[go: up one dir, main page]

WO2025195151A1 - Procédé d'identification de terminal, appareil et système - Google Patents

Procédé d'identification de terminal, appareil et système

Info

Publication number
WO2025195151A1
WO2025195151A1 PCT/CN2025/080156 CN2025080156W WO2025195151A1 WO 2025195151 A1 WO2025195151 A1 WO 2025195151A1 CN 2025080156 W CN2025080156 W CN 2025080156W WO 2025195151 A1 WO2025195151 A1 WO 2025195151A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
terminals
information
type
cluster
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
PCT/CN2025/080156
Other languages
English (en)
Chinese (zh)
Inventor
郑世琦
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN202410332525.9A external-priority patent/CN120692559A/zh
Priority claimed from CN202410374530.6A external-priority patent/CN120723995A/zh
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Publication of WO2025195151A1 publication Critical patent/WO2025195151A1/fr
Pending legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements

Definitions

  • the present application relates to the field of terminal technology, and in particular to a method, device, and system for identifying a terminal.
  • terminals have emerged to provide users with relevant services.
  • terminals such as government kiosks, queue checkers, evaluators, and information screens facilitates users in handling government affairs.
  • terminals such as electronic class signs, multimedia teaching devices, and facial recognition devices facilitates work in the education sector.
  • Terminal identification methods include: Method 1, which identifies the terminal based on a match between its fingerprint and fingerprint information in a fingerprint database; and Method 2, which identifies the terminal based on its traffic characteristics.
  • Method 1 which identifies the terminal based on a match between its fingerprint and fingerprint information in a fingerprint database
  • Method 2 which identifies the terminal based on its traffic characteristics.
  • the present application provides a terminal identification method, device and system, which can ensure effective identification of terminals even when facing terminals with blurred boundaries in the network and a variety of terminals in the network, and can improve the recognition rate of terminals to a certain extent.
  • the present application provides a terminal identification method, wherein an identification device obtains open port information of multiple terminals and clusters the multiple terminals based on the open port information of each terminal, thereby identifying at least one cluster to which the multiple terminals belong based on the clustering results.
  • the open port information of each terminal indicates at least one open port of each terminal, and the terminals included in each of the at least one cluster are of the same type.
  • the open port information of the terminals belonging to the same cluster is similar, and the terminals belonging to the same cluster are likely to be of the same type, thereby achieving effective and accurate identification of the terminals.
  • the terminal identification rate can be guaranteed, overcoming the problem that current terminal identification methods require the accumulation of terminal fingerprint information or the service traffic (or service messages) after the terminal joins the network, which cannot guarantee the terminal identification rate.
  • the "multiple terminals" in the method may refer to terminals that are newly connected to the network during the time interval from the last identification of the terminals in the network to the current execution of the method.
  • the identification device clusters the multiple terminals based on the open port information of the multiple terminals, which may include: the identification device determines the cluster of the known type to which each terminal in the multiple terminals belongs based on the similarity between the open port information of the multiple terminals and the open port information of each cluster of the known type.
  • the terminal to be identified is classified into a reasonable cluster of the known type, thereby determining the type of the terminal to be identified belonging to the cluster of the known type through the type of the cluster of the known type, thereby completing the clustering and identification of the terminal to be identified.
  • the identification device clustering the multiple terminals based on their open port information may include: the identification device clustering the multiple terminals based on the similarity of their open port information.
  • the terminals with similar open port information are clustered into a single cluster.
  • the type of each cluster is then used to determine the type of the terminals to be identified belonging to that cluster, thereby completing the clustering and identification of the terminals to be identified.
  • the terminal type can be identified based on the terminal's open port information in combination with other terminal information.
  • other terminal information may include, but is not limited to, the terminal's Media Access Control (MAC) address and/or the terminal's Internet Protocol (IP) address.
  • MAC Media Access Control
  • IP Internet Protocol
  • the identification device can identify the types of multiple terminals based on the MAC addresses of multiple terminals, the IP addresses of multiple terminals, and the open port information of multiple terminals.
  • the method can also include: the identification device obtains the MAC address and IP address of each terminal in the multiple terminals.
  • the identification device clustering the multiple terminals can include: the identification device clustering the multiple terminals based on the open port information of each terminal, the MAC address of each terminal, and the IP address of each terminal.
  • the identification device can first determine the comprehensive similarity between the terminals based on the similarity of the open port information between each terminal, the similarity of the MAC addresses between each terminal, and the similarity of the IP addresses between each terminal; then, the identification device clusters the multiple terminals based on the comprehensive similarity between the terminals. In this way, based on the MAC address of the terminal, the IP address of the terminal, and the open port information of the terminal, the type of the terminal can be accurately identified through clustering.
  • the open port information of each terminal among the multiple terminals may refer to the open port information obtained by a port scanning device performing a port scan on all or some of the designated ports of the terminal.
  • the designated ports may be commonly used ports that need to be detected (such as the top 100 most commonly used ports in a commonly used port list), or may be special ports that need to be detected (such as ports with designated port numbers based on actual application scenario requirements). Then, during the process of the port scanning device performing a port scan on the terminal, the port scanning device needs to send port detection messages corresponding to each designated port to the terminal, and the number of port detection messages sent is the same as the number of designated ports of the terminal.
  • the multiple terminals may be all terminals in the network, and the identification device obtaining the open port information of all terminals in the network may include: the identification device performing a port scan on all terminals in the network to obtain the open port information of the multiple terminals.
  • the multiple terminals may be terminals in a target network segment in the network, and the identification device obtaining the open port information of all terminals in the target network segment in the network may include: the identification device performing a port scan on terminals in the target network segment to obtain the open port information of the multiple terminals.
  • the identification device identifies at least one cluster to which multiple terminals belong based on the clustering results, which may include: the identification device determines the type of each cluster in the at least one cluster, and the type of each cluster is the type of the terminal belonging to the cluster. Therefore, determining the type of each cluster is equivalent to determining the types of multiple terminals, thereby realizing effective identification of the terminals.
  • the identification device determines the type of each cluster in at least one cluster, which may include: automatically identifying the types of some clusters, and displaying the type of one or more clusters whose specific types cannot be identified as unknown types; and manually marking the specific types of the one or more clusters.
  • the identification device's marking of the specific type of the unknown type cluster may, for example, include: for any first cluster in the unknown type cluster, identifying the type of one or more terminals in the first cluster, and marking the type as the type of the first cluster. In this way, after automatic identification, the type of the cluster is marked by the identification results of a small number of terminal types in each cluster of the unknown type, thereby achieving efficient marking of the cluster and achieving efficient terminal identification.
  • the identification device determining the type of each cluster in at least one cluster may include automatically identifying the types of all clusters. For example, for any second cluster in at least one cluster, in response to determining that the open port information of each terminal in the second cluster includes a first target port, the identification device determines that the type of the second cluster is the first type corresponding to the first target port. For another example, for any second cluster in at least one cluster, in response to determining that one or more terminals in the second cluster belong to the first type, the identification device determines that the type of the second cluster is the first type. In this way, for each cluster in the at least one determined cluster, the identification device can automatically identify the type of the cluster, thereby realizing intelligent identification of the terminals.
  • the recognition device may, after automatically identifying the type of the cluster, identify the type of the cluster as a candidate type, prompt and wait for the user to confirm or edit the candidate type to finally determine the type of the cluster.
  • This example can be considered an automatic recognition + manual confirmation method.
  • the recognition device determining the type of each cluster in at least one cluster may include: for any second cluster in the at least one cluster, determining the type of the second cluster as a first type based on automatic recognition; then, in response to an edit operation or a confirmation operation on the first type of the second cluster, determining the type of the second cluster as a second type.
  • the second type is the same as the first type. If the user finds that the automatic recognition result (i.e., the first type) is inaccurate, the user may identify the type of the second cluster using any other method, determine the second cluster as the second type, and then perform an edit operation on the first type of the second cluster to change the type of the second cluster from the first type to the second type. In this case, the second type is different from the first type. In this way, the automatic recognition + manual confirmation method can improve the accuracy of terminal recognition while ensuring recognition efficiency.
  • the method may further include: the identification device correcting the clustering results.
  • the identification device changes the cluster to which the terminal belongs based on the terminal type. In this way, by correcting the clustering results, higher-precision terminal identification can be achieved.
  • the method may further include: the identification device performing network admission control on the terminal based on the type of the terminal.
  • the method may further include: the identification device sending configuration information to the terminal of that type based on the type of the terminal.
  • the method may be applied to a network controller, and the identification device may be a functional module of the network controller used to implement the method provided herein.
  • the network controller may be a Network Admission Controller (NAC)
  • NAC Network Admission Controller
  • the identification device may be a functional module of the NAC used to implement the method provided herein.
  • the present application also provides a terminal identification method, which is applied to a terminal to be identified.
  • the method may, for example, include: the terminal to be identified receiving a port detection message for a target port of the terminal to be identified; if the target port is open, the terminal to be identified sending a response message to the port detection message for the target port, the response message being used to guide the identification of the type of the terminal to be identified.
  • the response message is used to indicate that the open port information of the terminal to be identified includes the target port, and the open port information is used to identify the type of the terminal to be identified.
  • the method performs a port scan on the terminal to be identified to obtain the open port information of the terminal to be identified, thereby using this information as a basis for identifying the type of the terminal to be identified.
  • the terminal identification rate can be guaranteed, overcoming the problem that current terminal identification methods require the accumulation of terminal fingerprint information or the service traffic (or service messages) after the terminal joins the network, which cannot guarantee the terminal identification rate.
  • the present application also provides a terminal identification device, which can be used in an identification device.
  • the device may include: an acquisition unit and a processing unit.
  • the acquisition unit is configured to acquire open port information for multiple terminals, where the open port information for each terminal indicates at least one open port of each terminal;
  • the processing unit is configured to cluster the multiple terminals based on the open port information for each terminal; and the processing unit is further configured to identify, based on the clustering results, at least one cluster to which the multiple terminals belong, where the terminals included in each cluster are of the same type.
  • the acquisition unit of the device is further configured to acquire the MAC address of each terminal; and the processing unit is specifically configured to cluster the multiple terminals according to the open port information of each terminal and the MAC address of each terminal.
  • the acquisition unit of the device is further configured to acquire the IP address of each terminal; and the processing unit is specifically configured to cluster the multiple terminals according to the open port information of each terminal and the IP address of each terminal.
  • the acquiring unit is specifically configured to receive open port information of multiple terminals sent by a port scanning device.
  • the acquiring unit is specifically configured to acquire open port information of multiple terminals by performing port scanning on all ports or some designated ports of each terminal.
  • the acquiring unit specifically performs any one of the following steps:
  • the open port information of multiple terminals can be obtained by performing port scanning on the terminals in the target VLAN;
  • the open port information of multiple terminals is obtained by performing port scanning on the terminals in the target BD.
  • the processing unit is specifically configured to: cluster the multiple terminals according to similarities in the open port information of the multiple terminals.
  • the processing unit is specifically configured to determine the cluster of the known type to which each of the multiple terminals belongs based on similarities between the open port information of the multiple terminals and the open port information of each cluster of the known type.
  • the processing unit is specifically configured to: determine a type of each cluster in the at least one cluster.
  • the processing unit is specifically configured to: for one or more clusters whose specific types cannot be identified, display the type of one or more clusters as unknown; and manually mark the specific type of one or more clusters.
  • the processing unit is also configured to mark the specific type of clusters of unknown types.
  • the processing unit is specifically configured to: for any first cluster of the unknown type clusters, identify the type of one or more terminals in the first cluster and mark the type as the type of the first cluster.
  • the processing unit is specifically configured to: for any second cluster in the at least one cluster, in response to determining that the open port information of each terminal in the second cluster includes the first target port, determine the type of the second cluster to be the first type corresponding to the first target port.
  • the processing unit is specifically configured to: for any second cluster in the at least one cluster, in response to determining that one or more terminals in the second cluster belong to the first type, determine that the type of the second cluster is the first type.
  • the processing unit is further configured to, in response to an edit operation or a confirmation operation of the first type on the second cluster, determine that the type of the second cluster is a second type, which is the same as or different from the first type.
  • the processing unit of the device is further configured to correct the clustering result.
  • the processing unit is specifically configured to: when the type of the terminal is inconsistent with the type of the cluster to which the terminal belongs, change the cluster to which the terminal belongs according to the type of the terminal.
  • the processing unit of the device is further configured to send configuration information to a terminal of the type based on the type of the terminal.
  • the device is applied to a network controller, that is, the device may be the network controller itself, or may be a functional module belonging to the network controller for implementing the method provided in this application.
  • the network controller may be, for example, a NAC.
  • the present application also provides a terminal identification device, which is applied to a terminal to be identified.
  • the device may include: a receiving unit and a sending unit.
  • the receiving unit is configured to receive a port detection message for a target port of the terminal to be identified; and the sending unit is configured to send a response message to the port detection message for the target port if the target port is open, wherein the response message is used to guide the identification of the type of the terminal to be identified.
  • the response message is used to indicate that the open port information of the terminal to be identified includes the target port, and the open port information is used to identify the type of the terminal to be identified.
  • the present application provides a communication device, the communication device comprising a communication interface and a processor;
  • a communication interface for executing the method provided by the aforementioned first aspect, any possible implementation of the first aspect, the second aspect, and any possible implementation of the second aspect;
  • a processor is used to execute the method provided by the aforementioned first aspect, any possible implementation of the first aspect, the second aspect, and any possible implementation of the second aspect.
  • the present application further provides a communication device, the communication device comprising a memory and a processor;
  • a memory for storing instructions
  • a processor is used to execute the instructions in the memory and execute the method provided by the aforementioned first aspect, any possible implementation of the first aspect, the second aspect, and any possible implementation of the second aspect.
  • the present application further provides a communication system, the communication system comprising a terminal identification device and a terminal to be identified;
  • a terminal identification device configured to execute the first aspect or any possible implementation of the first aspect to identify the terminal to be identified;
  • the terminal to be identified is used to execute the method provided by the aforementioned second aspect or any possible implementation of the second aspect.
  • the present application also provides a storage medium, which includes instructions.
  • the processor executes the method provided by the aforementioned first aspect, any possible implementation of the first aspect, the second aspect, and any possible implementation of the second aspect.
  • the present application also provides a program product, which includes a program.
  • the program runs on a processor, it executes the method provided by the aforementioned first aspect, any possible implementation of the first aspect, the second aspect, and any possible implementation of the second aspect.
  • the present application provides a chip comprising a memory and a processor, the memory being used to store instructions, and the processor being used to call and execute the instructions from the memory to implement the method provided by the aforementioned first aspect, any possible implementation of the first aspect, the second aspect, and any possible implementation of the second aspect.
  • the present application provides a method for identifying a terminal, which can be applied to a communication system, and the communication system can include a first communication entity, a second communication entity, and a third communication entity.
  • the method can, for example, include: the first communication entity in the communication system provides a web page to the terminal; the second communication entity in the communication system calls the browser interface of the terminal through the web page to obtain the capability information of the terminal; the third communication entity in the communication system identifies the type of the terminal based on the capability information of the terminal.
  • the browser interface of the terminal can be called through the web page provided by the web server to obtain the capability information of the terminal, and the specific type of the terminal can be accurately identified based on the capability information of the terminal, thereby overcoming the problem in the current terminal identification method that the terminal fingerprint information (such as Hypertext Transfer Protocol User Agent (HTTP UA)) cannot accurately identify the type of the terminal.
  • HTTP UA Hypertext Transfer Protocol User Agent
  • the communication system is a Web server, that is, the method is applied to the Web server
  • the first communication entity, the second communication entity and the third communication entity can be understood as group modules, components or chips within the Web server
  • the first communication entity and the second communication entity can be understood as components that implement the functions of the Web server
  • the third communication entity can be understood as a component that implements the functions of the terminal identification device.
  • the communication system includes three independent devices: a Web server, a communication device where the terminal identification device is located, and a terminal
  • the first communication entity can be understood as implementing the Web server
  • the second communication entity can be understood as the terminal
  • the third communication entity can be understood as the communication device where the terminal identification device is located.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or Universal Serial Bus (USB) capability.
  • touch screen capability media device capability
  • storage capability storage capability
  • USB Universal Serial Bus
  • a web page may include a script whose content may at least include: calling a browser interface to obtain terminal capability information.
  • the terminal can obtain the terminal capability information by executing the web page script, providing a basis for accurate terminal identification.
  • the script included in the web page may also include invoking a network interface to transmit the terminal's capability information to the terminal identification device.
  • the terminal can proactively transmit the terminal's capability information to the terminal identification device by executing the script on the web page. This allows the terminal identification device to obtain the terminal's capability information, which serves as the basis for accurate terminal identification, enabling the terminal identification device to accurately identify the terminal.
  • the terminal identification device may be deployed in a Web server, and the above-mentioned network interface may be a network interface opened by the Web server to the terminal.
  • the terminal identification device may not be deployed in the Web server.
  • the network interface may be a network interface opened to the terminal by the communication device where the terminal identification device is located.
  • a third communication entity in a communication system identifies the type of a terminal based on the terminal's capability information. This may include: the third communication entity in the communication system identifies the type of the terminal based on the terminal's capability information and the terminal's fingerprint information.
  • the terminal's fingerprint information includes at least one of the following: a Medium Access Control Organizationally Unique Identifier (MAC OUI), a Dynamic Host Configuration Protocol Option (DHCP Option), an HTTP UA, a Multicast Domain Name Service (mDNS), a Link Layer Discovery Protocol (LLDP), a MAC address, or an Internet Protocol (IP) address.
  • MAC OUI Medium Access Control Organizationally Unique Identifier
  • DHCP Option Dynamic Host Configuration Protocol Option
  • HTTP UA HTTP UA
  • mDNS Multicast Domain Name Service
  • LLDP Link Layer Discovery Protocol
  • IP Internet Protocol
  • the present application also provides a terminal identification method, which is applied to a terminal.
  • the method may include: the terminal receiving a web page sent by a web server; the terminal executing a script on the web page, the content of which may at least include: calling a browser interface to obtain terminal capability information; and the terminal sending the terminal capability information to a terminal identification device.
  • the terminal obtains the terminal capability information based on the script added to the web page downloaded from the web server and provides the terminal capability information to the terminal identification device, making it possible for the terminal identification device to accurately identify the specific type of the terminal based on the terminal capability information.
  • This overcomes the problem in current terminal identification methods that the terminal fingerprint information cannot accurately identify the terminal type. In scenarios where various types of terminals emerge in an endless stream and the boundaries between terminals are relatively vague, the accuracy of terminal identification can be improved.
  • the content of the script may further include: calling a network interface to send the terminal capability information to the terminal identification device; then, the terminal sending the terminal capability information to the terminal identification device may include: the terminal sending the terminal capability information to the terminal identification device through the network interface.
  • the terminal identification device may be deployed in a Web server, and the above-mentioned network interface may be a network interface opened by the Web server to the terminal.
  • the terminal identification device may not be deployed in the Web server.
  • the network interface may be a network interface opened to the terminal by the communication device where the terminal identification device is located.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the terminal may also obtain and transmit its fingerprint information to the terminal identification device.
  • the terminal's fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address, or IP address. This allows for more accurate identification of the terminal's specific type, even when the terminal's boundaries are vague, enabling refined terminal identification.
  • the present application also provides a terminal identification method, which is applied to a terminal identification device.
  • the method may include: the terminal identification device receiving capability information of the terminal, and identifying the terminal type based on the capability information.
  • the terminal identification device can obtain the capability information of the terminal and accurately identify the specific terminal type based on the capability information.
  • This overcomes the inability of current terminal identification methods to accurately identify the terminal type based on the terminal's fingerprint information. This method can improve the accuracy of terminal identification in scenarios where various types of terminals are constantly emerging and the boundaries between terminals are relatively vague.
  • the terminal's capability information is obtained by executing a script in a web page.
  • the script in the web page may include invoking a browser interface of the terminal to obtain the terminal's capability information.
  • the script in the web page may also include invoking a network interface to transmit the terminal's capability information to a terminal identification device.
  • the terminal obtains the terminal's capability information based on the script added to the web page downloaded from the web server and provides the terminal identification device with the capability information.
  • the terminal identification device can then accurately identify the terminal's specific type based on the capability information, thereby improving the accuracy of terminal identification.
  • the terminal identification device may be deployed in a Web server, and the above-mentioned network interface may be a network interface opened by the Web server to the terminal.
  • the terminal identification device may not be deployed in the Web server.
  • the network interface may be a network interface opened to the terminal by the communication device where the terminal identification device is located.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the terminal identification device may identify the terminal type based on the terminal's capability information, which may include: the terminal identification device identifies the terminal type based on the terminal's capability information and the terminal's fingerprint information, where the terminal's fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address, or IP address.
  • the terminal identification device can more accurately identify the specific type of the terminal based on the terminal's capability information and the terminal's fingerprint information, enabling refined terminal identification even when the terminal's boundaries are relatively vague.
  • the present application further provides a communication system comprising a first communication entity, a second communication entity, and a third communication entity.
  • the first communication entity is configured to provide a web page to a terminal; the second communication entity is configured to invoke a browser interface of the terminal via the web page to obtain capability information of the terminal; and the third communication entity is configured to identify the type of the terminal based on the capability information of the terminal.
  • the communication system is a Web server
  • the first communication entity, the second communication entity, and the third communication entity are components in the Web server.
  • the first communication entity is a Web server
  • the second communication entity is a terminal
  • the third communication entity is a terminal identification device.
  • the web page includes a script
  • the content of the script may include: calling a browser interface to obtain capability information of the terminal.
  • the script may also include invoking a network interface to transmit the terminal's capability information to a third communication entity.
  • the third communication entity may be deployed in a web server, in which case the network interface may be a network interface exposed by the web server to the terminal.
  • the third communication entity may not be deployed in a web server, in which case the network interface may be a network interface exposed by the communication device housing the third communication entity to the terminal.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the third communication entity is specifically used to: identify the type of the terminal based on the terminal capability information and the terminal fingerprint information, and the terminal fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address or IP address.
  • the present application provides a communication device, which is applied to a terminal.
  • the communication device may include a receiving unit, a processing unit, and a sending unit.
  • the receiving unit is configured to receive a web page sent by a web server;
  • the processing unit is configured to execute a script in the web page, wherein the script may include: calling a browser interface to obtain terminal capability information; and the sending unit is configured to send the terminal capability information to a terminal identification device.
  • the script may also include invoking a network interface to transmit the terminal's capability information to the terminal identification device.
  • the transmitting unit may then be configured to transmit the terminal's capability information to the terminal identification device via the network interface.
  • the terminal identification device may be deployed in a web server.
  • the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in a web server.
  • the network interface may be a network interface exposed by the communication device containing the terminal identification device to the terminal.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the communication device may also include an acquisition unit, which is used to obtain the fingerprint information of the terminal; and a sending unit, which is also used to send the fingerprint information of the terminal to the terminal identification device.
  • the fingerprint information of the terminal includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address or IP address.
  • the present application further provides a communication device, which is applied to a terminal identification device.
  • the communication device may include, for example, a receiving unit and a processing unit.
  • the receiving unit is configured to receive capability information of a terminal; and the processing unit is configured to identify the type of the terminal based on the capability information of the terminal.
  • the terminal's capability information is obtained by executing a script in a web page.
  • the content of the web page script includes: calling the terminal's browser interface to obtain the terminal's capability information.
  • the content of the web page script may also include: calling a network interface to send the terminal's capability information to the terminal identification device.
  • the terminal identification device may be deployed in a web server.
  • the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in the web server.
  • the network interface may be a network interface exposed to the terminal by the communication device where the terminal identification device resides.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the processing unit is specifically used to: identify the type of the terminal based on the terminal's capability information and the terminal's fingerprint information, where the terminal's fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address, or IP address.
  • the present application further provides a computer storage medium, the computer storage medium including instructions, which, when executed on a processor, implement the following method:
  • the web page includes a script
  • the content of the script may include: calling a browser interface to obtain capability information of the terminal.
  • the script may also include invoking a network interface to transmit the terminal's capability information to the terminal identification device.
  • the terminal identification device may be deployed in a web server, in which case the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in a web server, in which case the network interface may be a network interface exposed by the communication device containing the terminal identification device to the terminal.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the terminal identification device identifies the type of the terminal based on the terminal's capability information and the terminal's fingerprint information, where the terminal's fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address, or IP address.
  • the present application further provides a computer storage medium, the computer storage medium including instructions, which, when executed on a processor, implement the following method:
  • the script includes: calling the browser interface to obtain the terminal's capability information; and
  • the capability information of the terminal is sent to the terminal identification device.
  • the script may also include invoking a network interface to transmit the terminal's capability information to the terminal identification device.
  • the instructions of the computer storage medium are executed on the processor, the following method is specifically implemented: transmitting the terminal's capability information to the terminal identification device via the network interface.
  • the terminal identification device may be deployed in a web server.
  • the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in a web server.
  • the network interface may be a network interface exposed by the communication device containing the terminal identification device to the terminal.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the terminal identification device identifies the type of the terminal based on the terminal's capability information and the terminal's fingerprint information, where the terminal's fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address, or IP address.
  • the present application further provides a computer storage medium, the computer storage medium including instructions, which, when executed on a processor, implement the following method:
  • the terminal's capability information is obtained by executing a script in a web page.
  • the content of the web page script includes: calling the terminal's browser interface to obtain the terminal's capability information.
  • the content of the web page script may also include: calling a network interface to send the terminal's capability information to the terminal identification device.
  • the terminal identification device may be deployed in a web server.
  • the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in the web server.
  • the network interface may be a network interface exposed to the terminal by the communication device where the terminal identification device resides.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the following method is specifically implemented: based on the terminal capability information and the terminal fingerprint information, the terminal type is identified, and the terminal fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address or IP address.
  • the present application further provides a computer program product, comprising a computer program; when the computer program is run on a processor, the following method is implemented:
  • the web page includes a script
  • the content of the script may include: calling a browser interface to obtain capability information of the terminal.
  • the script may also include invoking a network interface to transmit the terminal's capability information to the terminal identification device.
  • the terminal identification device may be deployed in a web server, in which case the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in a web server, in which case the network interface may be a network interface exposed by the communication device containing the terminal identification device to the terminal.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the terminal identification device identifies the type of the terminal based on the terminal's capability information and the terminal's fingerprint information, where the terminal's fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address, or IP address.
  • the present application further provides a computer program product, comprising a computer program; when the computer program is run on a processor, the following method is implemented:
  • the script includes: calling the browser interface to obtain the terminal's capability information; and
  • the capability information of the terminal is sent to the terminal identification device.
  • the script may also include invoking a network interface to transmit the terminal's capability information to the terminal identification device.
  • the computer program of the computer program product runs on a processor, the following method is specifically implemented: transmitting the terminal's capability information to the terminal identification device via the network interface.
  • the terminal identification device may be deployed in a web server.
  • the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in a web server.
  • the network interface may be a network interface exposed to the terminal by a communication device containing the terminal identification device.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the terminal identification device identifies the type of the terminal based on the terminal's capability information and the terminal's fingerprint information, where the terminal's fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address, or IP address.
  • the present application further provides a computer program product, comprising a computer program; when the computer program is run on a processor, the following method is implemented:
  • the terminal's capability information is obtained by executing a script in a web page.
  • the content of the web page script includes: calling the terminal's browser interface to obtain the terminal's capability information.
  • the content of the web page script may also include: calling a network interface to send the terminal's capability information to the terminal identification device.
  • the terminal identification device may be deployed in a web server.
  • the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in the web server.
  • the network interface may be a network interface exposed to the terminal by the communication device where the terminal identification device resides.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the following method is specifically implemented: based on the terminal capability information and the terminal fingerprint information, the terminal type is identified, and the terminal fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address or IP address.
  • the present application provides a communication entity, which includes a processor and a memory; the processor is used to execute instructions stored in the memory so that the communication device implements the method corresponding to the eleventh aspect, the twelfth aspect or the thirteenth aspect and its possible implementation methods.
  • the present application provides a communication entity, which includes a communication interface and a processor; the communication interface is used to perform the sending and receiving operations in the methods corresponding to the aforementioned eleventh aspect, twelfth aspect or thirteenth aspect and their possible implementations; the processor is used to perform the processing operations in the methods corresponding to the aforementioned eleventh aspect, twelfth aspect or thirteenth aspect and their possible implementations.
  • the present application provides a chip system comprising a memory and a processor, wherein the memory is configured to store instructions, and the processor is configured to call and execute the instructions from the memory to implement the methods corresponding to the aforementioned eleventh aspect, twelfth aspect, or thirteenth aspect and their possible implementations.
  • the chip system may include one or more chips, and the communication system in the embodiments of the present application may be, for example, such a chip system.
  • FIG1 is a schematic diagram of a network architecture applicable to an embodiment of the present application.
  • FIG2 is a schematic flow chart of a terminal identification method 100 provided in an embodiment of the present application.
  • FIG3 is a schematic diagram of a network framework applicable to an embodiment of the present application.
  • FIG4 is a flow chart of the method 200 corresponding to FIG3 in an embodiment of the present application.
  • FIG5 is a schematic diagram of another applicable network framework in an embodiment of the present application.
  • FIG6 is a flow chart of method 300 corresponding to FIG5 in an embodiment of the present application.
  • FIG7 is a flow chart of a terminal identification method 400 according to an embodiment of the present application.
  • FIG8 is a schematic structural diagram of a communication device 800 according to an embodiment of the present application.
  • FIG10 is a schematic structural diagram of a communication device 1000 according to an embodiment of the present application.
  • FIG11 is a schematic structural diagram of a communication system 1100 according to an embodiment of the present application.
  • FIG12 is a schematic diagram of a network architecture applicable to an embodiment of the present application.
  • FIG13 is a schematic diagram of another applicable network architecture in an embodiment of the present application.
  • FIG14 is a schematic diagram of another applicable network architecture in an embodiment of the present application.
  • FIG15 is a flow chart of a terminal identification method 500 provided in an embodiment of the present application.
  • FIG16 is a flow chart of a terminal identification method 600 provided in an embodiment of the present application.
  • FIG17 is a schematic flow chart of a terminal identification method 700 provided in an embodiment of the present application.
  • FIG18 is a flow chart of a terminal identification method 800 provided in an embodiment of the present application.
  • FIG19 is a schematic structural diagram of a communication device 1900 according to an embodiment of the present application.
  • FIG20 is a schematic structural diagram of a communication device 2000 according to an embodiment of the present application.
  • FIG21 is a schematic structural diagram of a communication device 2100 according to an embodiment of the present application.
  • FIG22 is a schematic structural diagram of a communication device 2200 according to an embodiment of the present application.
  • FIG23 is a schematic structural diagram of a communication system 2300 in an embodiment of the present application.
  • IoT Internet of Things
  • Different types of terminals are used to implement different functions.
  • users can select and deploy corresponding terminal types based on their needs. It is often necessary to identify the type of terminal accessing the network. This identification is used to perform network asset management, security access, and network optimization based on the identified terminal type. Therefore, accurate identification of terminals in the network is a crucial and necessary step in the network operation.
  • the identification device can identify the terminal based on the fingerprint information of the terminal.
  • This method can be divided into active terminal identification and passive terminal identification according to the method of obtaining the fingerprint information of the terminal.
  • active terminal identification can refer to the identification device scanning the terminal through a possible scanning method, obtaining the terminal's fingerprint information from the terminal's response information to the scan, and determining the type of the terminal by matching the obtained fingerprint information with the fingerprint information in the fingerprint library.
  • the scanning method that the identification device may use to scan the terminal includes but is not limited to any one of the following methods: Simple Network Management Protocol (SNMP) query scanning method, Network Mapper (NMAP) operating system (OS) scanning method or other dynamically extensible detection script scanning method.
  • Passive terminal identification can refer to the identification device collecting the fingerprint information of the terminal and determining the type of the terminal by matching the collected fingerprint information with the fingerprint information in the fingerprint library.
  • fingerprint information may refer to information in the relevant information of the terminal that can be used to identify the terminal, and the fingerprint information may include but is not limited to at least one of the following information: Medium Access Control (MAC) Organizationally Unique Identifier (OUI), Dynamic Host Configuration Protocol Option (DHCP Option), Hypertext Transfer Protocol (Hypertext Transfer Protocol) User Agent (UA), Multicast Domain Name Service (mDNS) or Link Layer Discovery Protocol (LLDP).
  • MAC Medium Access Control
  • UUI Dynamic Host Configuration Protocol
  • DHCP Option Dynamic Host Configuration Protocol Option
  • HTTP Hypertext Transfer Protocol
  • User Agent User Agent
  • mDNS Multicast Domain Name Service
  • LLDP Link Layer Discovery Protocol
  • a fingerprint library may refer to a database that stores fingerprint information for terminals of known types.
  • the fingerprint library may store multiple sets of correspondences between fingerprint information and corresponding terminal types. Therefore, in the above-mentioned terminal identification method, the identification device matches the fingerprint information of the terminal to be identified with the fingerprint information in the fingerprint library to determine the terminal type. Specifically, the identification device searches for fingerprint information that matches the fingerprint information of the terminal to be identified from the multiple sets of fingerprint information in the fingerprint library, and determines the terminal type in the correspondence relationship where the matching fingerprint information exists as the type of the terminal to be identified.
  • the identification device can identify terminals through clustering based on the characteristics of the service traffic or service messages generated by the terminals after they join the network. For example, the identification device clusters multiple terminals to be identified based on the waveform similarity of the service traffic generated by the multiple terminals after they join the network, and manually labels the type corresponding to each cluster to determine that the terminal type is the type of the class to which the terminal belongs. For another example, the identification device clusters multiple terminals to be identified based on the content similarity of the service messages generated by the multiple terminals after they join the network, and manually labels the type corresponding to each cluster to determine that the terminal type is the type of the class to which the terminal belongs.
  • this approach can also be used as a method for accumulating a fingerprint library, accumulating identification results into the fingerprint library to improve the recognition rate of terminal identification based on terminal fingerprint information.
  • this approach requires that the terminals to be identified must have generated service traffic or service messages after joining the network. Terminals that have connected to the network but have not yet generated service traffic or service messages cannot be identified using this approach.
  • the recognition accuracy of this method also depends on the amount of business traffic or business messages generated. Therefore, for terminals that access the network and generate a small amount of business traffic or business messages, the accuracy of the recognition results obtained by this method is difficult to guarantee.
  • the terminal identification methods currently used are unable to effectively identify the ever-increasing variety of terminals, making it difficult to guarantee the terminal identification rate.
  • terminal admission can be understood as when a terminal accesses the network but does not operate normally, the network admission controller (also called the network access controller) in the network determines whether the terminal can be admitted to the network based on the terminal type.
  • the admitted terminal can operate normally in the network and provide the corresponding functions or services of the terminal.
  • dumb terminals can be a type of terminal that is divided according to whether it has a processing function. This type of terminal has no processing function and usually does not have a microprocessor. For example, printers, cameras, etc. are all dumb terminals. According to whether it has a processing function, in addition to dumb terminals, terminals can also include smart terminals (also called smart terminals). Smart terminals can refer to terminals with certain processing functions.
  • This type of terminal has its own microprocessor and control circuit.
  • smart phones, laptops, etc. are all smart terminals.
  • some terminals with single functions and simple systems are usually classified as dumb terminals.
  • dumb terminals For example, a dumb terminal's MAC OUI typically uses the first six characters of its MAC address to indicate its manufacturer. This manufacturer is only a reference and is not accurate. It also fails to indicate other information, such as the type of dumb terminal.
  • dumb terminals cannot open web pages to introduce themselves, their HTTP UA, a common terminal fingerprint, cannot be obtained.
  • mDNS a common terminal fingerprint
  • LLDP can only be obtained by IP phones; dumb terminals cannot obtain LLDP, a common terminal fingerprint. Clearly, obtaining the fingerprint information of dumb terminals is difficult.
  • an embodiment of the present application provides a terminal identification method, which achieves effective and accurate identification of the terminal to be identified based on clustering of the open ports of the terminal to be identified. Even if the terminals in the network are diverse, this method can improve the terminal identification rate to a certain extent.
  • the method may include, for example: first, the identification device obtains the open port information of multiple terminals, and the open port information of each terminal indicates at least one port of each terminal that is in an open state; then, the identification device can cluster the multiple terminals based on the open port information of each terminal, and identify at least one cluster to which the multiple terminals belong based on the clustering results, where the terminals included in each cluster are of the same type.
  • the open port information of the terminal to be identified is used as the basis for clustering the terminals to be identified. Then, in the clustering results, the open port information of the terminals belonging to the same cluster is similar, and the terminals belonging to the same cluster are likely to be of the same type, thereby achieving effective and accurate identification of the terminals, overcoming the problem that the current terminal identification method needs to accumulate the fingerprint information of the terminal or requires business traffic (or business messages) after the terminal enters the network, and cannot guarantee the recognition rate of the terminal. In the scenario where various types of terminals emerge in an endless stream, the recognition rate of the terminal can be guaranteed.
  • the method provided in the embodiment of the present application can be adapted to various scenarios with terminal identification requirements, such as automatic admission of dumb terminals.
  • the method provided in the embodiment of the present application can effectively identify the type of terminal and ensure the recognition rate of the terminal.
  • the network architecture adapted by the embodiments of the present application can be seen in Figure 1.
  • the network architecture may include at least: an identification device 10, and terminals 21, 22, ..., and 2N to be identified, where N is an integer greater than or equal to 1.
  • the identification device 10 is used to implement the methods provided in the embodiments of the present application (such as the following method 100) to identify terminals 21, 22, ..., and 2N.
  • the identification device 10 can obtain the open port information 1 of terminal 21, the open port information 2 of terminal 22, ... the open port information N of terminal 2N, and thus cluster the terminals 21 to 2N according to the open port information 1 to the open port information N to obtain the clustering results.
  • the clustering results may include cluster 1, cluster 2, ...
  • cluster M where M is a positive integer less than N, each cluster includes at least one terminal, and the types of terminals in each cluster are the same.
  • cluster 1 includes terminal 21 and terminal 2N, and terminal 21 and terminal 2N are both printers.
  • cluster 2 includes terminal 22, terminal 23 and terminal 24, and terminal 22, terminal 23 and terminal 24 are all electronic class signs.
  • cluster 3 includes terminal 25 and terminal 26, and terminal 25 and terminal 26 are both information screens.
  • the open port information is used to indicate the ports in the open state on the corresponding terminal. Based on the open port information, the identification device 20 can determine the port numbers and the number of ports in the open state on the corresponding terminal. For example, open port information 1 is used to indicate that the ports in the open state on terminal 21 are Transmission Control Protocol (TCP) 80 and TCP 81. Based on open port information 1, the number of ports in the open state on terminal 21 is determined to be 2, and the specific port numbers in the open state are TCP 80 and TCP 81. Then, the identification device 20 clusters terminals 21 to 2N based on open port information 1 to open port information N.
  • TCP Transmission Control Protocol
  • the identification device 20 can determine the number and/or port numbers of ports in the open state on terminals 21 to 2N based on open port information 1 to open port information N, and group terminals with the same or similar number of open ports and/or a high degree of similarity in open port numbers (e.g., meeting a preset similarity threshold) into the same cluster.
  • the similarity of the port numbers in the open state can be related to the number of port numbers in the same open state. For example, two port numbers are the same between the port numbers in the open state of terminal 21 and the port numbers in the open state of terminal 22, and four port numbers are the same between the port numbers in the open state of terminal 21 and the port numbers in the open state of terminal 2N. Then, it can be considered that the similarity of the port numbers in the open state of terminal 21 and terminal 2N is higher than the similarity of the port numbers in the open state of terminal 21 and terminal 22.
  • the identification device can be any communication device in the network that has the ability to implement the methods provided in the embodiments of the present application.
  • the communication device can be a network device such as a switch or router.
  • the identification device can be a functional module, component, or chip in any communication device in the network that has the ability to implement the methods provided in the embodiments of the present application, such as a single board or line card on the network device.
  • the embodiments of the present application do not specifically limit the form and type of the identification device.
  • a terminal may refer to any terminal that can be deployed in a network, and may be a smart terminal or a dumb terminal.
  • the embodiments of the present application do not specifically limit the form and type of the terminal.
  • FIG 2 is a flow chart illustrating a terminal identification method 100 provided in an embodiment of the present application.
  • the present embodiment is described using an identification device as the execution entity.
  • This identification device may be, for example, identification device 10 in Figure 1 , or may correspond to the network controller 30 of the network framework shown in Figure 3 , the network controller 30 of the network framework shown in Figure 5 , or communication device 800 .
  • the identification device executing this method 100 may be the NAC itself or a corresponding functional module within the NAC.
  • the method 100 may include, for example, the following steps S101 to S103 :
  • S101 Acquire open port information of a plurality of terminals, where the open port information of each terminal indicates at least one open port of each terminal.
  • the "terminal” in the method 100 can be understood as a terminal to be identified, for example, it can include one or more of the terminal 21, terminal 22, ..., terminal 2N in Figure 1.
  • the terminal to be identified can be all terminals in the network, then S101 can include: the identification device obtains the open port information of all terminals in the network.
  • the terminal to be identified can be a terminal belonging to a target network segment in the network, then S101 can include: the identification device obtains the open port information of all terminals belonging to the target network segment in the network.
  • the terminal to be identified can be a terminal belonging to a target VLAN in the network, then S101 can include: the identification device obtains the open port information of all terminals belonging to the target VLAN in the network.
  • the terminal to be identified can be a terminal belonging to a target BD in the network, then S101 can include: the identification device obtains the open port information of all terminals belonging to the target BD in the network.
  • a terminal has multiple ports, each of which can be in an open state or a closed state.
  • the terminal can interact with other communication devices through the open ports.
  • the terminal can open a specific port so that the specific port is in an open state, thereby connecting to the server corresponding to the terminal based on the open port.
  • the terminal provides corresponding services to the user.
  • the printer can open port 631, and other devices can connect to the printer based on the Internet Printing Protocol (IPP), thereby enabling other devices to manage the printer and use the printing services of the printer.
  • IPP Internet Printing Protocol
  • the open port information of a terminal may refer to any information that can indicate at least one port of the terminal that is in an open state.
  • the specific embodiment of the open port information is not limited in the embodiments of the present application.
  • the open port information may be a set of open ports.
  • the ports in the open state of terminal 21 include TCP port 80 and TCP port 81.
  • the open port information 1 of terminal 21 may be represented as an open port set such as ⁇ TCP 80, TCP 81 ⁇ .
  • the open port information may include the number of ports in the open state and the port number in the open state.
  • the open port information 1 of terminal 21 may also be represented as ⁇ number of ports in the open state: 2; port number in the open state: ⁇ TCP 80, TCP 81 ⁇ .
  • the terminal's open port information can be obtained by a port scanning device performing a port scan on each of a plurality of terminals.
  • the process of the port scanning device performing a port scan on a terminal can, for example, include: the port scanning device generating a port probe message corresponding to each port to be detected on the terminal, and sending the generated port probe message to the terminal; if the port to be detected by the port probe message received by the terminal is in an open state, the terminal sends a response message corresponding to the port probe message to the port scanning device; if the port to be detected by the port probe message received by the terminal is not in an open state, the terminal does not generate a response message corresponding to the port probe message; in this way, the port scanning device can determine at least one open port on the terminal based on the received response message to the port probe message, and obtain the terminal's open port information based on the at least one open port determined on the terminal.
  • the number of response messages corresponding to the port probe messages received by the port scanning device is equal to the number of
  • the terminal 21 includes 6 ports: TCP port 78, TCP port 79, TCP port 80, TCP port 81, TCP port 82 and TCP port 83.
  • the ports in the open state among the 6 ports include: TCP port 80, TCP port 81 and TCP port 83, and the ports to be detected among the 6 ports on the terminal 21 include: TCP port 78, TCP port 79, TCP port 80 and TCP port 81.
  • the process of the port scanning device performing a port scan on the terminal 21 may include: the port scanning device generates 4 port detection messages: port detection message 1 to port detection message 4, wherein the port detection message 1 to port detection message 4 are used to detect TCP port 78, TCP port 79, TCP port 80 and TCP port 81 respectively.
  • terminal 21 Since TCP port 80 and TCP port 81 of terminal 21 are in an open state, terminal 21 generates response message 3 for port detection message 3 and response message 4 for port detection message 4; terminal 21 sends response message 3 and response message 4 to the port scanning device; the port scanning device determines that TCP port 80 is in an open state according to response message 3, and determines that TCP port 81 is in an open state according to response message 4.
  • the port identification device can determine the open port information of the terminal 21, and the open port information is used to indicate that the ports in the terminal 21 that are in an open state include TCP port 80 and TCP port 81.
  • the type of port to be detected is different, and the type of port detection message constructed is also different.
  • the port to be detected is a TCP type port
  • the port detection message can be a TCP message
  • the port detection message can be a UDP message
  • the port detection message may include indication information indicating the port to be detected.
  • the indication information may be the port number of the port to be detected, and the indication information may be carried in the destination port (Destination Port, Dst Port) field of the port detection message.
  • the port to be detected is TCP port 80 of the terminal, then the port detection message may be a TCP message.
  • the protocol field TCP
  • the Dst Port field 80.
  • the ports to be detected can be flexibly determined according to actual needs.
  • the ports to be detected can be all the ports of the terminal. Then, during the process of the port scanning device performing port scanning on the terminal, the port scanning device needs to send port detection messages corresponding to each port to the terminal, and the number of port detection messages sent is the same as the number of ports included in the terminal.
  • the ports to be detected can be a specified part of the ports of the terminal (which can also be understood as a part of the specified ports among all the ports of the terminal).
  • the specified part of the ports can be commonly used ports that need to be detected (such as the top 100 most commonly used ports (i.e., Top 100) in the commonly used port list), or can be designated ports that need to be detected (such as ports with designated port numbers according to the needs of actual application scenarios). Then, during the process of the port scanning device performing port scanning on the terminal, the port scanning device needs to send port detection messages corresponding to each designated port to the terminal, and the number of port detection messages sent is the same as the number of designated ports of the terminal.
  • the port scanning device upon the start of method 100, the port scanning device is triggered to execute the port scanning process of the terminal to obtain the terminal's open port information.
  • the port scanning device may pre-execute the port scanning process of the terminal and save the open port information of multiple terminals.
  • the identification device reads the pre-saved open port information of the multiple terminals from the port scanning device.
  • the port scanning device obtaining the open port information of the terminal is equivalent to the identification device obtaining the open port information of the terminal.
  • S101 can be understood as: the network device including the port scanning device and the identification device obtains the open port information of multiple terminals by performing port scanning on the port to be detected of each terminal. Specifically, it can include: the network device sends port detection messages to the multiple terminals and obtains the open port information of the multiple terminals based on the received response messages.
  • S101 can include: the network device including the port scanning device and the identification device performs port scanning on all terminals in the network to obtain the open port information of the multiple terminals (i.e., all terminals in the network).
  • S101 can include: the network device including the port scanning device and the identification device performs port scanning on all terminals in the target network segment to obtain the open port information of the multiple terminals (i.e., all terminals in the target network segment).
  • S101 may include, for example: the network device including a port scanning device and an identification device performs a port scan on all terminals in the network to obtain open port information of the multiple terminals (i.e., all terminals in the target VLAN in the network).
  • S101 may include, for example: the network device including a port scanning device and an identification device performs a port scan on all terminals in the network to obtain open port information of the multiple terminals (i.e., all terminals in the target BD in the network).
  • the port scanning device and the identification device belong to two network devices, then after the port scanning device obtains the open port information of the terminal, it can send the obtained open port information of the terminal to the identification device.
  • S101 can be understood as: the network device where the identification device is located receives the open port information of multiple terminals sent by the network device where the port scanning device is located.
  • S102 Cluster the multiple terminals according to the open port information of each terminal.
  • the identification device may identify the type of the terminal only based on the open port information of the terminal.
  • S102 may include: the identification device clusters the multiple terminals according to the similarity of the open port information of the multiple terminals.
  • the similarity between the open port information of the terminals can be determined based on the number and port numbers of the ports in the open state of the terminals, and the calculation strategy for determining the similarity can be designed according to actual needs.
  • the similarity between the open port information of the terminals the number of the same port numbers in the open state + (1-the difference in the number of ports in the open state). It is still assumed that the open port information 1 of terminal 1 indicates that the port numbers of terminal 1 in the open state are: TCP 79, TCP 80 and TCP 81, the open port information 2 of terminal 2 indicates that the port numbers of terminal 2 in the open state are: TCP 80 and TCP 81, the open port information 3 of terminal 3 indicates that the port numbers of terminal 3 in the open state are: TCP 78, TCP 80 and TCP 81, and the open port information 4 of terminal 4 indicates that the port numbers of terminal 4 in the open state are: TCP 78, TCP 80 and TCP 82.
  • the similarity value the more similar the open ports between the terminals are, and the more likely the terminals are to belong to the same type. Conversely, the smaller the similarity value, the less similar the open ports between the terminals are, and the more likely the terminals are to belong to different types.
  • clustering of multiple terminals based on the similarity of the open port information of multiple terminals can be achieved through any clustering strategy, clustering algorithm or clustering model, and the embodiments of the present application do not make specific limitations.
  • the clustering in S102 can be achieved through a pre-configured clustering strategy, and the clustering strategy can be, for example: pre-configuring a similarity range, dividing two terminals whose similarities belong to the similarity range into one cluster, and each terminal can only belong to one cluster.
  • the clustering in S102 can be achieved through a clustering algorithm, and the clustering algorithm can be, for example, the density-based spatial clustering of applications with noise (Density-Based Spatial Clustering of Applications with Noise, DBSCAN) algorithm or the k-means clustering algorithm (k-means clustering algorithm, K-means).
  • DBSCAN Density-Based Spatial Clustering of Applications with Noise
  • K-means clustering algorithm K-means clustering algorithm
  • the clustering results obtained in S102 include at least one cluster, each of which includes at least one terminal of the same type.
  • the multiple terminals in S101 include terminals 1 to 10.
  • three clusters are obtained: clusters 1 to 3.
  • Cluster 1 includes terminals 1, 3, and 5;
  • cluster 2 includes terminals 2, 4, and 8; and
  • cluster 3 includes terminals 6, 7, 9, and 10.
  • the "multiple terminals" in method 100 may refer to terminals newly connected to the network during the time interval between the last identification of the terminals in the network and the execution of method 100.
  • S102 may include: the identification device determining, based on similarity between the open port information of the multiple terminals and the open port information of each cluster of the known type, the cluster of the known type to which each of the multiple terminals belongs, thereby completing clustering of the multiple terminals.
  • the similarity between the open port information of the terminal and the open port information of each cluster of known types can be determined based on the number and port number of the terminals in the open state, and the number and port number of the terminals in the open state at the cluster center of each cluster of known types.
  • the similarity calculation strategy can be designed according to actual needs.
  • the clusters of known types include cluster 1 and cluster 2.
  • the terminal at the cluster center of cluster 1 is terminal 1
  • the terminal at the cluster center of cluster 2 is terminal 8.
  • the multiple terminals to be identified include terminal 31, terminal 32, and terminal 33.
  • the identification device needs to calculate the similarity between the open port information of terminal 31, terminal 32, and terminal 33 and the open port information of terminal 1, and calculate the similarity between the open port information of terminal 31, terminal 32, and terminal 33 and the open port information of terminal 8. By comparing the calculated similarities, it is determined whether terminals 31, terminal 32, and terminal 33 should be classified into cluster 1 or cluster 2.
  • the identification device clusters the multiple terminals based on the similarity between the open port information of the multiple terminals and the open port information of each cluster of known types. This may be: for each terminal in the "multiple terminals", the terminal is assigned to the cluster with the greatest similarity to the open port information of the terminal. For example, if the similarity between the open port information of terminal 31 and the open port information of terminal 1 is greater than the similarity between the open port information of terminal 31 and the open port information of terminal 8, then terminal 31 is assigned to cluster 1 where terminal 1 is located. Similarly, if the similarity between the open port information of terminal 32 and the open port information of terminal 1 is less than the similarity between the open port information of terminal 32 and the open port information of terminal 8, then terminal 31 is assigned to cluster 2 where terminal 8 is located.
  • the clustering results in this example may include not only clusters of known types after executing S102, but also newly clustered clusters.
  • the clustering method of the newly clustered clusters please refer to the relevant instructions of the first example above.
  • subsequent processing please refer to the instructions related to the first example below.
  • the clustering results obtained in S102 may include clusters of known types, each of which includes at least one terminal of the same type.
  • the multiple terminals in S101 include terminals 31 to 35, and the clusters of known types include clusters 1 to 3.
  • terminals 31 and 33 are added to cluster 1, terminals 32, 34, and 35 are added to cluster 2, and no new terminals are added to cluster 3.
  • the terminal type can be identified based on the terminal's open port information combined with other terminal information.
  • other terminal information may include, but is not limited to, the terminal's Media Access Control (MAC) address and/or the terminal's IP address.
  • MAC Media Access Control
  • the method may further include: the identification device obtains the MAC address of each terminal from the plurality of terminals.
  • S102 may include: the identification device clustering the plurality of terminals based on the open port information of each terminal and the MAC address of each terminal.
  • the manner in which the identification device obtains the MAC address of each terminal from the plurality of terminals can refer to the manner in which the identification device obtains the open port information of each terminal from the plurality of terminals.
  • the identification device may obtain the open port information of the terminal and the MAC address of the terminal by performing a port scan on all or a specified portion of the ports of the terminal.
  • the identification device may receive the MAC address of the terminal from a port scanning device that receives the open port information of the terminal.
  • S102 may include: the identification device determines the comprehensive similarity between the terminals based on the similarity of the open port information between each terminal and the similarity of the MAC address between each terminal; thereby, the identification device clusters multiple terminals based on the comprehensive similarity between the terminals.
  • the calculation method of the similarity of the open port information between the terminals can refer to the description above.
  • the similarity of MAC addresses between terminals is calculated based on the prefix similarity of the MAC addresses in one case, that is, starting from the highest bit of the MAC address, the similarity of the two MAC addresses is determined based on the number of consecutive identical bits. The more consecutive identical bits there are, the higher the similarity of the MAC addresses of the two terminals is considered to be; the fewer consecutive identical bits there are, the lower the similarity of the MAC addresses of the two terminals is considered to be. For example, the MAC address of terminal 1 is 000BD4041508, the MAC address of terminal 2 is 000BD4042608, and the MAC address of terminal 3 is 000BD4160508.
  • User A assigns 000BD404 to printer terminal 1 and printer terminal 2, and the MAC addresses are: 000BD4041508 and 000BD4042608 respectively.
  • User A assigns 000BD416 to smart screen terminal 3 and smart screen terminal 4, and the MAC addresses are: 000BD4160508 and 000BD4160609 respectively.
  • the MAC address can be considered as a string, and the similarity of the MAC addresses between terminals is calculated based on the similarity of the strings. That is, the number of characters with the same values at corresponding positions in the MAC addresses of the two terminals is checked. The similarity of the two MAC addresses is determined based on the number of characters with the same values. The more characters with the same values, the higher the similarity of the MAC addresses of the two terminals; the fewer characters with the same values, the lower the similarity of the MAC addresses of the two terminals. For example, the MAC address of terminal 1 is 000BD4041508, the MAC address of terminal 2 is 000BD4042608, and the MAC address of terminal 3 is 000BD4160508.
  • the similarity of the MAC addresses of terminal 1 and terminal 2 is higher than that of the MAC addresses of terminal 1 and terminal 3. In this way, it is possible to provide a certain reference for whether two terminals are of the same type based on the character similarity of the MAC addresses.
  • the comprehensive similarity between terminals can refer to an indicator that can reflect the similarity between the two factors of open port information and MAC address between the terminals.
  • the comprehensive similarity between terminals can be, for example, the sum of the similarity of open port information between terminals and the similarity of MAC addresses between terminals, or it can be the average or weighted average of the similarity of open port information between terminals and the similarity of MAC addresses between terminals.
  • the weight can be flexibly set according to actual needs.
  • the method may further include: the identification device obtains the IP address of each terminal from the plurality of terminals.
  • S102 may include: the identification device clustering the plurality of terminals based on the open port information of each terminal and the IP address of each terminal.
  • the manner in which the identification device obtains the IP address of each terminal from the plurality of terminals can refer to the manner in which the identification device obtains the open port information of each terminal from the plurality of terminals.
  • the identification device may perform a port scan on all or a specified portion of the ports of the terminal to obtain the open port information of the terminal and the IP address of the terminal.
  • the identification device may receive the IP address of the terminal from a port scanning device that receives the open port information of the terminal.
  • S102 may include: the identification device determines the comprehensive similarity between the terminals based on the similarity of the open port information between each terminal and the similarity of the IP addresses between each terminal; thereby, the identification device clusters multiple terminals based on the comprehensive similarity between the terminals.
  • the calculation method of the similarity of the open port information between terminals can refer to the description of the method of calculating the similarity of the open port information between terminals above.
  • the calculation method of the similarity of the IP addresses between terminals can refer to the calculation method of calculating the similarity of the IP addresses between terminals above.
  • the comprehensive similarity between terminals can refer to an indicator that can reflect the similarity between the two factors of open port information and IP addresses between the terminals.
  • the comprehensive similarity between terminals can be, for example, the sum of the similarity of open port information between terminals and the similarity of IP addresses between terminals, or it can be the average or weighted average of the similarity of open port information between terminals and the similarity of IP addresses between terminals.
  • the weight can be flexibly set according to actual needs.
  • the method may further include: the identification device obtains the MAC address and IP address of each terminal in the plurality of terminals. Then, S102 may include: the identification device clusters the plurality of terminals based on the open port information of each terminal and the MAC address and IP address of each terminal.
  • the manner in which the identification device obtains the MAC address and IP address of each terminal in the plurality of terminals can refer to the manner in which the identification device obtains the open port information of each terminal in the plurality of terminals.
  • the identification device may obtain the open port information of the terminal by performing a port scan on all or a specified portion of the ports of the terminal to obtain the MAC address and IP address of the terminal.
  • the identification device may receive the MAC address and IP address of the terminal from a port scanning device that receives the open port information of the terminal.
  • S102 may include: the identification device determines the comprehensive similarity between the terminals based on the similarity of the open port information between each terminal, the similarity of the MAC addresses between each terminal, and the similarity of the IP addresses between each terminal; thereby, the identification device clusters multiple terminals based on the comprehensive similarity between the terminals.
  • the method for calculating the similarity of open port information between terminals please refer to the description above regarding the method for calculating the similarity of open port information between terminals.
  • the method for calculating the similarity of IP addresses between terminals please refer to the description above regarding the method for calculating the similarity of IP addresses between terminals.
  • the method for calculating the similarity of MAC addresses between terminals please refer to the description above regarding the method for calculating the similarity of MAC addresses between terminals.
  • the comprehensive similarity between terminals can refer to an indicator that can reflect the similarity of the three factors of open port information, MAC address and IP address between the terminals.
  • the comprehensive similarity between terminals can be, for example, the sum of the similarity of open port information between terminals, the similarity of MAC addresses between terminals and the similarity of IP addresses between terminals, or it can be the average value or weighted average value of the similarity of open port information between terminals, the similarity of MAC addresses between terminals and the similarity of IP addresses between terminals.
  • the weights can be flexibly set according to actual needs.
  • the identification device clusters multiple terminals based on the comprehensive similarity between the terminals. Please refer to the implementation method of the above identification device clustering multiple terminals based on the similarity of open port information between the terminals.
  • a cluster is a collection of terminals belonging to a single type in the clustering results. If multiple terminals to be identified belong to the same type, a single cluster corresponding to that type is identified based on the clustering results. If multiple terminals to be identified belong to multiple types, multiple clusters are identified based on the clustering results, with the number of clusters being the same as the number of types the terminals belong to.
  • S103 may include, for example, determining, based on the clustering results, the type of each cluster in at least one cluster to which the multiple terminals belong.
  • the type of a cluster is the type of all terminals belonging to that cluster. Therefore, determining the type of each cluster is equivalent to identifying the types of the terminals in each cluster, thereby achieving terminal identification. Determining the type of each cluster in S103 may be performed automatically, through a combination of automatic identification and manual confirmation, through manual labeling, or through a combination of automatic identification and manual labeling.
  • the type of the cluster may be automatically identified based on an automatic matching strategy, a local identification strategy, a machine learning model, or the like.
  • S103 may include: for any second cluster in the at least one cluster, in response to determining that the open port information of each terminal in the second cluster includes the first target port, determining that the type of the second cluster is the first type corresponding to the first target port.
  • the identification device may pre-configure certain correspondences between terminal types and ports as a basis for matching. Then, for each of the at least one determined clusters, the identification device checks whether the open ports indicated by the open port information of each terminal in the cluster match any of the correspondences. If so, the type of the cluster is determined to be the type of the terminal included in the matched correspondence.
  • the identification device pre-configured correspondences include correspondence 1 between a printer and port 631, and the identification device finds that the open ports indicated by the open port information of each terminal in cluster 1 among the three determined clusters all include port 631, cluster 1 may be considered to match correspondence 1, and the type of cluster 1 is determined to be the terminal type of printer in correspondence 1.
  • S103 may include: for any second cluster in at least one cluster, in response to determining that one or more terminals in the second cluster belong to the first type, determining that the type of the second cluster is the first type.
  • the identification device may select at least one terminal in each of the at least one determined clusters, identify the type of the selected terminal based on any possible method, and use the type as the type of the cluster.
  • the method for identifying the type of the selected terminal may, for example, adopt fingerprint recognition, business traffic (or business message) clustering, etc.
  • the identification device selects terminal 1 in cluster 1 of the three determined clusters, and determines that terminal 1 is a smart screen based on fingerprint recognition.
  • the identification device may determine that the type of cluster 1 is a smart screen, and the type of all terminals in cluster 1 (including terminal 1) is a smart screen. It should be noted that in this implementation, the fewer terminal types selected, the faster the cluster type is identified and the higher the recognition efficiency; the more terminal types selected, the more accurate and reliable the cluster type is identified, but the recognition efficiency and recognition rate will be affected to a certain extent.
  • the identification result of the terminal may include: the type corresponding to the cluster of the specific type, and further, the number of terminals included in the cluster of the specific type.
  • the method 100 may further include: a page displaying the identification result of the terminal, which may include, for example, a display item corresponding to each cluster in at least one cluster, and the display content of each display item may include, but is not limited to: the type of the corresponding cluster, the number of terminals included in the cluster, and an operation control, which provides the user with several operable operation items, and the operability may include, but is not limited to: viewing operation, editing operation, confirmation operation, etc.
  • the user can view the terminals included in the cluster by clicking the viewing operation; the user can modify the type of the cluster and the type of one or several terminals included in the cluster by clicking the editing operation; the user can confirm the automatically identified type of the cluster by clicking the confirmation operation.
  • S103 may include: for any second cluster in the at least one cluster, the identification device determines the type of the second cluster as the first type based on automatic identification; then, in response to an edit operation or confirmation operation on the first type of the second cluster, determining the type of the second cluster as the second type. If the user confirms the first type of the second cluster, the second type is the same as the first type.
  • the user finds that the automatic identification result (i.e., the first type) is inaccurate, the user can identify the type of the second cluster based on any other method, determine the second cluster as the second type, and then perform an edit operation on the first type of the second cluster to change the type of the second cluster from the first type to the second type.
  • the second type is different from the first type.
  • the automatic identification + manual confirmation method can improve the accuracy of terminal recognition while ensuring recognition efficiency.
  • S103 may include: for one or more clusters whose specific types cannot be identified, displaying the types of one or more clusters as unknown types; manually marking the specific types of one or more clusters.
  • the marking method for clusters of unknown types can be, for example: for any first cluster in the cluster of unknown type, identifying the type of one or more terminals in the first cluster, and marking the type as the type of the first cluster. In this way, through the method of automatic identification + manual marking, the type of each cluster can be determined, and the recognition rate of the terminal can be guaranteed.
  • the method 100 may also include: a process in which the recognition device corrects the clustering results.
  • the recognition device correcting the clustering results may include: when the type of the terminal is inconsistent with the type of the cluster to which the terminal belongs, changing the cluster to which the terminal belongs according to the type of the terminal. Specifically, on the page displaying the terminal recognition results, the user can view the terminals belonging to a certain display entry through a viewing operation. If it is found that a terminal does not belong to the same type as other terminals under the entry, the user can migrate the terminal from the entry to another display entry. The type of the cluster corresponding to the migrated entry is the same as the type of the terminal.
  • the recognition device migrates terminal 1 to cluster 2 corresponding to the smart screen. After the migration, cluster 1 no longer includes terminal 1, and cluster 2 includes terminal 1.
  • the identification results can be used in any scenario.
  • the recognition results can be integrated into the user's digital map, displaying the user's network topology.
  • the map will also display the terminals deployed at that point.
  • the displayed terminals are displayed based on the recognition results, and other terminal details can also be displayed. In this way, by integrating terminal recognition results into the digital map, the information provided to the user is enriched, making it easier for users to deploy, manage, and control their network.
  • network access control can be performed on terminals based on their type.
  • terminals 1 and 2 which are electronic signage terminals, are automatically allowed access and assigned to VLAN 100.
  • Terminals 3, 4, and 5, which are smart screen terminals, are automatically allowed access and assigned to VLAN 200.
  • configuration information can be sent to various types of terminals based on their type, completing automatic network configuration for each type of terminal.
  • This configuration information can be sent by an identification device or other network device with information configuration capabilities to the network device to which the terminal is connected for network configuration. In this way, by applying the terminal identification results to the terminal's automatic configuration scenario, rapid and efficient terminal configuration is achieved.
  • the open port information of the terminal to be identified is used as the basis for clustering the terminals to be identified. Then, in the clustering results, the open port information of the terminals belonging to a cluster is similar, and the terminals belonging to a cluster are likely to belong to the same type, thereby achieving effective and accurate identification of the terminals, overcoming the problem that the current terminal identification method needs to accumulate the fingerprint information of the terminal or needs to have the business traffic (or business message) after the terminal enters the network, and cannot guarantee the recognition rate of the terminal. In the scenario where various types of terminals emerge in an endless stream, the recognition rate of the terminal can be guaranteed.
  • the embodiment of the present application is explained by taking the identification of the type of terminal as an example.
  • the method provided in the embodiment of the present application can also use the open port information of the terminal, or combine the open port information of the terminal and other information of the terminal to realize the identification of other attribute information of the terminal through clustering.
  • the other attribute information of the terminal may, for example, include but is not limited to at least one of the following information: the manufacturer to which the terminal belongs, the model of the terminal or the operating system used by the terminal.
  • the specific implementation method is not limited in the embodiment of the present application.
  • the network framework may include: a network controller 30, a network 3, and a terminal 40.
  • Network 3 may include: a core layer device 31, an aggregation layer device 32, an aggregation layer device 33, an access layer device 34, an access layer device 35, and an access layer device 36.
  • the network controller 30 has at least the corresponding functions of the identification device and the port scanning device in the method provided in the embodiment of the present application.
  • the network architecture shown in Figure 3 is suitable for smaller networks.
  • the terminal identification process can refer to the method 200 shown in Figure 4.
  • the method 200 may include:
  • S201 The user connects the terminal 40 to the network 3 shown in FIG3.
  • the terminal 40 can be a wired terminal, then the terminal 40 can be connected to the access layer device 35 through a network cable; the terminal 40 can also be a wireless terminal, then the terminal 40 can be connected to the access layer device 35 through a service set identifier (Service Set Identifier, SSID).
  • SSID Service Set Identifier
  • S202 The user enables the terminal identification function on the network controller 30 and pre-configures the configuration information and network admission control policy of certain types of terminals in the network.
  • the network controller 30 performs a port scan on the terminal 40 to obtain the MAC address and open port information of the terminal 40 .
  • the network controller 30 can send the port detection message to the terminal 40 through the core layer device 31, the aggregation layer device 32 and the access layer device 35 in sequence. If the detected port on the terminal 40 is in an open state, the response message corresponding to the port is fed back to the network controller 30, so that the network controller 30 can determine the MAC address and open port information of the terminal 40 based on the received response message.
  • the scope of the port scan can be: terminals belonging to the target network segment, target VLAN or target BD, or terminals in the entire network. If a port scan is performed on terminals in the entire network, the port scan can be triggered by the Address Resolution Protocol (ARP) when the terminal goes online.
  • ARP Address Resolution Protocol
  • the network controller 30 performs clustering based on the similarity between the MAC addresses and the open port information of the terminals to be identified, and obtains a clustering result.
  • the terminals to be identified include the terminal 40 in FIG. 3 .
  • S205 The user marks the type of each cluster in the clustering result to obtain an identification result of the terminal to be identified.
  • the network controller 30 automatically sends pre-configured content to the access layer device to which the terminal is connected, thereby achieving automatic control of the terminal.
  • the pre-configured content sent may include the configuration information of the corresponding type of terminal in the network and the network access control policy. For example, the identification result determines that terminal 40 belongs to cluster 1, and the type of cluster 1 is a printer. Then, the configuration information 1 and network access control policy 1 of the printer in the network can be sent to the access layer device 35 connected to the terminal 40.
  • the configuration information 1 may include parameters such as the bandwidth and priority of the printer in the network.
  • the network access control policy 1 may include automatic admission of the printer and access to VLAN 20.
  • the network framework may include: a network controller 30, a network 3, and a terminal 40.
  • the network 3 may include: a core layer device 31, an aggregation layer device 32, an aggregation layer device 33, an access layer device 34, an access layer device 35, and an access layer device 36.
  • the network controller 30 at least has the function corresponding to the identification device in the method provided in the embodiment of the present application, and any device in the network 3 has the function corresponding to the port scanning device in the method provided in the embodiment of the present application.
  • the method 300 shown in Figure 6 is described as an example in which the access layer device 35 has the function corresponding to the port scanning device in the method provided in the embodiment of the present application.
  • the network architecture shown in Figure 5 is suitable for large-scale networks.
  • the link between the network controller 30 and the terminal 40 may be disconnected, or the network controller 30 may perform port scanning on a large number of terminals, which is costly. In this case, it is not reasonable to integrate the functions corresponding to the identification device and the port scanning device on the network controller 30.
  • the process of terminal identification can refer to the method 600 shown in Figure 6.
  • the method 300 may include:
  • S301 The user connects the terminal 40 to the network 3 shown in FIG5.
  • the terminal 40 may be a wired terminal, and then the terminal 40 may be connected to the access layer device 35 via a network cable; the terminal 40 may also be a wireless terminal, and then the terminal 40 may be connected to the access layer device 35 via an SSID.
  • S302 The user enables the terminal identification function on the network controller 30 and pre-configures the configuration information and network admission control policy of certain types of terminals in the network.
  • the network controller 30 notifies the access layer device 35 to perform a port scan on the terminal 40 .
  • the access layer device 35 performs a port scan on the terminal 40 to obtain the MAC address and open port information of the terminal 40 .
  • the access layer device 35 can send a port detection message to the terminal 40. If the detected port on the terminal 40 is in an open state, a response message corresponding to the port is fed back to the access layer device 35. Thus, the access layer device 35 can determine the MAC address and open port information of the terminal 40 based on the received response message.
  • the access layer device 35 sends the MAC address and open port information of the terminal 40 to the network controller 30 .
  • the network controller 30 performs clustering based on the similarity between the MAC addresses and the open port information of the terminals to be identified, and obtains a clustering result.
  • the terminals to be identified include the terminal 40 in FIG5 .
  • S307 The user marks the type of each cluster in the clustering result to obtain the identification result of the terminal to be identified.
  • the network controller 30 automatically sends pre-configured content to the access layer device to which the terminal is connected, thereby achieving automatic control of the terminal.
  • S308 may include: the network controller 30 automatically sends the pre-configured content corresponding to the terminal 40 to the access layer device 35 based on the identification result.
  • the pre-configured content sent may include but is not limited to: configuration information 1 of the terminal 40 in the network and the network access control policy 1 of the terminal 40.
  • FIG7 is a flow chart of a terminal identification method 400 provided in an embodiment of the present application.
  • the present application embodiment is described with the terminal to be identified as the execution subject.
  • the terminal to be identified can be, for example, any terminal in FIG1 , or terminal 40 corresponding to the network framework shown in FIG3 or FIG5 below, or communication device 900 described below.
  • the method 400 may include, for example, the following steps S401 to S402 :
  • S401 Receive a port detection message for the target port of the terminal to be identified.
  • the response message is used to indicate that the open port information of the terminal to be identified includes a target port, and the open port information is used to identify the type of the terminal to be identified.
  • this method 400 a port scan is performed on the terminal to be identified to obtain the open port information of the terminal to be identified, and thus, the type of the terminal to be identified is identified based on this.
  • the recognition rate of the terminal can be guaranteed, overcoming the problem that the current terminal identification method needs to accumulate the fingerprint information of the terminal or requires business traffic (or business messages) after the terminal enters the network, and cannot guarantee the recognition rate of the terminal.
  • method 400 please refer to the corresponding description of method 100, method 200 or method 300.
  • the embodiment of the present application also provides a communication device 800 (also referred to as a terminal identification device 800), as shown in Figure 8.
  • the communication device 800 may correspond to the identification device 10 in Figure 1; the communication device 800 may also correspond to the network controller 30 in Figure 3 or Figure 5, specifically corresponding to the identification device in the network controller 30 for implementing the terminal identification function provided in the embodiment of the present application.
  • the communication device 800 may include: an acquisition unit 801 and a processing unit 802.
  • the processing unit 802 is used to perform the processing operations in the above method 100, method 200 or method 300; the acquisition unit 801 is used to perform other operations in the above method 100, method 200 or method 300 except the processing operations.
  • the acquisition unit 801 is configured to acquire open port information of multiple terminals, where the open port information of each terminal indicates at least one open port of each terminal.
  • the acquisition unit 801 may execute S101 shown in FIG2 .
  • the processing unit 802 is configured to cluster multiple terminals according to the open port information of each terminal.
  • the processing unit 802 may execute S102 shown in FIG2 .
  • the processing unit 802 is further configured to identify, based on the clustering result, at least one cluster to which the multiple terminals belong, wherein the terminals included in each cluster of the at least one cluster are of the same type.
  • the processing unit 802 may execute S103 shown in FIG2 .
  • the acquisition unit 801 of the apparatus 800 is further configured to acquire the MAC address of each terminal; and the processing unit 802 is specifically configured to cluster multiple terminals according to the open port information of each terminal and the MAC address of each terminal.
  • the acquisition unit 801 of the apparatus 800 is further configured to acquire the IP address of each terminal; and the processing unit 802 is specifically configured to cluster multiple terminals according to the open port information of each terminal and the IP address of each terminal.
  • the acquiring unit 801 is specifically configured to receive open port information of multiple terminals sent by a port scanning device.
  • the acquiring unit 801 is specifically configured to acquire open port information of multiple terminals by performing port scanning on all ports or some designated ports of each terminal.
  • the acquiring unit 801 specifically performs any one of the following steps:
  • Scan ports of all terminals in the network to obtain information about open ports of multiple terminals.
  • the open port information of multiple terminals can be obtained by performing port scanning on the terminals in the target VLAN;
  • the open port information of multiple terminals is obtained by performing port scanning on the terminals in the target BD.
  • the processing unit 802 is specifically configured to cluster the multiple terminals according to similarities in the open port information of the multiple terminals.
  • the processing unit 802 is specifically configured to determine the cluster of the known type to which each of the multiple terminals belongs based on similarities between the open port information of the multiple terminals and the open port information of each cluster of the known type.
  • the processing unit 802 is specifically configured to determine a type of each cluster in the at least one cluster.
  • processing unit 802 is specifically configured to: display the type of one or more clusters whose specific types cannot be identified as unknown; and manually mark the specific types of one or more clusters.
  • Processing unit 802 of apparatus 800 is further configured to mark the specific types of clusters of unknown types.
  • Processing unit 802 is specifically configured to: for any first cluster of the unknown type clusters, identify the type of one or more terminals in the first cluster and mark the type as the type of the first cluster.
  • the processing unit 802 is specifically configured to: for any second cluster in the at least one cluster, in response to determining that the open port information of each terminal in the second cluster includes the first target port, determine that the type of the second cluster is the first type corresponding to the first target port.
  • processing unit 802 is specifically configured to: for any second cluster in the at least one cluster, in response to determining that one or more terminals in the second cluster belong to the first type, determine that the type of the second cluster is the first type.
  • the processing unit 802 is further configured to, in response to an edit operation or a confirmation operation of the first type on the second cluster, determine that the type of the second cluster is a second type, which is the same as or different from the first type.
  • the processing unit 802 of the apparatus 800 is further configured to correct the clustering result.
  • the processing unit 802 is specifically configured to: when the type of the terminal is inconsistent with the type of the cluster to which the terminal belongs, change the cluster to which the terminal belongs according to the type of the terminal.
  • the processing unit 802 of the apparatus 800 is further configured to perform network admission control on the terminal based on the type of the terminal.
  • the processing unit 802 of the apparatus 800 is further configured to send configuration information to a terminal of the type based on the type of the terminal.
  • the apparatus 800 may be a network controller itself, or may be a functional module belonging to the network controller and used to implement the method provided in this application.
  • the network controller may be, for example, a NAC.
  • an embodiment of the present application further provides a communication device 900 (also referred to as a terminal identification device 900), as shown in FIG9 .
  • the communication device 900 is applied to a terminal to be identified.
  • the communication device 900 may correspond to any terminal in FIG1 ; the communication device 900 may also correspond to the terminal 40 in FIG3 or FIG5 .
  • the communication device 900 may include: a receiving unit 901 and a sending unit 902. Among them:
  • the receiving unit 901 is configured to receive a port detection message for a target port of the terminal to be identified.
  • the receiving unit 901 may execute S401 shown in FIG7 .
  • the sending unit 902 is configured to send a response message to the port probe message for the target port if the target port is in an open state.
  • the response message is used to guide the identification of the type of the terminal to be identified.
  • the response message is used to indicate that the open port information of the terminal to be identified includes the target port, and the open port information is used to identify the type of the terminal to be identified.
  • the sending unit 901 can execute S402 shown in Figure 7.
  • an embodiment of the present application provides a communication device 1000.
  • the communication device 1000 can be the execution subject of any of the above embodiments, for example, it can correspond to the identification device 10 or any terminal in Figure 1 , for example, it can correspond to the network controller 30 or terminal 40 in Figure 3 , for example, it can correspond to the network controller 30 or terminal 40 in Figure 5 .
  • the communication device 1000 can implement the functions of the corresponding execution subjects in the above embodiments.
  • the communication device 1000 includes at least one processor 1001, a bus system 1002, a memory 1003, and at least one communication interface 1004.
  • the communication device 1000 is a hardware structure device that can be used to implement the functional modules in the communication device 800 shown in Figure 8. For example, those skilled in the art can imagine that the acquisition unit 801 and the processing unit 802 in the communication device 800 shown in Figure 8 are implemented by the at least one processor 1001 calling the code in the memory 1003.
  • the communication device 1000 is a hardware structure device that can be used to implement the functional modules in the communication device 900 shown in Figure 9.
  • the receiving unit 901 and the sending unit 902 in the communication device 900 shown in Figure 9 are implemented by the at least one processor 1001 calling the code in the memory 1003.
  • the communication device 1000 may be a network device or a control entity implementing an embodiment of the present application.
  • the processor 1001 may be a general-purpose central processing unit (CPU), a network processor (NP), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.
  • CPU general-purpose central processing unit
  • NP network processor
  • ASIC application-specific integrated circuit
  • the bus system 1002 may include a channel for transmitting information between the components.
  • the communication interface 1004 is used to communicate with other devices or communication networks.
  • the memory 1003 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, a random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including a compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.
  • the memory may be independent and connected to the processor via a bus.
  • the memory may also be integrated with the processor.
  • the memory 1003 is used to store application code for executing the solution of the present application, and the execution is controlled by the processor 1001.
  • the processor 1001 is used to execute the application code stored in the memory 1003, thereby realizing the functions of the method of the present application.
  • the processor 1001 may include one or more CPUs, such as CPU0 and CPU1 in FIG10 .
  • the communication device 1000 may include multiple processors, such as the processor 1001 and the processor 1007 in FIG10 .
  • processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor.
  • the processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (e.g., computer program instructions).
  • the embodiment of the present application also provides a chip, including a processor and an interface circuit, the interface circuit is used to receive instructions and transmit them to the processor; the processor, for example, can be a specific implementation form in the embodiment of the present application, and can be used to execute the above-mentioned method 100, method 200, method 300 or method 400.
  • the processor is coupled to a memory, and the memory is used to store programs or instructions. When the program or instructions are executed by the processor, the chip system implements the method in any of the above-mentioned method embodiments.
  • the interface circuit can be used to implement the relevant operations performed by the acquisition unit 801 in the communication device 800
  • the processor can be used to implement the relevant operations performed by the processing unit 802 in the communication device 800.
  • processors in the chip system there may be one or more processors in the chip system.
  • the processor may be implemented in hardware or software.
  • the processor may be a logic circuit, an integrated circuit, etc.
  • the processor may be a general-purpose processor implemented by reading software code stored in a memory.
  • the memory in the chip system may be one or more memories.
  • the memory may be integrated with the processor or may be provided separately from the processor, which is not limited in this application.
  • the memory may be a non-transient processor, such as a read-only memory (ROM), which may be integrated with the processor on the same chip or provided on different chips. This application does not specifically limit the type of memory or the configuration of the memory and the processor.
  • the chip system can be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), a central processing unit (CPU), a network processor (NP), a digital signal processing circuit (DSP), a microcontroller unit (MCU), a programmable logic device (PLD) or other integrated chips.
  • FPGA field programmable gate array
  • ASIC application specific integrated circuit
  • SoC system on chip
  • CPU central processing unit
  • NP network processor
  • DSP digital signal processing circuit
  • MCU microcontroller unit
  • PLD programmable logic device
  • an embodiment of the present application also provides a device that communicates with a linear direct-drive optical module, the device includes a first equalizer, and the linear direct-drive optical module includes a second equalizer; the device is used to execute the above-mentioned method 100 or method 200 to tune the parameters of the first equalizer and the second equalizer.
  • the embodiment of the present application further provides a communication system 1100, as shown in Figure 11.
  • the communication system 1100 may include a terminal to be identified 1101 and an identification device 1102.
  • Identification device 1102 configured to execute method 100, method 200, or method 300 to identify multiple terminals, where the multiple terminals include terminal 1101 to be identified;
  • the terminal 1101 to be identified is used to execute the above method 400.
  • the identification device 1102 can correspond to the identification device 10 shown in Figure 1 above, then the terminal 1101 to be identified can correspond to any terminal in Figure 1 (such as terminal 21); or, the identification device 1102 can correspond to the network controller 30 shown in Figure 3 above, then the terminal 1101 to be identified can correspond to the terminal 40 in Figure 3; or, the identification device 1102 can correspond to the network controller 30 shown in Figure 5 above, then the terminal 1101 to be identified can correspond to the terminal 40 in Figure 5; or, the identification device 1102 can correspond to the communication device 800 shown in Figure 8 above, then the terminal 1101 to be identified can correspond to the communication device 900 in Figure 9.
  • an embodiment of the present application further provides a storage medium, in which program code or instructions are stored.
  • the storage medium is run on a processor, the processor executes a method in any one of the implementation modes of the above embodiments.
  • an embodiment of the present application also provides a program product, which, when executed on a processor, enables the processor to execute any one of the aforementioned methods 100, 200, 300, or 400.
  • the automatic access control strategy may include: prohibiting terminals of the laptop type from accessing the network, while allowing other types of terminals (such as mobile phones and tablets) to access the network.
  • the terminal's HTTP UA is usually used to identify whether the terminal type is a laptop or a tablet.
  • an embodiment of the present application provides a terminal identification method, in which a Web page is provided to the terminal, and the browser interface of the terminal is called through the Web page to obtain the capability information of the terminal, and the terminal is effectively and accurately identified based on the capability information of the terminal. Even if the boundaries of the terminals in the network are vague, the method can distinguish the specific type of the terminal based on the obtained capability information of the terminal, thereby improving the accuracy of terminal identification to a certain extent.
  • the terminal identification device can be deployed in a World Wide Web (Web, also known as the World Wide Web) server, or in other devices other than the Web server.
  • Web World Wide Web
  • the method may include: first, the Web server provides a Web page to the terminal; then, the terminal calls the browser interface of the terminal through the Web page to obtain the capability information of the terminal, so that the Web server obtains the capability information of the terminal obtained by the terminal from the terminal; then, the Web server identifies the type of the terminal based on the capability information of the terminal.
  • the browser interface of the terminal can be called through the Web page provided by the Web server to obtain the terminal capability information, so that the Web server with terminal identification function can accurately identify the specific type of the terminal based on the terminal capability information, overcoming the problem that the current terminal identification method cannot accurately identify the terminal type based on the terminal fingerprint information (such as HTTP UA).
  • the accuracy of terminal identification can be improved.
  • the method provided in the embodiments of the present application can be adapted to various scenarios requiring terminal identification, such as automatic terminal access.
  • the method provided in the embodiments of the present application can effectively identify the terminal type and ensure the accuracy of terminal identification.
  • terminals connected to the network can automatically connect to a web server and download web pages from the web server.
  • the network configuration may include, but is not limited to, forced redirection to a web page or performing portal authentication on the web page.
  • the network architecture applicable to the embodiments of the present application can be seen in Figure 12 .
  • the network architecture may include at least: a terminal identification device 10, a terminal 20 to be identified, and a web server 30.
  • the web server 30 may be, for example, a portal server 30, and the terminal identification device 10 may be a functional module within a network controller 1.
  • the network architecture may also include a network 4, which may include core layer devices 41, convergence layer devices 42, convergence layer devices 43, access layer devices 44, access layer devices 45, and access layer devices 46, with the terminal 20 connected to the access layer devices 45.
  • the portal server 30 and the network controller 1 may access the network 4 via the core layer device 41.
  • the identification process for the terminal 20 may include the following: first, after the terminal 20 accesses the network 4, the request message from the terminal 20, under the effect of portal authentication, causes the request message received by the portal server 30 to carry the address of the web page. Next, based on the address of the web page in the request message, the portal server 30 obtains the web page indicated by the address and sends the web page to the terminal 20 via the network 4. Next, after receiving the web page, terminal 20 executes the script in the web page: it calls the browser interface to obtain terminal 20's capability information; it then calls the network interface of network controller 1 to send the capability information of terminal 20 to terminal identification device 10 within network controller 1 via network 4. Finally, terminal identification device 10 within network controller 1 determines the type of terminal 20 based on the capability information. Thus, through the web page provided to terminal 20 by web server 30, terminal 20 can obtain its capability information and send it to terminal identification device 10, enabling terminal identification device 10 to perform refined identification of terminal 20 based on the capability information.
  • the network architecture applicable to the embodiment of the present application can also be seen in Figure 13. As shown in Figure 13, compared with the network architecture shown in Figure 12, the network architecture no longer includes the terminal identification device 10 and the Web server 30. The capabilities of the two can be combined on the network controller 13 or the authentication server 13. The network controller 13 or the authentication server 13 can realize the functions of the terminal identification device 10 and the Web server 30 in Figure 12. The network controller 13 or the authentication server 13 can interact with the terminal 20 to be identified through the network 4.
  • the network 4 may include a core layer device 41, an aggregation layer device 42, an aggregation layer device 43, an access layer device 44, an access layer device 45 and an access layer device 46, and the terminal 20 is connected to the access layer device 45.
  • the network architecture applicable to the embodiments of the present application can also be seen in Figure 14.
  • this network architecture no longer includes the terminal identification device 10 and the web server 30.
  • the capabilities of both can be combined on any network device 4N in the network 4.
  • the network device 4N can implement the functions of the terminal identification device 10 and the web server 30 in Figure 12.
  • the network 4 may include a core layer device 41, an aggregation layer device 42, an aggregation layer device 43, an access layer device 44, an access layer device 45, and an access layer device 46, and the terminal 20 is connected to the access layer device 45.
  • the network device 4N is used as the access layer device 45 as an example.
  • the terminal identification device can be any communication device in the network that has the ability to finely identify the terminal type based on the terminal's capability information.
  • the communication device can be a network device such as a switch or router.
  • the terminal identification device can be a functional module, component, or chip in any communication device in the network that has the ability to finely identify the terminal type based on the terminal's capability information, such as a single board or line card on a network device.
  • the terminal identification device can be deployed in a web server as a module, component, or chip within the web server. The embodiments of the present application do not specifically limit the form and type of the terminal identification device.
  • a web server can be any communication device in a network that has the ability to provide a web page to a terminal so that the terminal can obtain the terminal's capability information and send the terminal's capability information to a terminal identification device.
  • the communication device can be a network device such as a switch or router.
  • the web server can be a functional module, component, or chip in any communication device in a network that has the ability to provide a web page to a terminal to be identified so that the terminal can obtain the terminal's capability information and send the terminal's capability information to a terminal identification device, such as a single board or line card on a network device.
  • the embodiments of the present application do not specifically limit the form and type of the web server.
  • the terminal may refer to any terminal that can be deployed in the network, and the embodiment of the present application does not specifically limit the form and type of the terminal.
  • the terminal in the embodiment of the present application may be a smart terminal or a dumb terminal.
  • Terminals can be divided into dumb terminals and smart terminals (also called smart terminals) according to whether they have processing functions.
  • Dumb terminals may refer to a type of terminal that has no processing function and usually does not have a microprocessor.
  • printers, cameras, etc. are all dumb terminals
  • smart terminals may refer to terminals with certain processing functions.
  • Such terminals have their own microprocessors and control circuits.
  • smart phones, laptops, etc. are all smart terminals.
  • some terminals with single functions and simple systems are usually classified as dumb terminals.
  • FIG15 is a flow chart of a terminal identification method 500 provided in an embodiment of the present application.
  • the Web server can be, for example, the Web server 30 in the network architecture shown in Figure 12, or the network controller 13 or the authentication server 13 in the network architecture shown in Figure 13, or the access layer device 45 in the network architecture shown in Figure 14, or the communication device 1900 or the communication device 2200, or the Web server 2301 in the communication system 2300;
  • the terminal identification device can be, for example, the terminal identification device 10 in the network architecture shown in Figure 12, or the network controller 13 or the authentication server 13 in the network architecture shown in Figure 13, or the access layer device 45 in the network architecture shown in Figure 14, or the communication device 2000 or the communication device 2200, or the terminal identification device 2302 in the communication system 2300;
  • the terminal can be, for example, the terminal 20 in the network architecture shown in Figure 12, Figure 13 or Figure 14, or the communication device 2100 or the communication device 2200, or the terminal
  • Figure 15 is used as an example to illustrate that the Web server and the terminal identification device belong to two different communication devices.
  • the interaction subject is simply changed from the terminal interacting with the two communication devices separately to the terminal interacting with the combined communication device, which does not affect the implementation of the embodiment of the present application.
  • the method 500 may include, for example, the following steps S501 to S507 :
  • a web server receives a request message from a terminal, where the request message carries the address of a web page.
  • S501 which may be executed before S502 in an example is shown, and S501 can be understood as an optional step in the method 500.
  • the web server can be, for example, any communication device or functional module on a communication device capable of providing web pages to a terminal.
  • the method 500 may further include: after the terminal accesses the network, sending a request message 1 to the network; the network processing the request message 1 to obtain the "request message” in step S501; and the network sending the "request message” to the web server.
  • the terminal access network can refer to: the terminal can be connected to the access layer device of the network through a network cable; if it is known to be a wireless terminal, then the terminal access network can refer to: the terminal is connected to the access layer device of the network through a service set identifier (SSID).
  • SSID service set identifier
  • a terminal sends a request message 1 to a network.
  • the terminal may send the request message 1 to an access layer device connected to the network.
  • Request message 1 may be used to request the opening of web page 1, and the request message 1 may include the URL of web page 1.
  • the network processes request message 1 to obtain the "request message" in S501. This may include: the access layer device connected to the network modifies the URL of web page 1 included in request message 1 to the URL of web page 2, thereby obtaining the "request message” in S501, and the access layer device sends the "request message” to the web server.
  • the network processes request message 1 to obtain the "request message” in S501.
  • This may include: the access layer device connected to the network informs the terminal that web page 2 is to be accessed and provides the terminal with the URL of web page 2.
  • the terminal modifies the URL of web page 1 included in request message 1 to the URL of web page 2, thereby obtaining the "request message” in S501, and the terminal sends the "request message” to the web server via the connected network.
  • the “web page” may refer to the web page 2 in the above example
  • the “address of the web page” may refer to the URL of the web page 2 in the above example.
  • Request message 1 can be, for example, a network access request message sent by the terminal to the access layer device for 1902.1x or MAC authentication. This network access request message can be forcibly redirected by the access layer device to the "web page" in S501.
  • the web server can be a 1902.1x authentication server, a MAC authentication server, a network controller, or other communication device capable of implementing the corresponding functions in this example.
  • the request message 1 sent by the terminal to the network may be, for example, a request message sent by the terminal to an access layer device of the network for Portal authentication.
  • the request message corresponding to Portal authentication instructs connecting to a web server to download the "web page" in S501.
  • the web server may be a Portal authentication server, a network controller, or other communication device capable of implementing the corresponding functions in this example.
  • the web server provides the web page to the terminal based on the address of the web page.
  • S503 The terminal receives the web page sent by the web server.
  • the web server In response to the terminal's request message for downloading a web page, the web server searches for the web page indicated by the web page address included in the request message and sends the web page to the terminal. If the "request message" in S501 is a network access request message for 1902.1x authentication (or MAC authentication), then the web page includes at least the 1902.1x authentication page (or MAC authentication page); if the "request message" in S501 is a request message for Portal authentication, then the web page includes at least the Portal authentication page.
  • a web page in addition to being able to render and display a specific web page on a terminal, may also include a script.
  • the content of the script includes: calling a browser interface to obtain the terminal's capability information.
  • the content of the script may also include: calling a network interface to send the terminal's capability information to the terminal identification device.
  • first information and second information may be added to the web page, with the first information used to indicate the acquisition of the terminal's capability information, and the second information used to indicate the provision of the terminal's capability information to the terminal identification device.
  • the first information and the second information may be carried in a script on the web page, that is, in addition to the program segment for rendering and displaying the web page, a new script is added to the web page.
  • the new script includes a program segment corresponding to the first information and a program segment corresponding to the second information; or the first information and the second information may be carried in two scripts on the web page, that is, in addition to the program segment for rendering and displaying the web page, two new scripts are added to the web page, one of which includes a program segment corresponding to the first information, and the other includes a program segment corresponding to the second information.
  • S504 The terminal calls the terminal's browser interface through the Web page to obtain the terminal's capability information.
  • method 500 may further include: the terminal rendering the received web page and displaying the web page on the display component of the terminal. Since the step of displaying the web page does not involve the core contribution of the embodiment of the present application, the step of displaying the web page is not described in detail. The embodiment of the present application does not limit the execution order of the step of displaying the web page and S504. The step of displaying the web page may be executed first and then S504, or S504 may be executed first and then the step of displaying the web page, or the step of displaying the web page and S504 may be executed simultaneously.
  • Capability information is used to indicate whether the terminal supports the target capability, which may include but is not limited to at least one of the following: touchscreen capability, media device capability, storage capability, or USB capability.
  • Target capabilities can be determined based on the characteristics corresponding to the terminal's identification requirements. For example, for refined identification of laptops and tablets, considering that tablets support touchscreens but laptops do not, the target capability may include the terminal's touchscreen capability. For another example, for two types of terminals with similar message characteristics, considering that the capabilities of their media devices, such as cameras and microphones, are different, the target capability may include the terminal's media device capabilities.
  • S504 may include the terminal executing the web page script that calls a browser interface to obtain terminal capability information.
  • the terminal obtains the capability information by calling the browser interface, providing a data basis for fine-grained identification of the terminal type.
  • the terminal can obtain the terminal's touch screen capabilities by calling navigator.maxTouchPoints; if the capability information includes media device capabilities, the terminal can obtain the terminal's media device capabilities by calling navigator.mediaDevices. In navigator.mediaDevices, mediaDevices can be understood as a read-only property.
  • the interface can return a media device (MediaDevices) object, which provides access to the terminal's connected media input devices (such as a camera or microphone) and/or screen sharing.
  • MediaDevices media device object
  • acquiring the capability information of the terminal through S504 provides a rich basis for the terminal identification device to reliably and effectively identify the terminal, thereby ensuring a certain recognition rate of the terminal identification device to accurately identify the terminal.
  • the terminal type can be identified based on the terminal's capability information combined with its fingerprint information.
  • Fingerprint information can be understood as information that can identify the terminal.
  • fingerprint information can include at least one of the following: MAC OUI, DHCP Option, mDNS, LLDP, UA, MAC address, or IP address.
  • the terminal identification device can identify the type of the terminal based on the capability information and UA information of the terminal. Then, the method 500 may further include: the terminal obtaining the UA information.
  • UA information usually a string, is used to help identify the terminal type.
  • UA information usually refers to the introduction to UA in "https://developer.mozilla.org/en-US/docs/Web/API/Navigator/userAgent”.
  • the format of UA information can be: browser type field + system information (system-information) field + platform (platform) field + platform details (platform-details) field + extensions (extensions) field.
  • the UA information is: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.210 Safari/537.36, where Mozilla/5.0 is the value of the browser type field, Macintosh; Intel Mac OS X 10_15_0 is the value of the system information field, AppleWebKit/537.36 is the value of the platform field, KHTML, like Gecko is the value of the platform details field, and Chrome/75.0.3770.210 Safari/537.36 is the value of the extension field.
  • the script in the Web page also includes: a browser interface of the terminal to obtain the UA information of the terminal. Then, the terminal executes the script in the Web page to call the browser interface of the terminal to obtain the UA information of the terminal.
  • the message introducing the terminal's own attributes generated when the terminal joins the network may also include the terminal's UA information. Then, the terminal can obtain the terminal's UA information from the message by parsing the message introducing the terminal's own attributes.
  • the terminal can obtain UA information and combine it with the terminal's capability information as the basis for the terminal identification device to finely identify the terminal type, so that the terminal type can be effectively identified, the terminal recognition rate is guaranteed, and the recognition result is more accurate.
  • the UA information obtained in the embodiment of the present application may refer to a character string that can reflect real, complete and relatively more information of the terminal, for example, it may include information such as the hardware model of the terminal.
  • UA information usually has two common formats.
  • the UA information in format 1 includes more information, such as the hardware model of the terminal; the UA information in format 2 sets a lot of information to fixed values and does not include some terminal information.
  • the reason is that the UA information includes too much information and the content involved is complicated. On the one hand, it is not conducive to easily obtaining one or some information. On the other hand, if it is passively monitored, it is likely to leak the user's privacy.
  • UA information As Format 2, an example of UA information is as follows: Mozilla/5.0 (Linux; Android 10; xxx Build/yyyxxx) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.32004.108 Mobile Safari/537.36, where "xxx" can indicate the hardware model of the terminal.
  • UA information is as follows: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/71.0.0.0 Mobile Safari/537.36, where the hardware model of the terminal is replaced by a fixed value K. That is, regardless of the hardware model, the UA information of the terminal includes K.
  • the terminal obtains UA information using format one
  • the UA information in the embodiment of the present application is obtained based on the web page, or the UA information in the embodiment of the present application is obtained by parsing the message in which the terminal introduces its own attributes.
  • the UA information in the embodiment of the present application can be obtained as follows: in the message sent by the web server to the terminal for carrying the web page, add indication information, which is used to indicate the specific content of the UA information to be obtained.
  • the message used to carry the web page can be, for example, an HTTP message
  • the indication information can be carried in the response header (Response Header) of the HTTP message
  • the indication information can be carried, for example, through the Accept-CH field in the response header.
  • the specific content indicated by the indication information can include, but is not limited to: user agent platform (UA-Platform), user agent platform version (UA-Platform-Version), user agent full version (UA-Full-Version), user agent architecture (UA-Arch), user agent model (UA-Model), user agent bitness (UA-Bitness), etc.
  • the terminal identification device can identify the terminal's type based on the terminal's MAC OUI, DHCP Option, mDNS, or LLDP fingerprint information and the terminal's capability information.
  • method 500 may further include: the terminal obtaining the terminal's MAC OUI, DHCP Option, mDNS, or LLDP fingerprint information.
  • the terminal's specific type can be more accurately identified based on the terminal's capability information and the terminal's MAC OUI, DHCP Option, mDNS, or LLDP fingerprint information, enabling refined terminal identification even when the terminal's boundaries are relatively vague.
  • the terminal's fingerprint information may include the terminal's address information.
  • the terminal identification device determines the terminal's type based on the terminal's capability information and the terminal's address information.
  • the address information may include at least one of the following: a MAC address or an IP address. This allows for more accurate identification of the terminal's specific type using the terminal's capability information and address information, enabling refined terminal identification even when the boundaries between terminals are vague.
  • S505 The terminal sends the terminal capability information to the terminal identification device.
  • the terminal identification device receives the capability information of the terminal.
  • the content of the script in the web page may also include: calling a network interface to send the terminal capability information to the terminal identification device.
  • S505 may, for example, include: the terminal executes the script in the web page and sends the terminal capability information to the terminal identification device.
  • the network interface can be a network interface opened by the Web server to the terminal
  • S505 may include: the terminal sends the terminal's capability information to the network interface opened to the terminal by the Web server
  • S506 may include: the Web server receives the capability information sent by the terminal from the network interface opened to the terminal, so that the terminal identification device in the Web server obtains the capability information of the terminal.
  • the network interface may be a network interface opened to the terminal by the communication device where the terminal identification device is located
  • S505 may include: the terminal sends the capability information of the terminal to the network interface opened to the terminal by the communication device where the terminal identification device is located
  • S506 may include: the communication device where the terminal identification device is located receives the capability information sent by the terminal from the network interface opened to the terminal, so that the terminal identification device of the communication device obtains the capability information of the terminal.
  • the terminal may carry its own capability information in any message interacting with the terminal identification device, and send the message to the terminal identification device, thereby achieving the purpose of sending its own capability information to the terminal identification device.
  • S505 may include: the terminal sending an HTTP message to the terminal identification device, the HTTP message carrying the terminal's capability information; then, S506 may include: the terminal identification device receiving the HTTP message from the terminal and obtaining the terminal's capability information by parsing the HTTP message.
  • the HTTP message may carry the terminal's capability information via any extensible field; for example, the HTTP message may carry the terminal's capability information in a payload.
  • the terminal sends a Constrained Application Protocol (CoAP) message to the terminal identification device, where the CoAP message carries the terminal's capability information.
  • S506 may include: the terminal identification device receives the CoAP message from the terminal, and obtains the terminal's capability information by parsing the CoAP message.
  • the CoAP message may carry the terminal's capability information via any extensible field.
  • the CoAP message may carry the terminal's capability information in a payload.
  • the communication device where the terminal identification device is located needs to open a network interface for the terminal to call the network interface and send its capability information to the communication device where the terminal identification device is located.
  • the network interface can be, for example, the /detect/report interface of the communication device where the terminal identification device is located.
  • the terminal obtains the terminal capability information through the Web page and sends the terminal capability information to the terminal identification device, which prepares the terminal identification device for realizing effective and accurate identification of the terminal.
  • the terminal identification device identifies the type of the terminal based on the capability information of the terminal.
  • S507 may include: the terminal identification device is capable of determining the type of the terminal based only on the capability information of the terminal.
  • S507 may include: the terminal identification device is capable of determining the type of the terminal based on the capability information of the terminal and the fingerprint information of the terminal.
  • the terminal identification device obtains capability information 1 and UA information 1 for terminal 1, and obtains capability information 2 and UA information 2 for terminal 2.
  • the terminal identification device can determine that the types of terminal 1 and terminal 2 are laptop computers or tablet computers based on UA information 1 and UA information 2, but cannot further refine the identification to determine whether they are laptop computers or tablet computers, the terminal identification device can determine that terminal 1 supports touch screens based on capability information 1, and that terminal 2 does not support touch screens based on capability information 2.
  • the terminal identification device can determine that terminal 1 is a tablet computer and terminal 2 is a laptop computer. In another case, if the terminal identification device can determine that the type of terminal 1 and terminal 2 is type 1 or type 2 based on UA information 1 and UA information 2, but cannot further refine the identification to determine whether it is type 1 or type 2, at this time, the terminal identification device can determine that the media capabilities of terminal 1 such as camera and microphone are media device capability 1 based on capability information 1, and determine that the media capabilities of terminal 2 such as camera and microphone are media device capability 2 based on capability information 2. Thus, the terminal identification device can determine that the type of terminal 1 is type 1 based on capability information 1, and determine that the type of terminal 2 is type 2 based on capability information 2.
  • the identification result after obtaining the identification result of the terminal (such as the type of the terminal), the identification result can be used in any scenario.
  • the recognition results can be integrated into the user's digital map, displaying the user's network topology.
  • the map will also display the terminals deployed at that point.
  • the displayed terminals are displayed based on the recognition results, and other terminal details can also be displayed. In this way, by integrating terminal recognition results into the digital map, the information provided to the user is enriched, making it easier for users to deploy, manage, and control their network.
  • network access control can be performed on terminals based on their type. For example, Terminal 1 (a mobile phone) and Terminal 2 (a tablet) can be automatically allowed to access the network and assigned to VLAN 210. Terminal 3 (a laptop) can be automatically blocked from network access. By applying terminal identification results to automatic terminal access control, rapid and effective terminal management is achieved.
  • configuration information can be sent to various types of terminals based on their type, completing automatic network configuration for each type of terminal.
  • This configuration information can be sent by a terminal identification device or other network device with information configuration capabilities to the network device to which the terminal is connected (such as the access layer device to which the terminal is connected) to configure the terminal. In this way, by applying the terminal identification results to the terminal's automatic configuration scenario, rapid and efficient terminal configuration is achieved.
  • the script of the web page includes the content of obtaining the terminal's capability information and sending the terminal's capability information to the terminal identification device.
  • the terminal downloads the web page, it obtains and provides the terminal's capability information to the terminal identification device by executing the web page, so that the terminal identification device can accurately identify the specific type of the terminal based on the terminal's capability information.
  • the terminal's fingerprint information such as HTTP UA
  • the accuracy of terminal identification can be improved.
  • the embodiment of the present application is explained by taking the identification of the type of terminal as an example.
  • the method provided in the embodiment of the present application can also use the terminal's capability information, or combine the terminal's capability information and the terminal's fingerprint information to realize the identification of other attribute information of the terminal.
  • the other attribute information of the terminal may, for example, include but is not limited to at least one of the following information: the manufacturer to which the terminal belongs, the model of the terminal, or the operating system used by the terminal.
  • the specific implementation method is not limited in the embodiment of the present application.
  • method 500 the embodiment of the present application is described in terms of the interaction between a web server, a terminal identification device, and a terminal.
  • the operations performed by the web server, the terminal identification device, and the terminal in method 500 can each be implemented as a separate embodiment to achieve the technical effects of the method provided by the embodiment of the present application.
  • FIG16 is a flow chart of a terminal identification method 600 provided in an embodiment of the present application.
  • the present application embodiment is described using a web server as the execution subject.
  • the web server can be, for example, the web server 30 in the network architecture shown in FIG12 , the network controller 13 or authentication server 13 in the network architecture shown in FIG13 , the access layer device 45 in the network architecture shown in FIG14 , the communication device 1900 or the communication device 2200 , or the web server 2301 in the communication system 2300 .
  • the method 600 may include, for example, the following S601 to S602:
  • the web server provides a web page to the terminal.
  • S602 The Web server calls the browser interface of the terminal through the Web page to obtain the capability information of the terminal.
  • the method 600 may further include: the Web server identifying the type of the terminal according to the capability information of the terminal.
  • the Web server identifying the type of the terminal according to the capability information of the terminal.
  • the Web server adds a script to the Web page provided to the terminal, and the content of the script includes: calling the browser interface to obtain the terminal capability information and providing the terminal capability information to the terminal identification device. Therefore, after the terminal downloads the Web page, the terminal capability information is obtained and provided to the terminal identification device by executing the newly added script on the Web page, making it possible for the terminal identification device to accurately identify the specific type of the terminal based on the terminal capability information.
  • This overcomes the problem in the current terminal identification method that the terminal type cannot be accurately identified based on the terminal fingerprint information. In scenarios where various types of terminals emerge in an endless stream and the boundaries between terminals are relatively vague, the accuracy of terminal identification can be improved.
  • FIG17 is a flow chart of a terminal identification method 700 provided in an embodiment of the present application.
  • the present application embodiment is described with a terminal identification device as the execution subject.
  • the terminal identification device can be, for example, the terminal identification device 10 in the network architecture shown in FIG12 , the network controller 13 or the authentication server 13 in the network architecture shown in FIG13 , the access layer device 45 in the network architecture shown in FIG14 , the communication device 2000 or the communication device 2200 , or the terminal identification device 2302 in the communication system 2300 .
  • the method 700 may include, for example, the following steps S701 to S702 :
  • the terminal identification device receives capability information of the terminal.
  • the terminal capability information is obtained by executing a script in a web page.
  • the content of the web page script includes: calling a browser interface of the terminal to obtain the terminal capability information.
  • the content of the web page script may also include: calling a network interface to send the terminal capability information to the terminal identification device.
  • the terminal identification device identifies the type of the terminal based on the capability information of the terminal.
  • the terminal obtains the terminal capability information and provides the terminal capability information to the terminal identification device based on the script added to the web page downloaded from the web server.
  • the terminal identification device can accurately identify the specific type of the terminal based on the terminal capability information, overcoming the problem that the current terminal identification method cannot accurately identify the terminal type based on the terminal fingerprint information. In scenarios where various types of terminals emerge in an endless stream and the boundaries between terminals are relatively vague, the accuracy of terminal identification can be improved.
  • FIG 18 is a flow chart of a terminal identification method 800 provided in an embodiment of the present application.
  • the present application embodiment is described with a terminal as the execution subject.
  • the terminal can be, for example, terminal 20 in the network architecture shown in Figures 12, 13, or 14, or communication device 2100 or communication device 2200, or terminal 2303 in communication system 2300.
  • the method 800 may include, for example, the following steps S801 to S803 :
  • S801 A terminal receives a web page sent by a web server.
  • S802 The terminal executes a script on the web page.
  • the content of the script includes: calling a browser interface to obtain capability information of the terminal.
  • S803 The terminal sends the terminal capability information to the terminal identification device.
  • the content of the script may further include: calling a network interface to send the terminal capability information to the terminal identification device; then, S803 may include: the terminal sending the terminal capability information to the terminal identification device through the network interface.
  • the terminal identification device may be deployed in the Web server, and the network interface may be a network interface opened by the Web server to the terminal.
  • the terminal identification device may not be deployed in the Web server, and the network interface may be a network interface opened by the communication device where the terminal identification device is located to the terminal.
  • the terminal obtains the terminal capability information and provides the terminal capability information to the terminal identification device based on the script added to the web page downloaded from the web server, making it possible for the terminal identification device to accurately identify the specific type of the terminal based on the terminal capability information.
  • This overcomes the problem that the current terminal identification method cannot accurately identify the type of the terminal based on the terminal fingerprint information. In scenarios where various types of terminals emerge in an endless stream and the boundaries between terminals are relatively vague, the accuracy of terminal identification can be improved.
  • an embodiment of the present application further provides a communication device 1900 (also referred to as a terminal identification device 1900), which is applied to a web server, as shown in FIG19 .
  • the communication device 1900 may correspond to the operations performed by the web server and the terminal identification device in method 500, or to the operations performed by the web server in method 600.
  • the communication device 1900 may correspond to the network controller 13 in FIG13 ; the communication device 1900 may also correspond to the access layer device 45 in FIG14 , or may correspond to the communication system 2300 described below.
  • the communication device 1900 may include: a sending unit 1901, a receiving unit 1902, and a processing unit 1903.
  • the sending unit 1901 is configured to provide a Web page type to the terminal.
  • the sending unit 1901 may execute S502 shown in FIG15 or S601 shown in FIG16 .
  • the receiving unit 1902 is configured to call the browser interface of the terminal through a web page to obtain the capability information of the terminal.
  • the receiving unit 1902 may execute S506 shown in FIG15 or S602 shown in FIG16 .
  • the processing unit 1903 is configured to identify the type of the terminal according to the capability information of the terminal.
  • the processing unit 1903 may execute S507 shown in FIG15 .
  • the web page includes a script
  • the content of the script may include: calling a browser interface to obtain capability information of the terminal.
  • the script may also include invoking a network interface to transmit the terminal's capability information to the terminal identification device.
  • the terminal identification device may be deployed in a web server, in which case the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in a web server, in which case the network interface may be a network interface exposed by the communication device containing the terminal identification device to the terminal.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the processing unit 1903 is specifically used to: identify the type of the terminal based on the terminal capability information and the terminal fingerprint information, and the terminal fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address or IP address.
  • an embodiment of the present application further provides a communication device 2000 (also referred to as a terminal identification device 2000), which is applied to a terminal identification device, as shown in FIG20 .
  • the communication device 2000 may correspond to the operations performed by the terminal identification device in method 500 or method 700.
  • the communication device 2000 may correspond to the terminal identification device 10 in FIG12 ; the communication device 2000 may also correspond to the network controller 13 in FIG13 ; the communication device 2000 may also correspond to the access layer device 45 in FIG14 , and may also correspond to the third communication entity in the communication system 2300 described below.
  • the communication device 2000 may, for example, include a receiving unit 2001 and a processing unit 2002.
  • the receiving unit 2001 is configured to receive the capability information of the terminal.
  • the receiving unit 2001 may execute S506 shown in FIG15 or S701 shown in FIG17 .
  • the processing unit 2002 is configured to identify the type of the terminal based on the capability information of the terminal.
  • the processing unit 2002 may execute S507 shown in FIG15 or S702 shown in FIG17 .
  • the terminal's capability information is obtained by executing a script in a web page.
  • the content of the web page script includes: calling the terminal's browser interface to obtain the terminal's capability information.
  • the content of the web page script may also include: calling a network interface to send the terminal's capability information to the terminal identification device.
  • the terminal identification device may be deployed in a web server.
  • the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in the web server.
  • the network interface may be a network interface exposed to the terminal by the communication device where the terminal identification device resides.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the processing unit 2002 is specifically used to: identify the type of the terminal based on the terminal capability information and the terminal fingerprint information, and the terminal fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address or IP address.
  • an embodiment of the present application further provides a communication device 2100 (also referred to as a terminal identification device 2100), which is applied to a terminal, as shown in FIG21.
  • the communication device 2100 may correspond to the operations performed by the terminal in method 500 or method 800.
  • the communication device 2100 may correspond to the terminal 20 in FIG12, FIG13, or FIG14; it may also correspond to the second communication entity in the communication system 2300 described below.
  • the communication device 2100 may, for example, include a receiving unit 2101, a processing unit 2102, and a sending unit 2103.
  • the receiving unit 2101 is configured to receive a web page sent by a web server.
  • the receiving unit 2101 may execute S503 shown in FIG15 or S801 shown in FIG18 .
  • the processing unit 2102 is configured to execute the script of the web page.
  • the content of the script may include: calling the browser interface to obtain the capability information of the terminal.
  • the processing unit 2102 may execute S504 shown in FIG15 or S802 shown in FIG18.
  • the sending unit 2103 is configured to send the terminal capability information to the terminal identification apparatus.
  • the sending unit 2103 may execute S505 shown in FIG15 or S803 shown in FIG18 .
  • the script may also include invoking a network interface to transmit the terminal's capability information to the terminal identification device.
  • the sending unit 2103 is specifically configured to transmit the terminal's capability information to the terminal identification device via the network interface.
  • the terminal identification device may be deployed in a web server.
  • the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in a web server.
  • the network interface may be a network interface exposed by the communication device containing the terminal identification device to the terminal.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the communication device 2100 may also include an acquisition unit, which is used to obtain the fingerprint information of the terminal; the sending unit 2103 is also used to send the fingerprint information of the terminal to the terminal identification device, and the fingerprint information of the terminal includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address or IP address.
  • an embodiment of the present application provides a communication device 2200.
  • the communication device 2200 can be an execution subject in any of the above-mentioned embodiments, and can correspond to, for example, the terminal identification device 10, web server 30, or terminal 20 in Figure 12 , the network controller 13 or terminal 20 in Figure 13 , the access layer device 45 or terminal 20 in Figure 14 , or the communication device 1900, communication device 2000, or communication device 2100 described above.
  • the communication device 2200 can implement the functions of the corresponding execution subjects in the above-mentioned embodiments.
  • the communication device 2200 includes at least one processor 2201, a bus system 2202, a memory 2203, and at least one communication interface 2204.
  • the communication device 2200 is a hardware device that can be used to implement the functional modules in the communication device 1900 shown in Figure 19.
  • the sending unit 1901, the receiving unit 1902, and the processing unit 1903 in the communication device 1900 shown in Figure 19 are implemented by the at least one processor 2201 calling the code in the memory 2203.
  • the communication device 2200 is a hardware device that can be used to implement the functional modules in the communication device 2100 shown in Figure 21.
  • the receiving unit 2101, the processing unit 2102, and the sending unit 2103 in the communication device 2100 shown in Figure 21 are implemented by the at least one processor 2201 calling the code in the memory 2203.
  • the communication device 2200 may be a network device or a control entity implementing an embodiment of the present application.
  • the processor 2201 may be a general-purpose central processing unit (CPU), a network processor (NP), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.
  • CPU general-purpose central processing unit
  • NP network processor
  • ASIC application-specific integrated circuit
  • the bus system 2202 may include a channel for transmitting information between the components.
  • the communication interface 2204 is used to communicate with other devices or communication networks.
  • the memory 2203 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, a random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.
  • the memory may be independent and connected to the processor via a bus.
  • the memory may also be integrated with the processor.
  • the memory 2203 is used to store application code for executing the solution of the present application, and the execution is controlled by the processor 2201.
  • the processor 2201 is used to execute the application code stored in the memory 2203, thereby realizing the functions of the method of the present application.
  • the processor 2201 may include one or more CPUs, such as CPU0 and CPU1 in Figure 22.
  • the communication device 2200 may include multiple processors, such as the processor 2201 and the processor 2207 in FIG22 .
  • processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor.
  • the processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (e.g., computer program instructions).
  • the embodiment of the present application further provides a chip system, including a processor and an interface circuit, the interface circuit being configured to receive instructions and transmit them to the processor;
  • the processor for example, may be a specific implementation form in the embodiment of the present application, and may be configured to execute the above-mentioned method 500, method 600, method 700, or method 800.
  • the processor is coupled to a memory, and the memory is configured to store programs or instructions.
  • the chip system implements the method in any of the above-mentioned method embodiments.
  • the chip system may include one or more chips.
  • the chip system may, for example, be the following communication system 2300.
  • the interface circuit can be used to implement the relevant operations performed by the sending unit 1901 and the receiving unit 1902 in the communication device 1900
  • the processor can be used to implement the relevant operations performed by the processing unit 1903 in the communication device 1900.
  • the interface circuit can be used to implement the relevant operations performed by the receiving unit 2001 in the communication device 2000
  • the processor can be used to implement the relevant operations performed by the processing unit 2002 in the communication device 2000.
  • the interface circuit can be used to implement the relevant operations performed by the sending unit 2103 and the receiving unit 2101 in the communication device 2100
  • the processor can be used to implement the relevant operations performed by the processing unit 2102 in the communication device 2100.
  • processors in the chip system there may be one or more processors in the chip system.
  • the processor may be implemented in hardware or software.
  • the processor may be a logic circuit, an integrated circuit, etc.
  • the processor may be a general-purpose processor implemented by reading software code stored in a memory.
  • the memory in the chip system may be one or more memories.
  • the memory may be integrated with the processor or may be provided separately from the processor, which is not limited in this application.
  • the memory may be a non-transient processor, such as a read-only memory (ROM), which may be integrated with the processor on the same chip or provided on different chips. This application does not specifically limit the type of memory or the configuration of the memory and the processor.
  • the chip system can be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), a central processing unit (CPU), a network processor (NP), a digital signal processing circuit (DSP), a microcontroller unit (MCU), a programmable logic device (PLD) or other integrated chips.
  • FPGA field programmable gate array
  • ASIC application specific integrated circuit
  • SoC system on chip
  • CPU central processing unit
  • NP network processor
  • DSP digital signal processing circuit
  • MCU microcontroller unit
  • PLD programmable logic device
  • the embodiment of the present application further provides a communication system 2300, as shown in Figure 23.
  • the communication system 2300 may include a first communication entity 2301, a second communication entity 2302, and a third communication entity 2303.
  • the first communication entity 2301 is used to provide a web page to the terminal;
  • the second communication entity 2302 is configured to call the browser interface of the terminal through the Web page to obtain capability information of the terminal;
  • the third communication entity 2303 is configured to identify the type of the terminal according to the capability information of the terminal.
  • first communication entity 2301, second communication entity 2302, and third communication entity 2303 are components within the web server.
  • communication system 2300 may correspond to network controller 13 in FIG. 13 or access layer device 45 in FIG. 14;
  • first communication entity 2301 and second communication entity 2302 correspond to portions of network controller 13 or access layer device 45 that implement web server functionality, for which specific reference may be made to the operations performed by the web server in method 500, method 600, or communication device 1900;
  • third communication entity 2303 corresponds to portions of network controller 13 or access layer device 45 that implement terminal identification functionality, for which specific reference may be made to the operations performed by the terminal identification device in method 500, method 700, or communication device 2000.
  • the first communication entity 2301 is a web server
  • the second communication entity 2302 is a terminal
  • the third communication entity 2303 is a terminal identification device.
  • the communication system 2300 may correspond to the network architecture shown in FIG12 , wherein the first communication entity 2301 corresponds to the web server 30, for which specific reference may be made to the operations performed by the web server in the aforementioned method 500, or to the method 600, or to the aforementioned communication device 1900; the second communication entity 2302 corresponds to the terminal 20, for which specific reference may be made to the operations performed by the terminal in the aforementioned method 500, or to the method 800, or to the aforementioned communication device 2100; and the third communication entity 2303 corresponds to the terminal identification device 10, for which specific reference may be made to the operations performed by the terminal identification device in the aforementioned method 500, or to the method 700, or to the aforementioned communication device 2000.
  • the Web page includes a script
  • the content of the script may include: calling the browser interface to obtain the capability information of the terminal.
  • the content of the script may further include: calling a network interface to send the capability information of the terminal to the third communication entity.
  • an embodiment of the present application further provides a computer storage medium, which includes instructions.
  • the instructions When the instructions are executed on a processor, the following method is implemented:
  • the web page includes a script
  • the content of the script may include: calling a browser interface to obtain capability information of the terminal.
  • the script may also include invoking a network interface to transmit the terminal's capability information to the terminal identification device.
  • the terminal identification device may be deployed in a web server, in which case the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in a web server, in which case the network interface may be a network interface exposed by the communication device containing the terminal identification device to the terminal.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the terminal identification device identifies the type of the terminal based on the terminal's capability information and the terminal's fingerprint information, where the terminal's fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address, or IP address.
  • an embodiment of the present application further provides a computer storage medium, which includes instructions.
  • the instructions When the instructions are executed on a processor, the following method is implemented:
  • the script includes: calling the browser interface to obtain the terminal's capability information; and
  • the terminal capability information is sent to the terminal identification device.
  • the script may also include invoking a network interface to transmit the terminal's capability information to the terminal identification device.
  • the instructions of the computer storage medium are executed on the processor, the following method is specifically implemented: transmitting the terminal's capability information to the terminal identification device via the network interface.
  • the terminal identification device may be deployed in a web server.
  • the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in a web server.
  • the network interface may be a network interface exposed by the communication device containing the terminal identification device to the terminal.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the terminal identification device identifies the type of the terminal based on the terminal's capability information and the terminal's fingerprint information, where the terminal's fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address, or IP address.
  • an embodiment of the present application further provides a computer storage medium, which includes instructions.
  • the instructions When the instructions are executed on a processor, the following method is implemented:
  • the terminal's capability information is obtained by executing a script in a web page.
  • the content of the web page script includes: calling the terminal's browser interface to obtain the terminal's capability information.
  • the content of the web page script may also include: calling a network interface to send the terminal's capability information to the terminal identification device.
  • the terminal identification device may be deployed in a web server.
  • the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in the web server.
  • the network interface may be a network interface exposed to the terminal by the communication device where the terminal identification device resides.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the following method is specifically implemented: based on the terminal capability information and the terminal fingerprint information, the terminal type is identified, and the terminal fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address or IP address.
  • an embodiment of the present application further provides a computer program product, which includes a computer program; when the computer program is run on a processor, the following method is implemented:
  • the web page includes a script
  • the content of the script may include: calling a browser interface to obtain capability information of the terminal.
  • the script may also include invoking a network interface to transmit the terminal's capability information to the terminal identification device.
  • the terminal identification device may be deployed in a web server, in which case the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in a web server, in which case the network interface may be a network interface exposed by the communication device containing the terminal identification device to the terminal.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the terminal identification device identifies the type of the terminal based on the terminal's capability information and the terminal's fingerprint information, where the terminal's fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address, or IP address.
  • an embodiment of the present application further provides a computer program product, which includes a computer program; when the computer program is run on a processor, the following method is implemented:
  • the script includes: calling the browser interface to obtain the terminal's capability information; and
  • the capability information of the terminal is sent to the terminal identification device.
  • the script may also include invoking a network interface to transmit the terminal's capability information to the terminal identification device.
  • the computer program of the computer program product runs on a processor, the following method is specifically implemented: transmitting the terminal's capability information to the terminal identification device via the network interface.
  • the terminal identification device may be deployed in a web server.
  • the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in a web server.
  • the network interface may be a network interface exposed to the terminal by a communication device containing the terminal identification device.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the terminal identification device identifies the type of the terminal based on the terminal's capability information and the terminal's fingerprint information, where the terminal's fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address, or IP address.
  • an embodiment of the present application further provides a computer program product, which includes a computer program; when the computer program is run on a processor, the following method is implemented:
  • the terminal's capability information is obtained by executing a script in a web page.
  • the content of the web page script includes: calling the terminal's browser interface to obtain the terminal's capability information.
  • the content of the web page script may also include: calling a network interface to send the terminal's capability information to the terminal identification device.
  • the terminal identification device may be deployed in a web server.
  • the network interface may be a network interface exposed by the web server to the terminal.
  • the terminal identification device may not be deployed in the web server.
  • the network interface may be a network interface exposed to the terminal by the communication device where the terminal identification device resides.
  • the capability information of the terminal may include at least one of the following: touch screen capability, media device capability, storage capability, or USB capability.
  • the following method is specifically implemented: based on the terminal capability information and the terminal fingerprint information, the terminal type is identified, and the terminal fingerprint information includes at least one of the following: MAC OUI, DHCP Option, HTTP UA, mDNS, LLDP, MAC address or IP address.
  • determining B based on A does not mean determining B only based on A, but B can also be determined based on A and/or other information.
  • ordinal numbers such as “1”, “2”, “3”, “first”, “second” and “third” are used to distinguish multiple objects and are not used to limit the order of multiple objects.
  • a and/or B mentioned in this application should be understood to include the following situations: only A, only B, or both A and B.
  • the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM)/RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or certain parts of the embodiments.
  • a storage medium such as a read-only memory (ROM)/RAM, a magnetic disk, an optical disk, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Small-Scale Networks (AREA)

Abstract

La présente demande concerne un procédé d'identification de terminal, un appareil et un système. Le procédé comprend les étapes suivantes : acquisition d'informations de port ouvert d'une pluralité de terminaux ; regroupement de la pluralité de terminaux sur la base des informations de port ouvert de chaque terminal ; et sur la base d'un résultat de regroupement, identification d'au moins un groupe auquel appartiennent la pluralité de terminaux, les terminaux compris dans chaque groupe parmi l'au moins un groupe appartenant au même type. De plus, le procédé comprend les étapes suivantes : fourniture d'une page Web pour un terminal ; appel d'une interface de navigateur du terminal au moyen de la page Web, de façon à acquérir des informations de capacité du terminal ; et sur la base des informations de capacité du terminal, identification du type du terminal. De cette manière, la précision de l'identification de terminal peut être améliorée dans un scénario dans lequel divers types de terminaux émergent sans cesse et les limites entre les terminaux sont relativement ambiguës.
PCT/CN2025/080156 2024-03-21 2025-03-03 Procédé d'identification de terminal, appareil et système Pending WO2025195151A1 (fr)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202410332525.9A CN120692559A (zh) 2024-03-21 2024-03-21 一种终端的识别方法和装置
CN202410332525.9 2024-03-21
CN202410374530.6 2024-03-28
CN202410374530.6A CN120723995A (zh) 2024-03-28 2024-03-28 一种终端的识别方法、装置及系统

Publications (1)

Publication Number Publication Date
WO2025195151A1 true WO2025195151A1 (fr) 2025-09-25

Family

ID=97138331

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2025/080156 Pending WO2025195151A1 (fr) 2024-03-21 2025-03-03 Procédé d'identification de terminal, appareil et système

Country Status (1)

Country Link
WO (1) WO2025195151A1 (fr)

Similar Documents

Publication Publication Date Title
CN106489251B (zh) 应用拓扑关系发现的方法、装置和系统
CN107431651B (zh) 一种网络服务的生命周期管理方法及设备
US10165507B2 (en) Network access method and apparatus applied to mobile application
WO2014069827A1 (fr) Système et procédé pour fournir un service d'analyse de données dans un environnement en nuage
Moreira et al. Next generation of microservices for the 5G Service‐Based Architecture
US12474939B2 (en) Sound and clear provenance tracking for microservice deployments
US20160124781A1 (en) Creating and Using Service Control Functions
US20250330465A1 (en) Application identification
CN106790444A (zh) 网络数据交互方法和装置
WO2025158261A1 (fr) Procédé et appareil de traitement de demande, et procédé et appareil d'exécution de tâche
US11057242B2 (en) Address system
CN115934110A (zh) 一种模型部署方法、装置及电子设备
EP4152723A1 (fr) Système et procédé de surveillance de l'état de composants de réseau dans une configuration de réseau
WO2025195151A1 (fr) Procédé d'identification de terminal, appareil et système
CN112565106B (zh) 流量业务识别方法、装置、设备及计算机存储介质
CN113726612A (zh) 一种获取测试数据的方法、装置、电子设备及存储介质
CN118585183A (zh) 一种基于鸿蒙系统的无障碍服务封装方法及装置
CN112000313A (zh) 请求响应方法、装置、设备及存储介质
CN110324345B (zh) 服务器的登陆方法、装置、存储介质及终端
CN114780241A (zh) 一种应用于服务器的加速卡设置方法、装置及介质
CN111475289B (zh) 负载均衡方法及装置
CN120692559A (zh) 一种终端的识别方法和装置
CN120723995A (zh) 一种终端的识别方法、装置及系统
CN112261051B (zh) 一种用户注册方法、装置及系统
CN117240787B (zh) 交换机负载均衡方法、装置、电子设备及可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 25772859

Country of ref document: EP

Kind code of ref document: A1