Access request processing method, data upload method and device

Abstract

The present invention discloses a method for processing access requests, a method for uploading data, and a device, and relates to the field of computer technology. A specific implementation of the method includes: receiving environmental assessment data of a terminal; determining the environmental perception score of the terminal according to the environmental assessment data; receiving an access request for a business system sent by the terminal; obtaining a preset access score of the business system, and determining whether the environmental perception score of the terminal is greater than or equal to the preset access score of the business system to obtain a comparison result; and determining whether to allow the terminal to access the business system according to the comparison result. This implementation can dynamically adjust the access control authority of the terminal and improve the security protection level of the system.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an access request processing method, a data uploading method and a device. Background Art

[0002] Many modern enterprises have realized information-based office. In the process of information-based office, employees' daily work cannot be separated from the support of various business systems. With the increase in the number of enterprise business systems and the increasing complexity of employee division of labor, the security requirements of enterprise data are getting higher and higher. The rapid construction of cloud computing and big data centers has also prompted more enterprises to centrally build and manage the resources of various business systems. Users need to access various business systems through terminals. The access rights to various business systems are usually determined only by the identity of the user, and the access rights are fixed, and the system security protection level is low. Summary of the invention

[0003] In view of this, an embodiment of the present invention provides a method and device for processing an access request, which performs an environmental assessment on a terminal, can dynamically adjust the access control authority of the terminal, and improve the security protection level of the system.

[0004] In a first aspect, an embodiment of the present invention provides a method for processing an access request, which is applied to a server, and includes:

[0005] Environmental assessment data of receiving terminals;

[0006] Determining an environmental perception score of the terminal according to the environmental assessment data;

[0007] Receiving an access request for a business system sent by the terminal;

[0008] Obtaining a preset access score of the business system, and determining whether the environment perception score of the terminal is greater than or equal to the preset access score of the business system, so as to obtain a comparison result;

[0009] According to the comparison result, it is determined whether to allow the terminal to access the service system.

[0010] Optionally, obtaining a preset access score of the business system includes:

[0011] determining a terminal source of the terminal;

[0012] Determine a preset access score of the business system for the terminal source.

[0013] Optionally, the terminal source of the terminal is an office device:

[0014] The determining of a preset access score of the business system for the terminal source includes:

[0015] Determine a first access score and a second access score of the business system for the office device, wherein the first access score is greater than the second access score;

[0016] The determining, according to the comparison result, whether to allow the terminal to access the business system includes:

[0017] If the comparison result indicates that the environment perception score of the terminal is greater than or equal to the first access score, allowing the terminal to access the service system;

[0018] If the comparison result indicates that the environment perception score of the terminal is between the second access score and the first access score, allowing the terminal to access the business system through the sandbox;

[0019] If the comparison result indicates that the environment perception score of the terminal is less than or equal to the second access score, the terminal is prohibited from accessing the business system, and an environment repair message is sent to the terminal.

[0020] Optionally, the terminal source of the terminal is a personal device:

[0021] The determining of a preset access score of the business system for the terminal source includes:

[0022] determining a third access score of the business system for the personal device;

[0023] The determining, according to the comparison result, whether to allow the terminal to access the business system includes:

[0024] If the comparison result indicates that the environment perception score of the terminal is greater than or equal to the third access score, allowing the terminal to access the business system through the sandbox;

[0025] If the comparison result indicates that the environment perception score of the terminal is less than the third access score, the terminal is prohibited from accessing the business system.

[0026] Optionally, obtaining a preset access score of the business system includes:

[0027] Determining the user identity corresponding to the access request;

[0028] A preset access score of the business system for the user identity is determined.

[0029] Optionally, the user identity is an employee user:

[0030] The determining of a preset access score of the business system for the user identity includes:

[0031] determining a fourth access score of the business system for the employee user;

[0032] The determining, according to the comparison result, whether to allow the terminal to access the business system includes:

[0033] If the comparison result indicates that the environment perception score of the terminal is greater than or equal to the fourth access score, allowing the terminal to access the business system;

[0034] If the comparison result indicates that the environment perception score of the terminal is less than the fourth access score, the terminal is prohibited from accessing the service system.

[0035] Optionally, the user identity is a third-party user:

[0036] The determining of a preset access score of the business system for the user identity includes:

[0037] determining a fifth access score of the business system for the third-party user;

[0038] The determining, according to the comparison result, whether to allow the terminal to access the business system includes:

[0039] If the comparison result indicates that the environment perception score of the terminal is greater than or equal to the fifth access score, allowing the terminal to access the business system through the sandbox;

[0040] If the comparison result indicates that the environment perception score of the terminal is less than the fifth access score, the terminal is prohibited from accessing the business system.

[0041] In a second aspect, an embodiment of the present invention provides a data uploading method, which is applied to a terminal and includes:

[0042] Obtain environmental assessment data of the terminal;

[0043] The environmental assessment data is uploaded to a server.

[0044] Optionally, after uploading the environmental assessment data to the server, the method further includes:

[0045] Receiving an environment repair message from the server;

[0046] Performing environment repair processing on the terminal according to the environment repair message.

[0047] Optionally, the environmental assessment data includes at least one of the following: hardware data, operating system data, security basic software data and application software data.

[0048] In a third aspect, an embodiment of the present invention provides a device for processing an access request, which is applied to a server, and includes:

[0049] A data receiving module, used for receiving environmental assessment data of a terminal;

[0050] A score determination module, used to determine the environment perception score of the terminal according to the environment assessment data;

[0051] A request receiving module, used to receive an access request for a business system sent by the terminal;

[0052] A comparison module, used to obtain a preset access score of the business system, and determine whether the environment perception score of the terminal is greater than or equal to the preset access score of the business system, so as to obtain a comparison result;

[0053] A processing module is used to determine whether to allow the terminal to access the business system according to the comparison result.

[0054] In a fourth aspect, an embodiment of the present invention provides a data uploading device, applied to a terminal, comprising:

[0055] A data acquisition module, used to acquire environmental assessment data of the terminal;

[0056] The data uploading module is used to upload the environmental assessment data to the server.

[0057] In a fifth aspect, an embodiment of the present invention provides an electronic device, including:

[0058] one or more processors;

[0059] a storage device for storing one or more programs,

[0060] When the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any of the above embodiments.

[0061] In a sixth aspect, an embodiment of the present invention provides a computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in any of the above embodiments.

[0062] In a seventh aspect, an embodiment of the present invention provides a computer program product, including a computer program, which implements the method described in any of the above embodiments when the program is executed by a processor.

[0063] An embodiment of the above invention has the following advantages or beneficial effects: according to the environmental assessment data of the terminal, the environmental perception score of the terminal is determined. The environmental perception score is used to characterize the security level of the terminal accessing the business system. According to the needs, the access score can be preset for each business system, thereby limiting the minimum environmental perception score of the terminal that can access the business system, so that terminals with a greater risk level cannot access the business system. Therefore, the embodiment of the present invention can ensure the security of the business system in the process of providing services to the outside.

[0064] In addition, as the terminal runs, the terminal's environmental assessment data is constantly changing, so that the terminal's environmental perception score is also constantly changing, and ultimately the terminal's access control authority is also constantly changing. Therefore, the embodiment of the present invention can also dynamically adjust the terminal's access control authority to improve the system security protection level.

[0065] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0067] Figure 1 It is a flowchart of a method for processing an access request provided by the first embodiment of the present invention;

[0068] Figure 2 is a flowchart of a method for processing an access request provided by a second embodiment of the present invention;

[0069] Figure 3 is a flow chart of a data uploading method provided by the third embodiment of the present invention;

[0070] Figure 4 This is a schematic diagram of a system architecture for providing external services for a business system provided by a fourth embodiment of the present invention;

[0071] Figure 5 is a schematic diagram of a terminal operating environment provided by a fourth embodiment of the present invention;

[0072] Figure 6 This is a schematic diagram of a network environment structure in which a business system provides services externally, provided in a fourth embodiment of the present invention;

[0073] Figure 7 is a schematic diagram of a method for setting dynamic access rights for a business system provided by a fourth embodiment of the present invention;

[0074] Figure 8 is a schematic diagram of a method for setting dynamic access rights for office equipment provided by a fourth embodiment of the present invention;

[0075] Fig. 9 is a schematic diagram of a method for setting dynamic access rights for terminal sources provided by a fourth embodiment of the present invention;

[0076] Fig.10 is a schematic diagram of a method for setting dynamic access rights for user identities provided by a fourth embodiment of the present invention;

[0077] Fig.11 is a schematic diagram of the structure of an access request processing device provided by an embodiment of the present invention;

[0078] Fig.12 is a structural schematic diagram of a data uploading device provided by an embodiment of the present invention;

[0079] Fig.13 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0080] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0081] The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0082] Figure 1 FIG. 1 is a flow chart of a method for processing an access request provided by the first embodiment of the present invention. Figure 1 As shown, the method includes:

[0083] Step 101: Receive environmental assessment data from a terminal.

[0084] Environmental assessment data refers to data related to the security of external access by the terminal. Environmental assessment data may include: hardware data, operating system data, security basic software data, and application software data. Specifically, operating system data may include: operating system version number, operating system patch upgrade status, etc. Security basic software data may include: virus database update status, antivirus status records, etc.

[0085] Step 102: Determine the environment perception score of the terminal according to the environment assessment data.

[0086] The environmental perception score is used to characterize the security level of the terminal's access to external business systems. The form of the environmental perception score can be set according to specific needs. The environmental perception score can be expressed as: high, medium, and low. The environmental perception score can also be expressed in percentages, ten points, etc.

[0087] Step 103: Receive an access request for the business system sent by the terminal.

[0088] Step 104: Obtain a preset access score of the business system, and determine whether the environment perception score of the terminal is greater than or equal to the preset access score of the business system to obtain a comparison result.

[0089] Different preset access scores can be set for each business system based on its requirements for privacy, security, etc., thereby limiting the minimum environmental perception score of terminals that can access the business system, so that terminals with a higher risk level cannot access the business system.

[0090] Step 105: Determine whether to allow the terminal to access the business system based on the comparison result.

[0091] If the comparison result indicates that the terminal's environment perception score is greater than or equal to the preset access score of the business system, the terminal is allowed to access the business system. If the comparison result indicates that the terminal's environment perception score is less than the preset access score of the business system, the terminal is prohibited from accessing the business system.

[0092] In an embodiment of the present invention, the environment perception score of the terminal is determined based on the environment assessment data of the terminal. The environment perception score is used to characterize the security level of the environment accessing the external business system. According to the needs, the access score can be preset for each business system, thereby limiting the minimum environment perception score of the terminal that can access the business system, so that terminals with a greater risk level cannot access the business system. Therefore, the embodiment of the present invention can ensure the security of the business system in the process of providing services to the outside.

[0093] In addition, as the terminal runs, the terminal's environmental assessment data is constantly changing, so that the terminal's environmental perception score is also constantly changing, and ultimately the terminal's access control authority is also constantly changing. Therefore, the embodiment of the present invention can also dynamically adjust the terminal's access control authority to improve the system security protection level.

[0094] Figure 2 FIG. 1 is a flow chart of a method for processing an access request provided by a second embodiment of the present invention. Figure 2 As shown, the method includes:

[0095] Step 201: Receive terminal environment assessment data.

[0096] Step 202: Determine the environment perception score of the terminal according to the environment assessment data.

[0097] Step 203: Receive an access request for the business system sent by the terminal.

[0098] Step 204: Determine the terminal source of the terminal and / or the user identity corresponding to the access request, and determine a preset access score of the business system for the terminal source and / or the user identity.

[0099] Terminal sources may include: office equipment, personal equipment, computers, mobile phones, etc. Office equipment refers to equipment within the system or company. Personal equipment refers to other equipment that is not office equipment. For the same business system, different preset access scores can be set for office equipment and personal equipment, so that the terminal's access to the business system can be controlled more flexibly. Specifically, since office equipment comes from the system or company's internal equipment, the reliability of office equipment is usually higher than that of personal equipment. Therefore, for the same business system, the preset access score for office equipment can be lower than the preset access score for personal equipment.

[0100] User identities may include: employee users, third-party users, common users, administrator users, etc. Employee users are users from the system or the company. Third-party users are users who are not employee users. For the same business system, different preset access scores may be set for employee users and third-party users, so that the terminal's access to the business system may be more flexibly controlled. Specifically, for the same business system, the preset access score for employee users may be lower than the preset access score for third-party users.

[0101] You can also set different preset access scores for business systems based on the terminal source and user identity. For example, for the same business system, you can set multiple preset access scores for office devices and employee users, office devices and third-party users, personal devices and third-party users, personal devices and administrator users, etc.

[0102] Step 205: Determine whether the environment perception score of the terminal is greater than or equal to the preset access score of the business system to obtain a comparison result.

[0103] Step 206: Determine whether to allow the terminal to access the business system based on the comparison result.

[0104] In an embodiment of the present invention, multiple different preset access scores can be set for the same business system according to the terminal source of the terminal and / or the user identity corresponding to the access request, so that the terminal's access rights to the business system can be flexibly controlled according to different business scenarios and needs.

[0105] In one embodiment of the present invention, the terminal source of the terminal is office equipment: determining the preset access score of the business system for the terminal source includes: determining a first access score and a second access score of the business system for the office equipment, the first access score being greater than the second access score; determining whether to allow the terminal to access the business system based on the comparison result includes: allowing the terminal to access the business system if the comparison result indicates that the environment perception score of the terminal is greater than or equal to the first access score; allowing the terminal to access the business system through a sandbox if the comparison result indicates that the environment perception score of the terminal is between the second access score and the first access score; prohibiting the terminal from accessing the business system if the comparison result indicates that the environment perception score of the terminal is less than or equal to the second access score, and sending an environment repair message to the terminal.

[0106] For terminals whose source is office equipment, the terminal's environmental perception score is used to limit three situations in which the terminal accesses the business system, thereby better ensuring the security of the business system during external access.

[0107] In one embodiment of the present invention, the terminal source of the terminal is a personal device: determining the preset access score of the business system for the terminal source includes: determining a third access score of the business system for personal devices; determining whether to allow the terminal to access the business system based on the comparison result includes: allowing the terminal to access the business system through a sandbox when the comparison result indicates that the environmental perception score of the terminal is greater than or equal to the third access score; prohibiting the terminal from accessing the business system when the comparison result indicates that the environmental perception score of the terminal is less than the third access score.

[0108] For terminals whose source is personal devices, the terminal's environmental perception score is used to limit two situations in which the terminal accesses the business system, thereby better ensuring the security of the business system during external access.

[0109] In one embodiment of the present invention, the user identity is an employee user: determining the preset access score of the business system for the user identity includes: determining a fourth access score of the business system for the employee user; determining whether to allow the terminal to access the business system based on the comparison result includes: allowing the terminal to access the business system if the comparison result indicates that the environmental perception score of the terminal is greater than or equal to the fourth access score; prohibiting the terminal from accessing the business system if the comparison result indicates that the environmental perception score of the terminal is less than the fourth access score.

[0110] For users whose user identity is employee users, the preset access scores set by the business system for employee users are used to limit two situations in which employee users access the business system, thereby better ensuring the security of the business system during external access.

[0111] In one embodiment of the present invention, the user identity is a third-party user: determining the preset access score of the business system for the user identity includes: determining a fifth access score of the business system for the third-party user; determining whether to allow the terminal to access the business system based on the comparison result includes: allowing the terminal to access the business system through a sandbox when the comparison result indicates that the environmental perception score of the terminal is greater than or equal to the fifth access score; prohibiting the terminal from accessing the business system when the comparison result indicates that the environmental perception score of the terminal is less than the fifth access score.

[0112] For users whose user identity is a third-party user, the preset access score set by the business system for third-party users is used to limit the two situations in which employee users access the business system, thereby better ensuring the security of the business system during external access.

[0113] Figure 3 is a flow chart of a data uploading method provided by the third embodiment of the present invention, such as Figure 3 As shown, the method includes:

[0114] Step 301: Obtain environmental assessment data of the terminal.

[0115] The method is applied to the terminal. The environmental assessment data is relevant data that affects the security of the terminal's external access. The environmental assessment data may include: hardware data, operating system data, security basic software data and application software data, etc. Specifically, the operating system data may include: operating system version number, operating system patch upgrade status, etc. The security basic software data may include: virus database update status, antivirus status records, etc.

[0116] Step 302: Upload the environmental assessment data to a server.

[0117] The server determines the environment perception score of the terminal based on the environment assessment data of the terminal. The environment perception score is used to characterize the security level of the environment accessing the external business system. The access score can be preset for each business system according to the needs, thereby limiting the minimum environment perception score of the terminal that can access the business system, so that terminals with a greater risk level cannot access the business system. Therefore, the embodiment of the present invention can ensure the security of the business system in the process of providing services to the outside world.

[0118] In addition, as the terminal runs, the terminal's environmental assessment data is constantly changing, so that the terminal's environmental perception score is also constantly changing, and ultimately the terminal's access control authority is also constantly changing. Therefore, the embodiment of the present invention can also dynamically adjust the terminal's access control authority to improve the system security protection level.

[0119] After uploading the environmental assessment data to the server, receiving an environmental restoration message from the server; and performing environmental restoration processing on the terminal according to the environmental restoration message.

[0120] If the terminal's environmental perception score is low, there are factors in the terminal that affect the security of the terminal's access to external business systems. The server sends an environmental repair message to the terminal. The environmental repair message may include: modifying the user login password, upgrading the virus database, installing system patches, etc. The terminal repairs the environment based on the environmental repair message to enhance the stability and security of the terminal itself.

[0121] Figure 4 This is a schematic diagram of a system architecture for providing services to external parties in a business system provided by the fourth embodiment of the present invention. Figure 4 As shown, in desktop terminals, environmental assessment data of terminals is obtained through security clients, etc., and secure access is achieved through security clients, zero-trust security agents, and devices. In mobile terminals, environmental assessment data is obtained through security clients, and secure access is achieved through security SDKs, VMD, etc. In the cloud service platform, application access is received through a secure access agent, and the access control engine is used to determine whether the terminal can access resources. The trust assessment engine is used to determine the trust rating of the terminal or user based on the identity authentication results sent by the security event management and control platform. The security event management and control platform receives security logs from terminals, cloud work platforms, and resources, and manages vulnerability intelligence data based on security logs.

[0122] The system takes identity as the cornerstone, assigns digital identity to users and devices, builds access subjects for digital identity, and sets minimum permissions for access subjects. Full-scenario business hiding, full-traffic encryption proxy, and full-business mandatory authorization. Identity-based trust assessment, environment-based risk determination, and behavior-based anomaly discovery. Attribute-based access control baseline, hierarchical access based on trust level, and dynamic permissions based on risk perception.

[0123] Figure 5 Schematic diagram of a terminal operating environment provided by the fourth embodiment of the present invention. Figure 5As shown in the figure, the security client in the terminal monitors the terminal's security operation in real time, and sends it to the server-side security operation management platform in real time as a trust evaluation indicator; the terminal provides virtualized desktops (sandboxes, virtual machines) and cloud desktops, VMI and other security operation platforms to effectively isolate sensitive data; the terminal environment security operation baseline must include hardware, operating system, security basic software, application software and other information; the terminal performs terminal security reinforcement through peripheral management, virus detection, vulnerability repair and other methods; the terminal uses watermarks, DLP and other tools to protect data security; terminal behavior is monitored through EDR, terminal auditing and other means; user identity authentication is performed through face recognition, single sign-on and other means;

[0124] In addition, the terminal also provides a network security browsing function, which comprehensively improves the desktop security access level through security functions such as browser interaction data, cache data security reinforcement storage, process security plug-in protection, user behavior security control, unified access policy management, unified operation behavior monitoring, and automatic switching of multiple browser kernels.

[0125] Figure 6 Schematic diagram of a network environment structure in which a business system provides services to the outside world, provided in the fourth embodiment of the present invention. Figure 6 As shown, the PC side establishes a communication layer encrypted tunnel through the zero-trust security gateway to ensure the communication security between the terminal and the background network; the mobile terminal establishes a communication layer encrypted tunnel and transaction message encryption through VMI or security SDK to ensure the communication security between the terminal and the background network; the security incident management and control platform is linked with the security operation big data platform to timely discover risks and take isolation measures; establish a secure access service for the business system, unify the access entrance, and uniformly perform security management and auditing of the entrance traffic; the security access control platform and security client log information are reported to the security incident management and control platform in real time, and the network equipment is linked through the security incident management and control platform for timely automatic disposal.

[0126] An embodiment of the present invention also provides a method for processing access requests. The method can dynamically set access rights for a business system. In the process of network access and resource access by a user or device, the trust level assigned to the device or user can be dynamically inferred through data aggregation from multiple data sources. The trust level is in a dynamic change process, and accurately reflects the real-time permission status of the user or device through real-time data processing, analysis, and judgment. Each accessed or defined resource needs to define the minimum trust level required for access. When a user or device accesses a resource, the current maximum trust level is obtained through dynamic analysis. When the maximum trust level is greater than or equal to the minimum trust level required for the resource, the resource is allowed to be accessed. Any form of privileged users, privileged devices, and privileged applications are prohibited, and permission control is required by defining trust levels.

[0127] Figure 7 FIG. 4 is a schematic diagram of a method for setting dynamic access rights of a business system provided by the fourth embodiment of the present invention. Figure 7 As shown, first determine multiple environmental risk levels of the terminal based on the terminal's environmental assessment data. For example, determine the operating environment security level based on the sandbox environment data, determine the operating system risk level based on the win7 operating system data, and determine the user type risk level based on the partner company personnel data. Then determine the terminal's environmental perception score based on multiple environmental risk levels. Finally, determine the business system accessible to the terminal based on the terminal's environmental perception score. For example, when the environmental perception score is 80, close the mailbox access permission, close the OA access permission, etc.

[0128] The access request processing method provided by the embodiment of the present invention can be applied to various application scenarios of different business systems and different terminals. Figure 8 FIG. 4 is a schematic diagram of a method for setting dynamic access rights for office equipment provided by the fourth embodiment of the present invention. Figure 8 As shown in the figure, different business systems can be accessed according to the terminal environment perception score (access to a business system within a certain score range can be adjusted). When the terminal environment perception score is 100 points, all business systems can be accessed; when the terminal environment perception score is between 80 and 100 points, other business systems except OA can be accessed; when the terminal environment perception score is between 60 and 80, only EIP can be accessed; when the terminal environment perception score is less than 60 points, the terminal is not allowed to access the intranet, and the terminal environment needs to be repaired.

[0129] Fig. 9 FIG. 4 is a schematic diagram of a method for setting dynamic access rights for terminal sources provided by the fourth embodiment of the present invention. Fig. 9 As shown, mobile office users can access the business system in different ways according to the terminal environment perception score; when the terminal environment perception is that of an office computer and meets the score for accessibility to the business system, the business system can be accessed directly on the terminal; when the terminal environment perception is that of an office computer and the score is lower than the score for terminal access to the business system but higher than the score for accessibility to the sandbox, the business system can be accessed through the sandbox; when the terminal environment perception is that of a personal computer and the score is higher than the score for accessibility to the sandbox, the user can access the business system through the sandbox.

[0130] Fig.10 FIG. 4 is a schematic diagram of a method for setting dynamic access rights for user identities provided by the fourth embodiment of the present invention. Fig.10As shown in the figure, the same mobile office terminal uses different methods to access different business systems according to different user identities. Bank employees can directly access business systems through the terminal when accessing through mobile office; third-party users need to access business systems through sandboxes when accessing through mobile office, and can only access business systems in development and testing environments.

[0131] Fig.11 is a schematic diagram of a structure of an access request processing device provided by an embodiment of the present invention, the device is applied to a server side, such as Fig.11 As shown, the device comprises:

[0132] A data receiving module 1101 is used to receive environmental assessment data of a terminal;

[0133] A score determination module 1102, configured to determine an environment perception score of the terminal according to the environment assessment data;

[0134] The request receiving module 1103 is used to receive an access request for a business system sent by the terminal;

[0135] The comparison module 1104 is used to obtain a preset access score of the business system and determine whether the environment perception score of the terminal is greater than or equal to the preset access score of the business system to obtain a comparison result;

[0136] The processing module 1105 is used to determine whether to allow the terminal to access the business system according to the comparison result.

[0137] Optionally, the comparison module 1104 is specifically used for:

[0138] determining a terminal source of the terminal;

[0139] Determine a preset access score of the business system for the terminal source.

[0140] Optionally, the terminal source of the terminal is an office device:

[0141] The comparison module 1104 is specifically used for:

[0142] Determine a first access score and a second access score of the business system for the office device, wherein the first access score is greater than the second access score;

[0143] The processing module 1105 is specifically used for:

[0144] If the comparison result indicates that the environment perception score of the terminal is greater than or equal to the first access score, allowing the terminal to access the service system;

[0145] If the comparison result indicates that the environment perception score of the terminal is between the second access score and the first access score, allowing the terminal to access the business system through the sandbox;

[0146] If the comparison result indicates that the environment perception score of the terminal is less than or equal to the second access score, the terminal is prohibited from accessing the business system, and an environment repair message is sent to the terminal.

[0147] Optionally, the terminal source of the terminal is a personal device:

[0148] The comparison module 1104 is specifically used for:

[0149] determining a third access score of the business system for the personal device;

[0150] The processing module 1105 is specifically used for:

[0151] If the comparison result indicates that the environment perception score of the terminal is greater than or equal to the third access score, allowing the terminal to access the business system through the sandbox;

[0152] If the comparison result indicates that the environment perception score of the terminal is less than the third access score, the terminal is prohibited from accessing the business system.

[0153] Optionally, the comparison module 1104 is specifically used for:

[0154] Determining the user identity corresponding to the access request;

[0155] A preset access score of the business system for the user identity is determined.

[0156] Optionally, the user identity is an employee user:

[0157] The comparison module 1104 is specifically used for:

[0158] determining a fourth access score of the business system for the employee user;

[0159] The processing module 1105 is specifically used for:

[0160] If the comparison result indicates that the environment perception score of the terminal is greater than or equal to the fourth access score, allowing the terminal to access the business system;

[0161] If the comparison result indicates that the environment perception score of the terminal is less than the fourth access score, the terminal is prohibited from accessing the service system.

[0162] Optionally, the user identity is a third-party user:

[0163] The comparison module 1104 is specifically used for:

[0164] determining a fifth access score of the business system for the third-party user;

[0165] The processing module 1105 is specifically used for:

[0166] If the comparison result indicates that the environment perception score of the terminal is greater than or equal to the fifth access score, allowing the terminal to access the business system through the sandbox;

[0167] If the comparison result indicates that the environment perception score of the terminal is less than the fifth access score, the terminal is prohibited from accessing the business system.

[0168] Fig.12 is a schematic diagram of a data uploading device provided by an embodiment of the present invention, the device is applied to a server side, such as Fig.12 As shown, the device comprises:

[0169] The data acquisition module 1201 is used to acquire the environmental assessment data of the terminal;

[0170] The data uploading module 1202 is used to upload the environmental assessment data to the server.

[0171] Optionally, the device further comprises:

[0172] A repair module 1203 is used to receive an environment repair message from the server;

[0173] Performing environment repair processing on the terminal according to the environment repair message.

[0174] Optionally, the environmental assessment data includes at least one of the following: hardware data, operating system data, security basic software data and application software data.

[0175] An embodiment of the present invention provides an electronic device, including:

[0176] one or more processors;

[0177] a storage device for storing one or more programs,

[0178] When one or more programs are executed by one or more processors, the one or more processors implement the method of any of the above embodiments.

[0179] An embodiment of the present invention provides a computer program product, including a computer program. When the computer program is executed by a processor, the method of any of the above embodiments of the present invention is implemented.

[0180] Reference below Fig.13 , which shows a schematic diagram of the structure of a computer system 1300 of a terminal device suitable for implementing an embodiment of the present invention. Fig.13 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0181] like Fig.13 As shown, the computer system 1300 includes a central processing unit (CPU) 1301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1302 or a program loaded from a storage part 1308 into a random access memory (RAM) 1303. In the RAM 1303, various programs and data required for the operation of the system 1300 are also stored. The CPU 1301, the ROM 1302, and the RAM 1303 are connected to each other via a bus 1304. An input / output (I / O) interface 1305 is also connected to the bus 1304.

[0182] The following components are connected to the I / O interface 1305: an input section 1306 including a keyboard, a mouse, etc.; an output section 1307 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1308 including a hard disk, etc.; and a communication section 1309 including a network interface card such as a LAN card, a modem, etc. The communication section 1309 performs communication processing via a network such as the Internet. A drive 1310 is also connected to the I / O interface 1305 as needed. A removable medium 1311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1310 as needed, so that a computer program read therefrom is installed into the storage section 1308 as needed.

[0183] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1309, and / or installed from the removable medium 1311. When the computer program is executed by the central processing unit (CPU) 1301, the above-mentioned functions defined in the system of the present invention are executed.

[0184] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0185] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0186] The modules involved in the embodiments of the present invention may be implemented by software or hardware. The modules described may also be set in a processor, for example, they may be described as: a data receiving module, a score determination module, a request receiving module, a comparison module, and a processing module. The names of these modules do not, in some cases, constitute limitations on the modules themselves, for example, the data receiving module may also be described as a "module for receiving environmental assessment data of a terminal".

[0187] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes:

[0188] Environmental assessment data of receiving terminals;

[0189] Determining an environmental perception score of the terminal according to the environmental assessment data;

[0190] Receiving an access request for a business system sent by the terminal;

[0191] Obtaining a preset access score of the business system, and determining whether the environment perception score of the terminal is greater than or equal to the preset access score of the business system, so as to obtain a comparison result;

[0192] According to the comparison result, it is determined whether to allow the terminal to access the service system.

[0193] According to the technical solution of the embodiment of the present invention, the environment perception score of the terminal is determined based on the environment assessment data of the terminal. The environment assessment data is terminal environment related data. The environment perception score is used to characterize the security level of the environment accessing the external business system. According to the needs, the access score can be preset for each business system, thereby limiting the minimum environment perception score of the terminal that can access the business system, so that terminals with a greater risk level cannot access the business system. Therefore, the embodiment of the present invention can ensure the security of the business system in the process of providing services to the outside world.

[0194] In addition, as the terminal runs, the terminal's environmental assessment data is constantly changing, so that the terminal's environmental perception score is also constantly changing. Therefore, the embodiment of the present invention can also dynamically adjust the terminal's access control authority, which can improve the system security protection level.

[0195] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for processing an access request, characterized in that: Applied to the server side, including: Environmental assessment data of receiving terminals; Determining an environmental perception score of the terminal according to the environmental assessment data; Receiving an access request for a business system sent by the terminal; Obtaining a preset access score of the business system, and determining whether the environment perception score of the terminal is greater than or equal to the preset access score of the business system, so as to obtain a comparison result; Determining whether to allow the terminal to access the business system according to the comparison result; The obtaining of a preset access score of the business system includes: determining a terminal source of the terminal; Determining a preset access score of the business system for the terminal source; The terminal source of the terminal is office equipment: The determining of a preset access score of the business system for the terminal source includes: Determine a first access score and a second access score of the business system for the office device, wherein the first access score is greater than the second access score; The determining, according to the comparison result, whether to allow the terminal to access the business system includes: If the comparison result indicates that the environment perception score of the terminal is greater than or equal to the first access score, allowing the terminal to access the service system; If the comparison result indicates that the environment perception score of the terminal is between the second access score and the first access score, allowing the terminal to access the business system through the sandbox; If the comparison result indicates that the environment perception score of the terminal is less than or equal to the second access score, prohibiting the terminal from accessing the business system, and sending an environment repair message to the terminal; The terminal source of the terminal is a personal device: The determining of a preset access score of the business system for the terminal source includes: determining a third access score of the business system for the personal device; The determining, according to the comparison result, whether to allow the terminal to access the business system includes: If the comparison result indicates that the environment perception score of the terminal is greater than or equal to the third access score, allowing the terminal to access the business system through the sandbox; If the comparison result indicates that the environment perception score of the terminal is less than the third access score, prohibiting the terminal from accessing the business system; The obtaining of a preset access score of the business system includes: Determining the user identity corresponding to the access request; Determining a preset access score of the business system for the user identity; The user identity is an employee user: The determining of a preset access score of the business system for the user identity includes: determining a fourth access score of the business system for the employee user; The determining, according to the comparison result, whether to allow the terminal to access the business system includes: If the comparison result indicates that the environment perception score of the terminal is greater than or equal to the fourth access score, allowing the terminal to access the service system; If the comparison result indicates that the environment perception score of the terminal is less than the fourth access score, prohibiting the terminal from accessing the business system; The user identity is a third-party user: The determining of a preset access score of the business system for the user identity includes: determining a fifth access score of the business system for the third-party user; The determining, according to the comparison result, whether to allow the terminal to access the business system includes: If the comparison result indicates that the environment perception score of the terminal is greater than or equal to the fifth access score, allowing the terminal to access the business system through the sandbox; If the comparison result indicates that the environment perception score of the terminal is less than the fifth access score, the terminal is prohibited from accessing the business system.

2. A device for processing access requests, characterized in that: Applied to the server side, including: A data receiving module, used for receiving environmental assessment data of a terminal; A score determination module, used to determine the environment perception score of the terminal according to the environment assessment data; A request receiving module, used to receive an access request for a business system sent by the terminal; A comparison module, used to obtain a preset access score of the business system, and determine whether the environment perception score of the terminal is greater than or equal to the preset access score of the business system, so as to obtain a comparison result; A processing module, used for determining whether to allow the terminal to access the business system according to the comparison result; The comparison module is specifically used to: determine the terminal source of the terminal; determine the preset access score of the business system for the terminal source; The terminal source of the terminal is office equipment: the comparison module is specifically used to: determine the first access score and the second access score of the business system for the office equipment, and the first access score is greater than the second access score; the processing module is specifically used to: when the comparison result indicates that the environment perception score of the terminal is greater than or equal to the first access score, allow the terminal to access the business system; when the comparison result indicates that the environment perception score of the terminal is between the second access score and the first access score, allow the terminal to access the business system through a sandbox; when the comparison result indicates that the environment perception score of the terminal is less than or equal to the second access score, prohibit the terminal from accessing the business system, and send an environment repair message to the terminal; The terminal source of the terminal is a personal device: the comparison module is specifically used to: determine the third access score of the business system for the personal device; the processing module is specifically used to: if the comparison result indicates that the environment perception score of the terminal is greater than or equal to the third access score, allow the terminal to access the business system through the sandbox; if the comparison result indicates that the environment perception score of the terminal is less than the third access score, prohibit the terminal from accessing the business system; The comparison module is specifically used to: determine the user identity corresponding to the access request; determine the preset access score of the business system for the user identity; The user identity is an employee user: the comparison module is specifically used to: determine the fourth access score of the business system for the employee user; the processing module is specifically used to: if the comparison result indicates that the environment perception score of the terminal is greater than or equal to the fourth access score, allow the terminal to access the business system; if the comparison result indicates that the environment perception score of the terminal is less than the fourth access score, prohibit the terminal from accessing the business system; The user identity is a third-party user: the comparison module is specifically used to determine the fifth access score of the business system for the third-party user; the processing module is specifically used to allow the terminal to access the business system through the sandbox when the comparison result indicates that the environmental perception score of the terminal is greater than or equal to the fifth access score; and prohibit the terminal from accessing the business system when the comparison result indicates that the environmental perception score of the terminal is less than the fifth access score.

3. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method as claimed in claim 1.

4. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to claim 1 is implemented.

5. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to claim 1 is implemented.

Images