Multi-application access control method, device, electronic device and storage medium

Abstract

The present application provides a multi-application access control method, device, electronic device and storage medium. The multi-application access control method includes: intercepting requests sent by a terminal; determining the target port used by the terminal when sending a request; determining the target application that uses the target port to send a request based on the mapping relationship between the application and the port in the terminal; when the target application has access rights, forwarding the request to the corresponding server. In this way, without repackaging the application, it is also possible to know which application sent the request, and then determine whether to send the request based on whether the application has access rights. When performing access control on each application in the terminal separately, it is possible to avoid cumbersome secondary packaging of each application, thereby improving the convenience of performing access control on each application in the terminal separately.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a multi-application access control method, device, electronic device and storage medium. Background Art

[0002] With the development of user services, more and more applications (Application, APP) are installed on the same terminal device.

[0003] At present, in order to achieve access control of each application in the terminal, the following two methods are mainly used: The first method: determine whether a certain application in the terminal has the authority to access a certain target server based on the Internet Protocol (IP) address of the terminal. However, this method cannot perform access control on different applications in the terminal separately, that is, it cannot control whether a certain application has the authority to access a certain target server, while another application does not have the authority to access a certain target server. Therefore, the second method came into being. The second method: perform secondary encapsulation for each application in the terminal, so that the header of the access request issued by the application carries the identification of the corresponding application, and then determine whether the application has the authority to access a certain target server based on the identification.

[0004] Although the second method can perform access control on different applications in the terminal separately, as the number of applications increases, it is necessary to frequently repackage the newly added applications. This method is very cumbersome and inconvenient to perform access control on each application in the terminal separately. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a multi-application access control method, device, electronic device and storage medium, which can more conveniently perform access control on each application in a terminal.

[0006] In order to solve the above technical problems, the embodiments of the present application provide the following technical solutions:

[0007] The first aspect of the present application provides a multi-application access control method, which includes: intercepting a request issued by a terminal; determining a target port used by the terminal when issuing the request; determining a target application that uses the target port to issue the request based on a mapping relationship between an application and a port in the terminal; and forwarding the request to a corresponding server when the target application has access rights.

[0008] The second aspect of the present application provides a multi-application access control device, which includes: an interception module for intercepting requests issued by a terminal; a port determination module for determining a target port used by the terminal when issuing the request; an application determination module for determining a target application that uses the target port to issue the request based on a mapping relationship between an application and a port in the terminal; and a sending module for forwarding the request to a corresponding server when the target application has access rights.

[0009] The third aspect of the present application provides an electronic device, comprising: a processor, a memory, and a bus; wherein the processor and the memory communicate with each other through the bus; and the processor is used to call program instructions in the memory to execute the method in the first aspect.

[0010] A fourth aspect of the present application provides a computer-readable storage medium, comprising: a stored program; wherein, when the program is executed, the device where the storage medium is located is controlled to execute the method in the first aspect.

[0011] Compared with the prior art, the multi-application access control method provided in the first aspect of the present application intercepts the request sent by the terminal and determines the target port used when the terminal sends the request, and then determines the target application that uses the target port to send the request according to the mapping relationship between the application and the port in the terminal, and forwards the request to the corresponding server when the target application has access rights. In this way, without repackaging the application, it is also possible to know which application sends the request, and then determine whether to send the request according to whether the application has access rights. When performing access control on each application in the terminal separately, it is possible to avoid cumbersome repackaging of each application, which improves the convenience of performing access control on each application in the terminal separately. Moreover, even if there is a high-security application in the terminal, since the repackaging of each application in the terminal is avoided, the high-security application can be accessed and controlled, which improves the comprehensiveness of performing access control on each application in the terminal separately. In addition, since the repackaging of each application in the terminal is avoided, it is also possible to avoid problems such as code conflicts, thereby improving the security of the terminal.

[0012] The multi-application access control device provided in the second aspect, the electronic device provided in the third aspect, and the computer-readable storage medium provided in the fourth aspect of the present application have the same or similar beneficial effects as the multi-application access control method provided in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] By reading the detailed description below with reference to the accompanying drawings, the above and other purposes, features and advantages of the exemplary embodiments of the present application will become easy to understand. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0014] Figure 1 This is a schematic diagram of the architecture of multi-application access control in an embodiment of the present application;

[0015] Figure 2 A flowchart of a multi-application access control method in an embodiment of the present application;

[0016] Figure 3 A schematic diagram of a specific process for determining a target application corresponding to a target port in an embodiment of the present application;

[0017] Figure 4 A schematic diagram of a specific process for determining whether to send a request in an embodiment of the present application;

[0018] Figure 5 A schematic diagram of a process for performing multi-application access control in an embodiment of the present application;

[0019] Figure 6 A schematic diagram of a process for determining whether a target application has access rights in an embodiment of the present application;

[0020] Figure 7 The structure of the multi-application access control device in the embodiment of the present application is shown as follows: Figure 1 ;

[0021] Figure 8 The structure of the multi-application access control device in the embodiment of the present application is shown as follows: Figure 2 ;

[0022] Fig. 9 Schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0023] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0024] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.

[0025] At present, in order to control whether different applications in a terminal can access a target server, generally speaking, different applications in the terminal are repackaged. After the different applications are repackaged, when different applications send requests, the requests sent will carry the identifiers of the corresponding applications. Therefore, after receiving the request, the target server can determine which application in the terminal is the one that sent the request through the identifier carried in the request, and then determine whether it has access rights, that is, whether to respond to the request.

[0026] However, as the number of applications continues to increase, it is necessary to frequently repackage the newly added applications, which is very cumbersome and inconvenient to perform access control on each application in the terminal. In addition, some applications with higher security cannot be repackaged, which makes it impossible to perform access control on some applications with higher security in the terminal, and thus it is impossible to perform access control on all applications used in the terminal, which reduces the comprehensiveness of access control. In addition, even if all applications in the terminal can be repackaged, there will still be conflicts between the packaging code and the application code, which will lead to various security issues.

[0027] In view of this, this application has replaced a new access control idea. It no longer continues to improve the specific method of secondary packaging of each application in the terminal, but determines the application that issued the request in the terminal through the request issued by the terminal, and then determines whether the application has the authority to access the target server according to the pre-set access control logic, thereby determining whether to send the application to the corresponding target server. In this way, there is no need to repackage the application, and you can know which application issued the request, and then determine whether to forward the request issued by the application to the target server to which the request needs to be sent, which can more conveniently perform access control on different applications in the terminal.

[0028] It should be noted here that the execution subject of the multi-application access control method provided in the embodiment of the present application can be an application installed in the terminal, or a functional module in a certain application. By running the application in the terminal, access control can be performed on each application in the terminal. Of course, the execution subject can also be other functional modules installed in the terminal. The execution subject of the multi-application access control method provided in the embodiment of the present application is not specifically limited here.

[0029] Generally speaking, users who use terminals do not want the access to applications installed in their terminals to be restricted, but want all applications installed in their terminals to be freely accessible. Therefore, users generally do not actively choose to install applications that can perform access control separately in their terminals. Therefore, in practical applications, the multi-application access control methods provided in the embodiments of the present application are all embedded in applications with another function. This other application is generally an application that users have a need to use. For example: another application can be an application that obtains information across network domains. When a user needs to work from home, the information used for the office is stored in the intranet of the work unit, but the user uses the public network when working from home and cannot use the intranet of the work unit. Therefore, the user needs to install an application customized by the work unit to achieve cross-domain information acquisition, that is, through the application customized by the work unit, the information of the intranet of the work unit can also be obtained by using the public network at home. At the same time, the application can also control which applications in the terminal used by the user at home can access the target server and which applications cannot access the target server. Of course, another application can also be an application with functions required by other users, which will not be listed one by one here.

[0030] Figure 1 This is a schematic diagram of the architecture of multi-application access control in the embodiment of this application, see Figure 1 As shown, in the terminal, application A, application B, and a zero-trust application embedded with the multi-application access control method provided by the embodiment of the present application are installed. After application A sends a request, the zero-trust application intercepts the request and determines whether to forward the request to the corresponding target server through the multi-application access control method provided by the embodiment of the present application. In this way, the target server is unaware of the request, and can also avoid frequent interference of requests without access rights to the target server.

[0031] During the forwarding process, the zero-trust application can first send the request to the zero-trust server corresponding to the zero-trust application. If the zero-trust application determines that the application A corresponding to the request has the permission to access the target server, the zero-trust server is controlled to send the request to the target server; if the zero-trust application determines that the application A corresponding to the request does not have the permission to access the target server, the zero-trust server is controlled to no longer send the request to the target server.

[0032] Next, the multi-application access control method provided in the embodiment of the present application is described in detail.

[0033] Figure 2 This is a flowchart of the multi-application access control method in the embodiment of the present application, see Figure 2 As shown, the method may include:

[0034] S21: Intercept the request sent by the terminal.

[0035] The intercepted request here is a request from an application in the terminal to access a target server. When an application in the terminal needs to call another application in the terminal, or needs to access a specified server, the application will send a corresponding request to the server of the other application or the above-specified server. Before the request is sent from the terminal, it will be intercepted by the zero-trust application in the terminal.

[0036] S22: Determine the target port used by the terminal when making a request.

[0037] Since the application in the terminal is not repackaged, the request sent by the application in the terminal does not carry the identification of the corresponding application. In other words, it is impossible to analyze from the request sent by the terminal which application in the terminal sent the request.

[0038] The request sent by the terminal has a certain correspondence with the port in the terminal. In other words, which request is sent from which port of the terminal is specified. Therefore, the target port used when the request is sent can be known through the intercepted request. The target port here refers to a port in the terminal that sends the request, that is, the source port.

[0039] For example, suppose that there are ports a, b, and c in the terminal, and ports a and b are currently occupied. When request a needs to be sent, the terminal will configure port c for request a so that request a can be sent through port c. In this way, through the terminal configuration file, it can be determined that port c is used when request a is sent.

[0040] In actual applications, ports are used to classify initiators based on the properties of requests, such as port 80, port 443, etc.

[0041] In actual applications, the traffic actually accessed by users, i.e., requests, may have many destination addresses. If all of these traffic are forwarded to a zero-trust server, high concurrency issues may occur. Therefore, before determining the destination port used by the terminal when making a request, you can first determine whether to directly transmit it transparently or forward it to a zero-trust server based on the destination IP and destination port. The destination IP and destination port here are related information about the object of the traffic request.

[0042] S23: Determine the target application that uses the target port to send the request according to the mapping relationship between the application and the port in the terminal.

[0043] After determining the target port corresponding to the request, the target application that uses the target port to send the request can be determined based on the mapping relationship between the application and the port.

[0044] In the terminal, applications and ports also have a mapping relationship. The mapping relationship between applications and ports can be dynamic. That is, for the same port, multiple requests corresponding to applications can be issued. At this time, after determining the target port, it is necessary to obtain the most updated mapping relationship between applications and ports from the terminal, and then find the target application corresponding to the target port from the most updated mapping relationship between applications and ports.

[0045] S24: When the target application has access rights, the request is forwarded to the corresponding server.

[0046] After determining the target application that issues the request, it is possible to determine whether the target application has access rights based on the preset policy. When it is determined that the target application has access rights, the request issued by the target application is forwarded to the corresponding server. Forwarding to the corresponding server here means releasing the request and allowing it to access the business resources corresponding to the request. For example: accessing a specific APP, accessing a specific system, etc. When it is determined that the target application does not have access rights, the request issued by the target application will no longer be forwarded to the corresponding server, which is equivalent to the zero-trust application intercepting the request in the terminal. The corresponding server will not receive the request, that is, it will not be perceived, avoiding interference from various irrelevant requests. The corresponding server is the target server that the request needs to access.

[0047] The preset policy may include the names of various applications that have access to the target server, i.e., a whitelist. When the target application is found in the whitelist, it means that the target application has access to the target server, and the request can be forwarded to the target server. When the target application is not found in the whitelist, it means that the target application does not have access to the target server, or the access is questionable, and the request is intercepted and not forwarded to the target server.

[0048] Of course, the preset policy may also include the names of various applications that do not have the permission to access the target server, i.e., a blacklist. When the target application is not found in the blacklist, it means that the target application has the permission to access the target server, and the request can be forwarded to the target server. When the target application is found in the blacklist, it means that the target application does not have the permission to access the target server, and the request is intercepted and not forwarded to the target server.

[0049] In the specific implementation process, the preset policy can be pre-configured by the administrator of the zero-trust application according to the requirements of the server provider, or it can be configured by the server provider according to its actual needs after logging into the zero-trust application with an account and password. The specific configuration process of the preset policy is not limited here.

[0050] As can be seen from the above content, the multi-application access control method provided by the embodiment of the present application intercepts the request sent by the terminal, determines the target port used when the terminal sends the request, and then determines the target application that uses the target port to send the request according to the mapping relationship between the application and the port in the terminal. When the target application has access rights, the request is forwarded to the corresponding server. In this way, without repackaging the application, it is also possible to know which application sends the request, and then determine whether to send the request according to whether the application has access rights. When performing access control on each application in the terminal, it is possible to avoid cumbersome repackaging of each application, which improves the convenience of performing access control on each application in the terminal. Moreover, even if there is a high-security application in the terminal, since the repackaging of each application in the terminal is avoided, the high-security application can be accessed, which improves the comprehensiveness of the access control of each application in the terminal. In addition, since the repackaging of each application in the terminal is avoided, it is also possible to avoid code conflicts and other problems, thereby improving the security of the terminal.

[0051] Furthermore, in order to improve the efficiency of multi-application access control, it is necessary to avoid obtaining the target port assigned by the system for the request issued by the application with access restrictions, and find the target application that uses the target port to send the request, and then determine whether the target application has access rights. Before obtaining the mapping relationship between the application and the port, it is possible to first determine whether there are allowed or not allowed applications in the terminal according to the preset access control policy. When there are no allowed applications in the terminal, or all the applications installed in the terminal are not allowed applications, the mapping relationship between the application and the port is no longer obtained, but all requests issued by the terminal are intercepted. Specifically, before S22, it can also include:

[0052] Step A1: Obtain a preset access control policy.

[0053] In the preset access control policy, there are names of allowed applications or names of not allowed applications. The so-called allowed application means that after the application sends a request, the request is allowed to be sent to the corresponding server. The so-called not allowed application means that after the application sends a request, the request is not allowed to be sent to the corresponding server, that is, the request sent by the application is intercepted.

[0054] Step A2: Obtain the names of all applications installed in the terminal.

[0055] After the applications are installed in the terminal, the terminal records the names of the applications installed therein.

[0056] Step A3: Based on the preset access control policy, determine whether there is no allowed application installed in the terminal, or whether all the applications installed in the terminal are not allowed applications; if either is yes, forward the request to the interception server; if either is no, continue to execute the above step S22.

[0057] If there is no permitted application in the terminal, it means that no application in the terminal has access rights, and any request from the terminal will be intercepted. Then, obtaining the target port that issues the request, determining the target application using the target port, and then determining whether the target application has access rights are all redundant steps. Therefore, after determining that there is no permitted application in the terminal, all requests from the terminal can be forwarded to the interception server for interception without performing subsequent steps, which can improve the access control efficiency of multiple applications.

[0058] If there is an allowed application in the terminal, it is necessary to continue to determine the target port used by the request sent by the terminal, and then determine the target application that uses the target port to send the request. In this way, it can avoid missing access control for any application in the terminal, thereby improving the accuracy of multi-application access control.

[0059] Furthermore, when a port can send out requests for multiple applications, that is, the mapping relationship between applications and ports is dynamic, then, when determining the target application corresponding to the target port sending the request, it is necessary to base it on the latest mapping relationship between applications and ports.

[0060] Figure 3 For a specific flow chart of determining the target application corresponding to the target port in the embodiment of the present application, see Figure 3 As shown, S23 may include:

[0061] S231: Obtain the latest mapping relationship between the current application and the port from the terminal.

[0062] Among them, the port in the mapping relationship between application and port is the port assigned by the terminal to the request when the request is issued. That is to say, no matter which application, each time a request is issued, the terminal will allocate a port for the request. After a period of time, the terminal will reclaim the port so that other requests in the subsequent terminal can continue to use it. In this way, each time an application issues a request, the mapping relationship between the application and the port will change. In order to improve the accuracy of the determined application and thus perform access control more accurately, it is necessary to obtain the latest mapping relationship between the application and the port from the terminal.

[0063] The mapping relationship between the application and the port can be obtained directly from the relevant files of the terminal, or indirectly from the relevant files of the terminal. Regardless of which method is used, it is necessary to obtain the correspondence between the process (Proportion Integral Differential, PID) number of the application and the port stored in the system file of the terminal. The difference between the two methods is that the former is the mapping relationship between the application and the port generated by the terminal, while the latter is generated in real time by the zero-trust application when it is necessary to determine whether the application that issues the request has access rights. Specifically, S231 may include:

[0064] Step B1: extracting the correspondence between the updated PID number and the port from the system file of the terminal.

[0065] In essence, the mapping relationship between applications and ports is represented by the mapping relationship between application package names and ports.

[0066] The PID number here is assigned by the terminal system to the application when the application is running in the terminal. In other words, when the application is installed and running in the terminal, the terminal will assign a PID number to the application according to the installation order of each application in the terminal. The same application is installed in different terminals, and the corresponding PID number of the application is different. The correspondence between the updated PID number and the port is stored in the system file of the terminal.

[0067] The port here is allocated by the terminal system to the application when the application initiates a network request. In other words, when a request needs to be sent, the terminal system will randomly allocate a port for the request so that the request can be sent through this port.

[0068] Step B2: query the corresponding application package name based on the PID number, and convert the PID number in the corresponding relationship between the PID number and the port into the application package name to obtain a mapping relationship between the application package name and the port.

[0069] The application package name can uniquely represent the application, that is, the unique identification number (package name) of the application. For example: Qi'anxin ID, its package name is com.secure.secid. Another example: the Winter Olympics version of Qi'anxin token, its package name is com.dongao.id.

[0070] In the specific implementation process, after extracting the correspondence between the PID number and the port from the system file, the target PID number corresponding to the target port can be found in the correspondence, and then only the target PID number is converted into the application package name. In this way, the conversion amount can be reduced, thereby improving the efficiency of multi-application access control. Of course, all PID numbers in the correspondence can also be converted into corresponding application package names, thereby obtaining the mapping relationship between the application and the port. The specific method for obtaining the mapping relationship between the application and the port is not limited here.

[0071] When converting the PID number to the application package name, various conversion tools may be used for conversion, such as the conversion tool in Google, etc. The specific method of obtaining the application package name through the PID number is not limited here.

[0072] After the PID number is converted into an application package name, since the application package name can uniquely represent the application, at this time, the latest mapping relationship between the current application and the port is obtained.

[0073] In addition, in order to further improve the speed of obtaining the mapping relationship between applications and ports, and thus improve the efficiency of multi-application access control, it is possible to determine whether to generate the mapping relationship between applications and ports based on the correspondence between the application PID number and the port in the terminal system file, or to continue to use the existing mapping relationship between applications and ports, based on whether the time interval between two requests is within the time for the terminal system to recycle the port.

[0074] This is because: when an application in the terminal needs to make a request, the terminal system will randomly assign a port to the application and record the correspondence between the application's PID number and the assigned port in the system file. The port assigned by the system will be used for the request for a period of time, namely the buffer time. When the buffer time is over, the system will reclaim the port. When the terminal makes a request again, if the request is still issued by the same application (the terminal system can know which application issued the request, but the third-party application in the terminal cannot know which specific application issued the request), and the time interval between the two requests is within the buffer time, the re-issued request will still be issued through the port randomly assigned last time.

[0075] In this way, before the terminal system reclaims the allocated port, when it is necessary to determine the mapping relationship between the application and the port, if the request sent again also corresponds to the target port, then it is not necessary to convert the corresponding relationship between the application PID number and the port in the terminal system file again to obtain the corresponding relationship between the application and the port, and then determine the target port corresponding to the request sent again, but it is possible to directly use the existing mapping relationship between the application and the port to determine the target port corresponding to the request sent again. That is, the target application corresponding to the target port corresponding to the request determined last time is directly used as the target application of the request sent this time.

[0076] Specifically, S231 may include:

[0077] Step C1: Determine whether the target port corresponding to the current request is the same port as the target port corresponding to the previous request, and determine whether the time interval between the issuance time of the current request and the issuance time of the previous request is within the buffer time; if both are yes, execute step C2; if at least one of the two is no, execute step C3.

[0078] The buffer time here is the time from when the terminal system allocates a port for the first request of an application to when the terminal system reclaims the port. For two requests sent by the same application in the terminal in a short period of time, when the terminal sends the second request, the terminal system may not have reclaimed the port previously allocated to the application, so the second request can still be sent using the port. Because the terminal system can distinguish which application in the terminal sends the request, while the third-party application in the terminal cannot distinguish which application in the terminal sends the outgoing request. Therefore, when the same application in the terminal sends the second request in a short period of time, the terminal system will not allocate a new port for the request, but can allow the request to continue to use the port previously allocated for the request sent by the application.

[0079] Step C2: The currently existing mapping relationship between the application and the port is used as the latest mapping relationship between the application and the port.

[0080] Step C3: Re-acquire the mapping relationship between the application and the port, and use it as the latest mapping relationship between the application and the port.

[0081] In this way, the time for generating the mapping relationship between the application and the port can be saved to a certain extent, thereby improving the efficiency of determining the target application that issues the request, thereby improving the efficiency of multi-application access control.

[0082] S232: Determine the target application corresponding to the target port according to the latest mapping relationship between the current application and the port.

[0083] The specific implementation method of step S232 is the same as that of step 23, which will not be repeated here.

[0084] In actual applications, the mapping relationship between applications and ports in the terminal is dynamic. In other words, the correspondence between each application in the terminal and each port in the terminal is not fixed. Instead, when an application in the terminal sends a network request, the terminal allocates a port for the network request based on the current actual situation. That is, a port is allocated to the application that sends the network request. After a period of time, the terminal will reclaim the port. If the application needs to send a network request again, the terminal will allocate a port to the application again. The port allocated this time may be different from the port allocated last time, or it may be the same.

[0085] Specifically, before executing S23, you need to perform the following steps:

[0086] Step D1: When an application in the terminal initiates a network request, a port is allocated to the application.

[0087] Step D2: Based on the applications in the terminal and the ports allocated to the applications, a mapping relationship between the applications in the terminal and the ports is established.

[0088] In this way, the dynamic mapping relationship between the application and the port in the terminal is established based on the network request initiated by the application in the terminal. Next, the mapping relationship between the application and the port is stored somewhere in the terminal, such as a system file. Then, it can be determined which application in the terminal issued the request based on the port that issued the request.

[0089] From the above content, it can be seen that after determining the target port corresponding to the request, the mapping relationship between the application and the port can be obtained by converting the application's PID number into an application package name through the correspondence between the latest port and the application PID number in the terminal system file. Based on this mapping relationship, the application currently using the target port, that is, the target application, can be accurately determined, and then it can be determined whether the target application has access rights, and then it can be accurately determined whether to forward the request to the corresponding server, thereby improving the convenience and accuracy of multi-application access control.

[0090] Furthermore, when finally determining whether to send a request to a corresponding server, in addition to whether the target application to which the request is sent is creative, other conditions need to be combined in order to improve the accuracy of access control.

[0091] Figure 4 For a specific flow chart of determining whether to send a request in the embodiment of the present application, see Figure 4 As shown, S24 may include:

[0092] S241: Determine whether the target application has access rights and whether it satisfies at least one of the conditions; if both are yes, execute S242; if at least one of the two is no, execute S243.

[0093] S242: Send the request to the corresponding server.

[0094] S243: intercept the request and no longer send the request to the corresponding server.

[0095] Here, the conditions may include: the terminal has access rights, the IP corresponding to the request allows access, the request is sent within the allowed access time, and the current location of the terminal is within the allowed access area.

[0096] When determining whether the target application has access rights, a whitelist or blacklist can be set in the policy. When the target application appears on the whitelist, or the target application does not appear on the blacklist, it can be determined that the target application has access rights. When the target application does not appear on the whitelist, or the target application appears on the blacklist, it can be determined that the target application does not have access rights.

[0097] Similar to determining whether the target application has access rights, when determining whether the terminal has access rights, a whitelist or blacklist can also be set in the policy. When the terminal's identity document (ID) appears on the whitelist, or the terminal's ID does not appear on the blacklist, it can be determined that the terminal has access rights. When the terminal's ID does not appear on the whitelist, or the terminal's ID appears on the blacklist, it can be determined that the terminal does not have access rights. For example: a terminal crawls product information from Taobao and JD servers many times (for example: at the beginning of the epidemic, many people used crawler technology to read all the mask products on Taobao and JD. Once the mask products are in stock, the program will automatically place an order), occupying a large amount of resources in Taobao and JD servers. Therefore, the terminal's ID can be set in the policy's blacklist to prevent the terminal from continuing to crawl resources from other servers.

[0098] Similar to determining whether the target application has access rights, when determining whether the IP corresponding to the request is allowed to access, a whitelist or blacklist can also be set in the policy. When the IP corresponding to the request appears on the whitelist, or the IP corresponding to the request does not appear on the blacklist, it can be determined that the IP corresponding to the request is allowed to access. When the IP corresponding to the request does not appear on the whitelist, or the IP corresponding to the request appears on the blacklist, it can be determined that the IP corresponding to the request is not allowed to access. For example: the IP corresponding to the request is confidential and the public is not allowed to access it at will.

[0099] Similar to determining whether the target application has access rights, when determining whether the time of the request is within the allowed access time, the allowed access time or the disallowed access time can be set in the policy. And when determining whether the current location of the terminal is within the allowed access area, the allowed access area or the disallowed access area can be set in the policy. For example: the allowed access time for game requests is between 7pm and 9pm, so as to control the game time of children. The allowed access area is within a certain workplace, so as to control certain work content from being leaked.

[0100] When determining the time when a request is issued, the time when the request is intercepted can be used as the time when the request is issued. Since the zero-trust application intercepts the request immediately after it is issued, the difference between the time when the request is intercepted and the actual time when the request is issued is at the millisecond level, which will not affect the accuracy of the time judgment. Then, it is determined whether the time when the request is issued is within the allowed access time.

[0101] When determining the current location of the terminal, the current location of the terminal can be determined by the global positioning system in the terminal. Alternatively, a preset request can be sent to a preset server through the terminal to obtain the current location of the terminal from the feedback information of the preset server. The preset server has the authority to obtain the terminal location. For example: open an application such as Baidu in the terminal that has the authority to obtain the terminal location, and the current location of the terminal is displayed in the application. Therefore, a preset request can be sent to a preset server through the terminal to obtain the current location of the terminal from the feedback information of the preset server. Then determine whether the current location of the terminal is within the allowed access area.

[0102] In this way, it is possible to determine whether the request can be sent by comprehensively considering multiple aspects such as the target application, the terminal itself, the time when the request is sent, the current location of the terminal, etc., thereby improving the accuracy of multi-application access control.

[0103] Figure 5 This is a flowchart of multi-application access control in the embodiment of the present application, see Figure 5As shown, in the terminal, when application A generates request a, the zero-trust application intercepts request a. At this time, the zero-trust application does not know that the application A is the one that issued request a. The zero-trust application needs to first determine that port 30 is used when issuing request a, and then determine that port 30 corresponds to application A in the mapping relationship between application and port. At this time, the zero-trust application can know that the application A is the one that issued request a. Next, find out whether application A is allowed to access in the package name access of the preset policy, find out whether the terminal where application A is located is allowed to access in the ID access, and find out whether the IP corresponding to the request is allowed to access in the IP access. When it is determined that access is allowed after comprehensive evaluation, request a is forwarded to the server corresponding to the request through the zero-trust server. When it is determined that access is not allowed after comprehensive evaluation, request a is intercepted in the zero-trust server, and the zero-trust server no longer forwards the request to the server corresponding to the request. Application B, application C, and application D are similar to application A and will not be repeated here.

[0104] From the above content, it can be seen that whether the request can be issued is determined by comprehensively considering multiple aspects such as whether the target application has access rights, whether the terminal itself has access rights, whether the time of request issuance is within the allowed access time, and whether the current location of the terminal is within the allowed access area, thereby improving the accuracy of multi-application access control.

[0105] Furthermore, when determining whether a target application has access rights, in addition to using the blacklist and whitelist in the preset policy, a machine learning model can also be used to determine whether the target application has access rights.

[0106] Figure 6 This is a flowchart of determining whether the target application has access rights in the embodiment of the present application. Figure 6 As shown, before S24, it may also include:

[0107] S251: Input feature information of the target application into the machine learning model to obtain the credibility of the feature information output by the machine learning model.

[0108] The machine learning model here is a trained model. When training the model, multiple applications with known access policies are selected, and the credibility is set for each of the multiple applications. Then, each application and its corresponding credibility are input into the model for training to obtain a trained model, namely a machine learning model.

[0109] Here, the credibility can be 0 or 1. 0 means that the corresponding application does not have access rights. 1 means that the corresponding application has access rights. Alternatively, the credibility can be any value between 0-1, 0-10, or 0-100. The larger the credibility value, the higher the possibility that the corresponding application has access rights. The smaller the credibility value, the lower the possibility that the corresponding application has access rights.

[0110] When it is necessary to determine whether the target application has access rights, the characteristic information of the target application (name, icon, configuration directory, source code, etc.) is input into the machine learning model, and the machine learning model will output a corresponding credibility of the target application.

[0111] S252: Determine whether the target application has access rights according to the credibility.

[0112] When the value of the credibility corresponding to the target application is 1 or greater than the preset value, it is determined that the target application has access rights. When the value of the credibility corresponding to the target application is 0 or less than or equal to the preset value, it is determined that the target application does not have access rights. Based on whether the target application has access rights, it is determined whether to forward the request sent by the target application to the corresponding target server.

[0113] From the above content, it can be seen that by using a machine learning model to determine whether a target application has access rights, applications that are not covered by the preset policy can also be taken into account, thereby improving the coverage of multi-application access control.

[0114] Based on the same inventive concept, as an implementation of the above method, an embodiment of the present application also provides a multi-application access control device. Figure 7 The structure of the multi-application access control device in the embodiment of the present application is shown as follows: Figure 1 , see Figure 7 As shown, the device may include:

[0115] The interception module 701 is used to intercept the request sent by the terminal.

[0116] The port determination module 702 is used to determine the target port used by the terminal when sending the request.

[0117] The application determination module 703 is used to determine the target application that uses the target port to send the request according to the mapping relationship between the application and the port in the terminal.

[0118] The sending module 704 is used to forward the request to the corresponding server when the target application has access rights.

[0119] Furthermore, as a Figure 7As a refinement and expansion of the device shown, an embodiment of the present application also provides a multi-application access control device. Figure 8 The structure of the multi-application access control device in the embodiment of the present application is shown as follows: Figure 2 , see Figure 8 As shown, the device may include:

[0120] The establishing module 801 is used to allocate a port to the application in the terminal when the application in the terminal initiates a network request; and to establish a mapping relationship between the application in the terminal and the port allocated to the application based on the application in the terminal.

[0121] The interception module 802 is used to intercept the request sent by the terminal.

[0122] The interception module 802 includes:

[0123] The policy acquisition unit 8021 acquires a preset access control policy, wherein the preset access control policy includes a name of an application to be allowed or a name of an application not to be allowed.

[0124] The application acquisition unit 8022 is used to acquire the names of all applications installed in the terminal.

[0125] The interception unit 8023 is used to forward the request to the interception server when it is determined that no permitted application is installed in the terminal, or all the applications installed in the terminal are not permitted applications.

[0126] When it is determined that the terminal has an allowed application installed, or not all the applications installed in the terminal are not allowed applications, the process proceeds to the port determination module 803 .

[0127] The port determination module 803 includes:

[0128] The mapping relationship acquisition unit 8031 ​​is used to acquire the latest mapping relationship between the application and the port from the terminal, where the port is allocated by the terminal to the request when the request is sent.

[0129] The port determination unit 8032 is used to determine the target application corresponding to the target port according to the latest mapping relationship between the application and the port.

[0130] The port determination unit 8032 is specifically used to obtain the mapping relationship between the application and the port from the terminal; obtain the version number of the application in the mapping relationship; if the version number is the latest, use the obtained mapping relationship between the application and the port as the current latest mapping relationship between the application and the port.

[0131] In essence, the mapping relationship between the application and the port is characterized by the mapping relationship between the application package name and the port.

[0132] The port determination unit 8032 is specifically used to extract the updated correspondence between the process number and the port from the system file of the terminal, where the process number is allocated by the system of the terminal to the application when the application runs in the terminal, and the port is allocated by the system of the terminal to the application when the application initiates a network request; based on the process number, the corresponding application package name is queried, and the process number in the correspondence is converted into an application package name to obtain a mapping relationship between the application package name and the port, and the application package name can uniquely represent the application.

[0133] The application determination module 804 is used to determine the target application that uses the target port to send the request according to the mapping relationship between the application and the port in the terminal.

[0134] The authentication module 805 is used to input the characteristic information of the target application into the machine learning model to obtain the credibility of the characteristic information output by the machine learning model; and determine whether the target application has access rights based on the credibility.

[0135] The time and location determination module 806 is used to use the time when the request is intercepted as the time when the request is sent; or, determine the current location of the terminal through the global positioning system in the terminal; or, send a preset request to a preset server through the terminal, and obtain the current location of the terminal from the feedback information of the preset server, and the preset server has the authority to obtain the location of the terminal.

[0136] The sending module 807 is specifically configured to send the request to a corresponding server when the target application has access rights and satisfies at least one of the following conditions;

[0137] The conditions include: the terminal has access rights, the IP corresponding to the request allows access, the request is sent within the allowed access time, and the current location of the terminal is within the allowed access area.

[0138] It should be noted here that the description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0139] Based on the same inventive concept, an embodiment of the present application also provides an electronic device. Fig. 9 This is a schematic diagram of the structure of the electronic device in the embodiment of the present application, see Fig. 9As shown, the electronic device may include: a processor 901, a memory 902, and a bus 903; wherein the processor 901 and the memory 902 communicate with each other via the bus 903; the processor 901 is used to call program instructions in the memory 902 to execute the methods in one or more of the above embodiments.

[0140] It should be noted that the description of the above electronic device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the electronic device embodiment of this application, please refer to the description of the method embodiment of this application for understanding.

[0141] Based on the same inventive concept, an embodiment of the present application further provides a computer-readable storage medium, which may include: a stored program; wherein, when the program is running, the device where the storage medium is located is controlled to execute the method in one or more of the above embodiments.

[0142] It should be noted here that the description of the above storage medium embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the storage medium embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0143] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A multi-application access control method, characterized in that: The method comprises: Intercept requests from the terminal; Determining a target port used by the terminal when issuing the request; Determine the target application that uses the target port to send the request according to the mapping relationship between the application and the port in the terminal; When the target application has access rights, forwarding the request to a corresponding server; Wherein, determining the target application corresponding to the target port according to the mapping relationship between the application and the port in the terminal includes: Acquire the latest mapping relationship between the application and the port from the terminal, where the port is allocated by the terminal for the request when the request is issued; Determine the target application corresponding to the target port according to the latest mapping relationship between the current application and the port; The mapping relationship between the application and the port is characterized by a mapping relationship between an application package name and a port, and the obtaining the latest mapping relationship between the application and the port from the terminal includes: Extracting the correspondence between the updated process number and the port from the system file of the terminal, wherein the process number is allocated by the system of the terminal to the application when the application runs in the terminal, and the port is allocated by the system of the terminal to the application when the application initiates a network request; The corresponding application package name is queried based on the process number, and the process number in the corresponding relationship is converted into an application package name to obtain a mapping relationship between the application package name and the port. The application package name can uniquely represent the application.

2. The method according to claim 1, characterized in that Before determining the target application that uses the target port to send the request according to the mapping relationship between the application and the port in the terminal, the method further includes: When an application in the terminal initiates a network request, allocating a port to the application; Based on the application in the terminal and the port allocated to the application, a mapping relationship between the application in the terminal and the port is established.

3. The method according to claim 1, characterized in that Before determining the target port used by the terminal when issuing the request, the method further includes: Obtaining a preset access control policy, wherein the preset access control policy includes a name of an application that is allowed to be accessed or a name of an application that is not allowed to be accessed; Obtaining the names of all applications installed in the terminal; When it is determined that no permitted application is installed in the terminal, or all the applications installed in the terminal are not permitted applications, forwarding the request to an interception server; When it is determined that the terminal has an allowed application installed, or that not all the applications installed in the terminal are not allowed applications, the step of determining the target port used by the terminal when sending the request is performed.

4. The method according to claim 1, characterized in that: When the target application has access rights, forwarding the request to a corresponding server includes: When the target application has access rights and satisfies at least one of the following conditions, sending the request to the corresponding server; The conditions include: the terminal has access rights, the Internet protocol corresponding to the request allows access, the request is sent within the allowed access time, and the current location of the terminal is within the allowed access area.

5. The method according to claim 4, characterized in that Before sending the request to the corresponding server when the target application has access rights and satisfies at least one of the following conditions, the method further includes: The time when the request is intercepted is regarded as the time when the request is issued; or, Determine the current location of the terminal by using a global positioning system in the terminal; or, The terminal sends a preset request to a preset server, and obtains the current location of the terminal from feedback information of the preset server, and the preset server has the authority to obtain the location of the terminal.

6. The method according to claim 1, characterized in that Before forwarding the request to the corresponding server when the target application has access rights, the method further includes: Inputting the characteristic information of the target application into a machine learning model to obtain the credibility of the characteristic information output by the machine learning model; Determine whether the target application has access rights according to the credibility.

7. A multi-application access control device, characterized in that: The device comprises: An interception module, used to intercept requests sent by the terminal; A port determination module, used to determine a target port used by the terminal when sending the request; An application determination module, used to determine the target application that uses the target port to send the request according to the mapping relationship between the application and the port in the terminal; A sending module, used for forwarding the request to a corresponding server when the target application has access rights; The port determination module includes: A mapping relationship acquisition unit, used to acquire the latest mapping relationship between the application and the port from the terminal, where the port is allocated by the terminal to the request when the request is issued; A port determination unit, configured to determine the target application corresponding to the target port according to the latest mapping relationship between the application and the port; The port determination unit is specifically used to extract the updated correspondence between the process number and the port from the system file of the terminal, wherein the process number is allocated by the system of the terminal to the application when the application runs in the terminal, and the port is allocated by the system of the terminal to the application when the application initiates a network request; based on the process number, the corresponding application package name is queried, and the process number in the correspondence is converted into an application package name to obtain a mapping relationship between the application package name and the port, and the application package name can uniquely represent the application.

8. An electronic device, characterized in that: include: Processor, memory, bus; Wherein, the processor and the memory communicate with each other through the bus; The processor is configured to call program instructions in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: include: stored programs; Wherein, when the program is running, the device where the storage medium is located is controlled to execute the method as claimed in any one of claims 1 to 6.

Images