WO2015127831A1

WO2015127831A1 - Anti-intrusion method and access device

Info

Publication number: WO2015127831A1
Application number: PCT/CN2015/070371
Authority: WO
Inventors: 郭金亮; 张连军
Original assignee: 华为技术有限公司
Priority date: 2014-02-28
Filing date: 2015-01-08
Publication date: 2015-09-03
Also published as: CN104883340B; CN104883340A

Abstract

Provided in an embodiment of the present invention are an anti-intrusion method and access device comprising an interface, the method comprising: when an access device determines that a triggering event is satisfied, the access device sets the working mode of the interface to locked mode to prevent any terminal from accessing the network of the access device via the interface. The access device of the embodiment of the present invention comprises at least one interface. For any one of the interfaces, when the access device determines an intrusion risk of the access device at the interface, the access device sets the working mode of the interface to locked mode to prevent any terminal from accessing the network of the access device via that interface, thus improving the security of the network of the access device. Further, the access device conducts the above processing on each of the at least one interfaces to prevent any terminal from communicating with the access device or with the superior network device of the access device, thus effectively preventing hacker invasion and protecting network security.

Description

Method for preventing intrusion and access device

The present application claims priority to Chinese Patent Application No. 201410070449.5, filed on February 28, 2014, the disclosure of which is incorporated herein by reference. in.

Technical field

The embodiments of the present invention relate to the field of network technologies, and in particular, to a method for preventing intrusion and an access device.

Background technique

The power business is divided into power generation, transmission, substation, dispatch, distribution, and power. As the distribution service and power service extend to roadsides and buildings, the security capability of the original power private network is seriously damaged. The attacker can easily access the power distribution network and the power network. The hacker can illegally access the power distribution network with the optical network unit (ONU) interface and the power network with the concentrator interface to invade and control. Power distribution, power consumption networks, and even dispatching automation systems cause serious consequences such as serious power distribution, power consumption, and even power grid safety accidents.

Summary of the invention

Embodiments of the present invention provide a method for preventing intrusion to improve network security.

The first aspect provides a method for preventing intrusion, where the method is applied to an access device, where the access device includes an interface, and the interface is used by the terminal to access the network where the access device is located through the interface. The method includes: the access device determines that a trigger event is satisfied, the trigger event is used to indicate that the access device is invaded at the interface; and the access device works on the interface The mode is set to a lockout mode, which is used to prevent any terminal from accessing the network in which the access device is located through the interface.

With reference to the first aspect, in a first possible implementation manner of the first aspect, the access device has an interface state monitoring function, and when the determining that the access device has enabled the interface state monitoring function, the triggering The event includes: changing the state of the interface from UP to DOWN, or The operation mode of the port is the operation mode, and the duration of the interface is DOWN exceeds a preset threshold, or the access device is restarted; when the access device starts the interface state monitoring function, the trigger event includes : The status of the interface is DOWN.

With reference to the first aspect or the first possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, the method further includes: the access device generates a first message, where the A message is used to indicate that the working mode of the interface is a blocking mode; the access device sends the first message to a network management system.

In conjunction with the second possible implementation of the first aspect, in a third possible implementation manner of the first aspect, after the access device sends the first message to the network management system, the method further includes: Receiving, by the access device, the second message sent by the network management system, where the second message is used to instruct the access device to switch the working mode of the interface to an operating mode; The second message switches the working mode of the interface to the running mode.

With reference to the first aspect, or any one of the foregoing possible implementation manners, in a fourth possible implementation manner of the foregoing aspect, the method further includes: the access device receiving, sending, by the network management system The third message is used to indicate that the interface needs to be debugged; and the access device switches the working mode of the interface to the debugging mode according to the third message.

A second aspect provides an access device, where the access device includes an interface, where the interface is used by the terminal to access the network where the access device is located, where the access device includes: Means for determining that a triggering event is used, the triggering event is used to indicate that the access device is invaded at the interface; and a setting unit is configured to set an operating mode of the interface to a blocking mode, The blocking mode is used to prevent any terminal from accessing the network where the access device is located through the interface.

With reference to the second aspect, in a first possible implementation manner of the second aspect, the access device has an interface state monitoring function, and when the determining that the access device has enabled the interface state monitoring function, the triggering The event includes: the status of the interface is changed from UP to DOWN, or the working mode of the interface is in the running mode, and the duration of the interface is DOWN exceeds a preset threshold, or the access device is restarted; When the access device starts the interface state monitoring function, the triggering event includes: the state of the interface is DOWN.

With reference to the second aspect, or the first possible implementation manner of the second aspect, in the second possible implementation manner of the second aspect, the access device further includes: a generating unit, configured to generate the first The first message is used to indicate that the working mode of the interface is a blocking mode, and the sending unit is configured to send the first message generated by the generating unit to a network management system.

With reference to the second possible implementation of the second aspect, in a third possible implementation manner of the second aspect, the access device further includes: a receiving unit, configured to receive the second sent by the network management system a message, the second message is used to indicate that the access device switches the working mode of the interface to an operating mode, and the setting unit is further configured to: according to the second message received by the receiving unit, The working mode of the interface is switched to the operating mode.

With reference to the second aspect, or any one of the foregoing possible implementation manners, in the fourth possible implementation manner of the second aspect, the receiving unit is further configured to receive the third sent by the network management system a message, the third message is used to indicate that the interface needs to be debugged, and the setting unit is further configured to switch the working mode of the interface to a debugging mode according to the third message received by the receiving unit.

A third aspect provides an access device, where the access device includes an interface, where the terminal is used to access the network where the access device is located, and the access device further includes a processor and a memory. Wherein: the memory is used to store program code; the processor is configured to read program code in the memory, and execute: determining to satisfy a trigger event, wherein the trigger event is used to indicate that the access device is invaded at the interface. The working mode of the interface is set to a blocking mode, which is used to prevent any terminal from accessing the network where the access device is located through the interface.

With reference to the third aspect, in a first possible implementation manner of the third aspect, the access device has an interface state monitoring function, and when the determining that the access device has enabled the interface state monitoring function, the triggering event includes: The state of the interface is changed from UP to DOWN, or the working mode of the interface is in the running mode, and the duration of the interface is DOWN exceeds a preset threshold, or the access device is restarted; When the device is enabled to open the interface state monitoring function, the triggering event includes: the state of the interface is DOWN.

With the third aspect or the first possible implementation manner of the third aspect, in a second possible implementation manner of the third aspect, the access device further includes a sending circuit, where the sending circuit is configured by using the The port in the device is in communication with the network management system, the processor is further configured to generate a first message, where the first message is used to indicate that the working mode of the interface is a latching mode, and the sending circuit is configured to The first message generated by the processor is sent to the network management system.

In conjunction with the second possible implementation of the third aspect, the third possible implementation in the third aspect In an aspect, the access device further includes a receiving circuit, wherein the receiving circuit communicates with the network management system by using a port in the access device, where the receiving circuit is configured to receive the sending by the network management system a second message, the second message is used to indicate that the access device switches the working mode of the interface to an operating mode, and the processor is further configured to: according to the second message received by the receiving circuit, Switch the operating mode of the interface to the operating mode.

With reference to the third aspect, or any one of the foregoing possible implementation manners of the third aspect, the receiving circuit is further configured to receive the third sent by the network management system, in a fourth possible implementation manner of the third aspect, a message, the third message is used to indicate that the interface needs to be debugged, and the processor is further configured to switch the working mode of the interface to a debugging mode according to the third message received by the receiving circuit.

The access device in the embodiment of the present invention includes at least one interface. For any one of the interfaces, when the access device determines that the access device is invaded at the interface, the working mode of the interface is set to The blocking mode can prevent any terminal from accessing the network where the access device is located through the interface, thereby improving the security of the network where the access device is located. Further, the access device performs the foregoing processing on each of the at least one interface to prevent any terminal from communicating with the access device or a superior network device of the access device, which can effectively prevent hacker connection. Into, protect the security of the network.

DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description are only some of the present invention. For the embodiments, those skilled in the art can obtain other drawings according to the drawings without any creative work.

1 is a schematic diagram of a scenario of an embodiment of the present invention.

2 is a flow chart of a method for preventing intrusion according to an embodiment of the present invention.

3 is a schematic diagram of switching between modes of operation of an interface in accordance with an embodiment of the present invention.

FIG. 4 is a schematic flowchart of a method for preventing intrusion according to an embodiment of the present invention.

Figure 5 is a block diagram of an access device in accordance with one embodiment of the present invention.

6 is a block diagram of an access device in accordance with another embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

In the embodiment of the present invention, the access device may be a power-dedicated communication device, such as an ONU or a concentrator. The access device can also be other communication devices, such as a switch or router or Customer Premises Equipment (CPE). The access device may also be another access device connected to the terminal, which is not limited by the present invention. The terminal connected to the access device may be a user terminal, or may be a hub, or may be another type of terminal, which is not limited by the present invention.

1 is a schematic diagram of a scenario of an embodiment of the present invention. The scenario shown in FIG. 1 includes an access device 100 having multiple interfaces. The access device 100 shown in FIG. 1 has six interfaces, respectively, as shown in FIG. Also shown in FIG. 1 is a first terminal 110 that communicates with the access device via interface 106.

It should be noted that the number of interfaces of the access device is not limited in the embodiment of the present invention. The access device in FIG. 1 has six interfaces, which are only schematic.

It should be noted that the access device in the embodiment of the present invention further has a central processing unit, a port for connecting to the network management system, and other components and the like, which are not shown in FIG. The invention is not limited thereto.

2 is a flow chart of a method for preventing intrusion according to an embodiment of the present invention. The method shown in Figure 2 is performed by an access device, where the access device includes an interface, and the interface is used by the terminal to access the network where the access device is located. The method of Figure 2 includes:

201. Determine to satisfy a trigger event, where the trigger event is used to indicate that the access device is at risk of being invaded at the interface.

202. Set the working mode of the interface to a blocking mode, where the blocking mode is used to prevent any terminal from accessing the network where the access device is located through the interface.

The access device in the embodiment of the present invention includes at least one interface. For any one of the interfaces, when the access device determines that the access device is invaded at the interface, the working mode of the interface is set to Blocking mode, which can prevent any terminal from accessing the access through the interface The network where the device is located improves the security of the network where the access device is located. Further, the access device performs the foregoing processing on each of the at least one interface to prevent any terminal from communicating with the access device or a superior network device of the access device, which can effectively prevent hacker connection. Into, protect the security of the network.

In the embodiment of the present invention, the access device includes an interface, and the state of the interface is UP or DOWN.

The status of the interface is UP. It can be understood that the first terminal connects to the access device through the interface and performs communication. The status of the interface is DOWN. It can be understood that the interface is idle. No terminal connects to the access device through the interface.

It should be noted that the communication in the embodiment of the present invention may be performed by communicating with the access device, or may be in communication with other devices in the network where the access device is located, which is not limited by the present invention.

The status of the interface changes from UP to DOWN. It can be understood that the relationship between the first terminal and the access device changes from the connected state to the disconnected state on the interface. The state of the interface changes from DOWN to UP. It can be understood that the interface starts to be idle, and then the first terminal connects to the access device through the interface and performs communication.

In the embodiment of the present invention, the working mode of the interface is a debugging mode, or an operating mode, or a blocking mode. As shown in Figure 3.

When the working mode of an interface is running mode, the status of the interface may be UP or DOWN. Specifically, when the working mode of the interface is the running mode and the state of the interface is DOWN, the interface may also be called UP. The interface can be up, and the current state of the interface is DOWN. When the second terminal attempts to connect to the access device through the interface, the second terminal can access the network where the access device is located and communicate. The second terminal may be the first terminal, or may be any other terminal different from the first terminal.

When the working mode of the interface is in blocking mode and the state of the interface is DOWN, the interface can also be said to be unreturnable. The interface cannot be up. It can be understood that the current state of the interface is DOWN. When any terminal attempts to connect to the access device through the interface, the access device does not allow any terminal to communicate through the interface.

It can also be understood that when the working mode of the interface is the blocking mode, even if a terminal is formally connected to the access device through the interface, communication cannot be performed.

In the embodiment of the present invention, the access device may have an interface state monitoring function, and the access device is connected. The port status monitoring function can be used to monitor the status change of each interface of the access device.

The access device may be in the deployment phase or in the operational phase. When the access device is in the deployment phase, the interface status monitoring function of the access device is disabled. This facilitates the deployment and debugging of the access device. When the access device is in the running phase, the interface state monitoring function of the access device is enabled. When the access device is switched from the running phase to the deployment phase, the interface state monitoring function of the access device can be disabled at the same time. When the access device is switched from the deployment phase to the running phase, the interface state monitoring function of the access device can be enabled at the same time.

Specifically, when the access device is in the deployment phase, the interface state monitoring function of the access device is turned off, and the working modes of all the interfaces of the access device are in the debugging mode. Specifically, when the access device is in the running phase, the interface state monitoring function of the access device is enabled, and the working mode of the interface of the access device is the running mode or the blocking mode. As shown in Figure 3, on the left side of the dotted line, the access device is in the deployment phase, and the working mode of the interface is the debug mode. On the right side of the dotted line, it indicates that the access device is in the running phase, and the working mode of the interface is the running mode or the blocking mode. This relationship can be seen in Table 1.

Table 1

Optionally, as an embodiment, when determining that the access device has enabled the interface state monitoring function, the triggering event in 201 may be: the state of the interface changes from UP to DOWN, or the working mode of the interface is the running mode, and The time when the interface is Down is longer than the preset threshold, or the access device is restarted.

The trigger event is: the state of the interface changes from UP to DOWN. It can be understood that the state of the interface changes from UP to DOWN when the working mode of the interface is the running mode.

The triggering event is: the access device is restarted, and the interface can be understood as any interface of the access device.

The embodiment of the present invention does not limit the size of the preset threshold. For example, the preset threshold may be 10 minutes, or may be 1 hour, or may be other sizes, which is not limited by the present invention.

It can be understood that 201 and 202 are performed while the access device is in the running phase. Alternatively, it can be understood that 201 and 202 are performed when the access device has enabled the interface state monitoring function. At this time, in 202, the access device sets the working mode of the interface from the running mode to the blocking mode according to the triggering event. As shown in 301 in FIG.

Optionally, in another embodiment, when the access device starts the interface state monitoring function, the triggering event in 201 may also be: the state of the interface of the access device is DOWN.

It can also be understood that the trigger event is: when the access device switches from the deployment phase to the running phase, the state of the interface is DOWN.

It can be understood that 201 and 202 are executed when the access device starts the interface state monitoring function. In other words, 201 and 202 are executed when the access device switches from the deployment phase to the running phase. At this time, the access device in 202 switches the working mode of the interface from the debug mode to the lock mode. As shown by 302 in FIG.

Optionally, as an embodiment, after the access device sets the working mode of the interface to the blocking mode, the access device may also generate a first message, or the access device may also set the working mode of the interface to be blocked at 202. The first message is generated simultaneously with the mode, or the access device may also generate the first message before 202. The invention is not limited thereto. The first message is used to indicate that the working mode of the interface of the access device is a locked mode.

The further access device can send the first message to a Network Management System.

In the embodiment of the present invention, the network management system may be a server installed with network management software, a personal computer (PC) installed with network management software, or other devices having network management functions, and the present invention This is not limited.

In this way, the network management system can learn the change of the working mode of the interface of the access device, so that the network management system performs further processing according to the first message.

Optionally, after receiving the first message, the network management system may present the information indicated by the first message to the user. For example, the interface number of the interface can be presented on the display interface of the server or PC on which the network management software is installed.

The user can check the interface based on the presented information. If the user confirms that the interface has been illegally hacked, the user does not perform further unlocking operations, and still maintains the working mode of the interface as the blocking mode. If the user confirms that the interface is in the DOWN state for a long time and does not need any terminal to access the access device through the interface for a period of time, the user may not perform further unlocking operations and still maintain the working of the interface. The mode is the lockout mode. The terminal that normally accesses the access device herein may refer to a terminal that the user can identify and permit to access the access device.

If the user is checked to make sure that the interface is not illegally hacked, the user can perform an unlock operation.

Specifically, the user can switch the working mode of the interface to the running mode through the network management system.

For example, the user can make a first input, and the network management system generates a second message according to the first input, and sends the second message to the access device. Further, the access device receives the second message sent by the network management system, where the second message is used to instruct the access device to switch the working mode of the interface to the operating mode, and according to the second message, the access device The working mode of the interface is switched to the operating mode. As shown at 303 in FIG.

In this way, the user can switch the working mode of the interface to the running mode by using the second message in time to ensure that the terminal is connected to the access device and the access device through the interface. Normal communication between devices.

Or, specifically, the user can switch the working mode of the interface to the debugging mode through the network management system.

For example, when the user determines that the interface of the access device needs to be debugged, the user may perform a second input, and the network management system generates a third message according to the second input, and sends the third message to the access device. Further, the access device receives the third message sent by the network management system, and switches the working mode of the interface to the debugging mode according to the third message. The third message is used to indicate that the interface of the access device needs to be debugged.

It should be noted that the access device can disable the interface state monitoring function of the access device while switching the working mode of the interface to the debugging mode.

It should be understood that, in conjunction with Table 1, the access device switches the access device from the running phase to the deployment phase while switching the working mode of the interface to the debugging mode, and monitors the interface state of the access device. Can close. That is to say, the working mode of all interfaces of the access device is switched to the debugging mode at the same time. As shown at 304 in FIG.

In this way, you can switch the operating mode of the interface from the operating mode or the blocking mode to the debugging mode.

Further, after the debugging of the interface of the access device is completed, the access device may open an interface state monitoring function of the access device, and switch the working mode of the interface from the debugging mode to the running mode or the blocking mode.

Specifically, after the debugging of the interface of the access device is completed, the user may perform a third input, and the network management system generates a fourth message according to the third input, and sends the fourth message to the access device. Further, the access device receives the fourth message sent by the network management system, starts the interface state monitoring function of the access device according to the fourth message, and switches the working mode of the interface to the operating mode or the blocking mode.

It should be understood that when the interface device monitor function is enabled, the access device also switches the access device from the deployment phase to the operation phase.

Specifically, if the access device starts the interface state monitoring function of the access device after the debugging, and determines that the interface meets the triggering event, the state of the interface is DOWN, then the access device starts the access device after debugging. When the interface status monitoring function is enabled, the working mode of the interface is switched to the blocking mode. As shown by 302 in FIG.

Specifically, if the access device starts the interface state monitoring function of the access device after the debugging, the state of the interface is UP, that is, at the interface, the terminal that the user can identify and permit access to the access device is accessed. Then, when the access device starts the interface state monitoring function of the access device after debugging, the working mode of the interface is switched to the operating mode. As shown at 305 in FIG.

This allows you to switch the operating mode of the interface from debug mode to run mode or latched mode.

In this way, the embodiment of the present invention can implement the switching between the working mode, the debugging mode, and the blocking mode of the interface of the access device.

FIG. 4 is a schematic flowchart of a method for preventing intrusion according to an embodiment of the present invention. It is assumed that the access device is in the running phase, that is, the interface device monitoring function is enabled on the access device. The method shown in Figure 4 includes:

401. The access device determines that the state of the interface changes from UP to DOWN.

It can be understood that the connection of a certain terminal that communicates with the access device through the interface is disconnected from the access device. Or it can be understood that when the working mode of the interface is the running mode, the state of the interface changes from UP to DOWN. The interface can be any interface of the access device.

For example, referring to FIG. 1, when the connection of the first terminal 110 to the access device 100 is disconnected at the interface 106, the access device 100 detects that the state of the interface 106 changes from UP to DOWN.

402. The access device sets the working mode of the interface to a blocking mode. And execute 403.

For example, referring to FIG. 1, access device 100 switches the mode of operation of interface 106 from an operational mode to a locked mode.

If the state of the interface changes from UP to DOWN in 401, it is because the hacker wants to connect the access device through the interface, thus preventing illegal intrusion.

403. The access device generates a first message. And execute 404.

Specifically, the first message is used to indicate that the working mode of the interface is a blocking mode.

404. The access device sends the first message generated by 403 to the network management system.

405. The access device receives a second message sent by the network management system, where the second message is used to indicate that the access device switches the working mode of the interface to an operating mode. And execute 406.

406. The access device switches the working mode of the interface to an operating mode.

In this way, when the network management system eliminates the possibility of illegal intrusion, the working mode of the interface is switched from the blocking mode to the running mode, which can ensure the normal use of the interface.

409, to prevent illegal intrusion.

After 406, 410 can also be performed.

410: Determine that the duration that the interface is in the UP state exceeds a preset threshold. If yes, execute 402.

It should be noted that Figure 4 is only one embodiment of the present invention. Other embodiments that can be obtained by those skilled in the art without the inventive work on the basis of this embodiment are within the scope of the present invention.

In this way, when the access device detects that there is a risk of being invaded at the interface, the working mode of the interface is set to the blocking mode, which can prevent unauthorized access to the access device through the interface, thereby effectively protecting the security of the network.

For the access device 100 shown in FIG. 1 , it is assumed that the access device 100 is initially in the deployment phase, at which time the interface state monitoring function of the access device 100 is closed, and at this time, the interface 101 to the interface 106 of the access device 100 The working mode is debug mode. Then, at the first moment, the access device 100 switches from the deployment phase to the operation phase, and simultaneously starts the interface state monitoring of the access device 100. When the function is controlled, it is determined that the state of the interface 101 to the interface 105 is DOWN, and the working modes of the interface 101 to the interface 105 are all switched to the blocking mode. At this time, the state of the interface 106 is UP, and the working mode of the interface 106 is switched to the operating mode. Thus, the first terminal 110 can communicate with the access device 100 through the interface 106, and can further access the interface 106. The upper network device of device 100 communicates.

At the second moment, when the access device 100 is restarted, the access device 100 sets all the working modes of the interface 101-interface 106 to the blocking mode. Specifically, at the second moment, the access device 100 maintains the operating mode of the interface 101 to the interface 105 as a blocking mode, and switches the operating mode of the interface 106 from the operating mode to the blocking mode. Further, under the instruction of the network management system, the access device 100 can switch the working mode of the interface 106 to the operating mode, so that the first terminal 110 connected to the access device 100 through the interface 106 can perform with the access device 100. Normal communication.

At the third moment, the access device 100 can also switch the operating mode of one or more of the interfaces 101 to 105 to the operating mode under the direction of the network management system. For example, the network management system can instruct the access device 100 to switch the operating mode of the interface 103 to the operating mode so that the licensed second terminal normally accesses the access device. However, if the access device 100 switches the working mode of the interface 103 to the operating mode, the state of the interface 103 is still DOWN after the preset threshold is exceeded, and the access device 100 can switch the working mode of the interface 103 to the blocking mode. . It can also be understood that the access device 100 switches the state of the interface 103 from UP to non-UP.

If, at the fourth moment, the access device 100 finds that the first terminal 110 is disconnected from the access device 100 through the interface 106, that is, the state of the interface 106 changes from UP to DOWN, the access device 100 operates the interface 106 at this time. The mode is switched to the lockout mode.

The access device in the embodiment of the present invention includes at least one interface, and when the access device determines that the access device is in the intrusion risk at the interface in the at least one interface, setting the working mode of the interface to the blocking mode, Blocking any terminal from accessing the access device through the interface further prevents any terminal from communicating with the access device or with the upper-level network device of the access device, thereby effectively preventing hackers from invading at the physical level. Moreover, the method of the embodiment of the present invention is implemented on the product side without additional equipment, and can effectively save costs.

Figure 5 is a block diagram of an access device in accordance with one embodiment of the present invention. The access device 500 shown in FIG. 5 includes an interface for the terminal to access the network where the access device 500 is located. The access device 500 includes a determining unit 501 and a setting unit 502.

The determining unit 501 is configured to determine that a triggering event is used, and the triggering event is used to indicate that the access device 500 is at risk of being invaded at the interface. The setting unit 502 is configured to, if the determining unit 501 determines that the trigger event is satisfied, set the working mode of the interface to a blocking mode, where the blocking mode is used to prevent any terminal from accessing the network where the access device 500 is located through the interface.

Optionally, as an embodiment, the access device 500 has an interface status monitoring function.

When it is determined that the access device 500 has enabled the interface state monitoring function, the triggering event includes: changing the state of the interface from UP to DOWN, or the working mode of the interface is an operating mode, and the interface is in the DOWN state. The duration exceeds a preset threshold, or the access device 500 restarts.

When the access device 500 starts the interface state monitoring function, the triggering event includes: the state of the interface is DOWN.

Optionally, as another embodiment, the access device 500 further includes a generating unit 503 and a sending unit 504. The generating unit 503 is configured to generate a first message, where the first message is used to indicate that the working mode of the interface is a blocking mode. The sending unit 504 is configured to send the first message generated by the generating unit 503 to the network management system.

Optionally, as another embodiment, the access device 500 further includes a receiving unit 505. The receiving unit 505 is configured to receive a second message sent by the network management system, where the second message is used to instruct the access device 500 to switch the working mode of the interface to an operating mode. The setting unit 502 is further configured to switch the working mode of the interface to the operating mode according to the second message received by the receiving unit 505.

Optionally, in another embodiment, the receiving unit 505 is further configured to receive a third message sent by the network management system, where the third message is used to indicate that the interface needs to be debugged. The setting unit 502 is further configured to switch the working mode of the interface to the debugging mode according to the third message received by the receiving unit 505.

The access device 500 can implement the various implementations implemented by the access device in the embodiments of Figures 2 and 4. To avoid repetition, I will not repeat them here.

6 is a block diagram of an access device in accordance with another embodiment of the present invention. The access device 600 in FIG. 6 includes an interface for the terminal to access the network where the access device 600 is located. The access device 600 includes a processor 601, a receiving circuit 602, a sending circuit 603, and a memory 604. . The receiving circuit 602 and the transmitting circuit 603 communicate with the network management system through ports in the access device 600.

The memory 604 is configured to store program code;

The processor 601 is configured to read the program code in the memory 604 and execute:

It is determined that the trigger event is satisfied, and the trigger event is used to indicate that the access device 600 is at risk of being compromised at the interface. The working mode of the interface is set to a blocking mode, and the blocking mode is used to prevent any terminal from accessing the network where the access device 600 is located through the interface.

The various components in access device 600 are coupled together by a bus system 605, which in addition to the data bus includes a power bus, a control bus, and a status signal bus. However, for clarity of description, various buses are labeled as bus system 605 in FIG.

The method disclosed in the foregoing embodiments of the present invention may be applied to the processor 601 or implemented by the processor 601. Processor 601 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the foregoing method may be completed by an integrated logic circuit of hardware in the processor 601 or an instruction in a form of software. The processor 601 may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a Field Programmable Gate Array (FPGA), or the like. Programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out. The general purpose processor may be a microprocessor or the processor or any conventional processor or the like. Knot The steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor. The software module can be located in a random access memory (RAM), a flash memory, a read-only memory (ROM), a programmable read only memory or an electrically erasable programmable memory, a register, and the like. in. The storage medium is located in the memory 604, and the processor 601 reads the information in the memory 604 and completes the steps of the above method in combination with its hardware.

Optionally, as an embodiment, the access device 600 has an interface status monitoring function.

When it is determined that the access device 600 has enabled the interface state monitoring function, the triggering event includes: changing the state of the interface from UP to DOWN, or the working mode of the interface is an operating mode, and the interface is in the DOWN state. The duration exceeds a preset threshold, or the access device 600 restarts.

When the access device 600 starts the interface state monitoring function, the triggering event includes: the state of the interface is DOWN.

Optionally, in another embodiment, the processor 601 is further configured to generate a first message, where the first message is used to indicate that the working mode of the interface is a blocking mode. The transmitting circuit 603 is configured to send the first message generated by the processor 601 to the network management system.

Optionally, as another embodiment, the receiving circuit 602 is configured to receive a second message sent by the network management system, where the second message is used to instruct the access device 600 to switch the working mode of the interface to an operating mode. The processor 601 is further configured to switch the working mode of the interface to the operating mode according to the second message received by the receiving circuit 602.

Optionally, as another embodiment, the receiving circuit 602 is further configured to receive a third message sent by the network management system, where the third message is used to indicate that the interface needs to be debugged. The processor 601 is further configured to switch the working mode of the interface to the debugging mode according to the third message received by the receiving circuit 602.

The access device 600 can implement various processes implemented by the access device in the embodiments of FIG. 2 and FIG. 4, and details are not described herein again to avoid repetition.

Those of ordinary skill in the art will appreciate that the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

A person skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

The functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including The instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

A method for preventing intrusion, the method is applied to an access device, where the access device includes an interface, and the interface is used by the terminal to access the network where the access device is located through the interface. The methods include:

Determining that the triggering event is satisfied, the triggering event is used to indicate that the access device is invaded at the interface;

The access device sets the working mode of the interface to a blocking mode, where the blocking mode is used to prevent any terminal from accessing the network where the access device is located through the interface.
The method according to claim 1, wherein the access device has an interface status monitoring function.

When it is determined that the interface device has enabled the interface state monitoring function, the triggering event includes: changing the state of the interface from UP to DOWN, or the working mode of the interface is an operating mode, and the interface is The duration of the DOWN exceeds a preset threshold, or the access device restarts;

The triggering event includes: the state of the interface is DOWN when the interface device is being enabled to perform the interface state monitoring function.
The method according to claim 1 or 2, wherein the method further comprises:

The access device generates a first message, where the first message is used to indicate that the working mode of the interface is a blocking mode;

The access device sends the first message to a network management system.
The method according to claim 3, further comprising: after the access device sends the first message to the network management system,

Receiving, by the access device, a second message sent by the network management system, where the second message is used to instruct the access device to switch an operation mode of the interface to an operation mode;

The access device switches the working mode of the interface to an operating mode according to the second message.
The method according to any one of claims 1 to 4, further comprising:

Receiving, by the access device, a third message sent by the network management system, where the third message is used to indicate that the interface needs to be debugged;

The access device switches the working mode of the interface to the debugging mode according to the third message.
An access device, where the access device includes an interface, and the interface is used by the terminal to access the network where the access device is located through the interface, where the access device includes:

a determining unit, configured to determine that a triggering event is used, where the triggering event is used to indicate that the access device is at risk of being invaded at the interface;

a setting unit, configured to: if the determining unit determines that the triggering event is met, set the working mode of the interface to a blocking mode, where the blocking mode is used to prevent any terminal from accessing the network where the access device is located through the interface .
The access device according to claim 6, wherein the access device has an interface status monitoring function.

When it is determined that the interface device has enabled the interface state monitoring function, the triggering event includes: changing the state of the interface from UP to DOWN, or the working mode of the interface is an operating mode, and the interface is The duration of the DOWN exceeds a preset threshold, or the access device restarts;

The triggering event includes: the state of the interface is DOWN when the interface device is being enabled to perform the interface state monitoring function.
The access device according to claim 6 or 7, the access device further comprising:

a generating unit, configured to generate a first message, where the first message is used to indicate that an working mode of the interface is a blocking mode;

And a sending unit, configured to send the first message generated by the generating unit to a network management system.
The access device according to claim 8, wherein the access device further comprises:

a receiving unit, configured to receive a second message sent by the network management system, where the second message is used to instruct the access device to switch an operating mode of the interface to an operating mode;

The setting unit is further configured to switch an operation mode of the interface to an operation mode according to the second message received by the receiving unit.
Access device according to claims 6 to 9, characterized in that

The receiving unit is further configured to receive a third message sent by the network management system, where the third message is used to indicate that the interface needs to be debugged;

The setting unit is further configured to switch the working mode of the interface to the debugging mode according to the third message received by the receiving unit.