WO2022052972A1 - 一种网络终端认证的方法及装置 - Google Patents
一种网络终端认证的方法及装置 Download PDFInfo
- Publication number
- WO2022052972A1 WO2022052972A1 PCT/CN2021/117358 CN2021117358W WO2022052972A1 WO 2022052972 A1 WO2022052972 A1 WO 2022052972A1 CN 2021117358 W CN2021117358 W CN 2021117358W WO 2022052972 A1 WO2022052972 A1 WO 2022052972A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- network
- port
- policy
- access request
- access
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
- H04L61/50—Address allocation
- H04L61/5007—Internet protocol [IP] addresses
- H04L61/503—Internet protocol [IP] addresses using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
- H04L61/09—Mapping addresses
- H04L61/25—Mapping addresses of the same type
- H04L61/2503—Translation of Internet protocol [IP] addresses
- H04L61/2517—Translation of Internet protocol [IP] addresses using port numbers
Definitions
- the present application relates to the field of network technologies, and in particular, to a method and apparatus for network terminal authentication.
- Nmap Network Mapper, network scan
- attackers may scan network ports through automated tools to obtain network services corresponding to open network ports such as MySQL; if there are security risks such as weak passwords on network ports at this time, it will cause serious data leakage, host damage, etc. security incident.
- Embodiments of the present invention provide a network terminal authentication method and device, which can eliminate the coupling between an IP address and a network server authentication mechanism, increase the flexibility of accessing IP addresses, and improve the security of network ports.
- an embodiment of the present invention provides a method for network terminal authentication, the method comprising:
- the network server receives the first access request sent by the network terminal; the first access request carries an access authentication policy; the network server determines a port policy matching the access authentication policy from the port policy record; the Each of the port policies in the port policy record is used to open corresponding network ports; the network server determines the first network port accessed by the network terminal according to the port policy; the network server receives the network A second access request sent by the terminal, where the second access request is used to obtain network services through the first network port.
- the network terminal sends the first access request to the network server, and according to the access authentication policy in the first access request, the port policy record is matched to determine the matching port policy, and further determine the network that provides the network service for the network terminal. port.
- the network server authenticates the access authentication policy in the first access request sent by the network terminal according to the port policy record, and matches the first network port.
- the present application can implement user authentication according to port policy records and access authentication policies when IP addresses change frequently, eliminating IP addresses and network services.
- the coupling of the end authentication mechanism increases the flexibility of accessing IP addresses; and ensures that the first network port is only open to users who have passed the authentication, thereby improving the security of the first network port.
- the method further includes: the network server closes a second network port, and the second network port is any port used for providing network services;
- the network server opens a third network port, and the third network port is used for capturing and analyzing malicious attack messages.
- the network server closes the second network port for providing network services to prevent the second network port from being in an open state, and anyone can access the second network port and cause malicious attacks, and increase the second network port. security.
- the third network port for capturing and analyzing malicious attack messages is opened, thereby realizing defense against attack behavior through the third network port, and improving the ability of the network server to defend against malicious attacks.
- the port policy record is obtained in the following manner: the network server generates different port policies for each second network port respectively; the network server records each port policy in the port policy record; the The port policy includes port information, preset parameters and access time limit; the preset parameters are used for matching with the access authentication policy.
- different port policies are respectively generated for each second network port; and recorded in the port policy record.
- the access authentication policy in the first access request is authenticated, and the network ports corresponding to the access authentication policy are obtained one-to-one, and there will be no simultaneous access to the same access authentication policy.
- set the port information in the port policy to determine the accuracy of the network terminal accessing the network server; set the preset parameters to ensure the matching accuracy of the access authentication policy and the port policy when the network terminal accesses; set the access time limit to ensure that the network
- the security of the terminal accessing the network server to prevent the access time from being too long and increasing the risk of the network port being attacked.
- users are authenticated through policy matching. Eliminate the coupling between the IP address and the authentication mechanism of the network server, and increase the flexibility of accessing the IP address.
- the method before the network server receives the first access request sent by the network terminal, the method further includes:
- the network service port publishes the port policy record to the network terminal; or a port policy acquisition script is preinstalled in the network terminal.
- the port policy record including the port policy of each network port is published to the network terminal, or the network terminal is pre-installed with a port policy acquisition script.
- the network terminal can generate a corresponding access authentication policy according to the port policy and the network service to be acquired, and further, the network server can authenticate the network terminal. This ensures the security of network terminals accessing network services. Authenticate users in such a way that the pass-through policy matches. Eliminate the coupling between the IP address and the authentication mechanism of the network server, and increase the flexibility of accessing the IP address.
- the network server determines the first network port accessed by the network terminal according to the port policy, including:
- the first access request further includes the IP address of the network terminal
- the network server before the network server provides network services for the network terminal through the first network port, the network server further includes: The first network port is open to the IP address of the network terminal carried in the first access request.
- the targeted opening of the first network port is realized and network services are provided for the network terminal. That is, the first network port is specifically opened to the IP address of the network terminal carried in the first access request; it is ensured that the first network port is only open to legitimate users after authentication, and the security of the first network port is guaranteed. The probability of the first network port being attacked is reduced, and the security of the first network port is increased.
- the method further includes:
- the network server determines that the opening time of the first network port to the network terminal reaches the access time limit in the port policy; the network server closes the access authority of the network terminal to the first network port.
- the first network port is closed when the preset access time limit of the network terminal is exceeded. In this way, the probability of the first network port being attacked is reduced, and the security of the first network port is increased.
- the method further includes: if the network server determines to disconnect the network connection from the network terminal, closing the first network port to the first network port. Access to a network port.
- the network terminal corresponding to the IP address disconnects the network connection
- the first network port is closed. In this way, after obtaining the IP address of the network terminal, a malicious attacker is prevented from attacking the first network port, thereby increasing the security of the first network port.
- an embodiment of the present invention provides a method for network terminal authentication, the method comprising:
- the network terminal sends a first access request to the network server, where the first access request includes an access authentication policy; the access authentication policy is used by the network server to determine a port matching the access authentication policy from the port policy record policy, and determine the first network port accessed by the network terminal according to the port policy; the network terminal sends a second access request to the network server, where the second access request is used to pass the first network
- the port obtains network services from the network server.
- the network terminal sends the first access request to the network server, so that the network server matches the port policy record according to the access authentication policy in the first access request to determine the matching port policy, which is further determined as the network server.
- the network server authenticates the access authentication policy in the first access request sent by the network terminal according to the port policy record, and matches the first network port.
- the present application can implement user authentication according to port policy records and access authentication policies when IP addresses change frequently, eliminating IP addresses and network services.
- the coupling of the end authentication mechanism increases the flexibility of accessing IP addresses; and ensures that the first network port is only open to users who have passed the authentication, thereby improving the security of the first network port.
- the network terminal before the first access request sent by the network terminal to the network server, it further includes:
- the network terminal acquires the port policy record published by the network service port.
- the network terminal obtains the port policy record published by the network service port.
- the network terminal can generate a corresponding access authentication policy according to the port policy and the network service to be acquired, and further, the network server can authenticate the network terminal.
- This ensures the security of network terminals accessing network services. Authenticate users in such a way that the pass-through policy matches. Eliminate the coupling between the IP address and the authentication mechanism of the network server, and increase the flexibility of accessing the IP address.
- an embodiment of the present invention provides an apparatus for user authentication, the apparatus comprising:
- a transceiver module configured to receive a first access request sent by a network terminal; the first access request carries an access authentication policy;
- a processing module configured to determine a port policy matching the access authentication policy from the port policy record; each of the port policies in the port policy record is used to open corresponding network ports;
- the processing module is further configured to determine the first network port accessed by the network terminal according to the port policy;
- the transceiver module is further configured to receive a second access request sent by the network terminal, where the second access request is used to obtain a network service through the first network port.
- an embodiment of the present invention provides an apparatus for user authentication, the apparatus comprising:
- a transceiver module configured to send a first access request to the network server, where the first access request includes an access authentication policy; the access authentication policy is used by the network server to determine from the port policy record and the access authentication policy matching port policy, and determining the first network port accessed by the network terminal according to the port policy;
- the transceiver module is further configured to send a second access request to the network server, where the second access request is used to obtain network services from the network server through the first network port.
- an embodiment of the present application further provides a computing device, including: a memory for storing a program; a processor for calling a program stored in the memory, and executing the first aspect and/or according to the obtained program The method described in various possible designs of the second aspect.
- embodiments of the present application further provide a computer-readable non-volatile storage medium, including a computer-readable program, when the computer reads and executes the computer-readable program, the computer is made to execute the first aspect and ⁇ or the method described in the various possible designs of the second aspect.
- FIG. 1 is a schematic structural diagram of a network terminal authentication provided by an embodiment of the present invention.
- FIG. 2 is a schematic flowchart of a method for network terminal authentication provided by an embodiment of the present invention
- FIG. 3 is a schematic flowchart of a method for network terminal authentication provided by an embodiment of the present invention.
- FIG. 4 is a schematic flowchart of a method for network terminal authentication provided by an embodiment of the present invention.
- FIG. 5 is a schematic diagram of a device for authentication of a network terminal according to an embodiment of the present invention.
- FIG. 6 is a schematic diagram of an apparatus for authentication of a network terminal according to an embodiment of the present invention.
- the network server 101 is provided with a port policy record for recording the port policy of each network port; the network server 101 records the port policy It is distributed to each legitimate network terminal 102 that is predetermined to allow access.
- the network terminal 103 in the network terminal 102 needs to obtain the network service from the network server 101, the port policy of the network service is determined according to the port policy record, and the first access request including the access authentication policy is generated according to the port policy, and the network terminal 103 sends the first access request to the network server 101 .
- the network server 101 searches for the matching port policy in the port policy record according to the access authentication policy in the first access request, and further obtains the first network port corresponding to the port policy according to the port policy that matches the access authentication policy.
- the first network port is open to the IP address of the access authentication request.
- the network terminal 103 sends a second access request to the network server 101 to obtain the network service.
- the first access request and the second access request may be two different access requests, or may be the same access request; for example, when the first access request and the second access request are the same access request, the access request
- the request may include an access authentication policy and related instructions and information for obtaining network services.
- the network server 101 determines the access authentication policy of the network terminal 103 according to the access authentication policy in the access request.
- the first network port provides network services to the network terminal 103 according to the relevant instructions and information for obtaining network services; the description methods for the first access request and the second access request in this application are only used to explain the technical solution more clearly, The specific form of the access request is not limited.
- the network server 101 may install a port policy script, which is used to generate different port policies corresponding to each network port, and to match the access authentication policies.
- a corresponding port policy acquisition script of the port policy script in the network server 101 can be installed in the network terminal 102, which is used to acquire a port policy record and generate an access authentication policy according to the port policy record.
- the specific implementation methods are not limited for the generation and matching of the port policy record of the network server 101 and the acquisition of the port policy record and the generation of the access authentication policy by the network terminal 102 .
- the network server 101 may include one or more network services, and each network server 101 may include the same network service or different network services, which is not specifically limited.
- an embodiment of the present application provides a flow of a method for network terminal authentication, as shown in FIG. 2 , including:
- Step 201 The network server receives a first access request sent by a network terminal; the first access request carries an access authentication policy;
- Step 202 the network server determines a port policy matching the access authentication policy from the port policy record; each port policy in the port policy record is used to open corresponding network ports;
- Step 203 the network server determines the first network port accessed by the network terminal according to the port policy
- Step 204 The network server receives a second access request sent by the network terminal, where the second access request is used to obtain a network service through the first network port.
- the network service may be a remote desktop service, a file transfer service, a virtual private network service, a web page service, etc., and the network service may be obtained through a first network port corresponding to the network service.
- the network terminal sends the first access request to the network server, and according to the access authentication policy in the first access request, the port policy record is matched to determine the matching port policy, and further determine the network that provides the network service for the network terminal. port.
- the network server authenticates the access authentication policy in the first access request sent by the network terminal according to the port policy record, and matches the first network port.
- the present application can implement user authentication according to port policy records and access authentication policies when IP addresses change frequently, eliminating IP addresses and network services.
- the coupling of the terminal authentication mechanism reduces the workload of staff and the cost of network terminal authentication, and increases the flexibility of accessing IP addresses; and ensures that the first network port is only open to authenticated users, improving the security of the first network port.
- the embodiment of the present application further provides a network port management method.
- the method further includes: the network server closes a second network port, where the second network port is Any port used to provide network services; the network server opens a third network port, and the third network port is used to capture and analyze malicious attack messages.
- the second network port is a network port that provides network services to the network terminal.
- the corresponding port of the virtual private network service is port 1723; the corresponding port of the web page service is port 80.
- the third network is used to capture and analyze malicious attack messages, such as network ports corresponding to the honeypot service.
- Honeypot service is a technology to deceive malicious attackers. By arranging hosts, network services or information as decoys, the attackers are induced to attack them, and the attacks are captured and analyzed. That is to say, before the network server receives the first access request from the network terminal, it closes the second network port for providing network services for the network terminal, and opens the third network port for deceiving the attacker, so as to prevent the attacker from attacking the network terminal.
- the second network port performs an attack to increase the security of the second network port. It should be noted here that if a network port can be used to provide network services and capture and analyze malicious attack messages, the network port can be closed as the second network port or opened as the third network port, depending on the requirements. set up.
- the embodiment of the present application also provides a method for generating a port policy record, where the port policy record is obtained in the following manner: the network server generates different port policies for each second network port; the network server generates a different port policy for each second network port; Each port policy is recorded in the port policy record; the port policy includes port information, preset parameters and access time limit; the preset parameters are used for matching with the access authentication policy.
- a port policy record can be recorded for different network ports, preset parameters such as ping (network diagnostic command) packets with different byte lengths, a string of characters corresponding to ID signs, etc., and access time, etc., as shown in the following table 1 shows:
- the network server generates different port policies for each second network port, so that there will be no network service confusion caused by matching multiple network ports for the same access authentication policy at the same time.
- the port information is set in the port policy, so that the network terminal can determine the port policy according to the port information of the network port of the network service to be obtained and the port information in the port policy; setting the preset parameters can make the network server according to the access authentication policy. Whether the preset parameters are included in it to determine whether the user is legitimate; set the access time limit to ensure the security of the network terminal accessing the network server and prevent the access time from being too long and increasing the risk of the network port being attacked.
- the preset parameter can be the length of the ping packet, which can confuse the attacker and make the attacker think that it is only a command used for network diagnosis and does not contain important information used for access authentication of the network port; Increase the security of network services.
- the network terminal generates the network diagnostic command according to the port policy, so that the number of bytes of the network diagnostic command matches the port policy, which is convenient for the subsequent network server to authenticate the network diagnostic command according to the port policy, and further increases the security of the network service. .
- An embodiment of the present application provides a method for a network terminal to obtain a port policy record.
- the method further includes: the network service port publishes the port policy record to the network terminal; or a port policy acquisition script is preinstalled in the network terminal. That is to say, the network terminal can obtain the port policy record by installing the port policy acquisition script on the network terminal.
- the file corresponding to the port policy acquisition script can be sent to the network terminal by means of secure email. It can also be sent through other secure channels, which is not specifically limited here.
- the port policy record is updated, the network terminal can actively obtain the update from the network server, or the network server can actively notify the network terminal to update, etc.
- the specific implementation method is not limited here.
- An embodiment of the present application further provides a network terminal authentication method, wherein the network server determines a first network port accessed by the network terminal according to the port policy, including: the first access request further includes the network The IP address of the terminal, before the network server provides network services for the network terminal through the first network port, the method further includes: configuring the first network port by the network server to add the first access request to the network server.
- the carried IP address of the network terminal is open. That is to say, the network server will only open and provide network services to the IP addresses of the network terminals that have passed the authentication.
- An implementation manner is provided here, that is, by adding a firewall to open only the IP addresses of the network terminals that have passed the authentication and provide network services, this implementation manner is only an example, and the specific implementation manner is not limited. In this way, the probability of the first network port being attacked can be reduced, and the security of the first network port can be increased.
- the embodiment of the present application further provides a user authentication method.
- the method further includes: the network server determines the opening time of the first network port to the network terminal. The access time limit in the port policy is reached; the network server closes the access authority of the network terminal to the first network port. For example, if the access time limit is one hour, after the network terminal sends the first access request and passes the authentication, the network server opens the first network port to the IP address of the network terminal, and can start timing from when the first network port is opened. , and the opening time reaches one hour, the first network port is closed.
- a non-response period may also be set, that is, after the access authority of the network terminal is closed, within a preset time, the first network port is not opened to the network terminal again.
- the present application also provides a method for authenticating a network terminal. After the network server provides a network service for the network terminal, the method further includes: the network server determines that the network connection is disconnected from the network terminal, and then closes the network connection. The access authority of the first network port to the first network port.
- an embodiment of the present application provides a flow of a method for network terminal authentication, as shown in FIG. 3 , including:
- Step 301 The network terminal sends a first access request to the network server, where the first access request includes an access authentication policy; the access authentication policy is used by the network server to determine from the port policy record and the access authentication policy. matching port policy, and determining the first network port accessed by the network terminal according to the port policy;
- Step 302 The network terminal sends a second access request to the network server, where the second access request is used to obtain a network service from the network server through the first network port.
- the network terminal sends the first access request to the network server, so that the network server matches the port policy record according to the access authentication policy in the first access request to determine the matching port policy, which is further determined as the network server.
- the network server authenticates the access authentication policy in the first access request sent by the network terminal according to the port policy record, and matches the first network port.
- the present application can implement user authentication according to port policy records and access authentication policies when IP addresses change frequently, eliminating IP addresses and network services.
- the coupling of the end authentication mechanism increases the flexibility of accessing IP addresses; and ensures that the first network port is only open to users who have passed the authentication, thereby improving the security of the first network port.
- an embodiment of the present application provides a process of a network terminal authentication method, as shown in FIG. 4 , including:
- Step 401 The network server closes all second network ports used to provide network services for the network terminal, and opens a third network port used to deceive attackers.
- Step 402 Different port policies may be generated for all the second network ports, or some second network ports may be selected to generate different port policies, and the port policy records of each second network port may be recorded to obtain port policy records.
- the selection of the second network port can be determined according to the requirements of the network terminal and the security consideration of the second network port, and the port policy can be configured.
- a corresponding port policy can be generated for the network port 1723 of the VPN (Virtual Private Network) service, as shown in Table 2:
- the corresponding port policy can be generated for the network port 8080 of the Web (web page) service, as shown in Table 3:
- Step 403 Set the access time limit for the selected second network port respectively.
- the access time limit set for the network port of the VPN service is 12h
- the access time limit set for the network port of the Web service is ⁇ .
- the access time limit can be correspondingly added to the port policy of the VPN network port and the Web network port, such as the access time limit shown in Table 2 and Table 3 in the above example.
- Step 404 The network terminal 1 is a legal user identified by the network server, which can be determined by a working technician or a corresponding program of the network server, etc., then send the port policy acquisition script to the network terminal 1, so that the network terminal 1 can Obtain the port policy record according to the port policy obtaining script.
- Step 406 The network server receives the first access request sent by the network terminal 1, obtains the access authentication policy in the first access request, matches the port policy record according to the access authentication policy, determines the first network port, and assigns the first network port to the first network port.
- the port is opened to the IP address of the network terminal 1 .
- the network server parses the monitored ICMP protocol data packets, and obtains the source IP address (1.1.1.1) of the network terminal 1 and the ping packet length.
- the ping packet length That is, if 12345 bytes match the port policy record, and it is determined that the port policy with a ping packet length of 12345 bytes belongs to the VPN network port, it is determined as a valid request; if it is determined that the ping packet length of 12345 bytes does not match the port policy, it is determined as Invalid request.
- Step 407 If the network server determines that the first access request of the network terminal 1 is an invalid request, the request is ignored. If the network terminal 1 passes the authentication, the first network port is opened to the IP address of the network terminal 1 . In the above example, the VPN network port or the Web network port is opened to the IP address (1.1.1.1) of the network terminal 1 .
- Step 408 The network terminal 1 generates a second access request to obtain the network service.
- the network terminal 1 generates the second access request to obtain the VPN network service or the Web network service.
- Step 409 The network server receives the second access request, and provides network services for the network terminal 1 through the first network port.
- the network server receives the second access request, and provides the network terminal 1 with a VPN network service or a Web network service through a VPN network port or a Web network port.
- Step 410 the network terminal 2 generates an access request and sends it to the network server, but because the network terminal 2 does not have a port policy record granted by the network server, and all second network ports of the network server are in a closed state for the network terminal 2, then the network Terminal 2 cannot successfully access the second network port of the network server. And because all second network ports are closed for network terminal 2, network terminal 2 cannot access the second network using automatic scanning tools such as Nmap (that is, Network Mapper, which is the earliest network scanning and sniffing toolkit under Linux). network port.
- Nmap that is, Network Mapper, which is the earliest network scanning and sniffing toolkit under Linux.
- Step 411 the network server determines that the access time limit of the first network port accessed by the network terminal 1 has expired according to the port policy record, and then revokes the access right to the IP address of the network terminal 1 . Or when the IP address of the network terminal 1 is disconnected from the network, the access authority to the IP address of the network terminal 1 is revoked.
- the network terminal 1 accesses the VPN network port
- the access authority to the IP address of the network terminal 1 is revoked; or the network terminal 1 When the access is less than 12 hours, but the network is disconnected, the access authority to the IP address of the network terminal 1 is revoked.
- the network terminal 1 accesses the Web network port, and the network server determines that the current IP address corresponding to the network terminal 1 has no access time limit, then the IP address corresponding to the network terminal 1 will not be disconnected from the network, and the IP address of the network terminal 1 will not be revoked. access to the address.
- Step 412 the port policy in the port policy record of the network server is modified, or a new port policy of the second network port is added.
- Step 413 The network terminal 1 acquires the updated port policy record.
- step 410 may occur before or after any one of the above process steps except step 401 .
- FIG. 5 is a schematic diagram of a network terminal authentication apparatus provided by an embodiment of the application, as shown in FIG. 5 , including:
- a transceiver module 501 configured to receive a first access request sent by a network terminal; the first access request carries an access authentication policy;
- a processing module 502 configured to determine a port policy matching the access authentication policy from the port policy record; each port policy in the port policy record is used to open corresponding network ports;
- the processing module 502 is further configured to determine the first network port accessed by the network terminal according to the port policy;
- the transceiver module 501 is further configured to receive a second access request sent by the network terminal, where the second access request is used to obtain network services through the first network port.
- processing module 502 is further configured to: close the second network port, the second network port is any port used for providing network services; open the third network port, the third network port Used to capture and analyze malicious attack messages.
- the processing module 502 is further configured to: generate different port policies for each second network port; record each port policy in the port policy record; the port policy includes port information, preset parameters and Access time limit; the preset parameter is used for matching with the access authentication policy.
- the processing module 502 is further configured to: publish the port policy record to the network terminal; or preinstall a port policy acquisition script in the network terminal.
- the processing module 502 is specifically configured to: the first access request further includes the IP address of the network terminal, and the network server provides network services for the network terminal through the first network port Before, the method further includes: configuring, by the network server, the first network port to be open to the IP address of the network terminal carried in the first access request.
- the processing module 502 is further configured to: determine that the opening time of the first network port to the network terminal reaches the access time limit in the port policy; access permission.
- processing module 502 is further configured to: determine that the network connection is disconnected from the network terminal, and then close the access authority of the first network port to the first network port.
- FIG. 6 is a schematic diagram of a network terminal authentication apparatus provided by an embodiment of the application, as shown in FIG. 6 , including:
- Transceiver module 601 configured to send a first access request to a network server, where the first access request includes an access authentication policy; the access authentication policy is used by the network server to determine from the port policy record and the access authentication policy a port policy matching the policy, and determining the first network port accessed by the network terminal according to the port policy;
- the transceiver module 601 is further configured to send a second access request to the network server, where the second access request is used to obtain network services from the network server through the first network port.
- the transceiver module 601 is also used for:
- the network terminal acquires the port policy record published by the network service port.
- the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
- computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
- These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions
- the apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Business, Economics & Management (AREA)
- Accounting & Taxation (AREA)
- Computer Security & Cryptography (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
本发明实施例提供一种网络终端认证的方法及装置，该方法包括：网络服务端接收网络终端发送的第一访问请求；第一访问请求中携带访问认证策略；网络服务端从端口策略记录中，确定与访问认证策略匹配的端口策略；端口策略记录中的各端口策略用于开启对应的各网络端口；网络服务端根据端口策略确定网络终端访问的第一网络端口；网络服务端接收网络终端发送的第二访问请求，第二访问请求用于通过第一网络端口获取网络服务。本申请可以实现在IP地址频繁变化的情况下，根据端口策略记录以及访问认证策略对用户进行认证，消除IP地址与网络服务端认证机制的耦合，增加访问IP地址的灵活性；提高第一网络端口的安全性。
Description
相关申请的交叉引用
本申请要求在2020年09月11日提交中国专利局、申请号为202010954007.2、申请名称为“一种网络终端认证的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
本申请涉及网络技术领域，尤其涉及一种网络终端认证的方法及装置。
在网络安全攻防演练以及实际的网络攻击场景中，大多数攻击者会在第一步的信息搜集阶段，使用Nmap(Network Mapper，网络扫描)等工具对拟攻击目标主机进行端口扫描，获取该主机IP地址中的所有开放的网络端口，进而实现进一步的攻击操作。例如，攻击者可能会通过自动化工具扫描网络端口，以获取MySQL等开放的网络端口对应的网络服务；如果此时，网络端口存在弱密码等安全隐患，则将造成数据泄露、主机损坏等严重的安全事故。因此，现有技术中通过在主机的防火墙中设置对应网络端口允许访问的IP地址白名单，当确定用户的IP地址属于白名单中的IP地址，则允许该用户访问该网络端口，并为该用户提供该网络端口对应的网络服务；否则，不对该用户开放网络端口；如此，实现对访问用户的权限控制。但上述方法在IP地址发生变化时，则需要修改IP地址白名单，尤其是IP地址频繁变化，将导致IP地址白名单频繁修改。
因此，现在亟需一种网络终端认证的方法及装置，能够消除IP地址与网络服务端认证机制的耦合，增加访问IP地址的灵活性，并提高网络端口的安全性。
发明内容
本发明实施例提供一种网络终端认证的方法及装置，能够消除IP地址与网络服务端认证机制的耦合，增加访问IP地址的灵活性，并提高网络端口的安全性。
第一方面，本发明实施例提供一种网络终端认证的方法，该方法包括：
网络服务端接收网络终端发送的第一访问请求；所述第一访问请求中携带访问认证策略；所述网络服务端从端口策略记录中，确定与所述访问认证策略匹配的端口策略；所述端口策略记录中的各所述端口策略用于开启对应的各网络端口；所述网络服务端根据所述端口策略确定所述网络终端访问的第一网络端口；所述网络服务端接收所述网络终端发送的第二访问请求，所述第二访问请求用于通过所述第一网络端口获取网络服务。
上述方法中，网络终端发送第一访问请求至网络服务端，根据第一访问请求中的访问认证策略，匹配端口策略记录，以确定与其匹配的端口策略，进一步确定为网络终端提供网络服务的网络端口。如此，网络服务端根据端口策略记录对网络终端发送的第一访问请求中的访问认证策略进行认证，以及匹配第一网络端口。相比于现有技术中通过IP地址白名单对访问用户进行控制，本申请可以实现在IP地址频繁变化的情况下，根据端口策略记录以及访问认证策略对用户进行认证，消除IP地址与网络服务端认证机制的耦合，增加访问IP地址的灵活性；并保证第一网络端口只针对认证通过的用户开放，提高第一网络端口的安全性。
可选的，网络服务端接收网络终端发送的第一访问请求之前，还包括：所述网络服务端将第二网络端口关闭，所述第二网络端口为用于提供网络服务的任一端口；所述网络服务端将第三网络端口开放，所述第三网络端口用于捕捉并分析恶意攻击消息。
上述方法中，网络服务端将用于提供网络服务的第二网络端口关闭，防止第二网络端口在开放状态，任何人都能访问该第二网络端口而造成被恶意攻击，增加第二网络端口的安全性。并将用于捕捉并分析恶意攻击消息的第 三网络端口开放，由此，通过第三网络端口实现对攻击行为的防御，提高网络服务端的防御恶意攻击能力。
可选的，所述端口策略记录通过如下方式得到：所述网络服务端为各第二网络端口分别生成不同的端口策略；所述网络服务端将各端口策略记录在端口策略记录中；所述端口策略中包括端口信息、预设参数及访问时效；所述预设参数用于与访问认证策略进行匹配。
上述方法中，为各个第二网络端口分别生成不同端口策略；并记录在端口策略记录中。如此，实现在接收网络终端的第一访问请求时，对第一访问请求中的访问认证策略进行认证，获得和该访问认证策略一一对应的网络端口，不会出现对于同一个访问认证策略同时匹配多个网络端口而造成的网络服务混乱的情况。以及在端口策略中设置端口信息，以确定网络终端访问网络服务端的准确性；设置预设参数，以保证网络终端访问时进行访问认证策略和端口策略的匹配精确性；设置访问时效，以保证网络终端访问网络服务端的安全性，防止访问时间过长，增加该网络端口的被攻击风险。并且，通过策略匹配的方式对用户进行认证。消除IP地址与网络服务端认证机制的耦合，增加访问IP地址的灵活性。
可选的，网络服务端接收网络终端发送的第一访问请求之前，还包括：
所述网络服务端口将所述端口策略记录发布至所述网络终端；或所述网络终端中预装有端口策略获取脚本。
上述方法中，将包含各个网络端口的端口策略的端口策略记录发布至网络终端，或者网络终端预安装有端口策略获取脚本。以使得网络终端可以根据端口策略和所要获取的网络服务生成对应的访问认证策略，进一步，使得网络服务端对该网络终端进行认证。保证了网络终端访问网络服务的安全性。以使通过策略匹配的方式对用户进行认证。消除IP地址与网络服务端认证机制的耦合，增加访问IP地址的灵活性。
可选的，所述网络服务端根据所述端口策略确定所述网络终端访问的第一网络端口，包括：
所述第一访问请求中还包括所述网络终端的IP地址，所述网络服务端通过所述第一网络端口为所述网络终端提供网络服务之前，还包括：所述网络服务端将所述第一网络端口向所述第一访问请求中携带的所述网络终端的IP地址开放。
上述方法中，通过将网络服务端的第一网络端口配置为向第一访问请求中携带的网络终端的IP地址开放，实现第一网络端口有针对性的开放，并为该网络终端提供网络服务。也即，第一网络端口针对性的向第一访问请求中携带的网络终端的IP地址开放；保证第一网络端口只向认证后，确定合法的用户开放，保证第一网络端口的安全性。降低第一网络端口被攻击的几率，增加第一网络端口的安全性。
可选的，所述网络服务端为所述网络终端提供网络服务之后，还包括：
所述网络服务端确定所述第一网络端口向所述网络终端开放时间到达所述端口策略中的访问时效；所述网络服务端关闭所述网络终端对所述第一网络端口的访问权限。
上述方法中，超过预设的网络终端的访问时效，则关闭第一网络端口。如此，降低第一网络端口被攻击的几率，增加第一网络端口的安全性。
可选的，所述网络服务端为所述网络终端提供网络服务之后，还包括：所述网络服务端确定与所述网络终端断开网络连接，则关闭所述第一网络端口对所述第一网络端口的访问权限。
上述方法中，IP地址对应的网络终端断开网络连接，则关闭第一网络端口。如此，防止恶意攻击者获取该网络终端的IP地址后，攻击第一网络端口，增加第一网络端口的安全性。
第二方面，本发明实施例提供一种网络终端认证的方法，该方法包括：
网络终端向网络服务端发送第一访问请求，所述第一访问请求中包括访问认证策略；所述访问认证策略用于网络服务端从端口策略记录中确定出与所述访问认证策略匹配的端口策略，并根据所述端口策略确定所述网络终端访问的第一网络端口；所述网络终端向所述网络服务端发送第二访问请求， 所述第二访问请求用于通过所述第一网络端口从所述网络服务端获取网络服务。
上述方法中，网络终端发送第一访问请求至网络服务端，以使的网络服务端根据第一访问请求中的访问认证策略，匹配端口策略记录，以确定与其匹配的端口策略，进一步确定为网络终端提供网络服务的网络端口。如此，网络服务端根据端口策略记录对网络终端发送的第一访问请求中的访问认证策略进行认证，以及匹配第一网络端口。相比于现有技术中通过IP地址白名单对访问用户进行控制，本申请可以实现在IP地址频繁变化的情况下，根据端口策略记录以及访问认证策略对用户进行认证，消除IP地址与网络服务端认证机制的耦合，增加访问IP地址的灵活性；并保证第一网络端口只针对认证通过的用户开放，提高第一网络端口的安全性。
可选的，网络终端向网络服务端发送的第一访问请求之前，还包括：
所述网络终端获取所述网络服务端口发布的端口策略记录。
上述方法中，网络终端获取网络服务端口发布的端口策略记录。以使得网络终端可以根据端口策略和所要获取的网络服务生成对应的访问认证策略，进一步，使得网络服务端对该网络终端进行认证。保证了网络终端访问网络服务的安全性。以使通过策略匹配的方式对用户进行认证。消除IP地址与网络服务端认证机制的耦合，增加访问IP地址的灵活性。
第三方面，本发明实施例提供一种用户认证的装置，所述装置包括：
收发模块，用于接收网络终端发送的第一访问请求；所述第一访问请求中携带访问认证策略；
处理模块，用于从端口策略记录中，确定与所述访问认证策略匹配的端口策略；所述端口策略记录中的各所述端口策略用于开启对应的各网络端口；
所述处理模块还用于，根据所述端口策略确定所述网络终端访问的第一网络端口；
所述收发模块还用于，接收所述网络终端发送的第二访问请求，所述第二访问请求用于通过所述第一网络端口获取网络服务。
第四方面，本发明实施例提供一种用户认证的装置，所述装置包括：
收发模块，用于向网络服务端发送第一访问请求，所述第一访问请求中包括访问认证策略；所述访问认证策略用于网络服务端从端口策略记录中确定出与所述访问认证策略匹配的端口策略，并根据所述端口策略确定所述网络终端访问的第一网络端口；
所述收发模块还用于，向所述网络服务端发送第二访问请求，所述第二访问请求用于通过所述第一网络端口从所述网络服务端获取网络服务。
第五方面，本申请实施例还提供一种计算设备，包括：存储器，用于存储程序；处理器，用于调用所述存储器中存储的程序，按照获得的程序执行如第一方面和\或第二方面的各种可能的设计中所述的方法。
第六方面，本申请实施例还提供一种计算机可读非易失性存储介质，包括计算机可读程序，当计算机读取并执行所述计算机可读程序时，使得计算机执行如第一方面和\或第二方面的各种可能的设计中所述的方法。
本申请的这些实现方式或其他实现方式在以下实施例的描述中会更加简明易懂。
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种网络终端认证的架构示意图；
图2为本发明实施例提供的一种网络终端认证的方法的流程示意图；
图3为本发明实施例提供的一种网络终端认证的方法的流程示意图；
图4为本发明实施例提供的一种网络终端认证的方法的流程示意图；
图5为本发明实施例提供的一种网络终端认证的装置示意图；
图6为本发明实施例提供的一种网络终端认证的装置示意图。
为了使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明作进一步地详细描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
如图1所示，为本发明实施例提供的一种网络终端认证的系统架构，网络服务端101中设置有记录各个网络端口的端口策略的端口策略记录；网络服务端101将该端口策略记录发布至各预先确定允许访问的合法网络终端102。当网络终端102中的网络终端103需要从网络服务端101获取网络服务时，则根据端口策略记录确定该网络服务的端口策略，根据该端口策略生成包含访问认证策略的第一访问请求，网络终端103将该第一访问请求发送至网络服务端101。网络服务端101根据第一访问请求中的访问认证策略查找端口策略记录中与其匹配的端口策略，进一步根据查找到与访问认证策略匹配的端口策略，获取对应该端口策略的第一网络端口，将该第一网络端口向该访问认证请求的IP地址开放。网络终端103向网络服务端101发送第二访问请求，以获取网络服务。其中，第一访问请求和第二访问请求可以为两个不同的访问请求，也可以为同一个访问请求；如，当第一访问请求和第二访问请求为同一个访问请求时，则该访问请求中可以包含访问认证策略和用于获取网络服务的相关指令及信息，相应的，网络服务端101在接收到该访问请求后，根据该访问请求中的访问认证策略确定该网络终端103访问的第一网络端口，根据用于获取网络服务的相关指令及信息向该网络终端103提供网络服务；本申请对于第一访问请求和第二访问请求的说明方式只用于更清楚的阐述技术方案，并不对访问请求的具体形式做限定。网络服务端101可以安装端口策略脚本，用于生成各个网络端口对应的不同的端口策略，以及对访问认证策略进行匹配等。网络终端102中可以安装网络服务端101中的端口策略脚本的对应的端口策略获取脚本，用于获取端口策略记录以及根据端口策略记 录生成访问认证策略等。这里只是提供一种可实施例，对于网络服务端101端口策略记录的生成与匹配，以及网络终端102的获取端口策略记录以及访问认证策略的生成，具体实现方式不做限定。网络服务端101可以存在多个，网络服务端101中可以包含一个或多个网络服务，各网络服务端101中可以包含相同的网络服务或不同的网络服务，具体不做限定。
基于此，本申请实施例提供了一种网络终端认证的方法的流程，如图2所示，包括：
步骤201、网络服务端接收网络终端发送的第一访问请求；所述第一访问请求中携带访问认证策略；
步骤202、所述网络服务端从端口策略记录中，确定与所述访问认证策略匹配的端口策略；所述端口策略记录中的各所述端口策略用于开启对应的各网络端口；
步骤203、所述网络服务端根据所述端口策略确定所述网络终端访问的第一网络端口；
步骤204、所述网络服务端接收所述网络终端发送的第二访问请求，所述第二访问请求用于通过所述第一网络端口获取网络服务。
此处，网络服务可以为远程桌面服务、文件传输服务、虚拟专用网络服务、网页服务等等，网络服务可以通过该网络服务对应的第一网络端口获取。
上述方法中，网络终端发送第一访问请求至网络服务端，根据第一访问请求中的访问认证策略，匹配端口策略记录，以确定与其匹配的端口策略，进一步确定为网络终端提供网络服务的网络端口。如此，网络服务端根据端口策略记录对网络终端发送的第一访问请求中的访问认证策略进行认证，以及匹配第一网络端口。相比于现有技术中通过IP地址白名单对访问用户进行控制，本申请可以实现在IP地址频繁变化的情况下，根据端口策略记录以及访问认证策略对用户进行认证，消除IP地址与网络服务端认证机制的耦合，降低工作人员工作量以及降低网络终端认证的成本，增加访问IP地址的灵活性；并保证第一网络端口只针对认证通过的用户开放，提高第一网络端口的 安全性。
本申请实施例还提供了一种网络端口管理方法，网络服务端接收网络终端发送的第一访问请求之前，还包括：所述网络服务端将第二网络端口关闭，所述第二网络端口为用于提供网络服务的任一端口；所述网络服务端将第三网络端口开放，所述第三网络端口用于捕捉并分析恶意攻击消息。
此处，第二网络端口为向网络终端提供网络服务的网络端口。例如，虚拟专用网络服务的对应端口为1723端口；网页服务的对应端口为80端口。第三网络用于捕捉并分析恶意攻击消息，如，蜜罐服务对应的网络端口。蜜罐服务是一种对恶意攻击方进行欺骗的技术，通过布置作为诱饵的主机、网络服务或信息，诱使攻击方对其进行攻击，并对该攻击进行抓捕和分析。也就是说，在网络服务端接收网络终端的第一访问请求之前，将用于为网络终端提供网络服务的第二网络端口关闭，而开启欺骗攻击者的第三网络端口，以防止攻击者对第二网络端口进行攻击，增加第二网络端口的安全性。这里需要说明的是，若一网络端口即可用于提供网络服务又可用于捕捉并分析恶意攻击消息，则该网络端口可以作为第二网络端口关闭，也可作为第三网络端口开启，具体根据需求设定。
本申请实施例还提供了一种端口策略记录的生成方法，所述端口策略记录通过如下方式得到：所述网络服务端为各第二网络端口分别生成不同的端口策略；所述网络服务端将各端口策略记录在端口策略记录中；所述端口策略中包括端口信息、预设参数及访问时效；所述预设参数用于与访问认证策略进行匹配。例如，一种端口策略记录可以分别为不同的网络端口，预设不同字节长度的ping(网络诊断命令)包、ID标志等对应的一串字符等预设参数，以及访问时效等，如下表1所示：
表1
以上方法中，网络服务端为各第二网络端口分别生成不同的端口策略，如此，不会出现对于同一个访问认证策略同时匹配多个网络端口而造成的网络服务混乱的情况。端口策略中设置端口信息，以使得网络终端可以根据要获取的网络服务的网络端口的端口信息，以及端口策略中的端口信息确定端口策略；设置预设参数，可以使得网络服务端根据访问认证策略中是否包含预设参数以确定该用户是否合法；设置访问时效，以保证网络终端访问网络服务端的安全性，防止访问时间过长，增加该网络端口的被攻击风险。另外，上述示例中，预设参数可以是ping包的长度，如此，可以迷惑攻击者，令攻击者认为其只是一个用于网络诊断的命令，不包含用于网络端口的访问认证的重要信息；增加网络服务的安全性。且网络终端根据端口策略生成该网络诊断命令，使得该网络诊断命令的字节数匹配该端口策略，便于后续网络服务端根据该端口策略对该网络诊断命令进行认证，进一步增加网络服务的安全性。
本申请实施例提供了一种网络终端获取端口策略记录的方法，网络服务端接收网络终端发送的第一访问请求之前，还包括：所述网络服务端口将所述端口策略记录发布至所述网络终端；或所述网络终端中预装有端口策略获取脚本。也就是说，网络终端获取端口策略记录可以通过在网络终端安装端口策略获取脚本实现，这里为了保证网络终端的合法性，可以通过安全邮件的方式，发送端口策略获取脚本对应的文件到网络终端，也可以通过其他安全通道发送，这里具体不做限定。当端口策略记录发生更新，则可以由网络终端主动从网络服务端获取更新，或者由网络服务端主动通知网络终端更新 等方式，这里具体实现方式不做限定。
本申请实施例还提供了一种网络终端认证方法，所述网络服务端根据所述端口策略确定所述网络终端访问的第一网络端口，包括：所述第一访问请求中还包括所述网络终端的IP地址，所述网络服务端通过所述第一网络端口为所述网络终端提供网络服务之前，还包括：所述网络服务端配置所述第一网络端口向所述第一访问请求中携带的所述网络终端的IP地址开放。也就是说，网络服务端只会对通过认证的网络终端的IP地址开放且提供网络服务。这里提供一种实现方式，即，通过添加防火墙以实现只对通过认证的网络终端的IP地址开放且提供网络服务，该种实现方式只作为一种示例，具体实现方式不做限定。如此可以降低第一网络端口被攻击的几率，增加第一网络端口的安全性。
本申请实施例还提供了一种用户认证方法，所述网络服务端为所述网络终端提供网络服务之后，还包括：所述网络服务端确定所述第一网络端口向所述网络终端开放时间到达所述端口策略中的访问时效；所述网络服务端关闭所述网络终端对所述第一网络端口的访问权限。例如，若访问时效为一小时，则网络终端发送第一访问请求认证通过后，网络服务端将第一网络端口针对该网络终端的IP地址开放，且可以从该第一网络端口开放时开始计时，开放时间达到一小时，则将该第一网络端口关闭。还可以设置一种非应答期，即，用于在网络终端访问权限关闭后，在预设时间内，不对该网络终端再次开放第一网络端口。
本申请还提供了一种网络终端认证方法，所述网络服务端为所述网络终端提供网络服务之后，还包括：所述网络服务端确定与所述网络终端断开网络连接，则关闭所述第一网络端口对所述第一网络端口的访问权限。
基于此，本申请实施例提供了一种网络终端认证的方法的流程，如图3所示，包括：
步骤301、网络终端向网络服务端发送第一访问请求，所述第一访问请求中包括访问认证策略；所述访问认证策略用于网络服务端从端口策略记录中 确定出与所述访问认证策略匹配的端口策略，并根据所述端口策略确定所述网络终端访问的第一网络端口；
步骤302、所述网络终端向所述网络服务端发送第二访问请求，所述第二访问请求用于通过所述第一网络端口从所述网络服务端获取网络服务。
上述方法中，网络终端发送第一访问请求至网络服务端，以使的网络服务端根据第一访问请求中的访问认证策略，匹配端口策略记录，以确定与其匹配的端口策略，进一步确定为网络终端提供网络服务的网络端口。如此，网络服务端根据端口策略记录对网络终端发送的第一访问请求中的访问认证策略进行认证，以及匹配第一网络端口。相比于现有技术中通过IP地址白名单对访问用户进行控制，本申请可以实现在IP地址频繁变化的情况下，根据端口策略记录以及访问认证策略对用户进行认证，消除IP地址与网络服务端认证机制的耦合，增加访问IP地址的灵活性；并保证第一网络端口只针对认证通过的用户开放，提高第一网络端口的安全性。
基于上述流程，本申请实施例提供了一种网络终端认证方法的流程，如图4所示，包括：
步骤401、网络服务端将所有用于为网络终端提供网络服务的第二网络端口关闭，并开启用于欺骗攻击者的第三网络端口。
步骤402、可以为所有第二网络端口对应生成不同的端口策略，或者选取部分第二网络端口对应生成不同的端口策略，并将各个第二网络端口的端口策略记录得到端口策略记录。这里可以根据网络终端需求以及第二网络端口的安全性考量，来确定第二网络端口的选取，并进行端口策略的配置。例如，可以为VPN(虚拟专用网络)服务的网络端口1723生成对应的端口策略，如表2所示：
表2
可以为Web(网页)服务的网络端口8080生成对应的端口策略，如表3所示：
表3
步骤403、分别为选取的第二网络端口设置访问时效，如，为VPN服务的网络端口设置的访问时效为12h，Web服务的网络端口设置的访问时效为∞。可以将访问时效对应添加到VPN网络端口和Web网络端口的端口策略中，如上述示例中的表2和表3中所示的访问时效。
步骤404、网络终端1为网络服务端认定的合法用户，可以为工作技术人员或者网络服务端相应的程序等确定的，则将端口策略获取脚本发送至网络终端1中，以使得网络终端1可以根据该端口策略获取脚本获取端口策略记录。
步骤405、网络终端1根据获取的端口策略记录生成第一访问请求，并使得第一访问请求中包含，网络终端1要访问的第一网络端口的端口策略对应的访问认证策略；在上述示例中，若第一网络端口为VPN网络端口：1723端口，第一访问请求可以为ping包，且ping包的长度为12345字节，所访问的网络服务端的IP地址为2.2.2.2。若第一网络端口为Web网络端口：8080端口，第一访问请求可以为HTTP请求，且HTTP请求中携带POST参数id＝9a6b3c0d，所访问的网络服务端的IP地址为2.2.2.2。
步骤406、网络服务端接收到网络终端1发送的第一访问请求，获取第一访问请求中的访问认证策略，并根据访问认证策略匹配端口策略记录，确定第一网络端口，并将第一网络端口向该网络终端1的IP地址开启。在上述示例中，当第一网络端口为VPN网络端口：网络服务端解析监听到的ICMP协议数据包，获取网络终端1的源IP地址(1.1.1.1)和ping包长度，根据ping包长度，即，12345字节匹配端口策略记录，确定ping包长度为12345字节 的端口策略属于VPN网络端口，则判定为有效请求；若确定ping包长度为12345字节匹配不到端口策略，则判定为无效请求。
当第一网络端口为Web网络端口：解析监听到的HTTP请求，获取源IP地址(1.1.1.1)和POST参数id＝9a6b3c0d，根据POST参数id＝9a6b3c0d匹配端口策略记录，确定POST参数为id＝9a6b3c0d的端口策略属于Web网络端口，则判定为有效请求；若确定POST参数为id＝9a6b3c0d匹配不到端口策略，则判定为无效请求。
步骤407、若网络服务端确定网络终端1的第一访问请求为无效请求，则忽略该请求。若该网络终端1认证通过后，则将第一网络端口向网络终端1的IP地址开启。在上述示例中，将VPN网络端口或Web网络端口向网络终端1的IP地址(1.1.1.1)开启。
步骤408、网络终端1生成第二访问请求以获取网络服务。在上述示例中，网络终端1生成第二访问请求以获取VPN网络服务或Web网络服务。
步骤409、网络服务端接收到第二访问请求，通过第一网络端口为该网络终端1提供网络服务。在上述示例中，网络服务端接收到第二访问请求，通过VPN网络端口或Web网络端口为该网络终端1提供VPN网络服务或Web网络服务。
步骤410、网络终端2生成访问请求发送至网络服务端，但由于网络终端2没有网络服务端授予的端口策略记录，且网络服务端的所有第二网络端口对于网络终端2皆处于关闭状态，则网络终端2无法成功访问网络服务端的第二网络端口。并且由于所有第二网络端口对于网络终端2皆处于关闭状态，网络终端2使用Nmap(也就是Network Mapper，最早是Linux下的网络扫描和嗅探工具包)等自动化扫描工具，也无法访问第二网络端口。
步骤411、网络服务端根据端口策略记录确定网络终端1所访问的第一网络端口的访问时效已到，则撤销对该网络终端1的IP地址的访问权限。或者网络终端1的IP地址发生网络断开，则撤销对该网络终端1的IP地址的访问权限。
在上述示例中，若网络终端1访问VPN网络端口，若网络服务端确定当前网络终端1对应的IP地址已经访问满12h，则撤销对该网络终端1的IP地址的访问权限；或者网络终端1在访问未满12h，但发生网络断开，则撤销对该网络终端1的IP地址的访问权限。或网络终端1访问Web网络端口，网络服务端确定当前网络终端1对应的IP地址没有访问时间限制，则网络终端1对应的IP地址不发生网络断开，不会撤销对该网络终端1的IP地址的访问权限。
步骤412、网络服务端的端口策略记录中的端口策略有发生修改，或者增加新的第二网络端口的端口策略。
步骤413、网络终端1获取更新后的端口策略记录。
这里需要说明的是，上述流程步骤并不唯一，如步骤410可以在除步骤401以外的上述流程步骤的任意一个流程步骤前或流程步骤后发生。
基于同样的构思，本发明实施例提供一种网络终端认证装置，图5为本申请实施例提供的一种网络终端认证装置示意图，如图5示，包括：
收发模块501，用于接收网络终端发送的第一访问请求；所述第一访问请求中携带访问认证策略；
处理模块502，用于从端口策略记录中，确定与所述访问认证策略匹配的端口策略；所述端口策略记录中的各所述端口策略用于开启对应的各网络端口；
所述处理模块502还用于，根据所述端口策略确定所述网络终端访问的第一网络端口；
所述收发模块501还用于，接收所述网络终端发送的第二访问请求，所述第二访问请求用于通过所述第一网络端口获取网络服务。
可选的，所述处理模块502还用于：将第二网络端口关闭，所述第二网络端口为用于提供网络服务的任一端口；将第三网络端口开放，所述第三网络端口用于捕捉并分析恶意攻击消息。
可选的，所述处理模块502还用于：为各第二网络端口分别生成不同的 端口策略；将各端口策略记录在端口策略记录中；所述端口策略中包括端口信息、预设参数及访问时效；所述预设参数用于与访问认证策略进行匹配。
可选的，所述处理模块502还用于：将所述端口策略记录发布至所述网络终端；或所述网络终端中预装有端口策略获取脚本。
可选的，所述处理模块502具体用于：所述第一访问请求中还包括所述网络终端的IP地址，所述网络服务端通过所述第一网络端口为所述网络终端提供网络服务之前，还包括：所述网络服务端配置所述第一网络端口向所述第一访问请求中携带的所述网络终端的IP地址开放。
可选的，所述处理模块502还用于：确定所述第一网络端口向所述网络终端开放时间到达所述端口策略中的访问时效；关闭所述网络终端对所述第一网络端口的访问权限。
可选的，所述处理模块502还用于：确定与所述网络终端断开网络连接，则关闭所述第一网络端口对所述第一网络端口的访问权限。
基于同样的构思，本发明实施例提供一种网络终端认证装置，图6为本申请实施例提供的一种网络终端认证装置示意图，如图6示，包括：
收发模块601，用于向网络服务端发送第一访问请求，所述第一访问请求中包括访问认证策略；所述访问认证策略用于网络服务端从端口策略记录中确定出与所述访问认证策略匹配的端口策略，并根据所述端口策略确定所述网络终端访问的第一网络端口；
所述收发模块601还用于，向所述网络服务端发送第二访问请求，所述第二访问请求用于通过所述第一网络端口从所述网络服务端获取网络服务。
可选的，所述收发模块601还用于：
所述网络终端获取所述网络服务端口发布的端口策略记录。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘 存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。
Claims (13)
- 一种网络终端认证的方法，其特征在于，所述方法包括：网络服务端接收网络终端发送的第一访问请求；所述第一访问请求中携带访问认证策略；所述网络服务端从端口策略记录中，确定与所述访问认证策略匹配的端口策略；所述端口策略记录中的各所述端口策略用于开启对应的各网络端口；所述网络服务端根据所述端口策略确定所述网络终端访问的第一网络端口；所述网络服务端接收所述网络终端发送的第二访问请求，所述第二访问请求用于通过所述第一网络端口获取网络服务。
- 如权利要求1所述的方法，其特征在于，网络服务端接收网络终端发送的第一访问请求之前，还包括：所述网络服务端将第二网络端口关闭，所述第二网络端口为用于提供网络服务的任一端口；所述网络服务端将第三网络端口开放，所述第三网络端口用于捕捉并分析恶意攻击消息。
- 如权利要求1所述的方法，其特征在于，所述端口策略记录通过如下方式得到：所述网络服务端为各第二网络端口分别生成不同的端口策略；所述网络服务端将各端口策略记录在端口策略记录中；所述端口策略中包括端口信息、预设参数及访问时效；所述预设参数用于与访问认证策略进行匹配。
- 如权利要求1所述的方法，其特征在于，网络服务端接收网络终端发送的第一访问请求之前，还包括：所述网络服务端口将所述端口策略记录发布至所述网络终端；或所述网络终端中预装有端口策略获取脚本。
- 如权利要求1至4任一项所述的方法，其特征在于，所述网络服务端根据所述端口策略确定所述网络终端访问的第一网络端口，包括：所述第一访问请求中还包括所述网络终端的IP地址，所述网络服务端通过所述第一网络端口为所述网络终端提供网络服务之前，还包括：所述网络服务端将所述第一网络端口向所述第一访问请求中携带的所述网络终端的IP地址开放。
- 如权利要求5所述的方法，其特征在于，所述网络服务端为所述网络终端提供网络服务之后，还包括：所述网络服务端确定所述第一网络端口向所述网络终端开放时间到达所述端口策略中的访问时效；所述网络服务端关闭所述网络终端对所述第一网络端口的访问权限。
- 如权利要求5所述的方法，其特征在于，所述网络服务端为所述网络终端提供网络服务之后，还包括：所述网络服务端确定与所述网络终端断开网络连接，则关闭所述第一网络端口对所述第一网络端口的访问权限。
- 一种网络终端认证的方法，其特征在于，所述方法包括：网络终端向网络服务端发送第一访问请求，所述第一访问请求中包括访问认证策略；所述访问认证策略用于网络服务端从端口策略记录中确定出与所述访问认证策略匹配的端口策略，并根据所述端口策略确定所述网络终端访问的第一网络端口；所述网络终端向所述网络服务端发送第二访问请求，所述第二访问请求用于通过所述第一网络端口从所述网络服务端获取网络服务。
- 如权利要求8所述的方法，其特征在于，网络终端向网络服务端发送的第一访问请求之前，还包括：所述网络终端获取所述网络服务端口发布的端口策略记录。
- 一种用户认证的装置，其特征在于，所述装置包括：收发模块，用于接收网络终端发送的第一访问请求；所述第一访问请求 中携带访问认证策略；处理模块，用于从端口策略记录中，确定与所述访问认证策略匹配的端口策略；所述端口策略记录中的各所述端口策略用于开启对应的各网络端口；所述处理模块还用于，根据所述端口策略确定所述网络终端访问的第一网络端口；所述收发模块还用于，接收所述网络终端发送的第二访问请求，所述第二访问请求用于通过所述第一网络端口获取网络服务。
- 一种用户认证的装置，其特征在于，所述装置包括：收发模块，用于向网络服务端发送第一访问请求，所述第一访问请求中包括访问认证策略；所述访问认证策略用于网络服务端从端口策略记录中确定出与所述访问认证策略匹配的端口策略，并根据所述端口策略确定所述网络终端访问的第一网络端口；所述收发模块还用于，向所述网络服务端发送第二访问请求，所述第二访问请求用于通过所述第一网络端口从所述网络服务端获取网络服务。
- 一种计算机可读存储介质，其特征在于，所述存储介质存储有程序，当所述程序在计算机上运行时，使得计算机实现执行权利要求1至7或8、9中任一项所述的方法。
- 一种计算机设备，其特征在于，包括：存储器，用于存储计算机程序；处理器，用于调用所述存储器中存储的计算机程序，按照获得的程序执行如权利要求1至7或8、9任一权利要求所述的方法。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010954007.2A CN112165536B (zh) | 2020-09-11 | 2020-09-11 | 一种网络终端认证的方法及装置 |
| CN202010954007.2 | 2020-09-11 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2022052972A1 true WO2022052972A1 (zh) | 2022-03-17 |
Family
ID=73857935
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2021/117358 WO2022052972A1 (zh) | 2020-09-11 | 2021-09-09 | 一种网络终端认证的方法及装置 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN112165536B (zh) |
| WO (1) | WO2022052972A1 (zh) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115333977A (zh) * | 2022-08-11 | 2022-11-11 | 南京国电南自电网自动化有限公司 | 一种基于网络接口的系统诊断通道实现方法及装置 |
| CN115987668A (zh) * | 2022-12-29 | 2023-04-18 | 北京深盾科技股份有限公司 | 访问控制方法、系统、电子设备及存储介质 |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112165536B (zh) * | 2020-09-11 | 2022-11-11 | 中国银联股份有限公司 | 一种网络终端认证的方法及装置 |
| CN114531303B (zh) * | 2022-04-24 | 2022-07-12 | 北京天维信通科技有限公司 | 一种服务器端口隐藏方法及系统 |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105262717A (zh) * | 2015-08-31 | 2016-01-20 | 福建天晴数码有限公司 | 一种网络服务安全管理方法及装置 |
| US9916545B1 (en) * | 2012-02-29 | 2018-03-13 | Amazon Technologies, Inc. | Portable network interfaces for authentication and license enforcement |
| CN108471432A (zh) * | 2018-07-11 | 2018-08-31 | 北京智芯微电子科技有限公司 | 防止网络应用程序接口被恶意攻击的方法 |
| CN110351298A (zh) * | 2019-07-24 | 2019-10-18 | 中国移动通信集团黑龙江有限公司 | 访问控制方法、装置、设备及存储介质 |
| CN110830444A (zh) * | 2019-10-14 | 2020-02-21 | 云深互联(北京)科技有限公司 | 一种单包增强安全验证的方法和装置 |
| CN112165536A (zh) * | 2020-09-11 | 2021-01-01 | 中国银联股份有限公司 | 一种网络终端认证的方法及装置 |
Family Cites Families (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8122365B2 (en) * | 2006-02-23 | 2012-02-21 | Infosys Technologies, Ltd. | System and method for dynamic creation and customization of a user interface in a web service environment |
| US8572717B2 (en) * | 2008-10-09 | 2013-10-29 | Juniper Networks, Inc. | Dynamic access control policy with port restrictions for a network security appliance |
| WO2012092269A1 (en) * | 2010-12-29 | 2012-07-05 | Citrix Systems, Inc. | Systems and methods for policy based integration to horizontally deployed wan optimization appliances |
| WO2013110857A1 (en) * | 2012-01-24 | 2013-08-01 | Ssh Communications Security Oyj | Privileged access auditing |
| CN102594814B (zh) * | 2012-02-10 | 2014-11-12 | 福建升腾资讯有限公司 | 基于端末的网络访问控制系统 |
| CN107665316B (zh) * | 2017-09-25 | 2020-09-01 | 四川卫士通信息安全平台技术有限公司 | 一种基于认证和可信度量的计算机bios设计方法 |
| CN110855709A (zh) * | 2019-11-26 | 2020-02-28 | 中国建设银行股份有限公司 | 安全接入网关的准入控制方法、装置、设备和介质 |
| CN111274046A (zh) * | 2020-01-16 | 2020-06-12 | 平安医疗健康管理股份有限公司 | 服务调用的合法性检测方法、装置、计算机设备及计算机存储介质 |
-
2020
- 2020-09-11 CN CN202010954007.2A patent/CN112165536B/zh active Active
-
2021
- 2021-09-09 WO PCT/CN2021/117358 patent/WO2022052972A1/zh active Application Filing
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9916545B1 (en) * | 2012-02-29 | 2018-03-13 | Amazon Technologies, Inc. | Portable network interfaces for authentication and license enforcement |
| CN105262717A (zh) * | 2015-08-31 | 2016-01-20 | 福建天晴数码有限公司 | 一种网络服务安全管理方法及装置 |
| CN108471432A (zh) * | 2018-07-11 | 2018-08-31 | 北京智芯微电子科技有限公司 | 防止网络应用程序接口被恶意攻击的方法 |
| CN110351298A (zh) * | 2019-07-24 | 2019-10-18 | 中国移动通信集团黑龙江有限公司 | 访问控制方法、装置、设备及存储介质 |
| CN110830444A (zh) * | 2019-10-14 | 2020-02-21 | 云深互联(北京)科技有限公司 | 一种单包增强安全验证的方法和装置 |
| CN112165536A (zh) * | 2020-09-11 | 2021-01-01 | 中国银联股份有限公司 | 一种网络终端认证的方法及装置 |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115333977A (zh) * | 2022-08-11 | 2022-11-11 | 南京国电南自电网自动化有限公司 | 一种基于网络接口的系统诊断通道实现方法及装置 |
| CN115333977B (zh) * | 2022-08-11 | 2023-08-15 | 南京国电南自电网自动化有限公司 | 一种基于网络接口的系统诊断通道实现方法及装置 |
| CN115987668A (zh) * | 2022-12-29 | 2023-04-18 | 北京深盾科技股份有限公司 | 访问控制方法、系统、电子设备及存储介质 |
| CN115987668B (zh) * | 2022-12-29 | 2024-01-02 | 北京深盾科技股份有限公司 | 访问控制方法、系统、电子设备及存储介质 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112165536A (zh) | 2021-01-01 |
| CN112165536B (zh) | 2022-11-11 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| WO2022052972A1 (zh) | 一种网络终端认证的方法及装置 | |
| US11604861B2 (en) | Systems and methods for providing real time security and access monitoring of a removable media device | |
| US10567403B2 (en) | System and method for providing data and device security between external and host devices | |
| US11647003B2 (en) | Concealing internal applications that are accessed over a network | |
| US9210126B2 (en) | Method for secure single-packet authorization within cloud computing networks | |
| EP2410452B1 (en) | Protection against malware on web resources | |
| US11539695B2 (en) | Secure controlled access to protected resources | |
| US20110107410A1 (en) | Methods, systems, and computer program products for controlling server access using an authentication server | |
| EP1905211A1 (en) | Technique for authenticating network users | |
| JP2010520566A (ja) | 外部デバイスとホスト・デバイスの間でデータおよびデバイスのセキュリティを提供するためのシステムおよび方法 | |
| US11588852B2 (en) | Vulnerability validation using attack payloads | |
| US20110023088A1 (en) | Flow-based dynamic access control system and method | |
| CN110611682A (zh) | 一种网络访问系统及网络接入方法和相关设备 | |
| US20110154469A1 (en) | Methods, systems, and computer program products for access control services using source port filtering | |
| CN113904826A (zh) | 数据传输方法、装置、设备和存储介质 | |
| US10104060B2 (en) | Authenticating applications to a network service | |
| US20200322356A1 (en) | Systems and methods for pre-configuration attestation of network devices | |
| Sidiropoulos et al. | Smart tv hacking | |
| CN110875903A (zh) | 一种安全防御方法及设备 | |
| US8590031B2 (en) | Methods, systems, and computer program products for access control services using a transparent firewall in conjunction with an authentication server | |
| Sørensen et al. | Automatic profile-based firewall for iot devices | |
| KR102362320B1 (ko) | 능동형 네트워크 보안용 주소변이 접속 시스템 및 방법 | |
| Kalil | Policy Creation and Bootstrapping System for Customer Edge Switching | |
| Al-Sabaawi et al. | Detecting Network Security Vulnerabilities and Proactive Strategies to Mitigate Potential Threats | |
| Turcotte | Disrupting Attacker Value Propositions in Residential Networks |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 21866024 Country of ref document: EP Kind code of ref document: A1 |