WO2024021408A1

WO2024021408A1 - Control device admission method and apparatus, and related product

Info

Publication number: WO2024021408A1
Application number: PCT/CN2022/135139
Authority: WO
Inventors: 褚健; 陈银桃; 王磊阳; 孙杭; 罗冰
Original assignee: 浙江中控技术股份有限公司
Priority date: 2022-07-26
Filing date: 2022-11-29
Publication date: 2024-02-01
Also published as: CN115250203A

Abstract

Provided in the present application are a control device admission method and apparatus, and a related product. The method comprises: first, when detecting that a new device accesses a control system local area network, carrying out preliminary admission judgment according to a preset protocol; after the new device meets a preliminary admission condition, allocating a first key to the new device, and encrypting an authentication message by using the first key; when the encrypted authentication message is transmitted to a device end, carrying out comparison and verification on the first key contained in the encrypted authentication message and a second key; and if said two keys are the same, which represents that the authentication succeeds, feeding back an authentication success result, which represents that a port of the new device is a licensed port allowing user access. That is, by means of the preliminary admission judgment based on the preset protocol and second judgment based on a key encryption mode, the problem of poor adaptability caused by only using 802.1X protocol is avoided, and the accuracy of an authenticated device accessing a network is improved, thus improving the network security of a control device.

Description

A method, device and related products for controlling equipment access

This invention requires priority for the Chinese patent application submitted to the State Intellectual Property Office of the People's Republic of China on July 26, 2022, with the application number CN202210885577.X and the application title "A method, device and related products for controlling equipment access" rights, the entire contents of which are incorporated herein by reference.

Technical field

The present invention relates to the field of control system communication, and in particular to a method, device and related products for controlling equipment access.

Background technique

With the development of automation control technology, more and more enterprises are adopting management and control integrated control systems, such as distributed control system (DCS). At present, the management and control integrated control system mainly relies on OPC software to provide real-time data to the outside world. The operating system environment that OPC software relies on has great security vulnerabilities. When dangerous or easily infected terminals are connected to the network, there will be security risks such as network attacks and ransomware viruses, resulting in the risk of leakage during the data transmission process.

The existing technology can use the 802.1X protocol as an access protocol for terminals to access the network. That is, the client port installs the 802.1X protocol for access authentication. The specific process is that the client sends an authentication request, the switch passes the received authentication information to the authentication server, and the authentication server compares the information to make authentication judgments. However, not all ports can be installed with the 802.1X protocol, which makes the protocol have poor adaptability during use, and the accuracy of authenticating devices to access the network is low, resulting in poor network security for control devices.

Contents of the invention

In view of this, this application provides a method, device and related products for controlling equipment access, aiming to make a preliminary access judgment through a preset protocol, and then use the key encryption method to make a second access judgment, thereby avoiding the need to only use The poor adaptability problem caused by the 802.1X protocol improves the accuracy of authentication equipment access to the network, thereby improving the network security of control equipment.

In a first aspect, in order to achieve the above-mentioned object of the invention, this application provides a method for controlling device access, which method includes:

When a new device is detected to be connected to the control system LAN, a preliminary access judgment is made for the new device according to the preset protocol;

Responsive to the new device meeting preliminary admission conditions, assigning a first key to the new device;

Encrypt the authentication message according to the first key, and transmit the encrypted authentication message to the network switching device for comparison and verification;

In response to the first key and the second key being the same, it is fed back that the authentication is successful, and it is determined that the new device is admitted to the local area network of the control system.

Optionally, encrypting the authentication message according to the first key and transmitting the encrypted authentication message to the network switching device for comparison and verification includes:

Encrypt the authentication message according to the preset encryption algorithm and the first key;

Transmit the encrypted authentication message to the data link layer of the switching device;

Decrypt the encrypted authentication message to obtain the first key, and verify whether the first key and the second key are the same.

Optionally, after allocating the first key to the new device, the method further includes:

Start a port timer; the port timer is used to obtain a preset time and regularly update the first key;

Regularly update the first key and the second key according to the preset time of the port timer;

The response that the first key is the same as the second key and feedback that the authentication is successful includes:

In response to the regularly updated first key and the second key being the same, it is fed back that the authentication is successful.

Optionally, the method also includes:

In response to the fact that the first key and the second key are different, feedback authentication fails, and it is determined that the port of the new device is an unauthorized port; the unauthorized port is a port that the user is not allowed to access.

Optionally, the preliminary admission judgment of the new device according to the preset protocol includes:

Determine whether the new device meets the first preset protocol;

If so, it is determined that the new equipment meets the preliminary access conditions;

If not, in response to the new device meeting the second preset protocol, it is determined that the new device meets the preliminary access condition; the second preset protocol is a protocol for authentication through identity identification.

Optionally, the method also includes:

In response to the new device being a device that logs in for the first time, assign a third key to the new device; the third key is a port-specific key;

Perform initial encryption on the authentication message according to the third key, and transmit the encrypted authentication message to the network switching device for comparison and verification;

In response to the third key being the same as the fourth key, determining that the new device meets the identity requirement;

It is determined that the new device meets preliminary access conditions based on the identity requirements and the preset protocol.

In the second aspect, this application provides a device for controlling equipment access, which device includes:

The first judgment unit is used to make a preliminary access judgment on the new device according to the preset protocol when it is detected that the new device has accessed the control system local area network;

an allocation unit configured to allocate a first key to the new device in response to the new device meeting the preliminary access condition;

The second judgment unit is configured to encrypt the authentication message according to the first key, and transmit the encrypted authentication message to the device for comparison and verification;

A response unit, configured to respond to the fact that the first key and the second key are the same, feedback that the authentication is successful, and determine that the new device is admitted to the local area network of the control system.

In a third aspect, embodiments of the present application provide an electronic device. The device includes: memory and processor.

Memory is used to store and transfer program code to the processor.

Processor: configured to execute the method steps of controlling device access described in any one of the first aspects according to instructions in the program code.

In the fourth aspect, embodiments of the present application provide a computer-readable storage medium. Code is stored on the computer-readable storage medium. When the code is executed by a processor, the control device as described in any one of the first aspects is implemented. Admission method steps.

This application provides a method, device and related products for controlling equipment access. When executing the method, firstly, when a new device is detected to access the control system local area network, a preliminary access judgment is made according to a preset protocol. After the new device meets the preliminary access conditions, a first key is assigned to the new device, and the first key is used to encrypt the authentication message. When the encrypted authentication message is transmitted to the device, the first key and the second key contained in the encrypted authentication message are compared and verified. If the two are the same, it means the authentication is successful and the authentication success result will be fed back. This means that the port of the new device is an authorized port for user access. That is, the preliminary access judgment of the preset protocol and the secondary judgment of the key encryption method are used to avoid the problem of poor adaptability caused by only using the 802.1X protocol, thereby improving the accuracy of the authentication device's access to the network, thereby improving the network control equipment safety.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are only These are embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on the provided drawings without exerting creative efforts.

Figure 1 is an exemplary application scenario diagram of a method for controlling device access provided by an embodiment of the present application;

Figure 2 is a flow chart of a method for controlling device access provided by an embodiment of the present application;

Figure 3 is a flow chart of another method for controlling device access provided by an embodiment of the present application;

Figure 4 is a flow chart of another method for controlling device access provided by an embodiment of the present application;

Figure 5 is a schematic structural diagram of a device for controlling device access provided by an embodiment of the present application.

Detailed ways

The terms “first”, “second”, “third”, and “fourth” in the description, claims and drawings of this application are used to distinguish different objects, rather than to limit a specific order.

In the embodiments of this application, words such as "as an example" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described in the embodiments of the application as "as an example" or "such as" should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of the words "as an example" or "for example" is intended to present the concept in a concrete way.

The terms used in the embodiments of the present application are only used to explain specific embodiments of the present application and are not intended to limit the present application.

As mentioned above, the existing technology can use the 802.1X protocol as the access protocol for terminal access to the network. That is, the client port installs the 802.1X protocol for access authentication. However, not all ports can be installed with the 802.1X protocol, which makes the protocol less adaptable during use and leads to poor security when the device is connected to the network. In addition, the inventor found that in order to solve the problem of poor network adaptability based on the 802.1X protocol, the existing technology proposes to bind the MAC address to the switch port for protection on dumb terminal devices that cannot install the 802.1X protocol. That is, the MAC address is used as the unique identifier for authentication. However, the inventor discovered that illegal users can still access the network by counterfeiting the MAC addresses of these dumb terminal devices and evade network security authentication checks.

Based on this, based on the existing technology, this application conducts a preliminary access judgment on the new access device through a preset protocol, and then uses key encryption to conduct a secondary access judgment on the new access device, so as to avoid only The problem of poor network adaptability caused by the use of 802.1X protocol. The accuracy of network security authentication is improved, thereby improving the network security of control equipment.

In order to enable those in the technical field to better understand the solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only These are part of the embodiments of this application, but not all of them. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of this application.

Refer to Figure 1, which is an exemplary application scenario diagram of a method for controlling device access provided by an embodiment of the present application. This method is applied in a typical C/S architecture, that is, client/server architecture. It includes client 101, network switching device 102, and authentication server 103.

In this embodiment of the present application, the client 101 supports the extensible authentication protocol EAPoL on the local area network to ensure that the client 101 can always send or receive authentication messages. The network switching device 102 provides a LAN access port for the client 101, acts as an intermediary between the client 101 and the authentication server 103, requests identity information from the client 101, and verifies the information with the authentication server 103.

In the embodiment of this application, the authentication server 103 can be a RADIUS server, used to perform authentication on clients that need to access the local area network, and determine the authorized or non-authorized status of the controlled port based on the authentication result (Accept or Reject). Take control. The client 101 can be a terminal device such as a desktop computer with a display screen, or other control device. The number of clients 101 may be one or multiple, and is not specifically limited in the embodiment of this application.

In this embodiment of the present application, the network switching device 102 may be an 802.1X authentication device, used to provide the client 101 with a port to access the local area network. This port includes controlled ports and uncontrolled ports. Among them, the uncontrolled port is always in a bidirectional connectivity state and is mainly used to transmit the extensible authentication protocol EAPoL. In the embodiment of this application, the authorization state indicates that the controlled port is in a bidirectional connectivity state and is used to transmit service messages. It is prohibited to receive authentication messages from the client 101 in an unauthorized state.

Obviously, the described embodiments are only some of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of this application.

Refer to Figure 2, which is a flow chart of a method for controlling device access provided by an embodiment of the present application, and is applied to a distributed control system. As can be seen from the figure, this method at least includes the following steps:

S201: When a new device is detected to be connected to the control system LAN, a preliminary access judgment is made for the new device according to the preset protocol.

When the control system detects the entry of a new device, it makes a preliminary admission judgment on the new device based on the preset protocol. When it is detected that a new device does not meet the access conditions, it will be directly authenticated and rejected. Save subsequent work processes.

In this embodiment of the present application, a preliminary admission judgment can be made on the new device according to the first preset protocol. For example, the commonly used 802.1X protocol is used to determine access. If the new device passes the 802.1X admission protocol, it means that the new device meets the preliminary admission conditions. If the new device cannot pass the 802.1X access protocol, consider the new device's dumb terminal device and make another judgment by binding the second default protocol to the network switching device. Among them, the second preset protocol is a protocol for authentication through identity identification, such as a MAC bypass authentication protocol or a Portal authentication backup mechanism.

Specifically, it can be determined that the new device meets the preliminary access conditions by determining whether the new device satisfies the second preset protocol. That is, if the new device passes the second preset protocol, it means that the new device meets the preliminary access conditions. This can avoid the problem of low authentication accuracy caused by insufficient adaptability of only the 802.1X protocol.

S202: In response to the new device meeting preliminary admission conditions, allocate a first key to the new device.

After determining that the new device meets the preliminary access conditions, the control system allocates a first key to the new device for encrypting the authentication message. In this embodiment of the present application, the distributed first key may be an RSA key. Specifically, after receiving the instruction that the new device meets the preliminary access conditions, the server of the control system assigns the first key dedicated to the industrial control network to the port of the new device and sends it to the new device through the network switching device.

S203: Encrypt the authentication message according to the first key, and transmit the encrypted authentication message to the device for comparison and verification.

After the new device port obtains the first key, the control system will encrypt the authentication message based on the first key. In this embodiment of the present application, the server of the control system allocates a preset encryption algorithm to the new device port. Then, the authentication message is encrypted according to the preset encryption algorithm and the first key, and the encrypted authentication message is transmitted to the data link layer of the network switching device. Decrypt the encrypted authentication message at the data link layer to obtain the first key. Verify whether the first key and the second key are the same. The second key may pre-store a local key for the network switching device.

In this embodiment of the present application, the first key can be added to the header of the authentication message, the middle of the authentication message, or the tail of the authentication message through a preset algorithm.

S204: In response to the fact that the first key and the second key are the same, feedback authentication is successful, and it is determined that the new device has entered the access control system.

When the network switch compares and verifies that the first key and the second key are the same, it indicates that the feedback authentication is successful, and the message is sent to the LAN communication to determine the new device's admission to the control system.

In this embodiment of the present application, if the first key and the second key are compared and found to be different, it means that the feedback authentication fails. The new device does not meet the admission conditions, and the port of the new device becomes an unauthorized port. Among them, unauthorized ports are ports that users are not allowed to access. It corresponds to the authorization port.

In this embodiment of the present application, the network switching device can also perform authentication on clients that need to access the local area network, and control the authorized status/non-authorized status of the controlled port based on the authentication results.

Specific: When the new device authentication fails, the new device port becomes an unauthorized port. When other users unplug the authorized port network cable, connect other hosts to the authorized port through the network cable, and then enter the LAN. At this time, the key comparison of other users fails, and the authorized port will be locked. Unauthorized port. In the embodiment of this application, when other users access the authorized port through the HUB device, and the key comparison of the other users fails, the authorized port will be locked and become an unauthorized port.

This application provides a method for controlling device access. First, when a new device is detected to be connected to the control system LAN, a preliminary access judgment is made based on a preset protocol. After the new device meets the preliminary access conditions, a first key is assigned to the new device, and the first key is used to encrypt the authentication message. When the encrypted authentication message is transmitted to the device, the first key and the second key contained in the encrypted authentication message are compared and verified. If the two are the same, it means the authentication is successful and the authentication success result will be fed back. This means that the port of the new device is an authorized port for user access. That is, the preliminary access judgment of the preset protocol and the secondary judgment of the key encryption method are used to avoid the problem of poor adaptability caused by only using the 802.1X protocol, thereby improving the accuracy of the authentication device's access to the network, thereby improving the network control equipment safety.

Referring to Figure 3, there is a flow chart of another method for controlling device access provided by the embodiment of the present application, which is applied to a distributed control system. The method at least includes the following steps:

S301: The client that complies with the extensible authentication protocol EAPoL issues a request to access the network switching device.

S302: Determine whether the access device is the access device for first login. If satisfied, proceed to step S303. Otherwise, proceed to step S310.

S303: The server allocates a third key to the new device, initially encrypts the authentication message based on the third key, and transmits the encrypted authentication message to the network switching device for comparison and verification.

In this embodiment of the present application, the third key is a port-specific key. The server has added a key distribution judgment system, which judges whether the new device is an access device for the first login. If so, it will randomly assign a port-specific key, that is, a third key. The network switching device records this port key. During subsequent use, the third key is compared with the fourth key recorded by the network switching device through message encryption and decryption.

S304: In response to the third key being the same as the fourth key, determine that the new device meets the identity requirement.

When the third key and the fourth key are the same, it means that the new device meets the identity requirements. That is, the device is not illegally logged in.

S305: Determine whether the access device meets the 802.1X access protocol. If satisfied, proceed to step S306. Otherwise, proceed to step S310.

S306: Determine whether the access device meets the second preset protocol. If so, it meets the preliminary access conditions and proceeds to step S307. Otherwise, proceeds to step S310.

S307: In response to the new device meeting the preliminary admission conditions, allocate a first key to the new device.

S308: Encrypt the authentication message according to the first key, and transmit the encrypted authentication message to the device for comparison and verification.

S309: In response to the fact that the first key and the second key are the same, feedback that the authentication is successful.

S310: The new device access authentication failed.

In the embodiment of the present application, S307 to S310 are the same as S202 to S204 in Figure 2 and will not be discussed here. In this embodiment of the present application, the identity recognition judgment in S302 and the access protocol judgment in S305 can be performed at the same time, or S302 can be performed first and then S305. You can also execute S305 first and then execute S302.

The control device access method provided by the embodiment of the present application authenticates the identity of the new device through a port-specific key, which avoids the solution generated by the existing technology of using a user name and password for identification, which can easily lead to address theft and illegal Problems with device access and multiple people using the same account. The network security of control equipment is further improved.

Refer to Figure 4, which is a flow chart of another control device admission method provided by an embodiment of the present application. This method is applied to a distributed control system. The method at least includes the following steps:

S401: When it is detected that the client sends a request to access the network switching device, a preliminary admission judgment is made on the new device through the 802.1X protocol and MAC bypass authentication. If satisfied, proceed to step S402. Otherwise, go to step S407

S402: Assign an RSA key to the new device and encrypt the authentication message based on the RSA key. Transmit the encrypted authentication message to the network switching device for decryption and comparison verification.

S403: The RSA key is the same as the local key pre-recorded by the network switching device, which means the authentication is successful and the feedback is that the authentication is successful. Otherwise, go to step S407

S404: Use the port timer to regularly update the RSA key and the local key pre-recorded by the network switching device.

In this embodiment of the present application, the port timer is timed. When the timer expires, the RSA key and the local key pre-recorded by the network switching device are randomly updated.

S405: Use the updated RSA key to encrypt the authentication message. Transmit the encrypted authentication message to the network switching device for decryption and comparison verification.

S406: When the updated RSA key is the same as the local key pre-recorded by the network switching device, it means that the authentication is successful and feedback that the authentication is successful.

S407: Authentication failed, feedback authentication failure.

In the method for controlling device access provided by the embodiments of this application, the key is regularly updated through a timer to further enhance the security of the key and improve the accuracy of the authentication device accessing the network, thereby improving the network security of the control device. .

Refer to Figure 5, which is a schematic structural diagram 500 of a device for controlling device access provided by an embodiment of the present application. The device includes at least the following units:

The first judgment unit 501 is configured to make a preliminary admission judgment on the new device according to a preset protocol when it is detected that a new device has accessed the control system local area network.

The allocation unit 502 is configured to allocate a first key to the new device in response to the new device meeting the preliminary access conditions.

The second judgment unit 503 is configured to encrypt the authentication message according to the first key, and transmit the encrypted authentication message to the device for comparison and verification.

The response unit 504 is configured to respond to the fact that the first key and the second key are the same, feedback that the authentication is successful, and determine that the port of the new device is an authorized port; the authorized port allows the user to access the port.

This application provides a device for controlling equipment access. When the first judgment unit 501 detects that a new device is included in the control system local area network, it makes a preliminary admission judgment according to a preset protocol. The allocation unit 502 allocates the first key to the new device after the new device meets the initial admission conditions. The second judgment unit 503 uses the first key to encrypt the authentication message. When the encrypted authentication message is transmitted to the device, the first key and the second key contained in the encrypted authentication message are processed. Comparison verification. The response unit 503 responds that the two are the same, indicating that the authentication is successful, and feeds back the authentication success result. This means that the port of the new device is an authorized port for user access. That is, the preliminary access judgment of the preset protocol and the secondary judgment of the key encryption method are used to avoid the problem of poor adaptability caused by only using the 802.1X protocol, thereby improving the accuracy of the authentication device's access to the network, thereby improving the network control equipment safety.

An embodiment of the present application also provides an electronic device. The device includes: memory and processor.

Memory is used to store and transfer program code to the processor.

Processor: used to execute the steps of one of the above methods for controlling device admission according to instructions in the program code.

An embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, a method for controlling device access according to the embodiment of the present application is implemented.

In practical applications, the computer-readable storage medium may be any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of computer readable storage media include: electrical connections having one or more conductors, portable computer disks, hard drives, random access memory (RAM), read only memory (ROM), Erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above. In this embodiment, a computer-readable storage medium may be any tangible medium that contains or stores a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave carrying computer-readable program code therein. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device .

Program code embodied on a computer-readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wire, optical cable, RF, etc., or any suitable combination of the foregoing.

Computer program code for performing the operations of the present invention may be written in one or more programming languages, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional Procedural programming language—such as "C" or a similar programming language. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In situations involving remote computers, the remote computer can be connected to the user's computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (such as an Internet service provider through Internet connection).

The above descriptions are only exemplary embodiments of the present application and are not intended to limit the protection scope of the present application.

Claims

A method for controlling device access, characterized in that the method includes:

When a new device is detected to be connected to the control system LAN, a preliminary access judgment is made for the new device according to the preset protocol;

Responsive to the new device meeting preliminary admission conditions, assigning a first key to the new device;

Encrypt the authentication message according to the first key, and transmit the encrypted authentication message to the network switching device for comparison and verification;

In response to the first key and the second key being the same, it is fed back that the authentication is successful, and it is determined that the new device is admitted to the local area network of the control system.
The method according to claim 1, characterized in that encrypting the authentication message according to the first key and transmitting the encrypted authentication message to a network switching device for comparison and verification includes:

Encrypt the authentication message according to the preset encryption algorithm and the first key;

Transmit the encrypted authentication message to the data link layer of the switching device;

Decrypt the encrypted authentication message to obtain the first key, and verify whether the first key and the second key are the same.
The method according to claim 1, characterized in that after allocating the first key to the new device, the method further includes:

Start a port timer; the port timer is used to obtain a preset time to regularly update the first key;

Regularly update the first key and the second key according to the preset time of the port timer;

The response that the first key is the same as the second key and feedback that the authentication is successful includes:

In response to the regularly updated first key and the second key being the same, it is fed back that the authentication is successful.
The method according to claim 1, characterized in that, the method further includes:

In response to the fact that the first key and the second key are different, feedback authentication fails, and it is determined that the port of the new device is an unauthorized port; the unauthorized port is a port that the user is not allowed to access.
The method according to claim 1, characterized in that the preliminary admission judgment of the new device according to a preset protocol includes:

Determine whether the new device meets the first preset protocol;

If so, it is determined that the new equipment meets the preliminary access conditions;

If not, in response to the new device meeting the second preset protocol, it is determined that the new device meets the preliminary access condition; the second preset protocol is a protocol for authentication through identity identification.
The method according to claim 5, characterized in that, the method further includes:

In response to the new device being a device that logs in for the first time, assign a third key to the new device; the third key is a port-specific key;

Perform initial encryption on the authentication message according to the third key, and transmit the encrypted authentication message to the network switching device for comparison and verification;

In response to the third key being the same as the fourth key, determining that the new device meets the identity requirement;

It is determined that the new device meets preliminary access conditions based on the identity requirements and the preset protocol.
The method according to claim 1, characterized in that, the method further includes:

When the user accesses the authorized port through the device, in response to the user's key comparison being different, the authorized port is locked, causing the authorized port to become an unauthorized port.
A device for controlling equipment access, characterized in that the device includes:

The first judgment unit is used to make a preliminary access judgment on the new device according to the preset protocol when it is detected that the new device has accessed the control system local area network;

an allocation unit configured to allocate a first key to the new device in response to the new device meeting the preliminary access condition;

The second judgment unit is configured to encrypt the authentication message according to the first key, and transmit the encrypted authentication message to the device for comparison and verification;

A response unit, configured to respond to the fact that the first key and the second key are the same, feedback that the authentication is successful, and determine that the new device is admitted to the local area network of the control system.
An electronic device. The device includes: memory and processor.

Memory is used to store and transfer program code to the processor.

Processor: configured to execute the method steps of controlling device access according to any one of claims 1-7 according to instructions in the program code.
A computer-readable storage medium, characterized in that the computer-readable storage medium stores code, and when the code is executed by a processor, the method for controlling device access according to any one of claims 1-7 is implemented. step.