基于MAC准入控制与网络流量监控的哑终端入网管控系统设计  

Design of a Dumb Terminal Network Access Management and Control System Based on MAC Access Control and Network Traffic Monitoring

作　　者：鹿文杨 孙皓 倪琛 赵秀琼 LU Wenyang;SUN Hao;NI Chen;ZHAO Xiuqiong(No.30 Institute of CETC,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《信息安全与通信保密》2024年第5期69-79,共11页Information Security and Communications Privacy

摘　　要：企业网络中大量哑终端设备的使用,给企业管理带来便利的同时,也带来较大安全隐患。通过分析主流准入控制方式的实现特点及不足,提出一种针对哑终端设备的MAC准入控制方式+网络流量监控相结合的准入控制方法,该方法能够利用2种认证方式的优点,弥补各认证方式自身的不足,使得针对哑终端设备的网络准入控制能够依托于接入交换机的MAC认证机制实现端口级别的管控。同时,根据哑终端设备网络业务流量相对固定的特点,采用网络流量监控的方式,为MAC准入控制方式提供持续性的、更细粒度的准入判决控制。The extensive use of dumb terminal devices in enterprise networks brings convenience to enterprise management,but it also brings great security risks.Through analyzing the implementation characteristics and shortcomings of mainstream access control methods,this paper proposes an access control method that combines MAC access control with network traffic monitoring for dumb terminal devices.The combined access control method can combine the characteristics of the two authentication methods and make up for their respective shortcomings,so that the network access control for dumb terminal devices can rely on the MAC authentication mechanism of the access switch to achieve portlevel control.At the same time,based on the relatively stable network traffic characteristics of dumb terminal devices,it adopts the network traffic monitoring method,which can provide continuous and more fine-grained access decision control for the MAC access control method.

关 键 词：哑终端 MAC准入控制 网络流量监控 准入判决控制 

分 类 号：TN918[电子电信—通信与信息系统]