Local auditing protection method and system for Azure cloud hybrid deployment

Abstract

The invention provides a local auditing protection method and system for Azure cloud hybrid deployment. The method comprises a hybrid deployment state exploration process, a key data auditing process and a threat protection process. After entering a mixed deployment state exploration process, entering a key data auditing process; after entering a key data auditing process, entering a threat protection process, judging whether rule verification is passed or not, and if a result is yes, ending; and if not, executing the security policy, and ending. According to the invention, through the preposed hybrid deployment state probing subsystem, integration and analysis of a local region hybrid deployment environment are realized, the mastering condition of a user on current domain hybrid deployment configuration is improved, and information support is provided for subsequent auditing and protection.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular, relates to a local domain audit protection method and system for Azure cloud hybrid deployment. More specifically, it is a local domain audit protection system and method in a Microsoft Azure cloud hybrid deployment scenario. Background Art

[0002] Hybrid deployment is a service provided by Microsoft Azure to enterprises. Through hybrid deployment, enterprises can extend the local domain environment to the cloud to achieve unified access and management. The user identities of the local domain will be synchronized to Azure AD. These identities are called hybrid identities. You can access cloud resources through local hybrid identity user credentials to achieve identity interoperability.

[0003] To support hybrid deployment, Azure provides three authentication methods: Password Hash Synchronization, referred to as PHS, Pass-through Authentication, referred to as PTA, and Active Directory Federation Services, referred to as ADFS; an additional feature, Single Sign-On, or SSO, is also provided, which can be applied to PHS and PTA.

[0004] Hybrid deployment provides enterprises with convenience in management and resource access, but it also increases security risks. The identity interoperability between the local domain and the cloud allows attackers to extend access rights to the cloud after obtaining access rights in the local domain, and vice versa. Therefore, it is necessary to audit and evaluate the security situation in this scenario.

[0005] Currently, existing host audit systems usually monitor the logs and events generated on the host as the main monitoring targets, and analyze the overall security status of the host based on these contents.

[0006] Patent document CN117692156A discloses a method, system, storage medium and computer device for host auditing, which collects audit events of system calls and file system operations by receiving audit policies issued by a background server, generates security analysis and corresponding security policies, and dynamically updates the audit policies of the host. This type of technology has certain defects when monitoring related risks in hybrid deployment scenarios. Since the local domain will have some additional resources in a hybrid deployment scenario, such as newly added privileged servers, privileged users, host status and confidential credentials, conventional audit policies for host events and logs may miss related risk operations; and some resources themselves have security risks, which are difficult to discover by analyzing logs and events alone. Summary of the invention

[0007] In view of the defects in the prior art, the purpose of the present invention is to provide a local domain audit protection method and system for Azure cloud hybrid deployment.

[0008] A local domain audit protection method for Azure cloud hybrid deployment provided according to the present invention includes: a hybrid deployment status exploration process, a key data audit process and a threat protection process;

[0009] After entering the hybrid deployment status exploration process, enter the key data audit process; after entering the key data audit process, enter the threat protection process to determine whether the rule verification passes. If the result is yes, it ends; if the result is no, execute the security policy and end.

[0010] Preferably, the hybrid deployment status detection process includes:

[0011] Step A1: Search services and obtain server location results;

[0012] Step A2: Query the service account through the server location result;

[0013] Step A3: query configuration information through the credentials of the service account to determine the identity authentication mode;

[0014] In the step A1, the services include: AdSync service, PTA proxy service and ADFS service; the server location results include: Azure AD Connect server, PTA proxy server and ADFS server;

[0015] In the step A2, the service account of the AdSync service is queried on the server through the positioning result of the Azure AD Connect server;

[0016] In step A3, Azure AD is accessed through the credentials of the service account to query configuration information;

[0017] The configuration information includes: identity authentication mode, domain hosting type;

[0018] The identity authentication mode includes: PHS, PTA, ADFS or SSO.

[0019] Preferably, the key data audit process includes:

[0020] Step B1: Collect privileged user information;

[0021] Step B2: Based on the privileged user situation, monitor and record data through the authentication mode and collect logs;

[0022] In the step B1, the privileged user information includes: member information of the AdSync service administrator group, user information of the PTA proxy service, member information of the ADFS service administrator group, and account information of the SSO service account AZUREADSSOACC;

[0023] In the step B2, if the identity authentication mode is PHS mode, the information of the AdSync table of the LocalDB database is recorded; if the identity authentication mode is PTA mode, the information of the PTA proxy certificate is recorded; if the identity authentication mode is ADFS mode, the information of the ServiceSetting table of the WID database is recorded; if it is determined whether SSO is enabled, if the result is yes, the information of the SSO device authentication certificate and the communication certificate is recorded; if the result is no, no record is made;

[0024] In step B2, the log collection, the authentication mode is PHS mode, collects the privileged user login log of the Azure ADConnect server, the access log of the LocalDB database, the MSOL user directory replication log and the login event of the Sync account in Azure AD;

[0025] The authentication mode is PTA mode, which collects the privileged user login log of the PTA proxy server, the start and stop records of the PTA proxy service, the DLL loading status of the running PTA proxy service, and the export event of the PTA proxy certificate;

[0026] The authentication mode is ADFS mode, which collects the privileged user login logs of the ADFS server and the access logs of the WID database;

[0027] If SSO is enabled, the attribute change log of the AZUREADSSOACC account, and the export events of the authentication certificate and communication certificate are collected.

[0028] Preferably, the threat protection process includes:

[0029] Step C1: Perform security verification based on the log and event information obtained in step B2;

[0030] Step C2: Execute the security policy for the rules that fail the security check.

[0031] Preferably, in step C1:

[0032] Step C1.1: Based on the data, determine whether the database file and the certificate file are consistent. If the result is yes, the verification passes and no processing is performed; if the result is no, execute step C2;

[0033] Step C1.2: Based on the log and event information obtained in step B2, determine whether there is any suspicious access, login, or loading. If the result is yes, execute step C2; if the result is no, do not process;

[0034] In step C2, the security policy is to issue a warning to redundant privileged users, restore the user to which the PTA proxy service belongs and restart the PTA proxy service, update the AZUREADSSOACC system account credentials; issue a warning for abnormal changes in confidential files, and force the update of credentials and certificates in the database; issue a warning for important resource access and privileged user login events, and determine whether the PTA proxy service loads a suspicious DLL. If the result is yes, the service needs to be restarted; if the result is no, no processing is performed. The suspicious means that it is different from the DLL loaded during the normal operation of the service, that is, it can be judged from the name or behavior that it has a suspicious purpose and will interfere with the normal operation of the service.

[0035] According to the present invention, a local domain audit protection system for Azure cloud hybrid deployment is provided, comprising: a hybrid deployment status detection subsystem, a key data audit subsystem and a threat protection subsystem;

[0036] After the hybrid deployment status detection subsystem is triggered, the key data audit subsystem is triggered; after the key data audit subsystem is triggered, the threat protection subsystem is triggered to determine whether the rule verification passes. If the result is yes, the process ends; if the result is no, the security policy is executed and the process ends.

[0037] Preferably, the hybrid deployment status detection subsystem includes:

[0038] Hybrid deployment of key service query module: search services and obtain server location results;

[0039] Hybrid deployment service account query module: query service accounts through server location results;

[0040] A hybrid deployment configuration query module: querying configuration information through the credentials of the service account to determine the authentication mode;

[0041] In the hybrid deployment key service query module, the services include: AdSync service, PTA proxy service and ADFS service; the server location results include: Azure AD Connect server, PTA proxy server and ADFS server;

[0042] In the hybrid deployment service account query module, the service account of the AdSync service is queried on the server through the location result of the Azure AD Connect server;

[0043] In the hybrid deployment configuration query module, Azure AD is accessed through the credentials of the service account to query configuration information;

[0044] The configuration information includes: identity authentication mode, domain hosting type;

[0045] The identity authentication mode includes: PHS, PTA, ADFS or SSO.

[0046] Preferably, the key data audit subsystem includes:

[0047] Privileged user detection module: collects privileged user information;

[0048] Confidential data monitoring module: monitors data based on the authentication mode based on privileged user conditions;

[0049] Log event recording module: records data according to the authentication mode and collects logs;

[0050] In the privileged user detection module of the step, the privileged user situation includes: member information of the AdSync service administrator group, user information of the PTA proxy service, member information of the ADFS service administrator group, and account information of the SSO service account AZUREADSSOACC;

[0051] In the log event recording module, if the identity authentication mode is PHS mode, the information of the AdSync table of the LocalDB database is recorded; if the identity authentication mode is PTA mode, the information of the PTA proxy certificate is recorded; if the identity authentication mode is ADFS mode, the information of the ServiceSetting table of the WID database is recorded; if it is determined whether SSO is enabled, if the result is yes, the information of the SSO device authentication certificate and the communication certificate is recorded; if the result is no, no record is made;

[0052] In the log event recording module, the log collection, the authentication mode is PHS mode, and the privileged user login log of the Azure AD Connect server, the access log of the LocalDB database, the MSOL user directory replication log and the login event of the Sync account in Azure AD are collected;

[0053] The authentication mode is PTA mode, which collects the privileged user login log of the PTA proxy server, the start and stop records of the PTA proxy service, the DLL loading status of the running PTA proxy service, and the export event of the PTA proxy certificate;

[0054] The authentication mode is ADFS mode, which collects the privileged user login logs of the ADFS server and the access logs of the WID database;

[0055] If SSO is enabled, the attribute change log of the AZUREADSSOACC account, and the export events of the authentication certificate and communication certificate are collected.

[0056] Preferably, the threat protection subsystem includes:

[0057] Rule verification module: performs security verification based on the log and event information recorded by the log event recording module;

[0058] Policy execution module: executes security policies for rules that fail security verification.

[0059] Preferably, the rule verification module includes:

[0060] Rule verification unit 1: based on the data, judge whether the database file and the certificate file are consistent. If the result is yes, the verification is passed without processing; if the result is no, the policy execution module is triggered;

[0061] Rule verification unit 2: based on the log and event information recorded by the log event recording module, determine whether there is suspicious access, login and loading. If the result is yes, trigger the policy execution module; if the result is no, no processing is performed;

[0062] In the policy execution module, the security policy is to issue warnings to redundant privileged users, restore the users to which the PTA proxy service belongs and restart the PTA proxy service, and update the AZUREADSSOACC system account credentials; issue warnings for abnormal changes to confidential files, and force the credentials and certificates in the database to be updated; issue warnings for important resource access and privileged user login events, and determine whether the PTA proxy service has loaded a suspicious DLL. If the result is yes, the service needs to be restarted; if the result is no, no processing is performed.

[0063] Compared with the prior art, the present invention has the following beneficial effects:

[0064] 1. The present invention realizes the integration and analysis of the local domain hybrid deployment environment through the front-end hybrid deployment status detection subsystem, improves the user's understanding of the current domain hybrid deployment configuration, and provides information support for subsequent auditing and protection. In other words, the present invention realizes more complete and accurate local domain auditing and protection in hybrid deployment scenarios, which can be used to comprehensively detect whether there are security risks in the hybrid deployment of the local domain environment, and executes warnings and protection measures for its risk items, thereby improving the security of the local domain when hybrid deployment is enabled.

[0065] 2. The present invention comprehensively monitors important resources in hybrid deployment scenarios by auditing privileged users, confidential data and log events, thereby solving the problem that previous host auditing technologies are not sufficiently targeted in hybrid deployment scenarios, especially in auditing under specific identity authentication modes, such as the audit of the AdSync database table of LocalDB in the PHS mode, the audit of the PTA proxy service in the PTA mode, and the audit of the service account AZUREADSSOACC in the SSO mode. This increases the audit coverage of key data in hybrid deployments by 52% compared to existing comprehensive host auditing technologies, reaching about 85%.

[0066] 3. The present invention verifies and protects the collected audit data by providing a default set of rules and policies, which can cover 80% of hybrid deployment anomalies; and, by combining protection strategies for issuing warnings and refreshing data, the audit system's ability to intervene in the actual environment is improved, ensuring the effectiveness of auditing and protection, and increasing the user response rate to the audit system by 27%, reaching about 71%.

[0067] 4. The present invention opens a customized rule policy configuration function, allowing users to adjust the protection scope and strength of the local domain according to actual conditions, thereby improving the applicability and flexibility of the system and further increasing the coverage by 15% based on the default rule policy set. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0069] Figure 1 A schematic diagram of the structure provided by the present invention;

[0070] Figure 2 A schematic diagram of the process provided by the present invention. DETAILED DESCRIPTION

[0071] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0072] In order to solve the problems of audit omissions and narrow analysis in the prior art, the present invention provides a new local domain audit protection method and system in a hybrid deployment scenario. The present invention collects data and audit logs in a more targeted manner in a hybrid deployment scenario, comprehensively monitors the hybrid deployment status, privileged users, and confidential data of the local domain, and takes corresponding protection measures according to the built-in policies, thereby achieving more complete and accurate local domain auditing and protection in a hybrid deployment scenario. In other words, the present invention is applicable to local domains that have enabled hybrid deployment and are associated with the cloud, with local domain data as the main data and cloud data as the supplementary data. The security of the local domain is monitored through data auditing and threat protection, and the existing risks are mitigated.

[0073] A local domain audit protection method for Azure cloud hybrid deployment provided according to the present invention includes: a hybrid deployment status exploration process, a key data audit process and a threat protection process;

[0074] After entering the hybrid deployment status exploration process, enter the key data audit process; after entering the key data audit process, enter the threat protection process to determine whether the rule verification passes. If the result is yes, it ends; if the result is no, execute the security policy and end.

[0075] The hybrid deployment status detection process includes:

[0076] Step A1: Search services and obtain server location results;

[0077] Step A2: Query the service account through the server location result;

[0078] Step A3: query configuration information through the credentials of the service account to determine the identity authentication mode;

[0079] The key data audit process includes:

[0080] Step B1: Collect privileged user information;

[0081] Step B2: Based on the privileged user situation, monitor and record data through the authentication mode and collect logs;

[0082] The threat protection process includes:

[0083] Step C1: Perform security verification based on the log and event information obtained in step B2;

[0084] Step C2: Execute the security policy for the rules that fail the security check.

[0085] In other words, the present invention provides a local domain audit protection system for Azure cloud hybrid deployment, including: a hybrid deployment status detection subsystem, a key data audit subsystem, and a threat protection subsystem;

[0086] The hybrid deployment status detection subsystem is used to obtain detailed configuration information and key server locations of the local domain hybrid deployment; the subsystem includes a hybrid deployment key service query module, a hybrid deployment service account query module, and a hybrid deployment configuration query module.

[0087] First, the hybrid deployment status detection subsystem comprehensively analyzes in the local domain whether the current domain environment is in hybrid deployment mode. If so, it further determines the authentication mode adopted by the hybrid deployment, namely password hash synchronization PHS, pass-through authentication PTA, federated service ADFS and single sign-on SSO, as well as the key server locations corresponding to different modes.

[0088] Secondly, after clarifying the authentication mode adopted by the hybrid deployment, the key data audit subsystem collects key data and status information from the local domain and collects logs and events for sensitive resources.

[0089] Finally, different authentication methods have different characteristics and security risks. The threat protection subsystem evaluates whether there are security risks in the current domain environment based on this information, and executes corresponding alerts and protection measures based on the built-in audit policies.

[0090] Specifically, the hybrid deployment status detection subsystem includes: a hybrid deployment key service query module, a hybrid deployment service account query module and a hybrid deployment configuration query module.

[0091] The hybrid deployment key service query module queries several key services involved in hybrid deployment in the local domain to determine whether hybrid deployment is enabled in the current domain and locate the location of important servers in the domain; in other words, it searches for key services for hybrid deployment in the local domain, namely AdSync service, PTA proxy service and ADFS service, to determine whether hybrid deployment is enabled in the current domain and locate the location of important servers in the domain. In short, the hybrid deployment status detection subsystem analyzes whether hybrid deployment is enabled in the current environment in the local domain, locates the location of related servers, and determines the authentication mode adopted by hybrid deployment.

[0092] The hybrid deployment service account query module queries the account names and plain text passwords of MSOL and Sync accounts on the Azure AD Connect server; in other words, it queries the information of the related service accounts of AdSync.

[0093] The hybrid deployment configuration query module uses the permissions of the MSOL and Sync accounts to query the detailed configuration information of the local domain hybrid deployment from Azure AD, including the primary authentication mode, domain hosting type, and the hybrid deployment mode used; in other words, it queries the detailed configuration information of the local domain hybrid deployment from Azure AD to determine the authentication mode used by the local domain hybrid deployment.

[0094] The key data audit subsystem is used to collect and co-deploy relevant privileged users, confidential data and log event information in the local domain; in other words, the key data audit subsystem collects privileged users, important data and status information, and records operation logs and events of sensitive resources.

[0095] Specifically, the key data audit subsystem includes: a privileged user detection module, a confidential data monitoring module and a log event recording module.

[0096] The privileged user detection module collects the user list synchronized from the local domain to the cloud, and detects whether there are different privileged users corresponding to the hybrid deployment authentication mode in the domain; in other words, the user list synchronized from the local to the cloud is collected on the Azure AD Connect server, and according to the different authentication modes of the hybrid deployment, it is detected whether there are corresponding privileged users in the domain.

[0097] The confidential data monitoring module checks the corresponding database files, cache files, certificate files, encrypted private key files and other data in the local domain according to the different identity authentication modes of hybrid deployment. These files store important data such as user credentials, access tokens, digital certificates, etc., and monitors the access rights of these files.

[0098] The log event recording module records corresponding sensitive operation logs, service operation logs, sensitive resource access events, user login events, etc. according to different identity authentication modes of hybrid deployment; in other words, it records abnormal operation logs, service operation logs, sensitive resource access events, and user login events for hybrid deployment.

[0099] The threat protection subsystem is used to verify the audit results of key data, evaluate whether there are security risks in the local domain, and implement corresponding mitigation strategies. In other words, the threat protection subsystem performs rule verification based on the audit results of key data, evaluates the security risks of the local domain, and implements corresponding mitigation strategies.

[0100] Specifically, the threat protection subsystem includes: a rule policy configuration module, a rule verification module and a policy execution module;

[0101] By receiving information collected by the key data audit subsystem and verifying the internally configured security rules, the corresponding strategy is executed according to the rule verification results.

[0102] The rule policy configuration module provides a customized rule configuration function. In different hybrid deployment identity authentication modes, different verification rules and execution policies can be configured for the collected key data; in other words, the rules that need to be verified and the policies that need to be executed are formulated based on the collected data.

[0103] The rule verification module verifies the information collected by the key data audit subsystem according to pre-configured verification rules and returns the verification results of all rules.

[0104] The policy execution module executes corresponding security policies for rules that fail to pass verification according to pre-configured execution policies, thereby achieving threat protection and security improvement.

[0105] In other words, according to a local domain audit protection method for Azure cloud hybrid deployment provided by the present invention, a hybrid deployment state detection method, a key data audit method and a log event recording method are sequentially executed, that is, the hybrid deployment state detection process, the key data audit process and the threat protection process are sequentially entered;

[0106] The hybrid deployment status detection process includes:

[0107] Hybrid deployment key service query steps, referred to as step A1: Search for AdSync service, PTA proxy service and ADFS service in the local domain, and locate the Azure AD Connect server, PTA proxy server and ADFS server respectively through the corresponding search results;

[0108] The PTA agent service is a key service running on the PTA agent server in the PTA authentication mode. The full name of PTA is Pass-Through Authentication, which means pass-through authentication; the full name of the PTA agent service is AzureADConnectAuthenticationAgentService.

[0109] Hybrid deployment service account query, referred to as step A2: query the service account of the AdSync service on the server through the location result of the Azure AD Connect server; the service account, i.e., the name and plaintext credentials, i.e., the plaintext password, of the MSOL account and the Sync account;

[0110] Hybrid deployment configuration query, referred to as step A3: access Azure AD through the credentials of the Sync account, query the detailed configuration information of the local domain hybrid deployment from Azure AD, so as to determine whether the authentication mode adopted by the hybrid deployment is PHS, PTA or ADFS, and whether SSO is additionally enabled. The configuration information includes: the authentication master mode and the type of domain hosting.

[0111] The key data audit process includes:

[0112] Privileged user detection, referred to as step B1: Collect the user list synchronized from the local to the cloud on the Azure AD Connect server, and collect the member information of the AdSync service administrator group, the user information of the PTA proxy service, the member information of the ADFS service administrator group, and the account information of the SSO service account AZUREADSSOACC, and collect the hybrid deployment privileged user information in the local domain.

[0113] In other words, different privileged users are recorded according to the different authentication modes that the local domain is currently in: if it is in PHS mode, the member information of the AdSync service administrator group is recorded; if it is in PTA mode, the information of users belonging to the PTA proxy service is recorded; if it is in ADFS mode, the member information of the ADFS service administrator group is recorded; if SSO is additionally enabled, the account information of the SSO service account AZUREADSSOACC is recorded;

[0114] The service account AZUREADSSOACC is a computer account automatically created in the Active Directory by the Azure AD Connect server after Seamless SSO is enabled in the local domain.

[0115] This account is also the service account of the service https: / / autologon.microsoftazuread-sso.com represented by Seamless SSO. Controlling the credentials of this account is considered controlling the Seamless SSO service.

[0116] Confidential data monitoring, referred to as step B2: monitoring different data according to the different authentication modes currently in the local domain.

[0117] If in PHS mode, record the basic file information and changes of the AdSync table of the LocalDB database; if in PTA mode, record the basic file information and changes of the PTA proxy certificate; if in ADFS mode, record the basic file information and changes of the ServiceSetting table of the WID database; if SSO is additionally enabled, record the basic information and changes of the SSO device authentication certificate and communication certificate; in other words, record the basic information and editing status of the LocalDB database, WID database, PTA proxy certificate, SSO device authentication and communication certificates.

[0118] Log event recording, collect different logs and events according to the different authentication modes currently in the local domain, referred to as step B3: if in PHS mode, collect privileged user login logs of the Azure AD Connect server, collect access logs of the LocalDB database, collect logs generated when MSOL users perform directory replication, and record login events of the Sync account in Azure AD;

[0119] If in PTA mode, collect the privileged user login log of the PTA proxy server, collect the start and stop records of the PTA proxy service, record the DLL loading status of the running PTA proxy service, and record the export event of the PTA proxy certificate;

[0120] If in ADFS mode, collect privileged user login logs of the ADFS server and access logs of the WID database; if SSO is additionally enabled, collect change logs of the AZUREADSSOACC account and record export events of device authentication certificates and communication certificates; in other words, collect user login events of the Azure AD Connect server, PTA proxy server, and ADFS server, collect access logs of LocalDB and WID databases, and collect operation logs of the AdSync service account, PTA proxy service, and SSO service account.

[0121] The threat protection process includes:

[0122] Based on the collected privileged user information, verify whether there are local administrators and cloud administrators in the user synchronization list, verify whether there are non-default privileged users in the administrator group of key services, verify whether the user to which the PTA proxy service belongs is a custom user, and verify whether there are any attribute changes to the SSO service account AZUREADSSOACC.

[0123] Rule verification: Verify the collected key data through pre-configured security rules, referred to as step C1: Verify whether there are administrators with excessive permissions and non-default custom users among privileged users, verify the consistency of confidential data and whether there are abnormal changes, and verify whether there are suspicious operations and usage records in log events.

[0124] Based on the collected confidential data, verify the consistency of database files and certificate files, and check whether there are any abnormal changes.

[0125] Based on the collected log and event information, check whether there is any suspicious access to important resources, check whether there are any suspicious login and usage events of privileged users, and check whether the PTA agent service loads suspicious DLLs.

[0126] Policy execution, referred to as step C2: For rules that fail verification, execute security policies, including issuing warnings for abnormal phenomena, restoring or updating important data that has changed, and restoring the local domain security status.

[0127] For each rule that fails the security check, the corresponding security policy is executed.

[0128] Based on the verification of privileged user information, a warning is issued for redundant privileged users, the user to which the PTA agent service belongs is restored and the PTA agent service is restarted, and the AZUREADSSOACC system account credentials are updated.

[0129] Based on the verification of confidential data, warnings are issued for abnormal changes to confidential files, and credentials and certificates in the database are forced to be updated.

[0130] Based on the verification of log events, warnings are issued for important resource access and privileged user login events, and the PTA agent service that has loaded suspicious DLLs is restarted.

[0131] Step 1: The hybrid deployment status detection subsystem runs in a local domain with certain permissions, collects hybrid deployment key service information, hybrid deployment service account information, and hybrid deployment detailed configuration information, and passes the information to the key data audit subsystem.

[0132] Step 2: The key data audit subsystem runs in a local domain with certain permissions based on the information received. According to the hybrid deployment key service information, it collects and synchronizes user information and privileged user lists on the corresponding server; according to the hybrid deployment key service information and detailed configuration information, it collects important file data on the corresponding server and monitors file access permissions; according to the hybrid deployment detailed configuration information, it records sensitive operation logs and key events in the local domain; and finally passes the data to the threat protection subsystem.

[0133] Step 3: The threat protection subsystem provides a customized rule policy configuration function, and users can pre-configure additional necessary rules and policies; then, the threat protection subsystem verifies the audit data based on the received data using the defined rules to obtain the verification results of each rule; finally, based on the verification results, the predefined security policies are executed for the rules that fail the verification.

[0134] The local domain audit protection method for Azure cloud hybrid deployment proposed in the present invention has the following process: Figure 2 As shown, when the hybrid deployment authentication mode adopted by the local domain is different, the specific implementation method is as follows.

[0135] Step 1: The hybrid deployment status detection method is executed in the local domain.

[0136] 1.1. The key service query sub-method traverses and scans important services in the local domain to locate the servers where the AdSync service, PTA proxy service, and ADFS service are located. These servers are the Azure AD Connect server, PTA proxy server, and ADFS server. According to the hybrid deployment authentication method adopted by the local domain, the PTA proxy server and ADFS server may not necessarily exist, but the Azure AD Connect server must exist.

[0137] 1.2. Hybrid deployment service account query sub-method, connects to the LocalDB database on the Azure AD Connect server and queries the plaintext credentials of the AdSync service account, namely the MSOL account and the Sync account.

[0138] 1.3. The hybrid deployment configuration query sub-method logs in to the Azure cloud through the credentials of the Sync service account, obtains the hybrid deployment detailed configuration information of the local domain from AzureAD, and determines the authentication mode used by the hybrid deployment.

[0139] Step 2: The key data audit method is executed in the local domain. First, the user list synchronized from the local to the cloud is collected on the Azure AD Connect server. Subsequently, depending on the hybrid deployment mode adopted by the local domain, the method will have different execution processes.

[0140] In particular, when the hybrid deployment mode used by the local domain is PHS:

[0141] a. Privileged user detection sub-method, recording the member information of the AdSync service administrator group;

[0142] b. Confidential data monitoring sub-method, recording the basic file information and changes of the AdSync table of the LocalDB database;

[0143] c. Log event recording sub-method, collects privileged user login logs of Azure AD Connect server, collects access logs of LocalDB database, collects logs generated when MSOL users perform directory replication, and records login events of Sync account in Azure AD.

[0144] In particular, when the hybrid deployment mode used by the local domain is PTA:

[0145] a. Privileged user detection sub-method, recording the information of users belonging to the PTA proxy service;

[0146] b. Confidential data monitoring sub-method, recording the basic information and changes of the PTA agent certificate;

[0147] c. Log event recording sub-method, collects privileged user login logs of PTA proxy server, collects start and stop records of PTA proxy service, records DLL loading status of running PTA proxy service, and records export events of PTA proxy certificate.

[0148] In particular, when the hybrid deployment mode used by the local domain is ADFS:

[0149] a. Privileged user detection sub-method, recording the member information of the ADFS service administrator group;

[0150] b. Confidential data monitoring sub-method, recording the basic information and changes of files in the ServiceSetting table of the WID database;

[0151] c. Log event recording sub-method, collects privileged user login logs of ADFS server and access logs of WID database;

[0152] Specifically, when the local domain is used with SSO enabled:

[0153] a. Privileged user detection sub-method, records the account information of the SSO service account AZUREADSSOACC;

[0154] b. Confidential data monitoring sub-method, recording the basic information and changes of SSO device authentication certificates and communication certificates;

[0155] c. The log event recording sub-method collects the attribute change log of the AZUREADSSOACC account and records the export events of the device authentication certificate and communication certificate.

[0156] Step 3: Threat protection methods are executed based on the above audit data. If the rule verification is successful, the built-in rule policy set is used for rule verification and policy execution; if the rule verification fails, the corresponding policy is executed. There is a basic rule policy set by default, and additional custom rules or policies can be added or modified.

[0157] 3.1 Custom rules and policies

[0158] a. When customizing rules, perform the following three items: First, specify the data type that the rule verifies, which should be one of the data types returned by the key data audit method in step 2; Second, clarify the data range allowed by the rule. For privileged user information, clarify the reasonable user range; for confidential data information, clarify the reasonable basic attributes and whether attribute changes are supported; for log event information, clarify the reasonable log operator and whether events are supported; Third, set the expected verification result of the rule based on the data range. The rule verification returns a binary result. When the verification fails, the corresponding policy execution will be triggered.

[0159] b. When customizing a policy, perform the following two tasks: first, specify the rules that the policy corresponds to; second, clarify the content of the policy execution, such as issuing warnings for abnormal data or resetting the status of abnormal data.

[0160] The following takes the default rules and policy sets provided by the present invention as an example to provide a subsequent implementation method of the threat protection method.

[0161] 3.2. Privileged user information collected based on step 2

[0162] a. Verify whether there are local or cloud administrators in the user synchronization list, and whether there are non-default privileged users in the administrator group of each key authentication service; if so, the verification fails. When the verification fails, a warning is issued for the redundant privileged users;

[0163] b. In particular, when the local domain uses the PTA mode, check whether the user to which the PTA proxy service belongs is a custom user; if so, the check fails. When the check fails, a warning is issued for the PTA proxy service, the user to which the PTA proxy service belongs is restored, and the PTA proxy service is restarted;

[0164] c. In particular, when the local domain uses the SSO mode, check whether the AZUREADSSOACC account has any attribute changes; if not, the verification is successful; if so, the verification fails. When the verification fails, a warning is issued for the AZUREADSSOACC account, and the AZUREADSSOACC system account credentials are forced to be updated.

[0165] 3.3. Based on the confidential data collected in step 2, verify the consistency of the database file and the certificate file itself, and verify whether there are any abnormal changes; if so, the verification fails. When the verification fails, a warning is issued for the abnormal changes of the confidential file, and the corresponding user credentials and certificates are forced to be updated.

[0166] 3.4. Log events collected based on step 2

[0167] a. Verify whether there is any suspicious access to important resources, and verify whether there is any suspicious login of privileged users on important servers; if so, the verification fails. When the verification fails, a warning is issued for important resource access and privileged user login events;

[0168] b. In particular, when the local domain uses the PTA mode, check whether the PTA proxy service loads the suspicious DLL; if so, the check fails. When the check fails, a warning is issued for the PTA proxy service, and the PTA proxy service that loaded the suspicious DLL is restarted.

[0169] The present invention also provides a local domain audit protection system for Azure cloud hybrid deployment. The local domain audit protection system for Azure cloud hybrid deployment can be implemented by executing the process steps of the local domain audit protection method for Azure cloud hybrid deployment, that is, technical personnel in this field can understand the local domain audit protection method for Azure cloud hybrid deployment as a preferred implementation method of the local domain audit protection system for Azure cloud hybrid deployment.

[0170] According to the present invention, a local domain audit protection system for Azure cloud hybrid deployment is provided, comprising: a hybrid deployment status detection subsystem, a key data audit subsystem and a threat protection subsystem;

[0171] After the hybrid deployment status detection subsystem is triggered, the key data audit subsystem is triggered; after the key data audit subsystem is triggered, the threat protection subsystem is triggered to determine whether the rule verification passes. If the result is yes, the process ends; if the result is no, the security policy is executed and the process ends.

[0172] Those skilled in the art know that, in addition to realizing the system and its various devices, modules, and units provided by the present invention in a purely computer-readable program code, it is entirely possible to realize the same functions in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered as a hardware component, and the devices, modules, and units included therein for realizing various functions can also be regarded as structures within the hardware component; the devices, modules, and units for realizing various functions can also be regarded as both software modules for realizing the method and structures within the hardware component.

[0173] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A local domain audit protection method for Azure cloud hybrid deployment, characterized in that: include: Hybrid deployment status exploration process, key data audit process and threat protection process; After entering the hybrid deployment status exploration process, enter the key data audit process; After entering the key data audit process, enter the threat protection process to determine whether the rule verification has passed. If the result is yes, then end; If the result is no, the security policy is executed and the process ends.

2. The local domain audit protection method for Azure cloud hybrid deployment according to claim 1 is characterized in that: The hybrid deployment status detection process includes: Step A1: Search services and obtain server location results; Step A2: Query the service account through the server location result; Step A3: query configuration information through the credentials of the service account to determine the identity authentication mode; In the step A1, the services include: AdSync service, PTA proxy service and ADFS service; the server location results include: Azure AD Connect server, PTA proxy server and ADFS server; In the step A2, the service account of the AdSync service is queried on the server through the positioning result of the Azure AD Connect server; In step A3, Azure AD is accessed through the credentials of the service account to query configuration information; The configuration information includes: identity authentication mode, domain hosting type; The identity authentication mode includes: PHS, PTA, ADFS or SSO.

3. The local domain audit protection method for Azure cloud hybrid deployment according to claim 2 is characterized in that: The key data audit process includes: Step B1: Collect privileged user information; Step B2: Based on the privileged user situation, monitor and record data through the authentication mode and collect logs; In the step B1, the privileged user information includes: member information of the AdSync service administrator group, user information of the PTA proxy service, member information of the ADFS service administrator group, and account information of the SSO service account AZUREADSSOACC; In the step B2, if the identity authentication mode is PHS mode, the information of the AdSync table of the LocalDB database is recorded; if the identity authentication mode is PTA mode, the information of the PTA proxy certificate is recorded; if the identity authentication mode is ADFS mode, the information of the ServiceSetting table of the WID database is recorded; if it is determined whether SSO is enabled, if the result is yes, the information of the SSO device authentication certificate and the communication certificate is recorded; if the result is no, no record is made; In step B2, the log collection uses the PHS authentication mode to collect privileged user login logs of the Azure AD Connect server, access logs of the LocalDB database, MSOL user directory replication logs, and login events of the Sync account in Azure AD; The authentication mode is PTA mode, which collects the privileged user login log of the PTA proxy server, the start and stop records of the PTA proxy service, the DLL loading status of the running PTA proxy service, and the export event of the PTA proxy certificate; The authentication mode is ADFS mode, which collects the privileged user login logs of the ADFS server and the access logs of the WID database; If SSO is enabled, the attribute change log of the AZUREADSSOACC account, and the export events of the authentication certificate and communication certificate are collected.

4. The local domain audit protection method for Azure cloud hybrid deployment according to claim 3 is characterized in that: The threat protection process includes: Step C1: Perform security verification based on the log and event information obtained in step B2; Step C2: Execute the security policy for the rules that fail the security check.

5. The local domain audit protection method for Azure cloud hybrid deployment according to claim 4 is characterized in that: In step C1: Step C1.1: Based on the data, determine whether the database file and the certificate file are consistent. If the result is yes, the verification passes without further processing; If the result is no, then execute step C2; Step C1.2: Based on the log and event information obtained in step B2, determine whether there is any suspicious access, login and loading. If the result is yes, execute step C2; if the result is no, do not process; In step C2, the security policy is to issue a warning to redundant privileged users, restore the user to which the PTA proxy service belongs and restart the PTA proxy service, and update the AZUREADSSOACC system account credentials; issue a warning for abnormal changes in confidential files, and force the credentials and certificates in the database to be updated; issue a warning for important resource access and privileged user login events, and determine whether the PTA proxy service loads a suspicious DLL. If the result is yes, the service needs to be restarted; If the result is no, no processing is done.

6. A local domain audit protection system for Azure cloud hybrid deployment, characterized in that: include: Hybrid deployment of status detection subsystem, key data audit subsystem and threat protection subsystem; After the hybrid deployment status detection subsystem is triggered, the key data audit subsystem is triggered; After the key data audit subsystem is triggered, the threat protection subsystem is triggered to determine whether the rule verification is passed. If the result is yes, the process ends; if the result is no, the security policy is executed and the process ends.

7. The local domain audit protection system for Azure cloud hybrid deployment according to claim 6, characterized in that: The hybrid deployment status detection subsystem includes: Hybrid deployment of key service query module: search services and obtain server location results; Hybrid deployment service account query module: query service accounts through server location results; A hybrid deployment configuration query module: querying configuration information through the credentials of the service account to determine the authentication mode; In the hybrid deployment key service query module, the services include: AdSync service, PTA proxy service and ADFS service; the server location results include: Azure AD Connect server, PTA proxy server and ADFS server; In the hybrid deployment service account query module, the service account of the AdSync service is queried on the server through the location result of the Azure AD Connect server; In the hybrid deployment configuration query module, Azure AD is accessed through the credentials of the service account to query configuration information; The configuration information includes: identity authentication mode, domain hosting type; The identity authentication mode includes: PHS, PTA, ADFS or SSO.

8. The local domain audit protection system for Azure cloud hybrid deployment according to claim 7, characterized in that: The key data audit subsystem includes: Privileged user detection module: collects privileged user information; Confidential data monitoring module: monitors data based on the authentication mode based on privileged user conditions; Log event recording module: records data according to the authentication mode and collects logs; In the privileged user detection module of the step, the privileged user situation includes: member information of the AdSync service administrator group, user information of the PTA proxy service, member information of the ADFS service administrator group, and account information of the SSO service account AZUREADSSOACC; In the log event recording module, if the identity authentication mode is PHS mode, the information of the AdSync table of the LocalDB database is recorded; if the identity authentication mode is PTA mode, the information of the PTA proxy certificate is recorded; if the identity authentication mode is ADFS mode, the information of the ServiceSetting table of the WID database is recorded; if it is determined whether SSO is enabled, if the result is yes, the information of the SSO device authentication certificate and the communication certificate is recorded; if the result is no, no record is made; In the log event recording module, the log collection, the authentication mode is PHS mode, collecting the privileged user login log of the AzureAD Connect server, the access log of the LocalDB database, the MSOL user directory replication log and the login event of the Sync account in Azure AD; The authentication mode is PTA mode, which collects the privileged user login log of the PTA proxy server, the start and stop records of the PTA proxy service, the DLL loading status of the running PTA proxy service, and the export event of the PTA proxy certificate; The authentication mode is ADFS mode, which collects the privileged user login logs of the ADFS server and the access logs of the WID database; If SSO is enabled, the attribute change log of the AZUREADSSOACC account, and the export events of the authentication certificate and communication certificate are collected.

9. The local domain audit protection system for Azure cloud hybrid deployment according to claim 8, characterized in that: The threat protection subsystem includes: Rule verification module: performs security verification based on the log and event information recorded by the log event recording module; Policy execution module: executes security policies for rules that fail security verification.

10. The local domain audit protection system for Azure cloud hybrid deployment according to claim 9, characterized in that: The rule verification module includes: Rule verification unit 1: based on the data, judge whether the database file and the certificate file are consistent. If the result is yes, the verification is passed without processing; if the result is no, the policy execution module is triggered; Rule verification unit 2: based on the log and event information recorded by the log event recording module, determine whether there is suspicious access, login and loading. If the result is yes, trigger the policy execution module; if the result is no, no processing is performed; In the policy execution module, the security policy is to issue warnings to redundant privileged users, restore the users to which the PTA proxy service belongs and restart the PTA proxy service, and update the AZUREADSSOACC system account credentials; issue warnings for abnormal changes to confidential files, and force the credentials and certificates in the database to be updated; issue warnings for important resource access and privileged user login events, and determine whether the PTA proxy service has loaded a suspicious DLL. If the result is yes, the service needs to be restarted; if the result is no, no processing is performed.

Images