Access control method and related apparatus

An access control method, comprising:

• receiving, by a first network device, a source identifier and a target identifier that are sent by a computer device, wherein the source identifier indicates the computer device, the target identifier indicates a target resource, and the target resource is a resource to be accessed by the computer device;
• determining, by the first network device based on the source identifier and the target identifier according to an access control policy, an association attribute and a first target constraint item corresponding to the association attribute, wherein the access control policy comprises a condition for the computer device to access the target resource, the association attribute is an attribute associated with the source identifier, and the first target constraint item is a preset constraint range of information corresponding to the association attribute;
• determining, by the first network device, a first verification code based on at least a first key, the association attribute, and the first target constraint item corresponding to the association attribute;
• and
• sending, by the first network device, first indication information to the computer device, to enable the computer device to send, based on the first indication information, a packet for accessing the target resource, wherein the first indication information comprises at least the first verification code.

A communication apparatus, comprising at least one processor, wherein the at least one processor is coupled to a memory, the memory stores instructions, and the at least one processor is configured to execute the instructions, to enable the communication apparatus to perform a method comprising:

• sending, by a computer device, a source identifier and a target identifier to a first network device, wherein the source identifier indicates the computer device, the target identifier indicates a target resource, and the target resource is a resource to be accessed by the computer device;
• receiving, by the computer device, first indication information sent by the first network device, wherein the first indication information comprises at least a first verification code, the first verification code is obtained based on at least a first key, an association attribute, and a first target constraint item corresponding to the association attribute, the association attribute is an attribute associated with the source identifier, and the first target constraint item is a preset constraint range of information corresponding to the association attribute;
• obtaining, by the computer device, the association attribute;
• determining, by the computer device, first target information corresponding to the association attribute, wherein the first target information is information corresponding to the association attribute when the computer device accesses the target resource;
• and
• sending, by the computer device, a packet for accessing the target resource, wherein the packet comprises at least the first indication information, the association attribute, and the first target information corresponding to the association attribute.