each network, and the created access rule is stored in the terminal in advance set client.

Further, the network information includes network segment information where the network ID is located,

According to the network information of each network, configure the access rights of each network through the operating system of the terminal, and create an access rule according to the access rights of each network, including:

According to the network segment information of each network, the operating system of the terminal creates an access rule with the access authority of the corresponding network segment.

Further, before switching the currently running access rule to the target access rule, so as to switch the network card of the terminal from the currently connected network to the target network according to the target access rule, the method further includes:

Create a network filter driver;

Binding the network filter driver to the network card;

Correspondingly, the switching the currently running access rule to the target access rule, so as to switch the network card of the terminal from the currently connected network to the target network according to the target access rule, includes:

The network filter driver blocks the currently connected network, and switches the network card from the currently connected network to connect to the target network.

Further, each of the access rules is also configured with application access rights,

Correspondingly, after the terminal accesses the target network, the method further includes:

Perform access control on the target network to the application program in the terminal according to the application program access right.

Further, the performing the access control of the target network on the application program in the terminal according to the application program access authority includes:

determining an authorized application program and an unauthorized application program of the terminal according to the application program access authority;

When the target application program in the terminal accesses the target network, if the target application program is an unauthorized application program, intercept the target application program’s access to the target network, otherwise, pass the target application program Program access to the target network.

In a second aspect, an embodiment of the present invention further provides a network access control device for a terminal, including:

An access rule selection module, configured to select a target access rule from a plurality of preset access rules according to the target network to be accessed, wherein each access rule in the plurality of access rules is respectively associated with one of the plurality of networks Association, each access rule is configured with the access rights of the associated network;

A network switching module, configured to switch the currently running access rule to the target access rule, so as to switch the network card of the terminal from the currently connected network to the target network according to the target access rule, so that the terminal can access the target network.

In the third aspect, the embodiment of the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and operable on the processor. When the processor executes the program, the first The steps of the terminal network access control method described in the aspect.

In a fourth aspect, an embodiment of the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the network access control of the terminal as described in the first aspect is implemented. method steps.

In a fifth aspect, an embodiment of the present invention further provides a computer program product, the computer program product includes a computer program, and when the computer program is executed by a processor, the steps of the terminal network access control method described in the first aspect are implemented. .

It can be seen from the above technical solutions that the terminal network access control method, device, electronic equipment, and storage medium provided by the embodiments of the present invention can select the corresponding target access rules according to the target network to be accessed, so that the target network can be accessed according to the target access rules. The network management and control of the network card of the terminal realizes the purpose that the terminal is only allowed to access one network at a time, and improves the security of network access. Compared with the way of restricting access to multiple networks through multiple network cards, the application of one network card can realize the requirement that the terminal is only allowed to access one network at the same time, which reduces the hardware cost and effectively ensures that the terminal cannot be connected to multiple networks at the same time. network.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

FIG. 1 is a flowchart of a terminal network access control method provided by an embodiment of the present invention;

FIG. 2 is a schematic diagram of network access control of a terminal network access control method provided by an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of a terminal network access control device provided by an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of an electronic device provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

The existing common technology is to realize the purpose that the terminal does not allow simultaneous access to multiple networks by configuring multiple network cards in the terminal to restrict simultaneous access to multiple networks. The present invention does not need to use multiple network cards, and selects the corresponding target access rules according to the target network to be accessed, so that the network control of the terminal network card is realized according to the target access rules, and the purpose of allowing the terminal to only access one network at the same time , to improve the security of network access. Compared with the way of restricting access to multiple networks through multiple network cards, the application of one network card can realize the requirement that the terminal is only allowed to access one network at the same time, which reduces the hardware cost and effectively ensures that the terminal cannot be connected to multiple networks at the same time. network. The terminal network access control method provided by the present invention will be explained and described in detail below through specific embodiments.

Fig. 1 shows a flowchart of a terminal network access control method provided by an embodiment of the present invention. As shown in Figure 1, the terminal network access control method provided by the embodiment of the present invention includes the following steps:

Step 101: According to the target network to be accessed, select a target access rule from multiple preset access rules, wherein each of the multiple access rules is associated with one of the multiple networks, and each access rule Configure access permissions for associated networks.

As shown in FIG. 2 , the multiple networks include network 1 to network n, where n is a positive integer greater than 1. The preset multiple access rules include access rule 1 to access rule n, wherein access rule 1 to access rule n are associated with network 1 to network n in one-to-one correspondence, and access rule 1 to access rule n are configured in one-to-one correspondence Has access to network 1 to network n.

Among them, the access authority refers to the access authority of the corresponding network, that is, the authority to access the corresponding network, for example, access to network 1 can be achieved through access rule 1, and access to network 2 can be achieved through access rule 2. Similarly, Access rule n can implement access to network n.

Wherein, multiple access rules can be created in the terminal, and the multiple access rules can be saved in a preset client in the terminal. As shown in FIG. 2 , access rule 1 to access rule n also become network 1 policy to network n policy, and the terminal can be called a network policy center. The terminal is, for example, a notebook computer, a PC, and the like.

In one embodiment of the present invention, the preset multiple access rules are pre-created and stored in the corresponding client in the terminal, wherein the step of creating multiple access rules specifically includes: obtaining multiple The network information of each network in the network; through the operating system of the terminal, according to the network information of each network, configure the access rights of each network, and create an access rule according to the access rights of each network, and the created Access rules are stored in preset clients in the terminal.

Further, the network information includes, for example, the network segment information where the network ID is located, then according to the network information of each network, configure the access rights of each network through the operating system of the terminal, and create a The access rule includes: according to the network segment information of each network, create an access rule with the access authority of the corresponding network segment through the operating system of the terminal. That is to say, the network segments of different networks are different. Therefore, the network segment of the network can be determined according to the network segment information of the network ID of the network, and then the access to the network segment can be configured in the corresponding access rules. Control permissions. In this way, when the access rule is applied, access to the network can be realized.

In the above description, the operating system is, for example, the windows operating system, that is, multiple access rules are set through the windows operating system, and then the multiple access rules are stored in the client on the terminal, where the client refers to the a specific application. In this way, the corresponding access rules can be quickly called from the client, improving the execution efficiency of the method. In addition, the access rule can be created directly through the operating system on the terminal, so that the method can be implemented on a terminal equipped with multiple operating systems, and the generality of the method can be improved.

Step 102: Switch the currently running access rule to the target access rule, so as to switch the network card of the terminal from the currently connected network to connect to the target network according to the target access rule, so that the terminal can access the target network.

As a specific example, before switching the currently running access rule to the target access rule, so as to switch the network card of the terminal from the currently connected network to the target network according to the target access rule, it also includes: creating a network filter driver ; Bind the network filter driver with the network card, so that the network in the terminal can be quickly switched through the network filter driver. Correspondingly, switch the currently running access rule to the target access rule, so as to switch the network card of the terminal from the currently connected network to connect to the target network according to the target access rule, including: the network filter driver blocks the currently connected network, and The network card is switched from the currently connected network to the target network. As shown in Figure 2, the target network takes network 1 as an example, then the target access rule is access rule 1, and the access rights configured in access rule 1 are the access rights of network 1, that is, access to network 1 can be realized through access rule 1 . In a specific example of the present invention, the switching between access rules can be realized through the network filter driver created in the client, for example: first bind the created network filter driver with the network card of the terminal, so as to Network management and control. After the network card is successfully bound, the network filter driver receives the access rule 1 distributed by the terminal, the network filter driver closes the access rule in use, the access rule in use becomes invalid, and the switch of the access rule is realized, that is, the network card is blocked The connection with the network being connected, and then switch to access rule 1, access rule 1 takes effect, and the network card is connected to network 1, thereby realizing the terminal’s access to network 1 and ensuring that the terminal is only allowed to access one network at a time through the network card the goal of.

In a specific application, network 1 is, for example, the business network of the enterprise, and network 2 is, for example, the research and development network of the enterprise. The access control method can prevent the terminal from being able to access the business network and the research and development network at the same time, thereby satisfying the requirements for compliant access.

According to the network access control method of the terminal in the embodiment of the present invention, the corresponding target access rule can be selected according to the target network to be accessed, so that the network control of the network card of the terminal can be realized according to the target access rule, and the terminal can only allow The purpose of accessing a network is to improve the security of network access. Compared with the way of restricting access to multiple networks through multiple network cards, the application of one network card can realize the requirement that the terminal is only allowed to access one network at the same time, which reduces the hardware cost and effectively ensures that the terminal cannot be connected to multiple networks at the same time. network.

In one embodiment of the present invention, each access rule is also configured with application program access rights. Further, after the terminal accesses the target network, it also includes: according to the application program access authority, performing access control on the target network to the application program in the terminal, for example: according to the application program access authority, determining the authorized application program and the unauthorized application program of the terminal application program; when the target application program in the terminal accesses the target network, if the target application program is an unauthorized application program, then intercept the target application program's access to the target network, otherwise, pass the target application program's access to the target network.

As shown in Figure 2, assuming that the application program APP1 is business processing software, APP2 is chat software, APP3 is a game client, and network 1 is, for example, a business network, when the terminal is connected to the business network, it is usually during office hours. Internet chatting and online games are not allowed. Therefore, the access rules are configured with application access permissions. For example: in access rule 1, configure APP1 as an authorized application, and APP2 and APP3 as unauthorized applications. At this time, the network card After connecting to network 1, when APP2 and APP3 are activated in the terminal, the Internet cannot be accessed, thereby preventing personnel from doing things unrelated to business during working hours, and further meeting the requirements for compliant access.

Fig. 3 shows a schematic structural diagram of an apparatus for network access control of a terminal provided by an embodiment of the present invention. As shown in FIG. 3, the terminal network access control device provided in this embodiment includes: an access rule selection module 31 and a network switching module 32, wherein:

An access rule selection module 31, configured to select a target access rule from a plurality of preset access rules according to the target network to be accessed, wherein each access rule in the plurality of access rules is respectively associated with one of the plurality of networks Network association, each access rule is configured with the access rights of the associated network;

A network switching module 32, configured to switch the currently running access rule to the target access rule, so as to switch the network card of the terminal from the currently connected network to connect to the target network according to the target access rule, so that the terminal access the target network.

Based on the content of each of the above embodiments, in this embodiment, it also includes: a creation module (not shown in FIG. 3 ), the creation module is used to create the steps of the plurality of access rules, specifically:

Obtain network information for each of the plurality of networks;

According to the network information of each network, configure the access rights of each network, and create an access rule based on the access rights of each network.

Based on the content of each of the above embodiments, in this embodiment, the network information includes the network segment information where the network ID is located, and the creation module is specifically used for:

According to the network segment information of each network, create an access rule with the access rights of the corresponding network segment.

Based on the contents of the foregoing embodiments, in this embodiment, each access rule is further configured with an application program access right.

Based on the contents of the foregoing embodiments, in this embodiment, after the terminal accesses the target network, the network switching module 32 is further configured to:

Perform access control on the target network to the application program in the terminal according to the application program access right.

Based on the contents of the foregoing embodiments, in this embodiment, the network switching module 32 performs access control of the target network on the application program in the terminal according to the application program access authority, including:

determining an authorized application program and an unauthorized application program of the terminal according to the application program access authority;

When the target application program in the terminal accesses the target network, if the target application program is an unauthorized application program, intercept the target application program’s access to the target network, otherwise, pass the target application program Program access to the target network.

Since the terminal network access control device provided in the embodiment of the present invention can be used to implement the terminal network access control method described in the above embodiment, its working principle and beneficial effect are similar, so it will not be described in detail here, and the specific content can be found in Introduction to the above examples.

In this embodiment, it should be noted that the various modules in the device of the embodiment of the present invention can be integrated into one body, or can be deployed separately. The above modules can be combined into one module, or can be further split into multiple sub-modules.

Based on the same inventive concept, another embodiment of the present invention provides an electronic device. Referring to FIG. 4 , the electronic device specifically includes the following: a processor 401, a memory 402, a communication interface 403, and a communication bus 404;

Wherein, the processor 401, the memory 402, and the communication interface 403 complete mutual communication through the communication bus 404;

The processor 401 is used to call the computer program in the memory 402, and when the processor executes the computer program, all the steps of the above terminal network access control method are implemented, for example, the processor executes the computer program At this time, the following process is implemented: according to the target network to be accessed, a target access rule is selected from a plurality of preset access rules, wherein each access rule in the plurality of access rules is respectively associated with one of the plurality of networks , each access rule is configured with the access authority of the associated network; switch the currently running access rule to the target access rule, so as to switch the network card of the terminal from the currently connected network to the target access rule according to the target access rule network connection, so that the terminal accesses the target network.

It can be understood that, for the detailed functions and extended functions that the computer program can execute, reference can be made to the description of the above embodiments.

Based on the same inventive concept, another embodiment of the present invention provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned All the steps of the terminal network access control method, for example, when the processor executes the computer program, the following process is implemented: according to the target network to be accessed, a target access rule is selected from a plurality of preset access rules, wherein, Each of the plurality of access rules is associated with one of the plurality of networks, and each access rule is configured with the access authority of the associated network; the currently running access rule is switched to the target access rule to Switching the network card of the terminal from the currently connected network to connecting with the target network according to the target access rule, so that the terminal can access the target network.

It can be understood that, for the detailed functions and extended functions that the computer program can execute, reference can be made to the description of the above embodiments.

Based on the same inventive concept, another embodiment of the present invention provides a computer program product, the computer program product includes a computer program, and when the computer program is executed by a processor, all the steps of the above terminal network access control method are implemented, for example , when the processor executes the computer program, the following process is implemented: according to the target network to be accessed, a target access rule is selected from a plurality of preset access rules, wherein each access rule in the plurality of access rules Each access rule is associated with one of the multiple networks, and each access rule is configured with the access authority of the associated network; the currently running access rule is switched to the target access rule, so that the network card of the terminal is controlled by the target access rule according to the target access rule. The currently connected network is switched to be connected to the target network, so that the terminal accesses the target network.

It can be understood that, for the detailed functions and extended functions that the computer program can execute, reference can be made to the description of the above embodiments.

In addition, the above logic instructions in the memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. .

The device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solutions of the embodiments of the present invention. It can be understood and implemented by those skilled in the art without any creative efforts.

Through the above description of the implementations, those skilled in the art can clearly understand that each implementation can be implemented by means of software plus a necessary general hardware platform, and of course also by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic Disk, CD, etc., including several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) execute the traffic auditing method described in each embodiment or some parts of the embodiment.

In addition, in the present invention, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is a relationship between these entities or operations. Any such actual relationship or sequence. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

Furthermore, in the present disclosure, description referring to the terms "one embodiment," "some embodiments," "example," "specific examples," or "some examples" means that specific features described in connection with the embodiment or example are , structure, material or characteristic is included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the described specific features, structures, materials or characteristics may be combined in any suitable manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine different embodiments or examples and features of different embodiments or examples described in this specification without conflicting with each other.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (8)

1. A network access control method of a terminal, comprising:

selecting a target access rule from a plurality of preset access rules according to a target network to be accessed, wherein each access rule in the plurality of access rules is respectively associated with one network in the plurality of networks, and each access rule is configured with the access authority of the associated network;

switching the access rule currently operated into the target access rule so as to switch the network card of the terminal from the currently connected network to be connected with the target network according to the target access rule, so that the terminal accesses the target network;

before switching the access rule currently operated into the target access rule so as to switch the network card of the terminal from the currently connected network to be connected with the target network according to the target access rule, the method further comprises the following steps:

creating a network filtering driver;

binding the network filtering driver with the network card;

correspondingly, the switching the access rule currently operated into the target access rule to switch the network card of the terminal from the currently connected network to be connected with the target network according to the target access rule includes:

and the network filtering driver blocks the currently connected network and switches the network card from the currently connected network to the target network.

2. The network access control method of a terminal according to claim 1, further comprising the step of creating the plurality of access rules, specifically comprising:

acquiring network information of each network in a plurality of networks;

according to the network information of each network, configuring access authority of each network through an operating system of the terminal, creating an access rule according to the access authority of each network, and storing the created access rule in a preset client in the terminal.

3. The method for controlling network access of a terminal according to claim 2, wherein the network information includes network segment information in which a network ID is located,

configuring access rights of each network through an operating system of the terminal according to network information of each network, and creating an access rule according to the access rights of each network, wherein the access rule comprises the following steps:

and creating an access rule with the access authority of the corresponding network segment through the operating system of the terminal according to the network segment information of each network.

4. A network access control method for a terminal according to any one of claims 1 to 3, wherein each access rule is further configured with an application access right,

accordingly, after the terminal accesses the target network, the method further comprises:

and according to the access authority of the application program, performing access control on the target network on the application program in the terminal.

5. The network access control method of the terminal according to claim 4, wherein the performing access control of the target network on the application in the terminal according to the application access right includes:

determining authorized application programs and unauthorized application programs of the terminal according to the application program access rights;

when a target application program in the terminal accesses the target network, if the target application program is an unauthorized application program, the access of the target application program to the target network is intercepted, otherwise, the access of the target application program to the target network is performed.

6. A network access control device of a terminal, comprising:

the access rule selection module is used for selecting a target access rule from a plurality of preset access rules according to a target network to be accessed, wherein each access rule in the plurality of access rules is respectively associated with one network in the plurality of networks, and each access rule is configured with the access authority of the associated network;

the network switching module is used for switching the access rule which is currently operated into the target access rule so as to switch the network card of the terminal from the network which is currently connected to the target network according to the target access rule, so that the terminal accesses the target network;

the network switching module is further configured to, before switching a currently running access rule to the target access rule, switch a network card of a terminal from a currently connected network to be connected with the target network according to the target access rule: creating a network filtering driver; binding the network filtering driver with the network card; correspondingly, the switching the access rule currently operated into the target access rule to switch the network card of the terminal from the currently connected network to be connected with the target network according to the target access rule includes: and the network filtering driver blocks the currently connected network and switches the network card from the currently connected network to the target network.

7. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the steps of the network access control method of the terminal according to any one of claims 1-5 when the program is executed by the processor.

8. A non-transitory computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when executed by a processor, implements the steps of the network access control method of a terminal according to any one of claims 1 to 5.

Images