Processing system for access control of intranet resources

Abstract

The embodiment of the invention relates to a processing system for performing access control on intranet resources. The system comprises an OpenLDAP server, a VPN server, a VPN log server, intranet routing equipment, a log analysis server and an early warning gateway, the OpenLDAP server is used for configuring a plurality of directory objects; the VPN server is used for processing a plurality of configured directory objects after receiving a login request / service request sent by the VPN client, generating a corresponding operation log based on each step of operation in the processing process and storing the operation log in the VPN log server; and the log analysis server is used for carrying out early warning event identification according to the early warning event directory object and the operation log to obtain a corresponding early warning event report, and calling the early warning gateway to send the early warning event report to one or more remote monitoring clients specified by the monitoring client directory object. According to the system, the access control capability of intranet resources can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a processing system for performing access control on intranet resources. Background Art

[0002] The technical solution for controlling access to intranet resources is often used in remote office. This technical solution is usually implemented through Virtual Private Network (VPN) technology, which is to configure a VPN client for the remote client, set up a VPN server at the internal / external network exit, and enable remote users to access intranet resources through the encrypted data channel of the private network between the VPN client and the VPN server. In actual applications, we found that although the encrypted data channel between the VPN client and the VPN server can ensure the security of data transmission, it lacks sufficient access control capabilities: 1) Each application submission must carry the original user login name and login password, and lacks the ability to protect privacy information; 2) It is unable to prevent practices at the application level that violate the operating company's regulations, such as former employees obtaining company information through remote work, employees violating company regulations and installing VPN clients on multiple devices, etc.; 3) It is unable to identify and warn of security incidents at the application level, such as unknown personnel access events where non-company personnel use VPN channels to try to access company internal employees, frequent access events that exceed normal access volume, abnormal access events during non-working hours, single-day large data download events that exceed normal download volume, and multiple access events to sensitive resources within the company that exceed normal access volume. Summary of the invention

[0003] The purpose of the present invention is to provide a processing system for access control of intranet resources in view of the defects of the prior art. The system comprises: an OpenLDAP server, a VPN server, a VPN log server, an intranet routing device, a log analysis server and an early warning gateway; wherein the OpenLDAP server is used to configure a plurality of directory objects (client directory object, MAC whitelist directory object, MAC blacklist directory object, login token directory object, department directory object, intranet resource directory object, early warning event directory object and monitoring client directory object) related to the access control policy; the VPN server is used to perform multi-step verification-employee token distribution-client receipt feedback based on a plurality of directory objects configured on the OpenLDAP server after receiving a login request sent by a VPN client, and generate a corresponding operation log based on each step of operation in the processing process and store it in the VPN log server; and is also used to perform multi-step verification-intranet request forwarding-client receipt feedback based on a plurality of directory objects configured on the OpenLDAP server after receiving a service request sent by a VPN client, and generate a corresponding operation log based on each step of operation in the processing process and store it in the VPN log server; the log analysis server is used to regularly identify early warning events according to the early warning event directory object and the operation log, and call the early warning gateway to send the identification result to one or more remote monitoring clients specified by the monitoring client directory object. The system of the present invention adds an OpenLDAP server, a VPN log server, a log analysis server and an early warning gateway to the traditional remote office technical solution, and correspondingly adds a variety of verification mechanisms including token verification, an early warning event identification mechanism and an event early warning mechanism; the system of the present invention can improve the ability to protect privacy information, improve the ability to prevent illegal operations, and improve the ability to identify and warn security incidents, thereby achieving the purpose of improving the ability to control access to intranet resources.

[0004] To achieve the above-mentioned purpose, an embodiment of the present invention provides a processing system for access control of intranet resources, the system comprising: an OpenLDAP server, a VPN server, a VPN log server, an intranet routing device, a log analysis server and an early warning gateway;

[0005] The OpenLDAP server is connected to the VPN server and the log analysis server respectively; the OpenLDAP server is used to configure client directory objects, MAC whitelist directory objects, MAC blacklist directory objects, login token directory objects, department directory objects, intranet resource directory objects, warning event directory objects and monitoring client directory objects;

[0006] The VPN server is connected to each VPN client of the external network respectively, is also connected to the VPN log server, and is also connected to each intranet resource server of the intranet through the intranet routing device;

[0007] The VPN server is used to receive a first login request sent by the VPN client; and perform multi-step verification, employee token distribution and client receipt feedback processing according to the first login request, the client directory object, the MAC whitelist directory object, the MAC blacklist directory object, the department directory object and the login token directory object, and generate a corresponding first operation log based on each step of the operation during the processing and store it in the VPN log server; wherein the first login request includes a first request timestamp, a first client identifier, a first client MAC address, a first client login username and a first client login password;

[0008] The VPN server is also used to receive a first service request sent by the VPN client; and perform multi-step verification, intranet request forwarding and client receipt feedback processing according to the first service request, the client directory object, the MAC whitelist directory object, the MAC blacklist directory object, the login token directory object, the department directory object and the intranet resource directory object, and generate the corresponding first operation log based on each step of the operation during the processing and store it in the VPN log server; wherein, the first service request includes a second request timestamp, a second client identifier, a second client MAC address, a second employee token, a first resource server address, a first server interface address and a first interface parameter;

[0009] The VPN log server is connected to the log analysis server; the VPN log server is used to store multiple first operation logs; the first operation log includes a third request timestamp, a third client identifier, a third client MAC address, a first employee ID, a first employee name, a first request type, a first request text, a first operation step, a first operation status and a first operation feedback data size; the first request type includes a login request and a service request; the first request text is the corresponding first login request or the first service request; the first operation step includes a client-MAC binding relationship verification step, a MAC black and white list verification step, an employee identity authentication step, an employee token distribution step, an employee token verification step, an employee authority verification step and an intranet request forwarding step; the first operation status includes a success status and a failure status;

[0010] The log analysis server is connected to the early warning gateway; the log analysis server is used to regularly identify early warning events based on the early warning event directory object and the operation log on the VPN log server to obtain a corresponding first early warning event report; and when the first early warning event report is not empty, the early warning gateway is called to send the first early warning event report to one or more remote monitoring clients specified by the monitoring client directory object.

[0011] Preferably, the object attributes of the client directory object include multiple client objects; the object attributes of the client object include a client identifier and a bound client MAC address;

[0012] The object attributes of the MAC whitelist directory object include a plurality of whitelist MAC addresses;

[0013] The object attributes of the MAC blacklist directory object include multiple blacklist MAC addresses;

[0014] The object attributes of the login token directory object include multiple login token objects; the login token object includes an employee token, a token validity period, and a token employee ID;

[0015] The object attributes of the department directory object include the department name and multiple employee objects; the object attributes of the employee object include the employee ID, employee name, login username, login password, employee grade, resignation status and intranet resource list; the employee grade includes multiple grade levels; the resignation status includes the employed status, the pre-resignation status and the resignation status; the intranet resource list includes one or more available resource server addresses;

[0016] The object attributes of the intranet resource directory object include multiple intranet resource objects; the intranet resource objects correspond to the intranet resource servers one by one; the object attributes of the intranet resource objects include the resource server name, resource server address, server interface list object, employee grade policy object and employee status authority policy object; the object attributes of the server interface list object include multiple server interface addresses; the object attributes of the employee grade policy object include multiple employee grade authority objects; the object attributes of the employee grade authority object include the grade level and grade interface list object; the object attributes of the grade interface list object include one or more server interface addresses; the object attributes of the employee status authority policy object include an on-the-job employee status authority object and a pre-retiring employee status authority object; the object attributes of the on-the-job employee status authority object and the pre-retiring employee status authority object both include one or more service interface addresses; but the service interface address set of the pre-retiring employee status authority object is a subset of the service interface address set of the on-the-job employee status authority object;

[0017] The object attributes of the warning event catalog object include multiple warning event objects; the object attributes of the warning event object include event type and event triggering condition; the event type includes unknown person access event, frequent access event, abnormal time period access event, single-day big data download event and sensitive resource multiple access event; when the event type is unknown person access event, the corresponding event triggering condition includes a single-day unknown person access number threshold; when the event type is a frequent access event, the corresponding event triggering condition includes the first event inspection duration and the frequent access number threshold; when the event type is an abnormal time period access event, the corresponding event triggering condition includes one or more single-day abnormal time periods and an abnormal time period access number threshold, and the single-day abnormal time period includes the time period start time and the time period end time; when the event type is a single-day big data download event, the corresponding event triggering condition includes a single-day download data volume threshold; when the event type is a sensitive resource multiple access event, the corresponding event triggering condition includes multiple sensitive resource access restrictions, and the sensitive resource access restrictions include the sensitive resource server address and the sensitive resource single-day access number threshold;

[0018] The object attributes of the monitoring client directory object include multiple monitoring client objects; the object attributes of the monitoring client object include a client interface type and a corresponding client interface address; the client interface type includes an SMS type, an email type and an instant messaging software type; when the client interface type is an SMS type, the corresponding client interface address is a mobile phone number; when the client interface type is an email type, the corresponding client interface address is an email address; when the client interface type is an instant messaging software type, the corresponding client interface address is an instant messaging software interface address.

[0019] Preferably, the VPN server is specifically used for extracting the corresponding first request timestamp, the first client identifier, the first client MAC address, the first client login user name and the first client login password from the first login request as the corresponding current request timestamp, the current client identifier, the current client MAC address, the current client login user name and the current client login password; and using the first login request as the corresponding current request original text when performing multi-step verification, employee token distribution and client receipt feedback processing according to the first login request, the client directory object, the MAC whitelist directory object, the MAC blacklist directory object, the department directory object and the login token directory object and generating a corresponding first operation log based on each step of the operation during the processing and storing it in the VPN log server;

[0020] and setting the current step as a client-MAC binding relationship verification step; and performing client-MAC binding relationship verification processing according to the current client identifier, the current client MAC address and the client directory object to obtain a corresponding binding relationship verification result;

[0021] When the binding relationship verification result is a verification failure, a preset first login failure receipt is returned to the VPN client; and the first login failure receipt is used as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current receipt, the current step and the department directory object, a failure log is assembled to obtain the corresponding first operation log and store it in the VPN log server; and the multi-step verification, employee token distribution and client receipt feedback processing are exited;

[0022] When the binding relationship verification result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current step and the department directory object to obtain the corresponding first operation log and store it in the VPN log server;

[0023] And set the current step as a MAC blacklist and whitelist verification step; and perform MAC blacklist and whitelist verification processing according to the current client MAC address, the MAC whitelist directory object and the MAC blacklist directory object to obtain a corresponding MAC blacklist and whitelist verification result;

[0024] When the MAC black and white list verification result is a verification failure, the first login failure receipt is returned to the VPN client; and the first login failure receipt is used as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current receipt, the current step and the department directory object, the failure log is assembled to obtain the corresponding first operation log and store it in the VPN log server; and the multi-step verification, employee token distribution and client receipt feedback processing are exited;

[0025] When the MAC blacklist and whitelist verification result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current step and the department directory object to obtain the corresponding first operation log and store it in the VPN log server;

[0026] And set the current step as an employee identity authentication step; and perform employee identity authentication processing according to the current client login user name, the current client login password and the department directory object to obtain a corresponding employee identity authentication result;

[0027] When the employee identity authentication result is a verification failure, the first login failure receipt is returned to the VPN client; and the first login failure receipt is used as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current receipt, the current step and the department directory object, the failure log is assembled to obtain the corresponding first operation log and store it in the VPN log server; and the multi-step verification, employee token distribution and client receipt feedback processing are exited;

[0028] When the employee identity authentication result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current step and the department directory object to obtain the corresponding first operation log and store it in the VPN log server;

[0029] The current step is set as the employee token distribution step; employee token distribution processing is performed according to the current request timestamp, the current client login user name, the department directory object and the login token directory object to obtain the corresponding first employee token; a first successful login receipt carrying the first employee token is sent to the VPN client; the first successful login receipt is used as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current receipt, the current step and the department directory object, a successful log assembly is performed to obtain the corresponding first operation log and store it in the VPN log server.

[0030] Preferably, the VPN server is specifically used for extracting the corresponding second request timestamp, the second client identifier, the second client MAC address, the second employee token, the first resource server address, the first server interface address and the first interface parameter from the first service request as the corresponding current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current resource server address, the current server interface address and the current interface parameter when performing multi-step verification, intranet request forwarding and client receipt feedback processing according to the first service request, the client directory object, the MAC whitelist directory object, the MAC blacklist directory object, the login token directory object, the department directory object and the intranet resource directory object and generating the corresponding first operation log based on each step of the operation in the processing process and storing it in the VPN log server; and using the first login request as the corresponding current request original text;

[0031] and setting the current step as a client-MAC binding relationship verification step; and performing client-MAC binding relationship verification processing according to the current client identifier, the current client MAC address and the client directory object to obtain a corresponding binding relationship verification result;

[0032] When the binding relationship verification result is a verification failure, a preset first service failure receipt is returned to the VPN client; and the first service failure receipt is used as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current receipt, the current step, the login token directory object and the department directory object, a failure log is assembled to obtain the corresponding first operation log and store it in the VPN log server; and the multi-step verification, intranet request forwarding and client receipt feedback processing are exited;

[0033] When the binding relationship verification result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current step, the login token directory object, and the department directory object to obtain the corresponding first operation log and store it in the VPN log server;

[0034] And set the current step as a MAC blacklist and whitelist verification step; and perform MAC blacklist and whitelist verification processing according to the current client MAC address, the MAC whitelist directory object and the MAC blacklist directory object to obtain a corresponding MAC blacklist and whitelist verification result;

[0035] When the MAC black and white list verification result is a verification failure, the first service failure receipt is returned to the VPN client; and the first service failure receipt is used as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current receipt, the current step, the login token directory object and the department directory object, a failure log is assembled to obtain the corresponding first operation log and store it in the VPN log server; and the multi-step verification, intranet request forwarding and client receipt feedback processing are exited;

[0036] When the MAC blacklist and whitelist verification result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current step, the login token directory object and the department directory object to obtain the corresponding first operation log and store it in the VPN log server;

[0037] And set the current step as the employee token verification step; and perform employee token verification processing according to the current employee token and the login token directory object to obtain a corresponding employee token verification result;

[0038] When the employee token verification result is a verification failure, the first service failure receipt is returned to the VPN client; and the first service failure receipt is used as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current receipt, the current step, the login token directory object and the department directory object, a failure log is assembled to obtain the corresponding first operation log and store it in the VPN log server; and the multi-step verification, intranet request forwarding and client receipt feedback processing are exited;

[0039] When the employee token verification result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request text, the current step, the login token directory object, and the department directory object to obtain the corresponding first operation log and store it in the VPN log server;

[0040] And set the current step as the employee authority verification step; and extract the token employee ID of the login token object whose employee token in the login token directory object matches the current employee token as the corresponding current employee ID; and perform employee authority verification processing according to the current employee ID, the current resource server address, the current server interface address, the department directory object and the intranet resource directory object to obtain the corresponding employee authority verification result;

[0041] When the employee authority verification result fails, the first service failure receipt is returned to the VPN client; and the first service failure receipt is used as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current receipt, the current step, the login token directory object and the department directory object, the failure log is assembled to obtain the corresponding first operation log and store it in the VPN log server; and the multi-step verification, intranet request forwarding and client receipt feedback processing are exited;

[0042] When the employee authority verification result fails, the first operation log is successfully assembled based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request text, the current step, the login token directory object and the department directory object to obtain the corresponding first operation log and store it in the VPN log server;

[0043] The current step is set as an intranet request forwarding step; a first intranet request carrying the current server interface address and the current interface parameters is sent to the intranet resource server corresponding to the current resource server address; first feedback data sent back by the intranet resource server is received; a first service success receipt carrying the first feedback data is sent to the VPN client; the first service success receipt is used as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current receipt, the current step, the login token directory object and the department directory object, a successful log assembly is performed to obtain the corresponding first operation log and store it in the VPN log server.

[0044] Further, the VPN server is specifically used to, when the client-MAC binding relationship verification process is performed according to the current client identifier, the current client MAC address and the client directory object to obtain a corresponding binding relationship verification result, use the client object in the client directory object whose client identifier matches the current client identifier and whose client MAC address matches the current client MAC address as the corresponding matching object; and identify whether the matching object is empty; if the matching object is not empty, set the corresponding binding relationship verification result to verification success; if the matching object is empty, set the corresponding binding relationship verification result to verification failure;

[0045] The VPN server is specifically used for, when the MAC black and white list verification processing is performed according to the current client MAC address, the MAC white list directory object and the MAC black list directory object to obtain the corresponding MAC black and white list verification result, identifying whether there is the white list MAC address matching the current client MAC address in the MAC white list directory object, if so, setting the corresponding first state to success, if not, setting the corresponding first state to failure; and identifying whether there is the black list MAC address matching the current client MAC address in the MAC black list directory object, if so, setting the corresponding second state to failure, if not, setting the corresponding second state to success; and identifying whether the first and second states are both successful, if so, setting the corresponding MAC black and white list verification result to verification success, if not, setting the corresponding MAC black and white list verification result to verification failure.

[0046] Furthermore, the VPN server is specifically used to, when the employee identity authentication processing is performed according to the current client login user name, the current client login password and the department directory object to obtain the corresponding employee identity authentication result, use the employee object whose login user name and login password in the department directory object match the corresponding current client login user name and the current client login password as the corresponding current matching object; and identify whether the current matching object is empty; if so, set the corresponding employee identity authentication result to verification failure; if not, set the corresponding employee identity authentication result to verification success.

[0047] Further, the VPN server is specifically used to use the employee ID of the employee object whose login user name in the department directory object matches the current client login user name as the corresponding current employee ID when performing employee token distribution processing according to the current request timestamp, the current client login user name, the department directory object and the login token directory object to obtain the corresponding first employee token;

[0048] And when the current employee ID is not empty, the login token object whose token employee ID in the login token directory object matches the current employee ID is used as the corresponding current token object;

[0049] And identifying whether the current token object is empty;

[0050] If the current token object is empty, the current client login user name and the current request timestamp form a corresponding first plaintext; and the first plaintext is hashed to obtain a corresponding first hash code; and the first hash code is used as the corresponding employee token; and the current time is used as the corresponding validity start time, and the validity start time and the preset validity period are added to obtain the corresponding validity end time, and the validity start time and the validity end time form the corresponding token validity period; and the current employee ID is used as the corresponding token employee ID; and the obtained employee token, the token validity period and the token employee ID form a corresponding login token object and add it to the login token directory object; and the employee token is used as the corresponding first employee token;

[0051] If the current token object is not empty but the token validity period of the current token object has expired, the current client login user name and the current request timestamp form a corresponding second plaintext; and the second plaintext is hashed to obtain a corresponding second hash code; and the second hash code is used as the corresponding first token; and the current time is used as the corresponding first start time, and the first start time and the validity period are added to obtain the corresponding first end time, and the first start time and the first end time form the corresponding first validity period; and the employee token and the token validity period of the current token object are reset to the corresponding first token and the first validity period; and the first token is used as the corresponding first employee token;

[0052] If the current token object is not empty and the token validity period of the current token object has not expired, the employee token of the current token object is extracted as the corresponding first employee token.

[0053] Furthermore, the VPN server is specifically used to, when the employee token verification process is performed according to the current employee token and the login token directory object to obtain the corresponding employee token verification result, use the login token object in the login token directory object that matches the employee token and the current employee token as the corresponding matching login object; and identify whether the matching login object is empty; if the matching login object is empty, set the corresponding employee token verification result to verification failure; if the matching login object is not empty, identify whether the token validity period of the matching login object has expired, if it has expired, set the corresponding employee token verification result to verification failure, and if it has not expired, set the corresponding employee token verification result to verification success.

[0054] Further, the VPN server is specifically used to, when the employee authority verification process is performed according to the current employee ID, the current resource server address, the current server interface address, the department directory object and the intranet resource directory object to obtain a corresponding employee authority verification result, use the employee object whose employee ID in the department directory object matches the current employee ID as the corresponding current employee object; and use the intranet resource object whose resource server address in the intranet resource directory object matches the current resource server address as the corresponding current resource object;

[0055] and identifying whether there is the available resource server address matching the current resource server address in the intranet resource list of the current employee object, and if so, setting the corresponding first check status to success; if not, setting the corresponding first check status to failure;

[0056] and extracting the employee grade and the resignation status of the current employee object as the corresponding current employee grade and current resignation status;

[0057] and taking the grade interface list object of the employee grade authority object whose grade level in the employee grade policy object of the current resource object matches the current employee grade as the corresponding current interface list object; and identifying whether there is the server interface address matching the current server interface address in the current interface list object, and if so, setting the corresponding second check status to success, and if not, setting the corresponding second check status to failure;

[0058] And the current resignation status is identified; if the current resignation status is the on-the-job status, it is identified whether there is a server interface address matching the current server interface address in the on-the-job employee status permission object of the employee status permission policy object of the current resource object, and if so, the corresponding third check status is set to success; if not, the corresponding third check status is set to failure; if the current resignation status is the pre-resignation status, it is identified whether there is a server interface address matching the current server interface address in the pre-resignation employee status permission object of the employee status permission policy object of the current resource object, and if so, the corresponding third check status is set to success; if not, the corresponding third check status is set to failure; if the current resignation status is the resignation status, the corresponding third check status is set to failure;

[0059] And it is identified whether the first, second and third checking states are all successful. If so, the corresponding employee authority verification result is set as verification success; otherwise, the corresponding employee authority verification result is set as verification failure.

[0060] Preferably, the log analysis server is specifically used for periodically traversing the warning event objects of the warning event directory object at a preset first time frequency when the warning event identification is performed regularly according to the warning event directory object and the operation log on the VPN log server to obtain the corresponding first warning event report; and when traversing, taking the warning event object currently traversed as the corresponding current warning event object; and taking the event type and the event triggering condition of the current warning event object as the corresponding current event type and current event triggering condition; and identifying the current event type; if the current event type is an unknown person access event, extracting the corresponding single-day unknown person access number threshold from the current event triggering condition, and performing warning event identification according to the single-day unknown person access number threshold, the current event type and the operation log on the VPN log server to obtain the corresponding first warning event data; if the current event type is a frequent access event, extracting the corresponding first event inspection time and the frequent access number threshold from the current event triggering condition, and extracting the corresponding first event inspection time, the frequent access number threshold, the current event type and the operation log on the VPN log server to obtain the corresponding first warning event data. The VPN log server performs warning event identification based on the event type. ...

[0061] The embodiment of the present invention provides a processing system for performing access control on intranet resources, the system comprising: an OpenLDAP server, a VPN server, a VPN log server, an intranet routing device, a log analysis server and an early warning gateway; wherein the OpenLDAP server is used to configure a plurality of directory objects (client directory object, MAC whitelist directory object, MAC blacklist directory object, login token directory object, department directory object, intranet resource directory object, early warning event directory object, and monitoring client directory object) related to the access control policy; the VPN server is used to perform multi-step verification-employee token distribution-client receipt feedback based on a plurality of directory objects configured on the OpenLDAP server after receiving a login request sent by a VPN client, and generate a corresponding operation log based on each step of operation in the processing process and store it in the VPN log server; and is also used to perform multi-step verification-intranet request forwarding-client receipt feedback based on a plurality of directory objects configured on the OpenLDAP server after receiving a service request sent by a VPN client, and generate a corresponding operation log based on each step of operation in the processing process and store it in the VPN log server; the log analysis server is used to periodically identify early warning events based on early warning event directory objects and operation logs, and call the early warning gateway to send the identification results to one or more remote monitoring clients specified by the monitoring client directory object. The system of the present invention adds an OpenLDAP server, a VPN log server, a log analysis server and an early warning gateway to the traditional remote office technical solution, and correspondingly adds a variety of verification mechanisms including token verification, an early warning event identification mechanism and an event early warning mechanism; through the system of the present invention, the ability to protect privacy information, the ability to prevent illegal operations, and the ability to identify and warn of security incidents are improved, thereby achieving the technical effect of improving the ability to control access to intranet resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 A module diagram of a processing system for performing access control on intranet resources provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] like Figure 1As shown in the module schematic diagram of a processing system for access control of intranet resources provided in an embodiment of the present invention, a processing system 2 for access control of intranet resources provided in an embodiment of the present invention includes: an OpenLDAP server 21, a VPN server 22, a VPN log server 23, an intranet routing device 24, a log analysis server 25 and an early warning gateway 26.

[0065] (I) OpenLDAP server 21:

[0066] The OpenLDAP server 21 is connected to the VPN server 22 and the log analysis server 25 respectively.

[0067] The OpenLDAP server 21 is used to configure client directory objects, MAC whitelist directory objects, MAC blacklist directory objects, login token directory objects, department directory objects, intranet resource directory objects, warning event directory objects and monitoring client directory objects.

[0068] The specific configuration information of the above multiple directory objects is as follows.

[0069] 1) The object attributes of the client directory object include multiple client objects;

[0070] The object attributes of the client object include the client identifier and the bound client MAC address.

[0071] 2) The object attributes of the MAC whitelist directory object include multiple whitelist MAC addresses.

[0072] 3) The object attributes of the MAC blacklist directory object include multiple blacklist MAC addresses.

[0073] 4) the object attributes of the login token directory object include a plurality of login token objects;

[0074] Among them, the login token object includes the employee token, token validity period and token employee number.

[0075] 5) The object attributes of the department directory object include the department name and multiple employee objects;

[0076] Among them, the object attributes of the employee object include employee ID, employee name, login username, login password, employee level, resignation status and intranet resource list;

[0077] The employee hierarchy includes several hierarchical levels;

[0078] The leaving status includes the employed status, the pre-leaving status and the leaving status;

[0079] The intranet resource list includes one or more available resource server addresses.

[0080] 6) The object attributes of the intranet resource directory object include multiple intranet resource objects;

[0081] Among them, the intranet resource objects correspond one to one with the intranet resource servers 3;

[0082] The object attributes of the intranet resource object include the resource server name, resource server address, server interface list object, employee level policy object and employee status authority policy object;

[0083] The object attributes of the server interface list object include multiple server interface addresses;

[0084] The object attributes of the employee grade policy object include multiple employee grade authority objects; the object attributes of the employee grade authority object include grade level and grade interface list objects; the object attributes of the grade interface list object include one or more server interface addresses;

[0085] The object attributes of the employee status permission policy object include the current employee status permission object and the pre-resignation employee status permission object; the object attributes of the current employee status permission object and the pre-resignation employee status permission object both include one or more service interface addresses; but the service interface address set of the pre-resignation employee status permission object is a subset of the service interface address set of the current employee status permission object.

[0086] 7) The object attributes of the warning event catalog object include multiple warning event objects;

[0087] Among them, the object attributes of the warning event object include event type and event triggering condition;

[0088] Event types include unknown personnel access events, frequent access events, access events during abnormal time periods, single-day large data download events, and multiple access events to sensitive resources;

[0089] When the event type is an unknown person access event, the corresponding event triggering condition includes the threshold of the number of unknown person accesses per day;

[0090] When the event type is a frequent access event, the corresponding event triggering conditions include the first event inspection duration and the frequent access number threshold;

[0091] When the event type is an abnormal time period access event, the corresponding event triggering condition includes one or more single-day abnormal time periods and an abnormal time period access count threshold. The single-day abnormal time period includes the time period start time and the time period end time.

[0092] When the event type is a single-day large data download event, the corresponding event triggering condition includes a single-day download data volume threshold;

[0093] When the event type is a sensitive resource multiple access event, the corresponding event triggering conditions include multiple sensitive resource access restrictions, and the sensitive resource access restrictions include the sensitive resource server address and the threshold for the number of sensitive resource accesses per day.

[0094] 8) The object attributes of the monitoring client directory object include a plurality of monitoring client objects;

[0095] Wherein, the object attributes of the monitored client object include the client interface type and the corresponding client interface address;

[0096] The client interface types include SMS type, email type and instant messaging software type;

[0097] When the client interface type is SMS type, the corresponding client interface address is a mobile phone number;

[0098] When the client interface type is the email type, the corresponding client interface address is an email address;

[0099] When the client interface type is an instant messaging software type, the corresponding client interface address is an instant messaging software interface address; the instant messaging software here is such as WeChat.

[0100] (II) VPN Server 22:

[0101] The VPN server 22 is connected to each VPN client 1 of the external network, is also connected to the VPN log server 23, and is also connected to each intranet resource server 3 of the intranet through the intranet routing device 24.

[0102] The VPN server 22 is used to receive a first login request sent by the VPN client 1; and perform multi-step verification, employee token distribution and client receipt feedback processing according to the first login request, client directory object, MAC whitelist directory object, MAC blacklist directory object, department directory object and login token directory object, and generate a corresponding first operation log based on each step of the operation during the processing and store it in the VPN log server 23; wherein the first login request includes a first request timestamp, a first client identifier, a first client MAC address, a first client login username and a first client login password.

[0103] The VPN server 22 is also used to receive a first service request sent by the VPN client 1; and perform multi-step verification, intranet request forwarding and client receipt feedback processing according to the first service request, client directory object, MAC whitelist directory object, MAC blacklist directory object, login token directory object, department directory object and intranet resource directory object, and generate a corresponding first operation log based on each step of the operation during the processing and store it in the VPN log server 23; wherein the first service request includes a second request timestamp, a second client identifier, a second client MAC address, a second employee token, a first resource server address, a first server interface address and a first interface parameter.

[0104] In a specific implementation of the embodiment of the present invention, the VPN server 22 is specifically used to perform multi-step verification, employee token distribution and client receipt feedback processing according to the first login request, the client directory object, the MAC whitelist directory object, the MAC blacklist directory object, the department directory object and the login token directory object, and generate a corresponding first operation log based on each step of the operation during the processing and store it in the VPN log server 23:

[0105] Step A1, extracting the corresponding first request timestamp, first client identifier, first client MAC address, first client login user name and first client login password from the first login request as the corresponding current request timestamp, current client identifier, current client MAC address, current client login user name and current client login password;

[0106] Step A2, and taking the first login request as the corresponding current request original text;

[0107] Step A3, and setting the current step as a client-MAC binding relationship verification step; and performing client-MAC binding relationship verification processing according to the current client identifier, the current client MAC address and the client directory object to obtain a corresponding binding relationship verification result;

[0108] Step A4, when the binding relationship verification result is verification failure, return the preset first login failure receipt to the VPN client 1; and use the first login failure receipt as the corresponding current receipt; and assemble the failure log based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current receipt, the current step and the department directory object to obtain the corresponding first operation log and store it in the VPN log server 23; and exit the multi-step verification, employee token distribution and client receipt feedback processing;

[0109] Step A5, when the binding relationship verification result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current step and the department directory object to obtain a corresponding first operation log and store it in the VPN log server 23;

[0110] Step A6, and set the current step as the MAC blacklist and whitelist verification step; and perform MAC blacklist and whitelist verification processing according to the current client MAC address, MAC whitelist directory object and MAC blacklist directory object to obtain the corresponding MAC blacklist and whitelist verification result;

[0111] Step A7, when the MAC black and white list verification result is a verification failure, a first login failure receipt is returned to the VPN client 1; and the first login failure receipt is used as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current receipt, the current step and the department directory object, the failure log is assembled to obtain the corresponding first operation log and stored in the VPN log server 23; and the multi-step verification, employee token distribution and client receipt feedback processing are exited;

[0112] Step A8, when the MAC blacklist and whitelist verification result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current step and the department directory object to obtain a corresponding first operation log and store it in the VPN log server 23;

[0113] Step A9, and set the current step as the employee identity authentication step; and perform employee identity authentication processing according to the current client login user name, the current client login password and the department directory object to obtain the corresponding employee identity authentication result;

[0114] Step A10, when the employee identity authentication result is a verification failure, a first login failure receipt is returned to the VPN client 1; and the first login failure receipt is used as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current receipt, the current step and the department directory object, the failure log is assembled to obtain the corresponding first operation log and stored in the VPN log server 23; and the multi-step verification, employee token distribution and client receipt feedback processing are exited;

[0115] Step A11, when the employee identity authentication result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current step and the department directory object to obtain a corresponding first operation log and store it in the VPN log server 23;

[0116] Step A12, and set the current step as the employee token distribution step; and perform employee token distribution processing according to the current request timestamp, the current client login user name, the department directory object and the login token directory object to obtain the corresponding first employee token; and send the first login success receipt carrying the first employee token to the VPN client 1; and use the first login success receipt as the corresponding current receipt; and perform successful log assembly based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current receipt, the current step and the department directory object to obtain the corresponding first operation log and store it in the VPN log server 23.

[0117] In another specific implementation of the embodiment of the present invention, the VPN server 22 is specifically used for assembling the failure log based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current receipt, the current step and the department directory object to obtain the corresponding first operation log and store it in the VPN log server 23:

[0118] Step B1, using the current request timestamp, the current client identifier, and the current client MAC address as the corresponding third request timestamp, the third client identifier, and the third client MAC address;

[0119] Step B2, and taking the employee object whose login user name in the department directory object matches the current client login user name as the corresponding current employee object;

[0120] Step B3, and identify whether the current employee object is empty, if so, set the corresponding first employee number and first employee name to be empty, otherwise, set the corresponding first employee number and first employee name to be the employee number and employee name of the current employee object;

[0121] Step B4, and setting the corresponding first request type to a login request;

[0122] Step B5, and use the current request original text as the corresponding first request original text;

[0123] Step B6, and set the corresponding first operation step as the current step;

[0124] Step B7, setting the corresponding first operation state to a failure state;

[0125] Step B8, and setting the corresponding first operation feedback data size as the data size of the current receipt;

[0126] Step B9, a corresponding first operation log is formed by the obtained third request timestamp, third client identifier, third client MAC address, first employee ID, first employee name, first request type, first request original text, first operation step, first operation status and first operation feedback data size and stored in the VPN log server 23.

[0127] In another specific implementation of the embodiment of the present invention, the VPN server 22 is specifically used for, when successfully assembling the log based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current step and the department directory object to obtain the corresponding first operation log and storing it in the VPN log server 23:

[0128] Step C1, using the current request timestamp, the current client identifier, and the current client MAC address as the corresponding third request timestamp, the third client identifier, and the third client MAC address;

[0129] Step C2, and taking the employee object whose login user name in the department directory object matches the current client login user name as the corresponding current employee object;

[0130] Step C3, and identify whether the current employee object is empty, if so, set the corresponding first employee number and first employee name to be empty, otherwise, set the corresponding first employee number and first employee name to be the employee number and employee name of the current employee object;

[0131] Step C4, and set the corresponding first request type as a login request; and use the current request original text as the corresponding first request original text;

[0132] Step C5, and set the corresponding first operation step as the current step;

[0133] Step C6, and setting the corresponding first operation state to a success state;

[0134] Step C7, and setting the corresponding first operation feedback data size to zero;

[0135] Step C8, a corresponding first operation log is formed by the obtained third request timestamp, third client identifier, third client MAC address, first employee ID, first employee name, first request type, first request original text, first operation step, first operation status and first operation feedback data size and stored in the VPN log server 23.

[0136] In another specific implementation of the embodiment of the present invention, the VPN server 22 is specifically used for, when successfully assembling the log based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current receipt, the current step and the department directory object to obtain the corresponding first operation log and storing it in the VPN log server 23:

[0137] Step D1, using the current request timestamp, the current client identifier, and the current client MAC address as the corresponding third request timestamp, the third client identifier, and the third client MAC address;

[0138] Step D2, and taking the employee object whose login user name in the department directory object matches the current client login user name as the corresponding current employee object;

[0139] Step D3, and identify whether the current employee object is empty, if so, set the corresponding first employee number and first employee name to be empty, otherwise, set the corresponding first employee number and first employee name to be the employee number and employee name of the current employee object;

[0140] Step D4, and setting the corresponding first request type to a login request;

[0141] Step D5, and taking the current request original text as the corresponding first request original text;

[0142] Step D6, and setting the corresponding first operation step as the current step;

[0143] Step D7, and setting the corresponding first operation state to a success state;

[0144] Step D8, and setting the corresponding first operation feedback data size as the data size of the current receipt;

[0145] Step D9, and a corresponding first operation log is formed by the obtained third request timestamp, third client identifier, third client MAC address, first employee ID, first employee name, first request type, first request original text, first operation step, first operation status and first operation feedback data size and stored in the VPN log server 23.

[0146] In another specific implementation of the embodiment of the present invention, the VPN server 22 is specifically used to, when performing employee identity authentication processing according to the current client login user name, the current client login password and the department directory object to obtain the corresponding employee identity authentication result, use the employee object whose login user name and login password in the department directory object match the corresponding current client login user name and current client login password as the corresponding current matching object; and identify whether the current matching object is empty; if so, set the corresponding employee identity authentication result to verification failure; if not, set the corresponding employee identity authentication result to verification success.

[0147] In another specific implementation of the embodiment of the present invention, the VPN server 22 is specifically configured to, when performing employee token distribution processing according to the current request timestamp, the current client login user name, the department directory object, and the login token directory object to obtain the corresponding first employee token:

[0148] Step E1, taking the employee ID of the employee object whose login user name in the department directory object matches the current client login user name as the corresponding current employee ID;

[0149] Step E2, when the current employee ID is not empty, the login token object whose token employee ID in the login token directory object matches the current employee ID is used as the corresponding current token object;

[0150] Step E3, and identifying whether the current token object is empty;

[0151] Step E4, if the current token object is empty, the current client login user name and the current request timestamp form the corresponding first plain text; and perform hash calculation on the first plain text to obtain the corresponding first hash code; and use the first hash code as the corresponding employee token; and use the current time as the corresponding validity start time, and add the validity start time and the preset validity period to obtain the corresponding validity end time, and use the validity start time and the validity end time to form the corresponding token validity period; and use the current employee ID as the corresponding token employee ID; and use the obtained employee token, token validity period and token employee ID to form a corresponding login token object and add it to the login token directory object; and use the employee token as the corresponding first employee token;

[0152] Step E5, if the current token object is not empty but the token validity period of the current token object has expired, the current client login user name and the current request timestamp form a corresponding second plaintext; and perform hash calculation on the second plaintext to obtain a corresponding second hash code; and use the second hash code as the corresponding first token; and use the current time as the corresponding first start time, and add the first start time and the validity period to obtain the corresponding first end time, and use the first start time and the first end time to form the corresponding first validity period; and reset the employee token and token validity period of the current token object to the corresponding first token and first validity period; and use the first token as the corresponding first employee token;

[0153] Step E6: If the current token object is not empty and the token validity period of the current token object has not expired, extract the employee token of the current token object as the corresponding first employee token.

[0154] In another specific implementation of the embodiment of the present invention, the VPN server 22 is specifically used to perform multi-step verification, intranet request forwarding and client receipt feedback processing according to the first service request, the client directory object, the MAC whitelist directory object, the MAC blacklist directory object, the login token directory object, the department directory object and the intranet resource directory object, and generate a corresponding first operation log based on each step of the operation during the processing and store it in the VPN log server 23:

[0155] Step F1, extracting the corresponding second request timestamp, second client identifier, second client MAC address, second employee token, first resource server address, first server interface address and first interface parameter from the first service request as the corresponding current request timestamp, current client identifier, current client MAC address, current employee token, current resource server address, current server interface address and current interface parameter;

[0156] Step F2, and taking the first login request as the corresponding current request original text;

[0157] Step F3, and set the current step as a client-MAC binding relationship verification step; and perform client-MAC binding relationship verification processing according to the current client identifier, the current client MAC address and the client directory object to obtain a corresponding binding relationship verification result;

[0158] Step F4: When the binding relationship verification result is verification failure, a preset first service failure receipt is returned to the VPN client 1; and the first service failure receipt is used as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current receipt, the current step, the login token directory object and the department directory object, the failure log is assembled to obtain the corresponding first operation log and stored in the VPN log server 23; and the multi-step verification, intranet request forwarding and client receipt feedback processing are exited;

[0159] Step F5, when the binding relationship verification result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request text, the current step, the login token directory object and the department directory object to obtain a corresponding first operation log and store it in the VPN log server 23;

[0160] Step F6, and set the current step as the MAC blacklist and whitelist verification step; and perform MAC blacklist and whitelist verification processing according to the current client MAC address, MAC whitelist directory object and MAC blacklist directory object to obtain the corresponding MAC blacklist and whitelist verification result;

[0161] Step F7, when the MAC black and white list verification result is a verification failure, a first service failure receipt is returned to the VPN client 1; and the first service failure receipt is used as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current receipt, the current step, the login token directory object and the department directory object, a failure log is assembled to obtain a corresponding first operation log and stored in the VPN log server 23; and the multi-step verification, intranet request forwarding and client receipt feedback processing are exited;

[0162] Step F8, when the MAC blacklist and whitelist verification result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request text, the current step, the login token directory object and the department directory object to obtain the corresponding first operation log and store it in the VPN log server 23;

[0163] Step F9, and set the current step as the employee token verification step; and perform employee token verification processing according to the current employee token and the login token directory object to obtain the corresponding employee token verification result;

[0164] Step F10, when the employee token verification result is a verification failure, a first service failure receipt is returned to the VPN client 1; and the first service failure receipt is used as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current receipt, the current step, the login token directory object and the department directory object, a failure log is assembled to obtain a corresponding first operation log and stored in the VPN log server 23; and the multi-step verification, intranet request forwarding and client receipt feedback processing are exited;

[0165] Step F11, when the employee token verification result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request text, the current step, the login token directory object and the department directory object to obtain a corresponding first operation log and store it in the VPN log server 23;

[0166] Step F12, and set the current step as the employee authority verification step; and extract the token employee ID of the login token object whose employee token in the login token directory object matches the current employee token as the corresponding current employee ID; and perform employee authority verification processing according to the current employee ID, the current resource server address, the current server interface address, the department directory object and the intranet resource directory object to obtain the corresponding employee authority verification result;

[0167] Step F13, when the employee authority verification result fails, a first service failure receipt is returned to the VPN client 1; and the first service failure receipt is used as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current receipt, the current step, the login token directory object and the department directory object, the failure log is assembled to obtain the corresponding first operation log and stored in the VPN log server 23; and the multi-step verification, intranet request forwarding and client receipt feedback processing are exited;

[0168] Step F14, when the result of the employee authority verification fails and becomes a successful verification, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current step, the login token directory object and the department directory object to obtain a corresponding first operation log and store it in the VPN log server 23;

[0169] Step F15, and set the current step as the intranet request forwarding step; and send the first intranet request carrying the current server interface address and the current interface parameters to the intranet resource server 3 corresponding to the current resource server address; and receive the first feedback data sent back by the intranet resource server 3; and send the first service success receipt carrying the first feedback data to the VPN client 1; and use the first service success receipt as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current receipt, the current step, the login token directory object and the department directory object, perform successful log assembly to obtain the corresponding first operation log and store it in the VPN log server 23.

[0170] In another specific implementation of the embodiment of the present invention, the VPN server 22 is specifically used for assembling the failed log based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current receipt, the current step, the login token directory object and the department directory object to obtain the corresponding first operation log and store it in the VPN log server 23:

[0171] Step G1, using the current request timestamp, the current client identifier, and the current client MAC address as the corresponding third request timestamp, the third client identifier, and the third client MAC address;

[0172] Step G2, and taking the token employee ID of the login token object whose employee token in the login token directory object matches the current employee token as the corresponding matching employee ID;

[0173] Step G3, and identify whether the matching employee ID is empty, if so, set the corresponding first employee ID and first employee name to be empty, otherwise, use the matching employee ID as the corresponding first employee ID, and use the employee name of the employee object corresponding to the employee ID and the matching employee ID in the department directory object as the corresponding first employee name;

[0174] Step G4, and set the corresponding first request type as a service request; and use the current request text as the corresponding first request text;

[0175] Step G5, and set the corresponding first operation step as the current step;

[0176] Step G6, and setting the corresponding first operation state to a failure state;

[0177] Step G7, and setting the corresponding first operation feedback data size as the data size of the current receipt;

[0178] Step G8, a corresponding first operation log is formed by the obtained third request timestamp, third client identifier, third client MAC address, first employee ID, first employee name, first request type, first request original text, first operation step, first operation status and first operation feedback data size and stored in the VPN log server 23.

[0179] In another specific implementation of the embodiment of the present invention, the VPN server 22 is specifically used for, when successfully assembling the log based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request text, the current step, the login token directory object and the department directory object to obtain the corresponding first operation log and storing it in the VPN log server 23:

[0180] Step H1, using the current request timestamp, the current client identifier, and the current client MAC address as the corresponding third request timestamp, the third client identifier, and the third client MAC address;

[0181] Step H2, and taking the token employee ID of the login token object whose employee token in the login token directory object matches the current employee token as the corresponding matching employee ID;

[0182] Step H3, and identify whether the matching employee ID is empty, if so, set the corresponding first employee ID and first employee name to be empty, otherwise, use the matching employee ID as the corresponding first employee ID, and use the employee name of the employee object corresponding to the employee ID in the department directory object and the matching employee ID as the corresponding first employee name;

[0183] Step H4, and set the corresponding first request type as a service request; and use the current request original text as the corresponding first request original text;

[0184] Step H5, and set the corresponding first operation step as the current step;

[0185] Step H6, and setting the corresponding first operation state to a success state;

[0186] Step H7, and setting the corresponding first operation feedback data size to zero;

[0187] Step H8, a corresponding first operation log is formed by the obtained third request timestamp, third client identifier, third client MAC address, first employee ID, first employee name, first request type, first request original text, first operation step, first operation status and first operation feedback data size and stored in the VPN log server 23.

[0188] In another specific implementation of the embodiment of the present invention, the VPN server 22 is specifically used for, when successfully assembling the log based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current receipt, the current step, the login token directory object and the department directory object to obtain the corresponding first operation log and storing it in the VPN log server 23:

[0189] Step J1, using the current request timestamp, the current client identifier, and the current client MAC address as the corresponding third request timestamp, the third client identifier, and the third client MAC address;

[0190] Step J2, and taking the token employee ID of the login token object whose employee token in the login token directory object matches the current employee token as the corresponding matching employee ID;

[0191] Step J3, and identify whether the matching employee ID is empty, if so, set the corresponding first employee ID and first employee name to be empty, otherwise, use the matching employee ID as the corresponding first employee ID, and use the employee name of the employee object corresponding to the employee ID and the matching employee ID in the department directory object as the corresponding first employee name;

[0192] Step J4, and setting the corresponding first request type as a service request;

[0193] Step J5, and use the current request original text as the corresponding first request original text;

[0194] Step J6, and set the corresponding first operation step as the current step;

[0195] Step J7, and set the corresponding first operation state to a success state;

[0196] Step J8, and set the corresponding first operation feedback data size as the data size of the current receipt;

[0197] Step J9, and a corresponding first operation log is formed by the obtained third request timestamp, third client identifier, third client MAC address, first employee ID, first employee name, first request type, first request original text, first operation step, first operation status and first operation feedback data size and stored in the VPN log server 23.

[0198] In another specific implementation method of the embodiment of the present invention, the VPN server 22 is specifically used to, when performing employee token verification processing according to the current employee token and the login token directory object to obtain the corresponding employee token verification result, use the login token object in the login token directory object that matches the current employee token as the corresponding matching login object; and identify whether the matching login object is empty; if the matching login object is empty, set the corresponding employee token verification result to verification failure; if the matching login object is not empty, identify whether the token validity period of the matching login object has expired, if it has expired, set the corresponding employee token verification result to verification failure, and if it has not expired, set the corresponding employee token verification result to verification success.

[0199] In another specific implementation of the embodiment of the present invention, the VPN server 22 is specifically used to perform employee authority verification processing according to the current employee ID, the current resource server address, the current server interface address, the department directory object and the intranet resource directory object to obtain the corresponding employee authority verification result:

[0200] Step K1, taking the employee object whose employee ID in the department directory object matches the current employee ID as the corresponding current employee object; and taking the intranet resource object whose resource server address in the intranet resource directory object matches the current resource server address as the corresponding current resource object;

[0201] Step K2, and identify whether there is an available resource server address matching the current resource server address in the intranet resource list of the current employee object, if so, set the corresponding first check status to success, if not, set the corresponding first check status to failure;

[0202] Step K3, extracting the employee grade and the resignation status of the current employee object as the corresponding current employee grade and the current resignation status;

[0203] Step K4, and taking the level interface list object of the employee level authority object whose level in the employee level policy object of the current resource object matches the current employee level as the corresponding current interface list object; and identifying whether there is a server interface address matching the current server interface address in the current interface list object, if so, setting the corresponding second check status to success, and if not, setting the corresponding second check status to failure;

[0204] Step K5, and identify the current resignation status;

[0205] If the current resignation status is the employment status, then identify whether there is a server interface address matching the current server interface address in the employment employee status permission object of the employee status permission policy object of the current resource object, and if so, set the corresponding third check status to success; if not, set the corresponding third check status to failure;

[0206] If the current resignation status is the pre-resignation status, then identify whether there is a server interface address matching the current server interface address in the pre-resignation employee status permission object of the employee status permission policy object of the current resource object, and if so, set the corresponding third check status to success; if not, set the corresponding third check status to failure;

[0207] If the current resignation status is resignation status, set the corresponding third check status to failure;

[0208] Step K6, and identify whether the first, second and third check statuses are all successful. If so, set the corresponding employee authority verification result to verification success, otherwise set the corresponding employee authority verification result to verification failure.

[0209] In another specific implementation of the embodiment of the present invention, the VPN server 22 is specifically used to, when performing client-MAC binding relationship verification processing according to the current client identifier, the current client MAC address and the client directory object to obtain a corresponding binding relationship verification result, use the client object in the client directory object whose client identifier matches the current client identifier and whose client MAC address matches the current client MAC address as the corresponding matching object; and identify whether the matching object is empty; if the matching object is not empty, set the corresponding binding relationship verification result to verification success; if the matching object is empty, set the corresponding binding relationship verification result to verification failure.

[0210] In another specific implementation of the embodiment of the present invention, the VPN server 22 is specifically used to identify whether there is a whitelist MAC address matching the current client MAC address in the MAC whitelist directory object when performing MAC blacklist and whitelist verification processing according to the current client MAC address, the MAC whitelist directory object and the MAC blacklist directory object to obtain the corresponding MAC blacklist and whitelist verification result. If so, the corresponding first state is set to success, and if not, the corresponding first state is set to failure; and identify whether there is a blacklist MAC address matching the current client MAC address in the MAC blacklist directory object. If so, the corresponding second state is set to failure, and if not, the corresponding second state is set to success; and identify whether both the first and second states are successful. If so, the corresponding MAC blacklist and whitelist verification result is set to verification success, and if not, the corresponding MAC blacklist and whitelist verification result is set to verification failure.

[0211] (III) VPN Log Server 23:

[0212] The VPN log server 23 is connected to the log analysis server 25 .

[0213] The VPN log server 23 is used to store multiple first operation logs;

[0214] Among them, the first operation log includes the third request timestamp, the third client identifier, the third client MAC address, the first employee ID, the first employee name, the first request type, the first request original text, the first operation step, the first operation status and the first operation feedback data size; the first request type includes a login request and a service request; the first request original text is the corresponding first login request or the first service request; the first operation step includes a client-MAC binding relationship verification step, a MAC black and white list verification step, an employee identity authentication step, an employee token distribution step, an employee token verification step, an employee authority verification step and an intranet request forwarding step; the first operation status includes a success status and a failure status.

[0215] (IV) Log analysis server 25:

[0216] The log analysis server 25 is connected to the early warning gateway 26 .

[0217] The log analysis server 25 is used to regularly identify warning events based on the warning event directory objects and the operation logs on the VPN log server 23 to obtain the corresponding first warning event report; and when the first warning event report is not empty, the warning gateway 26 is called to send the first warning event report to one or more remote monitoring clients 4 specified by the monitoring client directory object.

[0218] In another specific implementation of the embodiment of the present invention, the log analysis server 25 is specifically used to periodically traverse the warning event objects of the warning event directory object according to the preset first time frequency when periodically identifying the warning event according to the warning event directory object and the operation log on the VPN log server 23 to obtain the corresponding first warning event report; and when traversing, the warning event object currently traversed is used as the corresponding current warning event object; and the event type and event triggering condition of the current warning event object are used as the corresponding current event type and current event triggering condition; and the current event type is identified; 1) if the current event type is an unknown person access event, the corresponding single-day unknown person access number threshold is extracted from the current event triggering condition, and the warning event is identified according to the single-day unknown person access number threshold, the current event type and the operation log on the VPN log server 23 to obtain the corresponding first warning event data; 2) if the current event type is a frequent access event, the corresponding first event inspection time and frequent access number threshold are extracted from the current event triggering condition, and according to the first event inspection time, the frequent access number threshold, the current event type and the VPN log server 23 1) If the current event type is an abnormal time period access event, all single-day abnormal time periods and abnormal time period access number thresholds are extracted from the current event trigger conditions, and the warning event is identified based on all single-day abnormal time periods, abnormal time period access number thresholds, the current event type and the operation log on the VPN log server 23 to obtain the corresponding third warning event data; 2) If the current event type is a single-day large data download event, the corresponding single-day download data volume threshold is extracted from the current event trigger conditions, and the warning event is identified based on the single-day download data volume threshold, the current event type and the operation log on the VPN log server 23 to obtain the corresponding fourth warning event data; 3) If the current event type is a sensitive resource multiple access event, all sensitive resource access restrictions are extracted from the current event trigger conditions, and the warning event is identified based on all sensitive resource access restrictions, the current event type and the operation log on the VPN log server 23 to obtain the corresponding fifth warning event data; and after the traversal is completed, the corresponding first warning event report is composed of the obtained first, second, third, fourth and fifth warning event data.

[0219] In another specific implementation of the embodiment of the present invention, the log analysis server 25 is specifically used to obtain the corresponding first warning event data by performing warning event identification based on the threshold of the number of unknown personnel access in a single day, the current event type and the operation log on the VPN log server 23. The total number of first operation logs whose date information of the third request timestamp on the VPN log server 23 is the date of the day and the first employee's work number is empty is counted to obtain the corresponding number of unknown personnel access on the day; and identify whether the number of unknown personnel access on the day exceeds the threshold of the number of unknown personnel access in a single day; if not, the corresponding first warning event data is set to be empty; if it is exceeded, the current time is used as the corresponding first event time, and the first event time, the current event type, the number of unknown personnel access on the day and the threshold of the number of unknown personnel access in a single day constitute a corresponding first warning event data.

[0220] In another specific implementation of the embodiment of the present invention, the log analysis server 25 is specifically used to identify the warning event according to the first event inspection time, the frequent access number threshold, the current event type and the operation log on the VPN log server 23 to obtain the corresponding second warning event data, and use the current time as the corresponding first time period end time; and use the time obtained by subtracting the first event inspection time from the first time period end time as the corresponding first time period start time; and the first time period start time and the first time period end time form the corresponding first time period; and count the total number of first operation logs whose third request timestamps on the VPN log server 23 meet the first time period to obtain the corresponding first access number; and identify whether the first access number exceeds the frequent access number threshold; if not, set the corresponding second warning event data to empty; if it has exceeded, use the current time as the corresponding second event time, and form a corresponding second warning event data with the second event time, the current event type, the first access number and the frequent access number threshold.

[0221] In another specific implementation of the embodiment of the present invention, the log analysis server 25 is specifically used to traverse each single-day abnormal period when obtaining corresponding third warning event data through warning event identification based on all single-day abnormal periods, abnormal period access number threshold, current event type and operation log on the VPN log server 23; and when traversing, the single-day abnormal period currently traversed is used as the corresponding current abnormal period; and the total number of first operation logs whose third request timestamps meet the current abnormal period on the VPN log server 23 is counted to obtain the corresponding current period access number; and whether the current period access number exceeds the abnormal period access number threshold is identified; if not, the corresponding first period data is set to empty; if exceeded, the current abnormal period, the current period access number and the abnormal period access number threshold constitute the corresponding first period data; and after the traversal is completed, the current time is used as the corresponding third event time, and the third event time, the current event type and all first period data constitute a corresponding third warning event data.

[0222] In another specific implementation of the embodiment of the present invention, the log analysis server 25 is specifically used to obtain the corresponding fourth warning event data by performing warning event identification based on the single-day download data volume threshold, the current event type and the operation log on the VPN log server 23, and then calculating the sum of the first operation feedback data sizes of the first operation log whose date information of the third request timestamp is the date of the day to obtain the corresponding total download volume of the day; and identifying whether the total download volume of the day exceeds the single-day download data volume threshold; if not, setting the corresponding fourth warning event data to empty; if exceeded, using the current time as the corresponding fourth event time, and the fourth event time, the current event type, the total download volume of the day and the single-day download data volume threshold to form a corresponding fourth warning event data.

[0223] In another specific implementation of the embodiment of the present invention, the log analysis server 25 is specifically used to traverse each sensitive resource access restriction when obtaining the corresponding fifth warning event data through warning event identification based on all sensitive resource access restrictions, the current event type and the operation log on the VPN log server 23; and when traversing, the currently traversed sensitive resource access restriction is used as the corresponding current sensitive resource access restriction; and the number of first operation logs whose date information of the third request timestamp on the VPN log server 23 is the date of the day, and the first request type is a service request, and the first resource server address of the original text of the first request matches the sensitive resource server address of the current sensitive resource access restriction is counted to obtain the corresponding first number; and whether the first number exceeds the threshold of the number of sensitive resource visits per day of the current sensitive resource access restriction is identified; if not, the corresponding first resource data is set to empty; if it is exceeded, the corresponding first resource data is composed of the first number, the sensitive resource server address and the threshold of the number of sensitive resource visits per day; and after the traversal is completed, the current time is used as the corresponding fifth event time, and the fifth event time, the current event type and all the first resource data are composed of a corresponding fifth warning event data.

[0224] In another specific implementation method of an embodiment of the present invention, the log analysis server 25 is specifically used to call the early warning gateway 26 to send the first early warning event report to one or more remote monitoring clients 4 specified by the monitoring client directory object, and call the early warning gateway 26 to send the first early warning event report to the remote monitoring client 4 corresponding to the client interface address of each monitoring client object of the monitoring client directory object.

[0225] The embodiment of the present invention provides a processing system for performing access control on intranet resources, the system comprising: an OpenLDAP server, a VPN server, a VPN log server, an intranet routing device, a log analysis server and an early warning gateway; wherein the OpenLDAP server is used to configure a plurality of directory objects (client directory object, MAC whitelist directory object, MAC blacklist directory object, login token directory object, department directory object, intranet resource directory object, early warning event directory object, and monitoring client directory object) related to the access control policy; the VPN server is used to perform multi-step verification-employee token distribution-client receipt feedback based on a plurality of directory objects configured on the OpenLDAP server after receiving a login request sent by a VPN client, and generate a corresponding operation log based on each step of operation in the processing process and store it in the VPN log server; and is also used to perform multi-step verification-intranet request forwarding-client receipt feedback based on a plurality of directory objects configured on the OpenLDAP server after receiving a service request sent by a VPN client, and generate a corresponding operation log based on each step of operation in the processing process and store it in the VPN log server; the log analysis server is used to periodically identify early warning events based on early warning event directory objects and operation logs, and call the early warning gateway to send the identification results to one or more remote monitoring clients specified by the monitoring client directory object. The system of the present invention adds an OpenLDAP server, a VPN log server, a log analysis server and an early warning gateway to the traditional remote office technical solution, and correspondingly adds a variety of verification mechanisms including token verification, an early warning event identification mechanism and an event early warning mechanism; through the system of the present invention, the ability to protect privacy information, the ability to prevent illegal operations, and the ability to identify and warn of security incidents are improved, thereby achieving the technical effect of improving the ability to control access to intranet resources.

[0226] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0227] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0228] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A processing system for access control of intranet resources, characterized in that: The system includes: an OpenLDAP server, a VPN server, a VPN log server, an intranet routing device, a log analysis server and an early warning gateway; The OpenLDAP server is connected to the VPN server and the log analysis server respectively; the OpenLDAP server is used to configure client directory objects, MAC whitelist directory objects, MAC blacklist directory objects, login token directory objects, department directory objects, intranet resource directory objects, warning event directory objects and monitoring client directory objects; The VPN server is connected to each VPN client of the external network respectively, is also connected to the VPN log server, and is also connected to each intranet resource server of the intranet through the intranet routing device; The VPN server is used to receive a first login request sent by the VPN client; and perform multi-step verification, employee token distribution and client receipt feedback processing according to the first login request, the client directory object, the MAC whitelist directory object, the MAC blacklist directory object, the department directory object and the login token directory object, and generate a corresponding first operation log based on each step of the operation during the processing and store it in the VPN log server; wherein the first login request includes a first request timestamp, a first client identifier, a first client MAC address, a first client login username and a first client login password; The VPN server is also used to receive a first service request sent by the VPN client; and perform multi-step verification, intranet request forwarding and client receipt feedback processing according to the first service request, the client directory object, the MAC whitelist directory object, the MAC blacklist directory object, the login token directory object, the department directory object and the intranet resource directory object, and generate the corresponding first operation log based on each step of the operation during the processing and store it in the VPN log server; wherein, the first service request includes a second request timestamp, a second client identifier, a second client MAC address, a second employee token, a first resource server address, a first server interface address and a first interface parameter; The VPN log server is connected to the log analysis server; the VPN log server is used to store multiple first operation logs; the first operation log includes a third request timestamp, a third client identifier, a third client MAC address, a first employee ID, a first employee name, a first request type, a first request text, a first operation step, a first operation status and a first operation feedback data size; the first request type includes a login request and a service request; the first request text is the corresponding first login request or the first service request; the first operation step includes a client-MAC binding relationship verification step, a MAC black and white list verification step, an employee identity authentication step, an employee token distribution step, an employee token verification step, an employee authority verification step and an intranet request forwarding step; the first operation status includes a success status and a failure status; The log analysis server is connected to the early warning gateway; the log analysis server is used to regularly identify early warning events based on the early warning event directory object and the operation log on the VPN log server to obtain a corresponding first early warning event report; and when the first early warning event report is not empty, the early warning gateway is called to send the first early warning event report to one or more remote monitoring clients specified by the monitoring client directory object.

2. The processing system for controlling access to intranet resources according to claim 1, characterized in that: The object attributes of the client directory object include multiple client objects; the object attributes of the client object include a client identifier and a bound client MAC address; The object attributes of the MAC whitelist directory object include a plurality of whitelist MAC addresses; The object attributes of the MAC blacklist directory object include multiple blacklist MAC addresses; The object attributes of the login token directory object include multiple login token objects; the login token object includes an employee token, a token validity period, and a token employee ID; The object attributes of the department directory object include the department name and multiple employee objects; the object attributes of the employee object include the employee ID, employee name, login username, login password, employee grade, resignation status and intranet resource list; the employee grade includes multiple grade levels; the resignation status includes the employed status, the pre-resignation status and the resignation status; the intranet resource list includes one or more available resource server addresses; The object attributes of the intranet resource directory object include multiple intranet resource objects; the intranet resource objects correspond to the intranet resource servers one by one; the object attributes of the intranet resource objects include the resource server name, resource server address, server interface list object, employee grade policy object and employee status authority policy object; the object attributes of the server interface list object include multiple server interface addresses; the object attributes of the employee grade policy object include multiple employee grade authority objects; the object attributes of the employee grade authority object include the grade level and grade interface list object; the object attributes of the grade interface list object include one or more server interface addresses; the object attributes of the employee status authority policy object include an on-the-job employee status authority object and a pre-retiring employee status authority object; the object attributes of the on-the-job employee status authority object and the pre-retiring employee status authority object both include one or more service interface addresses; but the service interface address set of the pre-retiring employee status authority object is a subset of the service interface address set of the on-the-job employee status authority object; The object attributes of the warning event catalog object include multiple warning event objects; the object attributes of the warning event object include event type and event triggering condition; the event type includes unknown person access event, frequent access event, abnormal time period access event, single-day big data download event and sensitive resource multiple access event; when the event type is unknown person access event, the corresponding event triggering condition includes a single-day unknown person access number threshold; when the event type is a frequent access event, the corresponding event triggering condition includes the first event inspection duration and the frequent access number threshold; when the event type is an abnormal time period access event, the corresponding event triggering condition includes one or more single-day abnormal time periods and an abnormal time period access number threshold, and the single-day abnormal time period includes the time period start time and the time period end time; when the event type is a single-day big data download event, the corresponding event triggering condition includes a single-day download data volume threshold; when the event type is a sensitive resource multiple access event, the corresponding event triggering condition includes multiple sensitive resource access restrictions, and the sensitive resource access restrictions include the sensitive resource server address and the sensitive resource single-day access number threshold; The object attributes of the monitoring client directory object include multiple monitoring client objects; the object attributes of the monitoring client object include client interface type and corresponding client interface address; the client interface type includes SMS type, email type and instant messaging software type; When the client interface type is a text message type, the corresponding client interface address is a mobile phone number; when the client interface type is an email type, the corresponding client interface address is an email address; when the client interface type is an instant messaging software type, the corresponding client interface address is an instant messaging software interface address.

3. The processing system for performing access control on intranet resources according to claim 2, characterized in that: The VPN server is specifically used to extract the corresponding first request timestamp, the first client identifier, the first client MAC address, the first client login user name and the first client login password from the first login request as the corresponding current request timestamp, the current client identifier, the current client MAC address, the current client login user name and the current client login password when performing multi-step verification, employee token distribution and client receipt feedback processing according to the first login request, the client directory object, the MAC whitelist directory object, the MAC blacklist directory object, the department directory object and the login token directory object and generating a corresponding first operation log based on each step of the operation during the processing and storing it in the VPN log server; and taking the first login request as the corresponding current request original text; and setting the current step as a client-MAC binding relationship verification step; and performing client-MAC binding relationship verification processing according to the current client identifier, the current client MAC address and the client directory object to obtain a corresponding binding relationship verification result; and when the binding relationship verification result is verification failure, returning a preset first login failure receipt to the VPN client; and taking the first login failure receipt as the corresponding current receipt; and assembling the failure log based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current receipt, the current step and the department directory object to obtain the corresponding first operation log and store it in the VPN log server; and exiting the multi-step verification, employee token distribution and client receipt feedback processing; When the binding relationship verification result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current step and the department directory object to obtain the corresponding first operation log and store it in the VPN log server; And set the current step as the MAC black and white list verification step; And perform MAC blacklist and whitelist verification processing according to the current client MAC address, the MAC whitelist directory object and the MAC blacklist directory object to obtain a corresponding MAC blacklist and whitelist verification result; and when the MAC black and white list verification result is verification failure, returning the first login failure receipt to the VPN client; and taking the first login failure receipt as the corresponding current receipt; and assembling the failure log based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current receipt, the current step and the department directory object to obtain the corresponding first operation log and store it in the VPN log server; and exiting the multi-step verification, employee token distribution and client receipt feedback processing; When the MAC blacklist and whitelist verification result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current step and the department directory object to obtain the corresponding first operation log and store it in the VPN log server; And set the current step as an employee identity authentication step; and perform employee identity authentication processing according to the current client login user name, the current client login password and the department directory object to obtain a corresponding employee identity authentication result; and returning the first login failure receipt to the VPN client when the employee identity authentication result is a verification failure; and taking the first login failure receipt as the corresponding current receipt; and assembling the failure log based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current receipt, the current step and the department directory object to obtain the corresponding first operation log and store it in the VPN log server; and exiting the multi-step verification, employee token distribution and client receipt feedback processing; When the employee identity authentication result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current step and the department directory object to obtain the corresponding first operation log and store it in the VPN log server; And set the current step as the employee token distribution step; and perform employee token distribution processing according to the current request timestamp, the current client login user name, the department directory object and the login token directory object to obtain the corresponding first employee token; and sending a first successful login receipt carrying the first employee token to the VPN client; And use the first successful login receipt as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current client login user name, the current request original text, the current receipt, the current step and the department directory object, perform successful log assembly to obtain the corresponding first operation log and store it in the VPN log server.

4. The processing system for controlling access to intranet resources according to claim 2, characterized in that: The VPN server is specifically used for extracting the corresponding second request timestamp, the second client identifier, the second client MAC address, the second employee token, the first resource server address, the first server interface address and the first interface parameter from the first service request as the corresponding current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current resource server address, the current server interface address and the current interface parameter when performing multi-step verification, intranet request forwarding and client receipt feedback processing according to the first service request, the client directory object, the MAC whitelist directory object, the MAC blacklist directory object, the login token directory object, the department directory object and the intranet resource directory object and generating the corresponding first operation log based on each step of the operation in the processing process and storing it in the VPN log server; and using the first login request as the corresponding current request original text; and setting the current step as a client-MAC binding relationship verification step; and performing client-MAC binding relationship verification processing according to the current client identifier, the current client MAC address and the client directory object to obtain a corresponding binding relationship verification result; and when the binding relationship verification result is verification failure, returning a preset first service failure receipt to the VPN client; and taking the first service failure receipt as the corresponding current receipt; and assembling the failure log based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current receipt, the current step, the login token directory object and the department directory object to obtain the corresponding first operation log and store it in the VPN log server; And exit this multi-step verification, intranet request forwarding and client receipt feedback processing; When the binding relationship verification result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current step, the login token directory object, and the department directory object to obtain the corresponding first operation log and store it in the VPN log server; And set the current step as the MAC black and white list verification step; And perform MAC blacklist and whitelist verification processing according to the current client MAC address, the MAC whitelist directory object and the MAC blacklist directory object to obtain a corresponding MAC blacklist and whitelist verification result; and when the MAC black and white list verification result is verification failure, returning the first service failure receipt to the VPN client; and taking the first service failure receipt as the corresponding current receipt; and assembling the failure log based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request text, the current receipt, the current step, the login token directory object and the department directory object to obtain the corresponding first operation log and store it in the VPN log server; And exit this multi-step verification, intranet request forwarding and client receipt feedback processing; When the MAC blacklist and whitelist verification result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current step, the login token directory object and the department directory object to obtain the corresponding first operation log and store it in the VPN log server; And setting the current step as the employee token verification step; And perform employee token verification processing according to the current employee token and the login token directory object to obtain a corresponding employee token verification result; and when the employee token verification result is verification failure, returning the first service failure receipt to the VPN client; and taking the first service failure receipt as the corresponding current receipt; and assembling the failure log based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current receipt, the current step, the login token directory object and the department directory object to obtain the corresponding first operation log and store it in the VPN log server; And exit this multi-step verification, intranet request forwarding and client receipt feedback processing; When the employee token verification result is successful, a successful log assembly is performed based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request text, the current step, the login token directory object, and the department directory object to obtain the corresponding first operation log and store it in the VPN log server; And setting the current step as the employee authority verification step; and extracting the token employee ID of the login token object whose employee token in the login token directory object matches the current employee token as the corresponding current employee ID; And perform employee authority verification processing according to the current employee ID, the current resource server address, the current server interface address, the department directory object and the intranet resource directory object to obtain a corresponding employee authority verification result; and when the employee authority verification result fails as verification failure, returning the first service failure receipt to the VPN client; and taking the first service failure receipt as the corresponding current receipt; and assembling the failure log based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current receipt, the current step, the login token directory object and the department directory object to obtain the corresponding first operation log and store it in the VPN log server; and exiting the multi-step verification, intranet request forwarding and client receipt feedback processing; When the employee authority verification result fails, the first operation log is successfully assembled based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request text, the current step, the login token directory object and the department directory object to obtain the corresponding first operation log and store it in the VPN log server; And setting the current step as an intranet request forwarding step; and sending a first intranet request carrying the current server interface address and the current interface parameters to the intranet resource server corresponding to the current resource server address; and receiving first feedback data sent back by the intranet resource server; and sending a first service success receipt carrying the first feedback data to the VPN client; And use the first service success receipt as the corresponding current receipt; and based on the current request timestamp, the current client identifier, the current client MAC address, the current employee token, the current request original text, the current receipt, the current step, the login token directory object and the department directory object, perform successful log assembly to obtain the corresponding first operation log and store it in the VPN log server.

5. The processing system for performing access control on intranet resources according to any one of claims 3 to 4, characterized in that: The VPN server is specifically configured to, when performing the client-MAC binding relationship verification process according to the current client identifier, the current client MAC address and the client directory object to obtain a corresponding binding relationship verification result, use the client object in the client directory object whose client identifier matches the current client identifier and whose client MAC address matches the current client MAC address as a corresponding matching object; and identifying whether the matching object is empty; If the matching object is not empty, the corresponding binding relationship verification result is set to verification success; if the matching object is empty, the corresponding binding relationship verification result is set to verification failure; The VPN server is specifically used for, when the MAC black and white list verification processing is performed according to the current client MAC address, the MAC white list directory object and the MAC black list directory object to obtain the corresponding MAC black and white list verification result, identifying whether there is the white list MAC address matching the current client MAC address in the MAC white list directory object, if so, setting the corresponding first state to success, if not, setting the corresponding first state to failure; and identifying whether there is the black list MAC address matching the current client MAC address in the MAC black list directory object, if so, setting the corresponding second state to failure, if not, setting the corresponding second state to success; and identifying whether the first and second states are both successful, if so, setting the corresponding MAC black and white list verification result to verification success, if not, setting the corresponding MAC black and white list verification result to verification failure.

6. The processing system for controlling access to intranet resources according to claim 3, characterized in that: The VPN server is specifically used to, when the employee identity authentication processing is performed according to the current client login user name, the current client login password and the department directory object to obtain the corresponding employee identity authentication result, use the employee object whose login user name and login password in the department directory object match the corresponding current client login user name and the current client login password as the corresponding current matching object; and identify whether the current matching object is empty; if so, set the corresponding employee identity authentication result to verification failure; if not, set the corresponding employee identity authentication result to verification success.

7. The processing system for controlling access to intranet resources according to claim 3, characterized in that: The VPN server is specifically configured to, when performing employee token distribution processing according to the current request timestamp, the current client login user name, the department directory object and the login token directory object to obtain a corresponding first employee token, use the employee ID of the employee object whose login user name in the department directory object matches the current client login user name as the corresponding current employee ID; And when the current employee ID is not empty, the login token object whose token employee ID in the login token directory object matches the current employee ID is used as the corresponding current token object; And identifying whether the current token object is empty; If the current token object is empty, the corresponding first plain text is composed of the current client login user name and the current request timestamp; and performing a hash calculation on the first plaintext to obtain a corresponding first hash code; and using the first hash code as the corresponding employee token; The current time is used as the corresponding validity start time, and the corresponding validity end time is obtained by adding the validity start time and the preset validity period, and the validity start time and the validity end time constitute the corresponding token validity period; The current employee ID is used as the corresponding token employee ID; The obtained employee token, the token validity period and the token employee ID form a corresponding login token object and add it to the login token directory object; and using the employee token as the corresponding first employee token; If the current token object is not empty but the token validity period of the current token object has expired, the current client login user name and the current request timestamp form a corresponding second plaintext; and perform a hash calculation on the second plaintext to obtain a corresponding second hash code; and use the second hash code as the corresponding first token; and taking the current time as the corresponding first start time, and adding the first start time and the validity period to obtain the corresponding first end time, and the first start time and the first end time constitute the corresponding first validity period; and resetting the employee token and the token validity period of the current token object to the corresponding first token and the first validity period; and using the first token as the corresponding first employee token; If the current token object is not empty and the token validity period of the current token object has not expired, the employee token of the current token object is extracted as the corresponding first employee token.

8. The processing system for controlling access to intranet resources according to claim 4, characterized in that: The VPN server is specifically used to, when the employee token verification process is performed according to the current employee token and the login token directory object to obtain the corresponding employee token verification result, use the login token object in the login token directory object that matches the employee token with the current employee token as the corresponding matching login object; and identifying whether the matching login object is empty; If the matching login object is empty, the corresponding employee token verification result is set to verification failure; if the matching login object is not empty, it is identified whether the token validity period of the matching login object has expired. If it has expired, the corresponding employee token verification result is set to verification failure; if it has not expired, the corresponding employee token verification result is set to verification success.

9. The processing system for controlling access to intranet resources according to claim 4, characterized in that: The VPN server is specifically used to, when the employee authority verification process is performed according to the current employee ID, the current resource server address, the current server interface address, the department directory object and the intranet resource directory object to obtain a corresponding employee authority verification result, use the employee object whose employee ID in the department directory object matches the current employee ID as the corresponding current employee object; and use the intranet resource object whose resource server address in the intranet resource directory object matches the current resource server address as the corresponding current resource object; and identifying whether there is the available resource server address matching the current resource server address in the intranet resource list of the current employee object, and if so, setting the corresponding first check status to success; if not, setting the corresponding first check status to failure; and extracting the employee grade and the resignation status of the current employee object as the corresponding current employee grade and current resignation status; and taking the grade interface list object of the employee grade authority object whose grade level in the employee grade policy object of the current resource object matches the current employee grade as the corresponding current interface list object; and identifying whether there is the server interface address matching the current server interface address in the current interface list object, and if so, setting the corresponding second check status to success, and if not, setting the corresponding second check status to failure; And the current resignation status is identified; if the current resignation status is the on-the-job status, it is identified whether there is a server interface address matching the current server interface address in the on-the-job employee status permission object of the employee status permission policy object of the current resource object, and if so, the corresponding third check status is set to success; if not, the corresponding third check status is set to failure; if the current resignation status is the pre-resignation status, it is identified whether there is a server interface address matching the current server interface address in the pre-resignation employee status permission object of the employee status permission policy object of the current resource object, and if so, the corresponding third check status is set to success; if not, the corresponding third check status is set to failure; if the current resignation status is the resignation status, the corresponding third check status is set to failure; And it is identified whether the first, second and third checking states are all successful. If so, the corresponding employee authority verification result is set as verification success; otherwise, the corresponding employee authority verification result is set as verification failure.

10. The processing system for performing access control on intranet resources according to claim 2, characterized in that: The log analysis server is specifically used for periodically traversing the warning event objects of the warning event directory object at a preset first time frequency when the corresponding first warning event report is obtained by periodically identifying the warning event according to the warning event directory object and the operation log on the VPN log server; and when traversing, taking the currently traversed warning event object as the corresponding current warning event object; and taking the event type and the event trigger condition of the current warning event object as the corresponding current event type and current event trigger condition; and identifying the current event type; if the current event type is an unknown person access event, extracting the corresponding single-day unknown person access number threshold from the current event trigger condition, and performing early warning event identification based on the single-day unknown person access number threshold, the current event type and the operation log on the VPN log server to obtain corresponding first early warning event data; If the current event type is a frequent access event, extract the corresponding first event inspection duration and the frequent access number threshold from the current event trigger condition, and perform warning event identification according to the first event inspection duration, the frequent access number threshold, the current event type and the operation log on the VPN log server to obtain corresponding second warning event data; If the current event type is an abnormal period access event, all the single-day abnormal periods and the abnormal period access number thresholds are extracted from the current event triggering conditions, and warning event identification is performed according to all the single-day abnormal periods, the abnormal period access number thresholds, the current event type and the operation log on the VPN log server to obtain corresponding third warning event data; If the current event type is a single-day large data download event, the corresponding single-day download data volume threshold is extracted from the current event trigger condition, and a warning event is identified according to the single-day download data volume threshold, the current event type and the operation log on the VPN log server to obtain corresponding fourth warning event data; If the current event type is a sensitive resource multiple access event, all the sensitive resource access restrictions are extracted from the current event trigger condition, and warning event identification is performed according to all the sensitive resource access restrictions, the current event type and the operation log on the VPN log server to obtain corresponding fifth warning event data; After the traversal is completed, the first, second, third, fourth and fifth warning event data obtained form the corresponding first warning event report.

Images