A security policy detection method, related device and storage medium

Abstract

The embodiments of the present application provide a method, related devices and storage medium for security policy detection. A first policy and a second policy to be detected are obtained, wherein the first policy and the second policy have the same execution action and different execution results. Since each policy often does not apply to all configurable attributes in the full attribute set, the first attribute sequence corresponding to the first policy and the second attribute sequence corresponding to the second policy can be determined based on the full attribute set, and then the target attribute sequence is determined based on the first attribute sequence and the second attribute sequence. The target attribute sequence represents the relationship between the various attributes between the first policy and the second policy, so that the detection results of the first policy and the second policy can be determined based on the target attribute sequence. In the above manner, all the configured attributes and unconfigured attributes of the policy to be detected are involved in the calculation, thereby improving the scope and accuracy of security policy detection.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, related device, and storage medium for security policy detection. Background Art

[0002] Attribute-based access control (ABAC) is an important security measure that has been widely used in system security. The ABAC model uses attributes to unify the identity, resources, and environment involved in access control, making the application of access control policies more accurate and flexible.

[0003] For security systems with a large number of policies, the attributes defined by each policy can easily overlap, leading to frequent policy conflicts and threatening system security. For example, consider a security system with two policies. Policy A restricts users initiating access requests by allowing access if the user is both male and over 18 years old. Policy B, on the other hand, restricts users initiating access requests by denying access if the user is both male and has a general employee position. In this case, if the user initiating access requests has the attributes of male, 20 years old, and general employee, they both meet the requirements of Policy A, allowing access, and Policy B, denying access. Therefore, there is a risk of policy conflict between Policies A and B.

[0004] In existing technologies, policy conflict risk detection generally uses static attribute conflict detection methods: This involves comparing the attributes of various policies to identify those with identical attributes but conflicting authorization results, identifying them as triggering policy conflicts. However, in practice, even when policies have different attributes, the risk of policy conflict still exists. This risk is undetectable by existing static attribute conflict detection methods. Consequently, these existing static attribute conflict detection methods have a narrow detection scope and low accuracy, leading to a significant potential risk of policy conflicts. Summary of the Invention

[0005] In view of this, embodiments of the present application provide a method, related apparatus, and storage medium for detecting a security policy, so as to improve the scope and accuracy of the security policy detection.

[0006] The first aspect of the present application provides a method for security policy detection, comprising:

[0007] Obtain a first policy and a second policy, wherein the first policy includes M attributes, the second policy includes N attributes, the first policy and the second policy have the same execution action and different execution results, and M and N are both integers greater than or equal to 1;

[0008] Generate a first attribute sequence according to the M attributes included in the first strategy and the full attribute set, wherein the full attribute set includes K attributes, the first attribute sequence includes M first elements and (KM) second elements, and K is an integer greater than 1;

[0009] Generate a second attribute sequence according to the N attributes included in the second strategy and the full attribute set, wherein the second attribute sequence includes N first elements and (KN) second elements;

[0010] Determining a target attribute sequence according to the first attribute sequence and the second attribute sequence;

[0011] According to the target attribute sequence, detection results for the first strategy and the second strategy are determined.

[0012] A second aspect of the present application provides a security policy detection device, comprising:

[0013] an acquiring unit, configured to acquire a first policy and a second policy, wherein the first policy includes M attributes, the second policy includes N attributes, the first policy and the second policy have the same execution action and different execution results, and M and N are both integers greater than or equal to 1;

[0014] a generating unit, configured to generate a first attribute sequence according to the M attributes included in the first policy and the full attribute set, wherein the full attribute set includes K attributes, the first attribute sequence includes M first elements and (KM) second elements, where K is an integer greater than 1;

[0015] The generating unit is further configured to generate a second attribute sequence according to the N attributes and the full attribute set included in the second strategy, wherein the second attribute sequence includes N first elements and (KN) second elements;

[0016] a determining unit, configured to determine a target attribute sequence according to the first attribute sequence and the second attribute sequence;

[0017] The determining unit is configured to determine detection results for the first strategy and the second strategy according to the target attribute sequence.

[0018] In a possible design, in an implementation of the second aspect of the embodiments of the present application,

[0019] The determining unit is specifically configured to perform an AND operation on the first attribute sequence and the second attribute sequence to obtain a third attribute sequence.

[0020] In a possible design, in an implementation of the second aspect of the embodiments of the present application,

[0021] The determining unit is specifically configured to determine, in response to the third attribute sequence including K second elements, that the detection results of the first strategy and the second strategy are at a low risk level.

[0022] In a possible design, in an implementation of the second aspect of the embodiment of the present application, the security policy detection device further includes: a computing unit.

[0023] The calculation unit is configured to perform an OR operation on the first attribute sequence and the second attribute sequence to obtain a fourth attribute sequence.

[0024] In a possible design, in an implementation of the second aspect of the embodiments of the present application,

[0025] The determining unit is specifically configured to, in response to the third attribute sequence being equal to the fourth attribute sequence, determine that the detection results of the first strategy and the second strategy are at a high risk level.

[0026] In a possible design, in an implementation of the second aspect of the embodiments of the present application,

[0027] The determining unit is specifically configured to determine, in response to the third attribute sequence being not equal to the fourth attribute sequence, that the detection results of the first strategy and the second strategy are at a medium risk level.

[0028] In a possible design, in an implementation of the second aspect of the embodiment of the present application, the security policy detection device further includes: a feedback unit.

[0029] The feedback unit is used to feedback an error prompt, where the error prompt is used to indicate that there is a high risk level between the first strategy and the second strategy.

[0030] In a possible design, in an implementation of the second aspect of the embodiments of the present application,

[0031] The determination unit is further used to determine the first attribute processing rule corresponding to the first strategy; determine the second attribute processing rule corresponding to the second strategy; and determine the risk event set corresponding to the medium risk level based on the first attribute processing rule and the second attribute processing rule, wherein the risk event set includes at least one risk event, each risk event is related to the first attribute and the second attribute, the first attribute comes from the first strategy, and the second attribute comes from the second strategy.

[0032] In a possible design, in an implementation of the second aspect of the embodiments of the present application,

[0033] The determining unit is further configured to determine a first attribute processing rule corresponding to the first policy;

[0034] Determining a second attribute processing rule corresponding to the second strategy;

[0035] According to the first attribute processing rule and the second attribute processing rule, a risk event set corresponding to the low risk level is determined, wherein the risk event set includes at least one risk event, each risk event is related to the first attribute and the second attribute, the first attribute is derived from the first strategy, and the second attribute is derived from the second strategy.

[0036] In a possible design, in an implementation of the second aspect of the embodiment of the present application, the security policy detection device further includes: a new creation unit and a triggering unit.

[0037] A new creation unit, configured to create a first strategy, wherein the first strategy includes a first execution action and a first execution result;

[0038] The acquiring unit is further configured to acquire the strategy to be matched, wherein the strategy to be matched includes the second execution action and the second execution result;

[0039] The determining unit is further configured to, in response to the first execution action being the same as the second execution action, and the first execution result being different from the second execution result, determine that the strategy to be matched is the second strategy;

[0040] The triggering unit is used to trigger the steps of obtaining the first strategy and the second strategy.

[0041] In a possible design, in an implementation of the second aspect of the embodiment of the present application, the security policy detection device further includes: a receiving unit and a configuration unit.

[0042] A receiving unit, configured to receive timing configuration information;

[0043] The configuration unit is used to configure a timer according to the timing configuration information, and the timer is used to regularly trigger the steps of obtaining the first strategy and the second strategy.

[0044] In a possible design, in an implementation of the second aspect of the embodiment of the present application, the security policy detection device further includes: a processing unit.

[0045] a processing unit, configured to delete the first policy or the second policy; or

[0046] Lower the priority of the first or second policy.

[0047] The third aspect of the present application provides a computer device, comprising: a memory, a processor and a bus system; the memory is used to store program code; the processor is used to execute the security policy detection method described in any of the above aspects according to the instructions in the program code.

[0048] In a fourth aspect, the present application provides a computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium. When the computer-readable storage medium is run on a computer, the computer is enabled to execute the security policy detection method described in any one of the above aspects.

[0049] In a fifth aspect, the present application provides a computer program product or computer program, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the security policy detection method described in any of the above aspects.

[0050] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0051] In an embodiment of the present application, a method for security policy detection is provided. First, a first policy and a second policy requiring security policy detection are obtained, wherein the first policy and the second policy have the same execution action and different execution results. Then, a first attribute sequence corresponding to the first policy and a second attribute sequence corresponding to the second policy are determined based on a full attribute set, wherein the full attribute set is a set of configurable attributes for each policy. Since each policy often does not apply all configurable attributes in the full attribute set, the first attribute sequence reflects the configured and unconfigured attributes of the first policy, and the second attribute sequence reflects the configured and unconfigured attributes of the second policy. Based on the first attribute sequence and the second attribute sequence, a target attribute sequence is determined. The target attribute sequence represents the relationship between the various attributes of the first and second policies, and the detection results of the first and second policies can be determined based on the target attribute sequence. In this way, all configured and unconfigured attributes of the policy to be detected are included in the calculation, thereby improving the scope and accuracy of security policy detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0053] Figure 1a A schematic diagram of the ABAC access control framework;

[0054] Figure 1b This is a diagram of a policy authorization application scenario for an identity authentication product in an enterprise database;

[0055] Figure 2 A schematic diagram of an embodiment of a security policy detection method in an embodiment of the present application;

[0056] Figure 3 This is a schematic diagram showing that the detection results of the first strategy and the second strategy in the embodiment of the present application are low risk levels;

[0057] Figure 4 This is a schematic diagram of a case where the detection results of the first strategy and the second strategy in the embodiment of the present application are high risk levels;

[0058] Figure 5 This is a schematic diagram of the detection results of the first strategy and the second strategy in the embodiment of the present application being a medium risk level;

[0059] Figure 6 A schematic diagram of a process for security policy detection in this embodiment;

[0060] Figure 7 This is another schematic diagram of a process for security policy detection in this embodiment;

[0061] Figure 8 A schematic diagram of the structure of a security policy detection device provided in an embodiment of the present application;

[0062] Figure 9 This is a structural diagram of a computer device in an embodiment of the present application. DETAILED DESCRIPTION

[0063] The embodiments of the present application provide a method, related apparatus, and storage medium for detecting a security policy, which are used to improve the scope and accuracy of security policy detection.

[0064] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the numbers used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can, for example, be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "corresponding to" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0065] In recent years, with the development and growth of the Internet, system security has become a major issue that modern information security must address. The configuration of security policies for different network environments is not only increasingly complex, but conflicts between policies frequently occur, seriously affecting the efficiency of security policy execution.

[0066] Attribute-based access control (ABAC) is an access control model that uses the attributes of entities (such as identity, resources, and environment) as the basis for authorization to study how to control access to related entities. For this purpose, the entire ABAC access control framework includes the following concepts:

[0067] A. The attributes of an entity can be divided into identity attributes, resource attributes, and environment attributes.

[0068] The subject attribute refers to the specific attributes of the user or device that needs to access resources, such as the user's position, capabilities, location, administrative relationship, or certificate authority (CA) certificate. For the user subject, certain attributes of these users can also be standardized based on the attribute characteristics of users in the industry, including the user's department, position, or business responsibilities.

[0069] Resource attributes refer to the attributes of objects such as resources accessed by an entity, such as files, data, services, or system devices that the entity needs to access. The attributes of these objects can include identity, location (uniform resource locator, URL), size, or value. These attributes can be obtained from the "metadata" of the object and can also be inherited by the subject that operates on it. In other words, object attributes and subject attributes can have a certain correlation;

[0070] Environment attributes refer to the environmental information when an entity accesses a resource, such as time, date, system status, or security level.

[0071] B. Action: The specific operation that an entity needs to perform to access resources, such as read, write, modify, or delete operations.

[0072] C. Attribute processing rules: A method that determines whether the entity's execution action is allowed based on identity attributes, resource attributes, and environment attributes, combined with function expressions or logical operations.

[0073] D. Execution result (Flag): The result of the entity's access to resources, such as permission or rejection.

[0074] A policy is an expression or a group of expressions composed of the above elements, and the result of the expression is the execution result;

[0075] Please refer to Table 1. For example, there is an ABAC-based policy that defines the following: VIP users with identity attributes over 20 years old are allowed to download high-definition movies on October 1st. Otherwise, the execution result is not allowed.

[0076] Table 1

[0077]

[0078] Among them, "over 20 years old" and "VIP user" are the entity's identity attributes, "October 1st" is the environment attribute, "HD movie" is the resource attribute, and "download" is the execution action. The complete judgment logic formed by combining these identity attributes, environment attributes, and resource attributes is the "attribute processing rule", which results in the execution result of "allow". In other words, if the entity's attributes meet the judgment logic of the above policy, the operation of downloading HD movies is allowed; otherwise, it is not allowed.

[0079] Figure 1a This is a schematic diagram of the ABAC access control framework, as shown in Figure 1aAs shown, after a user initiates a request to access a resource, the policy execution engine 101 forwards the request to the policy analysis engine 102, which analyzes the request and retrieves the policy related to the request from the policy library 104 via the policy reading engine 103 for analysis. Furthermore, the attribute information reading engine 105 also needs to read the user's attributes from the attribute library 106 for use by the policy analysis engine 102. After the policy analysis engine 102 obtains the relevant policies and the user's relevant attributes, it can perform an analysis, obtain the analysis results, and send them to the policy execution engine 101. The policy execution engine judges the analysis results to determine whether it needs to obtain relevant data from the resource 107 and provides feedback to the user.

[0080] It should be understood that the security policy detection method provided in this application can be applied to a system or program containing a security policy detection function in a terminal device, such as database software that requires authorization and authentication. Specifically, the security policy detection system can be run on Figure 1a As shown in the ABAC access control framework, the security policy detection system can detect the conflict risks between different policies and reduce the conflicts in the operation process. Figure 1a Users can access the system with security policy detection function through terminal devices or manage various policies based on the results of risk detection. The terminal device can be a computer device. In actual scenarios, there can be more or fewer types of terminal devices participating in the security policy detection process. The specific number and type depends on the actual scenario and is not limited here. In addition, it should be understood that Figure 1a As shown in the figure, the functional modules such as the policy execution engine 101, the policy analysis engine 102, the policy reading engine 103, the policy library 104, the attribute information reading engine 105, the attribute library 106 and the resource 107 can be implemented through other compositions or connection methods. Figure 1a The module division given in the figure is schematic and is only a logical function division. There may be other division methods in actual implementation. For example Figure 1a Multiple modules can be combined or integrated into one server, or multiple servers can be involved, especially in the scenario of multi-model training interaction. The specific number of servers depends on the actual scenario.

[0081] In this embodiment, the server can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal can be a smartphone, tablet computer, laptop computer, desktop computer, smart speaker, smartwatch, etc., but is not limited to these. The terminal and server can be connected directly or indirectly via wired or wireless communication, and the terminal and server can be connected to form a blockchain network, which is not limited in this application.

[0082] In actual applications, the policies in the policy library of security systems are becoming more and more complex, and the number of policies is also increasing, which leads to conflicts between policies from time to time. For example, Figure 1a The user's request to access a resource often involves multiple policies. If the policy analysis engine 102 finds multiple policies with different execution results (for example, policy A has an execution result of "allow" and policy B has an execution result of "deny"), a policy conflict will occur, seriously affecting the efficiency of policy execution. Therefore, how to avoid logical conflicts between different policies becomes the key to ensuring safe and efficient policy execution.

[0083] The security policy detection method provided in the embodiment of this application can be applied to products involving security policy configuration, such as risk control products, rights management products, identity authentication products or firewall security policy configuration, etc., which are not limited here. For ease of understanding, please refer to Figure 1b , Figure 1b The following is a diagram of the policy authorization application scenario of the identity authentication product in the enterprise database. When a user requests to access resources in the enterprise database, the identity authentication product in the enterprise database will first authenticate the user. Figure 1b As shown in the figure, the identity authentication product has policies A, B, C, D, and E. The user initiating an access request meets the judgment logic of policies A, D, and E, resulting in three execution results: Policy A's execution result is access permitted, Policy D's execution result is access denied, and Policy E's execution result is access denied. At this point, the user's access request receives three inconsistent execution results from the identity authentication product, resulting in an execution result conflict. Therefore, the security policies configured in this identity authentication product present a potential policy conflict.

[0084] Combined with the above introduction, the following is an introduction to the security policy detection method in this application. Figure 2 , Figure 2Schematic diagram of an embodiment of a method for security policy detection in an embodiment of the present application. As shown in the figure, an embodiment of a method for security policy detection in an embodiment of the present application includes:

[0085] 201. Obtain a first policy and a second policy, wherein the first policy includes M attributes, the second policy includes N attributes, the first policy and the second policy have the same execution action and different execution results, and M and N are both integers greater than or equal to 1;

[0086] In an embodiment of the present application, in order to improve the efficiency of security policy detection, the policies to be detected can be preliminarily screened first, and two policies with the same execution action and different execution results can be selected. For example, the execution action of the first policy is "delete", and the execution result after judgment is "allow"; the execution action of the second policy is "delete", and the execution result after judgment is "reject". Then, it can be considered that there is a risk of conflict between the first policy and the second policy. That is, there may be a request with an execution action of "delete", but this request satisfies the judgment logic of the first policy, with an execution result of "allow", and also satisfies the judgment logic of the second policy, with an execution result of "reject". Therefore, subsequent detection and judgment of the first policy and the second policy are required.

[0087] When the execution actions of the first policy and the second policy are different or the execution results are the same, it can be considered that there is no risk of policy conflict between the first policy and the second policy. For example, the execution action of the first policy is "delete", and the execution result after judgment is "allow"; the execution action of the second policy is "delete", and the execution result after judgment is "allow". Alternatively, the execution action of the first policy is "delete", and the execution result after judgment is "allow"; the execution action of the second policy is "download", and the execution result after judgment is "reject". Based on such a situation, generally speaking, there is no risk of policy conflict between the first policy and the second policy. Therefore, there is no need to conduct subsequent detection of the first policy and the second policy, and you can directly find the policy and then perform further screening.

[0088] Furthermore, since each policy has corresponding attributes, the identity attributes, resource attributes, and environmental attributes of the entity that needs access control are specifically restricted. For the first policy and the second policy that are screened out for detection, each has its own corresponding attributes, and the number and type of attributes of the first policy and the second policy are not necessarily the same. In the embodiment of the present application, the number of attributes of the first policy is M, and the number of attributes of the second policy is N, and M and N are both integers greater than or equal to 1. For example, the first policy has 4 attributes, which restrict the entity requesting access, whose identity attributes are "VIP user" and "male", the resource attribute is "chat history", and the environmental attribute is "October 1st"; the second policy has 3 attributes, which restrict the entity requesting access, whose identity attributes are "VIP user" and "female", and the resource attribute is "chat history".

[0089] 202. Generate a first attribute sequence based on the M attributes included in the first strategy and the full attribute set, wherein the full attribute set includes K attributes, the first attribute sequence includes M first elements and (KM) second elements, where K is an integer greater than 1;

[0090] In the embodiment of the present application, for the entity requesting access, multiple attributes related to it can be obtained. The multiple attributes obtained are the full attribute set in the present application and can be used as configurable attributes of the policy. The full attribute set includes K attributes, where K is an integer greater than 1.

[0091] However, for a single policy, not all attributes in the full attribute set will necessarily be used. For example, in response to a user's access request, the attributes related to the user that can be obtained by the system include: gender, age, position, access object, and IP address. That is, the corresponding full attribute set is {gender, age, position, access object, and IP address), which includes a total of 5 attributes. Assuming that the attributes configured for the first policy are "male", "over 18 years old", and "chat history", then the first policy only uses the three attributes of "gender", "age", and "access object" in the full attribute set. Therefore, the first attribute sequence corresponding to the first policy is 3 first elements and (4-3) second elements. Among them, the first element is used to represent the attributes that have been configured in the policy relative to the full attribute set, and the second element is used to represent the attributes that have not been configured in the policy relative to the full attribute set. The first attribute sequence represents the configuration status of the attributes in the first policy for the full attribute set.

[0092] Furthermore, in order to facilitate subsequent operations, in the embodiments of the present application, the identity attributes, resource attributes, and environment attributes of the policy can be encoded separately. Please refer to Table 2 for the attribute sequence corresponding to the policy. For example, in this embodiment and subsequent embodiments, the first element is encoded as 1 and the second element is encoded as 0, as an example for explanation. In actual applications, other encoding methods can also be used, for example, the first element is encoded as A and the second element is encoded as B, which is not limited here.

[0093] Table 2

[0094] Attribute 1 Property 2 Attribute 3 Attribute 4 ...... Attribute K 0 / 1 0 / 1 0 / 1 0 / 1 0 / 1 0 / 1

[0095] The full attribute set includes K attributes. The attributes corresponding to each policy are divided into "configured" and "unconfigured." Taking Table 2 as an example, if the policy configures attribute 1, the corresponding code is 1; if attribute 2 is not configured, the corresponding code is 0. Assuming K is 10, the full attribute set includes 10 attributes. If a policy configures attributes 1, 3, 4, 8, and 10, but does not configure attributes 2, 5, 6, 7, and 9, the attribute sequence corresponding to this policy is 1011000101.

[0096] This encoding allows all attributes of each policy (including configured attributes and unconfigured attributes) to participate in the calculation, thereby avoiding the problem of undetected conflict caused by irrelevant attributes between the first policy and the second policy.

[0097] 203. Generate a second attribute sequence according to the N attributes included in the second strategy and the full attribute set, wherein the second attribute sequence includes N first elements and (KN) second elements;

[0098] In this embodiment, step 203 is similar to step 202. A second attribute sequence is generated based on the full attribute set and the attribute configuration of the second policy. The second attribute sequence includes N first elements and (KN) second elements. For specific implementation methods, please refer to the description of step 202 and will not be repeated here.

[0099] It should be noted that in the embodiment of the present application, the timing relationship between step 202 and step 203 is not limited. That is, step 202 can be performed first, and then step 203; step 203 can be performed first, and then step 202; or step 202 and step 203 can be performed simultaneously. The specific details are not limited here.

[0100] 204. Determine a target attribute sequence based on the first attribute sequence and the second attribute sequence;

[0101] After obtaining the first attribute sequence corresponding to the first policy and the second attribute sequence corresponding to the second policy, the first attribute sequence and the second attribute sequence can be operated on to obtain the target attribute sequence. This target attribute sequence represents the association between the first attribute sequence and the second attribute sequence, thereby reflecting the association between the configured and unconfigured attributes of each policy.

[0102] 205. Determine detection results for the first strategy and the second strategy based on the target attribute sequence.

[0103] Because the target attribute sequence reflects the association between configured and unconfigured attributes between each policy, the degree of overlap between the first and second policies and between each attribute can be determined based on the encoding of the target attribute sequence, thereby determining the detection results between the first and second policies. For example, if the target attribute sequence shows that the first and second policies have many identical attributes, it can be considered that there is a high risk of conflict between the first and second policies; if the target attribute sequence shows that the first and second policies have few identical attributes, it can be considered that there is a low risk of conflict between the first and second policies.

[0104] The security policy detection method provided in the embodiment of the present application can be applied to products involving policy configuration applications, such as risk control products, rights management products, or firewall security policy configuration, etc., and is not specifically limited here.

[0105] In an embodiment of the present application, a method for security policy detection is provided. First, a first policy and a second policy requiring security policy detection are obtained, wherein the first policy and the second policy have the same execution action and different execution results. Then, a first attribute sequence corresponding to the first policy and a second attribute sequence corresponding to the second policy are determined based on a full attribute set, wherein the full attribute set is a set of configurable attributes for each policy. Since each policy often does not apply all configurable attributes in the full attribute set, the first attribute sequence reflects the configured and unconfigured attributes of the first policy, and the second attribute sequence reflects the configured and unconfigured attributes of the second policy. Based on the first attribute sequence and the second attribute sequence, a target attribute sequence is determined. The target attribute sequence represents the relationship between the various attributes of the first and second policies, and the detection results of the first and second policies can be determined based on the target attribute sequence. In this way, all configured and unconfigured attributes of the policy to be detected are included in the calculation, thereby improving the scope and accuracy of security policy detection.

[0106] Optionally, in the above Figure 2On the basis of the corresponding embodiment, in an optional embodiment of the security policy detection method provided in the embodiment of the present application, determining a target attribute sequence according to the first attribute sequence and the second attribute sequence specifically includes:

[0107] An AND operation is performed on the first attribute sequence and the second attribute sequence to obtain a third attribute sequence.

[0108] In this embodiment, an AND operation may be performed on the first attribute sequence and the second attribute sequence to obtain a third attribute sequence.

[0109] For example, the attributes included in the full attribute set are: gender, age, position, access object, and access date. Among them, the attributes configured by the first policy limit the entity initiating the access request to male users (gender) over 20 years old (age) who initiate access on October 10 (access date) and can obtain authorization. Then the first attribute sequence corresponding to the first policy is (1101); the attributes configured by the second policy limit the entity initiating the access request to denying male users (gender) from downloading games (access object) in October (access date). Then the second attribute sequence corresponding to the second policy is (1011). Performing an AND operation on the first attribute sequence (1101) and the second attribute sequence (1011) yields the third attribute sequence (1001). From the third attribute sequence (1001), it can be seen that the first and second policies overlap in the two attributes of gender and access date.

[0110] In this embodiment, the third attribute sequence is obtained by performing an AND operation on the first attribute sequence and the second attribute sequence, thereby determining the overlap of various attributes between the first policy and the second policy, thereby improving the accuracy of security policy detection.

[0111] Optionally, in the above Figure 2 Based on the corresponding embodiment, in another optional embodiment of the security policy detection method provided in the embodiment of the present application, determining the detection results for the first policy and the second policy specifically includes:

[0112] If the third attribute sequence includes K second elements, it is determined that the detection results of the first strategy and the second strategy are at a low risk level.

[0113] For easier understanding, see Figure 3 , Figure 3This is a schematic diagram showing that the detection results of the first and second policies in the embodiment of the present application are at a low risk level. Since the first element is used to represent the configured attributes of the policy relative to the full attribute set, the second element is used to represent the unconfigured attributes of the policy relative to the full attribute set. If the third attribute sequence obtained by the AND operation includes K second elements, it means that there is no overlap in all the configured attributes of the first and second policies. At this time, it can be considered that the detection results of the first and second policies are at a low risk level, and the possibility of the risk of policy conflict is low.

[0114] For example, the attributes included in the full attribute set are: gender, age, position, and nationality. Among them, the first policy limits the entity initiating the access request to male users (gender) over 20 years old (age), and access is allowed. Then the first attribute sequence corresponding to the first policy is (1100); the second policy limits the entity initiating the access request to Chinese users (nationality) below the general manager (position), and access is not allowed. Then the second attribute sequence corresponding to the second policy is (0011). Performing an AND operation on the first attribute sequence (1100) and the second attribute sequence (0011) yields the third attribute sequence (0000), indicating that all configured attributes of the first and second policies do not overlap. At this point, it can be considered that the detection results of the first and second policies are low risk levels, and the risk of policy conflicts is low. However, in actual applications, a low risk level does not mean that policy conflicts will never occur. In the above example, if a 30-year-old male Chinese user with an ordinary employee position initiates an access request, the user satisfies the first policy's logic, resulting in a permitted access. The user also satisfies the second policy's logic, resulting in a denied access. In this case, the first and second policies conflict.

[0115] In this embodiment, by performing an AND operation on the first attribute sequence and the second attribute sequence, it is determined that the detection result between the first strategy and the second strategy is a low risk level, thereby dividing the risk level of the strategy conflict into multiple levels, thereby improving the execution efficiency and management efficiency of the strategy.

[0116] Optionally, in the above Figure 2 On the basis of the corresponding embodiment, in another optional embodiment of the security policy detection method provided in the embodiment of the present application, if the third attribute sequence does not include K second elements, the method may further include the following steps:

[0117] An OR operation is performed on the first attribute sequence and the second attribute sequence to obtain a fourth attribute sequence.

[0118] If the third attribute sequence does not include K second elements, it means that there are several first elements in the third attribute sequence, that is, there is some attribute overlap between the first strategy and the second strategy. In this case, it is necessary to perform an OR operation on the first attribute sequence and the second attribute sequence to obtain the fourth attribute sequence.

[0119] In this embodiment, after performing an AND operation on the first attribute sequence and the second attribute sequence, an OR operation is further performed on the first attribute sequence and the second attribute sequence, thereby increasing the scope of security policy detection and improving the accuracy of security policy detection.

[0120] Optionally, in the above Figure 2 Based on the corresponding embodiment, in another optional embodiment of the security policy detection method provided in the embodiment of the present application, determining the detection results for the first policy and the second policy specifically includes:

[0121] If the third attribute sequence is equal to the fourth attribute sequence, it is determined that the detection results of the first strategy and the second strategy are a high risk level.

[0122] For easier understanding, see Figure 4 , Figure 4 This is a schematic diagram showing that the detection results of the first strategy and the second strategy in the embodiment of the present application are at a high risk level. In this embodiment, the first attribute sequence and the second attribute sequence are subjected to an AND operation to obtain a third attribute sequence, and the first attribute sequence and the second attribute sequence are subjected to an OR operation to obtain a fourth attribute sequence. At this time, if the third attribute sequence is equal to the fourth attribute sequence, that is, the result of the AND operation of the first attribute sequence and the second attribute sequence is equal to the result of the OR operation, then it means that the attributes between the first strategy and the second strategy completely overlap. Therefore, between the first strategy and the second strategy, the execution actions are the same, the attributes are exactly the same, and the execution results are different, then it means that the first strategy and the second strategy are more likely to cause a policy conflict, and it can be determined that the detection results of the first strategy and the second strategy are at a high risk level.

[0123] For example, the attributes included in the full attribute set are: gender, age, position and nationality. Among them, the first policy limits the entity initiating the access request to male Chinese users (gender and nationality) over 20 years old (age) and is allowed to initiate access, so the first attribute sequence corresponding to the first policy is (1101); the second policy limits the entity initiating the access request to male Chinese users (gender and nationality) under 30 years old (age) and is not allowed to initiate access requests, so the second attribute sequence corresponding to the second policy is (1101). Performing an AND operation on the first attribute sequence (1101) and the second attribute sequence (1101) yields a third attribute sequence (1101), indicating that the configured attributes of the first and second policies overlap. Then, further performing an OR operation on the first attribute sequence and the second attribute sequence yields a fourth attribute sequence (1101). At this point, the third attribute sequence (1101) is the same as the fourth attribute sequence (1101), so it can be determined that the configured attributes and unconfigured attributes of the first policy are exactly the same as the configured attributes and unconfigured attributes of the second policy. Therefore, it can be considered that there is a high probability of a policy conflict between the first and second policies, and the detection results of the first and second policies are determined to be high risk. Based on the above example, when a male Chinese user aged 20 to 30 initiates an access request, the user meets the judgment logic of the first policy (allowed) and the judgment logic of the second policy (denied). In this case, the execution results of the first and second policies conflict.

[0124] In this embodiment, the results of the AND operation between the first attribute sequence and the second attribute sequence are compared with the results of the OR operation between the first attribute sequence and the second attribute sequence, thereby determining that the detection result between the first policy and the second policy is a high risk level. This allows for a multi-level classification of the risk level of policy conflicts, thereby improving the efficiency of policy execution and management. High-risk conflicts between policies are identified, thereby improving the stability of policy execution.

[0125] Optionally, in the above Figure 2 Based on the corresponding embodiment, in another optional embodiment of the security policy detection method provided in the embodiment of the present application, determining the detection results for the first policy and the second policy specifically includes:

[0126] If the third attribute sequence is not equal to the fourth attribute sequence, it is determined that the detection results of the first strategy and the second strategy are a medium risk level.

[0127] For easier understanding, see Figure 5 , Figure 5This is a schematic diagram showing that the detection results of the first strategy and the second strategy in the embodiment of the present application are at a medium risk level. In this embodiment, the first attribute sequence and the second attribute sequence are subjected to an AND operation to obtain a third attribute sequence, and the first attribute sequence and the second attribute sequence are subjected to an OR operation to obtain a fourth attribute sequence. At this time, if the third attribute sequence is not equal to the fourth attribute sequence, that is, the result of the AND operation of the first attribute sequence and the second attribute sequence is not equal to the result of the OR operation, then it means that there is a partial overlap in the attributes between the first strategy and the second strategy. This means that the first strategy and the second strategy have a certain degree of policy conflict risk, and it can be determined that the detection results of the first strategy and the second strategy are at a medium risk level.

[0128] For example, the attributes included in the full attribute set are: gender, age, position and nationality. Among them, the first policy limits the entity that initiates the access request to male Chinese users (gender and nationality) over 20 years old (age) and is allowed to initiate access, so the first attribute sequence corresponding to the first policy is (1101); the second policy limits the entity that initiates the access request to male Chinese users (gender and nationality) with a position below general manager (age) and is not allowed to initiate access requests, so the second attribute sequence corresponding to the second policy is (1011). Performing an AND operation on the first attribute sequence (1101) and the second attribute sequence (1011) yields a third attribute sequence (1001), indicating that the configured attributes of the first and second policies overlap. Then further performing an OR operation on the first attribute sequence and the second attribute sequence yields a fourth attribute sequence (1111). At this time, the third attribute sequence (1001) is not the same as the fourth attribute sequence (1111), so it can be determined that the configured attributes and unconfigured attributes of the first policy are not exactly the same as the configured attributes and unconfigured attributes of the second policy, and there is a partial overlap in the attributes between the first policy and the second policy. This means that the first policy and the second policy have a certain degree of policy conflict risk, and it can be determined that the detection results of the first policy and the second policy are medium risk levels. Based on the above example, when a male Chinese user who is over 20 years old and whose position is an ordinary employee initiates an access request, the user satisfies the judgment logic of the first policy and the execution result is allowed, and also satisfies the judgment logic of the second policy and the execution result is not allowed. At this time, the execution results of the first policy and the second policy will conflict.

[0129] In this embodiment, the result of the AND operation of the first attribute sequence and the second attribute sequence is compared with the result of the OR operation of the first attribute sequence and the second attribute sequence, so as to determine that the detection result between the first strategy and the second strategy is a medium risk level, thereby dividing the risk level of the strategy conflict into multiple levels, thereby improving the execution efficiency and management efficiency of the strategy.

[0130] Optionally, in the above Figure 2Based on the corresponding embodiment, in another optional embodiment of the security policy detection method provided in the embodiment of the present application, after determining that the detection results of the first policy and the second policy are high risk levels, the method may further include the following steps:

[0131] Feedback error prompt, the error prompt is used to indicate that there is a high risk level between the first strategy and the second strategy.

[0132] In this embodiment, when a high risk level is determined between the first and second policies, it indicates that there is a high probability of a policy conflict between the first and second policies. Therefore, a relevant error message can be fed back to the system. This allows for timely error reporting and improves the security of policy execution.

[0133] Optionally, in the above Figure 2 Based on the corresponding embodiment, in another optional embodiment of the security policy detection method provided in the embodiment of the present application, after determining that the detection results of the first policy and the second policy are at a medium risk level, the method may further include the following steps:

[0134] Determining a first attribute processing rule corresponding to the first strategy;

[0135] Determining a second attribute processing rule corresponding to the second strategy;

[0136] According to the first attribute processing rule and the second attribute processing rule, a risk event set corresponding to the medium risk level is determined, wherein the risk event set includes at least one risk event, each risk event is related to the first attribute and the second attribute, the first attribute is derived from the first strategy, and the second attribute is derived from the second strategy.

[0137] In this embodiment, after determining that the detection results of the first and second policies are at a medium risk level, the attribute processing rules of the first and second policies can be combined to determine a set of risk events that can cause a policy conflict, namely, a risk event set. The attribute processing rules are methods that determine whether an entity's execution action is permitted based on the identity attributes, resource attributes, and environment attributes of the policy, combined with function expressions or logical operations. The risk event satisfies both the first attribute and judgment logic corresponding to the first policy and the second attribute and judgment logic corresponding to the second policy, resulting in two different execution results, i.e., a risk event that causes a policy conflict.

[0138] For example, the first policy allows access requests from male Chinese users over 20 years old. The second policy disallows access requests from male Chinese users with a position below general manager. The corresponding risk events for the first and second policies are: when a male Chinese user over 20 years old with a position below general manager initiates an access request, the user satisfies both the first policy's logic (allowed) and the second policy's logic (disallowed). Consequently, the execution results of the first and second policies conflict.

[0139] In this embodiment, after determining that the detection result is a medium risk level, the attribute processing rules of the first policy and the second policy are further calculated to determine the risk events that lead to policy conflicts in advance, thereby improving the execution efficiency and management efficiency of the policies.

[0140] Optionally, in the above Figure 2 Based on the corresponding embodiment, in another optional embodiment of the security policy detection method provided in the embodiment of the present application, after determining that the detection results of the first policy and the second policy are low risk levels, the method may further include the following steps:

[0141] Determining a first attribute processing rule corresponding to the first strategy;

[0142] Determining a second attribute processing rule corresponding to the second strategy;

[0143] According to the first attribute processing rule and the second attribute processing rule, a risk event set corresponding to the low risk level is determined, wherein the risk event set includes at least one risk event, each risk event is related to the first attribute and the second attribute, the first attribute is derived from the first strategy, and the second attribute is derived from the second strategy.

[0144] In this embodiment, after determining that the detection results of the first and second policies are at a low risk level, the attribute processing rules of the first and second policies can be combined to determine a set of risk events that can cause a policy conflict, namely, a risk event set. The attribute processing rules are methods that determine whether an entity's execution action is permitted based on the identity attributes, resource attributes, and environment attributes of the policy, combined with function expressions or logical operations. The risk event satisfies both the first attribute and judgment logic corresponding to the first policy and the second attribute and judgment logic corresponding to the second policy, resulting in two different execution results, i.e., a risk event that causes a policy conflict.

[0145] For example, the first policy allows access requests from male users over 20 years old. The second policy disallows access requests from Chinese users below the rank of General Manager. The corresponding risk events for the first and second policies are: when a male Chinese user over 20 years old and below the rank of General Manager initiates an access request, the user satisfies the first policy's logic (allowed), and also satisfies the second policy's logic (disallowed). In this case, the execution results of the first and second policies conflict.

[0146] In this embodiment, after determining that the detection result is a medium risk level, the attribute processing rules of the first policy and the second policy are further calculated to determine the risk events that lead to policy conflicts in advance, thereby improving the execution efficiency and management efficiency of the policies.

[0147] Optionally, in the above Figure 2 On the basis of the corresponding embodiment, in another optional embodiment of the security policy detection method provided in the embodiment of the present application, before obtaining the first policy and the second policy, the following steps may be further included:

[0148] Creating a first strategy, wherein the first strategy includes a first execution action and a first execution result;

[0149] Obtaining a to-be-matched policy, wherein the to-be-matched policy includes a second execution action and a second execution result;

[0150] If the first execution action is the same as the second execution action, and the first execution result is different from the second execution result, then determining that the policy to be matched is the second policy;

[0151] The steps of obtaining the first policy and the second policy are triggered.

[0152] The security policy detection method provided in this application can be applied to the detection of newly created policies. When a new first policy is created, in order to detect the compatibility of the policy with other policies in the policy library and reduce the risk of conflicts during the operation of the policy, the risk detection of the newly created policy can be automatically triggered after each new policy is created. Furthermore, since the number of policies may be large, the original policies that need to be detected (i.e., the policies to be matched) can be preliminarily screened first. The policy to be matched that has the same execution action as the first policy and the opposite execution result is selected as the second policy, so as to perform the subsequent security policy detection process on the first and second policies. For ease of understanding, please refer to Figure 6 , Figure 6 This is a flow chart of security policy detection in this embodiment. Figure 6 As shown, specifically:

[0153] Step 601: The user can design a strategy through the management device;

[0154] Step 602: Create a corresponding policy in the security policy detection system;

[0155] Step 603: The security policy detection system obtains the original policy in the policy library;

[0156] Step 604: Perform security policy detection on the newly created policy and the original policy;

[0157] Step 605: After obtaining the test results, feedback can be sent to the management device;

[0158] Step 606: The management device processes the policy accordingly based on the different detection results.

[0159] Step 607: After processing the policies that have the risk of policy conflict, in order to further ensure the compatibility of the policies, the policies may be subjected to risk detection again;

[0160] Step 608: Determine whether the risk of policy conflict is still detected. If so, return to step 605; if not, end the detection process.

[0161] In this embodiment, when a new policy is created, a security policy check is automatically performed on the new policy and the original policy, thereby improving the security of policy creation and reducing the potential conflict between the new policy and the original policy.

[0162] Optionally, in the above Figure 2 On the basis of the corresponding embodiment, in another optional embodiment of the security policy detection method provided in the embodiment of the present application, before obtaining the first policy and the second policy, the following steps may be further included:

[0163] receiving timing configuration information;

[0164] A timer is configured according to the timing configuration information, and the timer is used to regularly trigger the steps of obtaining the first policy and the second policy.

[0165] In this embodiment, security policy checks can be performed on multiple policies on a regular basis. Specifically, an administrator or other user with certain permissions can set a timer for a system with security policy checking capabilities based on business needs. The system then configures a timer based on the timer information. This allows for regular policy conflict detection and maintenance for each policy, improving the security and reliability of policy operation.

[0166] Optionally, in the above Figure 2Based on the corresponding embodiment, in another optional embodiment of the security policy detection method provided in the embodiment of the present application, after determining that the detection results of the first policy and the second policy are high risk levels, the method may further include the following steps:

[0167] Deleting the first policy or the second policy; or,

[0168] Lower the priority of the first or second policy.

[0169] In this embodiment, if a high-risk level is determined between the first and second policies, there is a high probability of a policy conflict between the first and second policies. Therefore, the first or second policy can be proactively deleted, or the priority of the first or second policy can be lowered. This prevents the simultaneous execution of multiple policies with high conflict risks, thereby improving the security and reliability of policy execution.

[0170] In the embodiment of this application, a security policy detection method for two different policies is introduced. In actual application, since there are often multiple policies in the policy library of the system, you can first determine a policy to be detected, and then test the policy against each policy in the policy library one by one to determine whether there is a risk of conflict between the policy and other policies in the policy library. For ease of understanding, please refer to Figure 7 , exemplary, Figure 7 FIG. 1 is another flow chart of security policy detection in this embodiment. Figure 7 As shown, specifically:

[0171] Step 701: trigger security policy detection. The specific triggering method can be active triggering by the management device or server, or it can be triggered regularly in response to a timer, or it can be automatically triggered each time a new policy is created. The specific triggering method is not limited here.

[0172] Step 702: Obtain the target policy to be tested, and then perform matching tests on the target policy and other policies one by one;

[0173] Step 703: Encode the attributes of the target policy. Figure 2 The description of step 202 is omitted here.

[0174] Step 704: Obtain a first attribute sequence corresponding to the target policy after encoding;

[0175] Step 705: Loop through the strategies in the strategy library and select strategies that have the same execution action as the target strategy but different execution results as the strategies to be matched. Then, perform subsequent testing on the strategies to be matched with the target strategy one by one. If the loop through the strategies in the strategy library is completed, the corresponding loop process ends.

[0176] Step 706: Encode the attributes of the strategy to be matched. Figure 2 The description of step 202 is omitted here.

[0177] Step 707: After encoding, obtain the second attribute sequence corresponding to the strategy to be matched;

[0178] Step 708: Determine whether the result of the AND operation of the first attribute sequence and the second attribute sequence is 0. If so, execute step 709; if not, execute step 710.

[0179] Step 709: If the result of the AND operation of the first attribute sequence and the second attribute sequence is 0, it is determined to be a low risk level, and step 715 is executed;

[0180] Step 710: If the result of the AND operation of the first attribute sequence and the second attribute sequence is not 0, determine whether the result of the AND operation of the first attribute sequence and the second attribute sequence is equal to the result of the OR operation of the first attribute sequence and the second attribute sequence. If so, execute step 711; if not, execute step 714.

[0181] Step 711: If the result of the AND operation of the first attribute sequence and the second attribute sequence is equal to the result of the OR operation of the first attribute sequence and the second attribute sequence, it is determined to be a high risk level, and step 712 or step 713 is executed;

[0182] Step 712: After determining that the detection result between the strategies is a high risk level, an error message is fed back;

[0183] Step 713: After determining that the detection result between the policies is a high risk level, delete one of the policies or lower its priority;

[0184] Step 714: If the result of the AND operation of the first attribute sequence and the second attribute sequence is not equal to the result of the OR operation of the first attribute sequence and the second attribute sequence, it is determined to be a medium risk level, and step 715 is executed;

[0185] Step 715: Determine the risk event sets corresponding to the medium risk level and the low risk level.

[0186] In order to better implement the above solution of the embodiment of the present application, the following also provides related devices for implementing the above solution. Figure 8 , Figure 8 This is a schematic diagram of the structure of a security policy detection device provided in an embodiment of the present application. The security policy detection device 800 includes:

[0187] An acquiring unit 801 is configured to acquire a first policy and a second policy, wherein the first policy includes M attributes, the second policy includes N attributes, the first policy and the second policy have the same execution action and different execution results, and M and N are both integers greater than or equal to 1;

[0188] A generating unit 802 is configured to generate a first attribute sequence based on the M attributes included in the first policy and the full attribute set, wherein the full attribute set includes K attributes, the first attribute sequence includes M first elements and (KM) second elements, and K is an integer greater than 1;

[0189] The generating unit 802 is further configured to generate a second attribute sequence according to the N attributes and the full attribute set included in the second policy, wherein the second attribute sequence includes N first elements and (KN) second elements;

[0190] A determining unit 803 is configured to determine a target attribute sequence according to the first attribute sequence and the second attribute sequence;

[0191] The determining unit 803 is configured to determine detection results for the first strategy and the second strategy according to the target attribute sequence.

[0192] Optionally, in the above Figure 8 On the basis of the corresponding embodiment, in one embodiment of the security policy detection device 800 provided in the embodiment of the present application,

[0193] The determining unit 803 is specifically configured to perform an AND operation on the first attribute sequence and the second attribute sequence to obtain a third attribute sequence.

[0194] Optionally, in the above Figure 8 On the basis of the corresponding embodiment, in one embodiment of the security policy detection device 800 provided in the embodiment of the present application,

[0195] The determining unit 803 is specifically configured to determine, in response to the third attribute sequence including K second elements, that the detection results of the first strategy and the second strategy are at a low risk level.

[0196] Optionally, in the above Figure 8 On the basis of the corresponding embodiment, in one embodiment of the security policy detection device 800 provided in the embodiment of the present application, the security policy detection device further includes: a calculation unit 804.

[0197] The calculation unit 804 is configured to perform an OR operation on the first attribute sequence and the second attribute sequence to obtain a fourth attribute sequence.

[0198] Optionally, in the above Figure 8On the basis of the corresponding embodiment, in one embodiment of the security policy detection device 800 provided in the embodiment of the present application,

[0199] The determining unit 803 is specifically configured to determine, in response to the third attribute sequence being equal to the fourth attribute sequence, that the detection results of the first strategy and the second strategy are at a high risk level.

[0200] Optionally, in the above Figure 8 On the basis of the corresponding embodiment, in one embodiment of the security policy detection device 800 provided in the embodiment of the present application,

[0201] The determining unit 803 is specifically configured to determine, in response to the third attribute sequence being not equal to the fourth attribute sequence, that the detection results of the first strategy and the second strategy are at a medium risk level.

[0202] Optionally, in the above Figure 8 On the basis of the corresponding embodiment, in one embodiment of the security policy detection device 800 provided in the embodiment of the present application, the security policy detection device further includes: a feedback unit 805.

[0203] The feedback unit 805 is configured to feed back an error prompt, where the error prompt indicates that there is a high risk level between the first strategy and the second strategy.

[0204] Optionally, in the above Figure 8 On the basis of the corresponding embodiment, in one embodiment of the security policy detection device 800 provided in the embodiment of the present application,

[0205] Determination unit 803 is also used to determine the first attribute processing rule corresponding to the first strategy; determine the second attribute processing rule corresponding to the second strategy; and determine the risk event set corresponding to the medium risk level based on the first attribute processing rule and the second attribute processing rule, wherein the risk event set includes at least one risk event, each risk event is related to the first attribute and the second attribute, the first attribute comes from the first strategy, and the second attribute comes from the second strategy.

[0206] Optionally, in the above Figure 8 On the basis of the corresponding embodiment, in one embodiment of the security policy detection device 800 provided in the embodiment of the present application,

[0207] The determining unit 803 is further configured to determine a first attribute processing rule corresponding to the first policy;

[0208] Determining a second attribute processing rule corresponding to the second strategy;

[0209] According to the first attribute processing rule and the second attribute processing rule, a risk event set corresponding to the low risk level is determined, wherein the risk event set includes at least one risk event, each risk event is related to the first attribute and the second attribute, the first attribute is derived from the first strategy, and the second attribute is derived from the second strategy.

[0210] Optionally, in the above Figure 8 On the basis of the corresponding embodiment, in one embodiment of the security policy detection device 800 provided in the embodiment of the present application, the security policy detection device further includes: a new creation unit 806 and a triggering unit 807 .

[0211] A creating unit 806 is configured to create a first policy, wherein the first policy includes a first execution action and a first execution result;

[0212] The acquisition unit 801 is further configured to acquire a policy to be matched, wherein the policy to be matched includes a second execution action and a second execution result;

[0213] The determining unit 803 is further configured to determine that the policy to be matched is the second policy in response to the first execution action being the same as the second execution action and the first execution result being different from the second execution result;

[0214] The triggering unit 807 is configured to trigger the step of acquiring the first policy and the second policy.

[0215] Optionally, in the above Figure 8 On the basis of the corresponding embodiment, in one embodiment of the security policy detection device 800 provided in the embodiment of the present application, the security policy detection device further includes: a receiving unit 808 and a configuration unit 809.

[0216] The receiving unit 808 is configured to receive timing configuration information;

[0217] The configuration unit 809 is configured to configure a timer according to the timing configuration information, where the timer is used to periodically trigger the steps of obtaining the first policy and the second policy.

[0218] Optionally, in the above Figure 8 On the basis of the corresponding embodiment, in one embodiment of the security policy detection device 800 provided in the embodiment of the present application, the security policy detection device further includes: a processing unit 810.

[0219] The processing unit 810 is configured to delete the first policy or the second policy; or

[0220] Lower the priority of the first or second policy.

[0221] In this embodiment, the security policy detection device 800 can execute the above Figure 2 、 Figure 6 or Figure 7 The security policy detection method provided by the corresponding embodiment is used to improve the scope and accuracy of security policy detection.

[0222] The present application also provides a computer device for executing Figure 2 、 Figure 6 or Figure 7 The corresponding embodiment provides a security policy detection method. Please refer to Figure 9 , Figure 9 This is a structural diagram of a computer device in an embodiment of the present application. As shown in the figure, the computer device 900 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPU) 922 (for example, one or more processors) and memory 932, and one or more storage media 930 (for example, one or more mass storage devices) for storing application programs 942 or data 944. Among them, the memory 932 and the storage medium 930 can be temporary storage or permanent storage. The program stored in the storage medium 930 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the computer device. Furthermore, the central processing unit 922 can be configured to communicate with the storage medium 930 to execute a series of instruction operations in the storage medium 930 on the computer device 900.

[0223] The computer device 900 may also include one or more power supplies 926, one or more wired or wireless network interfaces 950, one or more input and output interfaces 958, and / or one or more operating systems 941, such as Windows Server 2008. TM , Mac OS X TM , Unix TM , Linux TM , FreeBSD TM etc.

[0224] The security policy detection method in the above embodiment can be based on the Figure 9 The structure of the computer device shown.

[0225] A computer-readable storage medium is also provided in an embodiment of the present application. The computer-readable storage medium stores a computer program, which, when executed on a computer, enables the computer to execute the methods described in the aforementioned embodiments.

[0226] An embodiment of the present application also provides a computer program product including a program, which, when executed on a computer, enables the computer to execute the methods described in the aforementioned embodiments.

[0227] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0228] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0229] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0230] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0231] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, an interactive video management device, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0232] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

[0233] It should be noted that the user-related information (including but not limited to user device information, user personal information, user chat records, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

Claims

1. A method for security policy detection, characterized in that: include: Obtain a first policy and a second policy, wherein the first policy includes M attributes, the second policy includes N attributes, the first policy and the second policy have the same execution action and different execution results, and both M and N are integers greater than or equal to 1; Generate a first attribute sequence according to the M attributes and the full attribute set included in the first policy, wherein the full attribute set includes K attributes, the first attribute sequence includes M first elements and KM second elements, and K is an integer greater than 1; Generate a second attribute sequence according to the N attributes included in the second strategy and the full attribute set, wherein the second attribute sequence includes N first elements and KN second elements; Determining a target attribute sequence according to the first attribute sequence and the second attribute sequence specifically includes: performing an AND operation on the first attribute sequence and the second attribute sequence to obtain a third attribute sequence; Determining detection results for the first strategy and the second strategy based on the target attribute sequence specifically includes: If the third attribute sequence does not include K second elements, performing an OR operation on the first attribute sequence and the second attribute sequence to obtain a fourth attribute sequence; If the third attribute sequence is equal to the fourth attribute sequence, it is determined that the detection results of the first strategy and the second strategy are a high risk level.

2. The method according to claim 1, characterized in that Determining the detection results for the first strategy and the second strategy according to the target attribute sequence includes: If the third attribute sequence includes K second elements, it is determined that the detection results of the first strategy and the second strategy are at a low risk level.

3. The method according to claim 1, characterized in that Determining the detection results for the first strategy and the second strategy according to the target attribute sequence includes: If the third attribute sequence is not equal to the fourth attribute sequence, it is determined that the detection results of the first strategy and the second strategy are a medium risk level.

4. The method according to claim 1, wherein After determining that the detection results of the first strategy and the second strategy are at a high risk level, the method further includes: An error prompt is fed back, where the error prompt is used to indicate that a high risk level exists between the first strategy and the second strategy.

5. The method according to claim 3, characterized in that After determining that the detection results of the first strategy and the second strategy are at a medium risk level, the method further includes: Determining a first attribute processing rule corresponding to the first policy; Determining a second attribute processing rule corresponding to the second policy; According to the first attribute processing rule and the second attribute processing rule, a risk event set corresponding to the medium risk level is determined, wherein the risk event set includes at least one risk event, each risk event is related to a first attribute and a second attribute, the first attribute is derived from the first policy, and the second attribute is derived from the second policy.

6. The method according to claim 2, characterized in that After determining that the detection results of the first strategy and the second strategy are at a low risk level, the method further includes: Determining the first attribute processing rule corresponding to the first policy; Determining the second attribute processing rule corresponding to the second policy; According to the first attribute processing rule and the second attribute processing rule, a risk event set corresponding to the low risk level is determined, wherein the risk event set includes at least one risk event, each risk event is related to a first attribute and a second attribute, the first attribute is derived from the first policy, and the second attribute is derived from the second policy.

7. The method according to any one of claims 1 to 6, characterized in that Before obtaining the first strategy and the second strategy, the method further includes: Creating the first policy, wherein the first policy includes a first execution action and a first execution result; Acquire a policy to be matched, wherein the policy to be matched includes a second execution action and a second execution result; If the first execution action is the same as the second execution action, and the first execution result is different from the second execution result, determining that the policy to be matched is the second policy; The step of obtaining the first strategy and the second strategy is triggered.

8. The method according to any one of claims 1 to 6, characterized in that Before obtaining the first strategy and the second strategy, the method further includes: receiving timing configuration information; A timer is configured according to the timing configuration information, and the timer is used to regularly trigger the step of obtaining the first policy and the second policy.

9. The method according to claim 1 or 4, characterized in that After determining that the detection results of the first strategy and the second strategy are at a high risk level, the method further includes: deleting the first policy or the second policy; or, Lower the priority of the first policy or the second policy.

10. A security policy detection device, characterized in that: The security policy detection device includes: an acquiring unit, configured to acquire a first policy and a second policy, wherein the first policy includes M attributes, the second policy includes N attributes, the first policy and the second policy have the same execution action and different execution results, and both M and N are integers greater than or equal to 1; a generating unit, configured to generate a first attribute sequence according to the M attributes and the full attribute set included in the first policy, wherein the full attribute set includes K attributes, the first attribute sequence includes M first elements and KM second elements, and K is an integer greater than 1; The generating unit is further configured to generate a second attribute sequence according to the N attributes included in the second policy and the full attribute set, wherein the second attribute sequence includes N first elements and KN second elements; a determining unit, configured to determine a target attribute sequence according to the first attribute sequence and the second attribute sequence; The determining unit is specifically configured to perform an AND operation on the first attribute sequence and the second attribute sequence to obtain a third attribute sequence; The determining unit is configured to determine detection results for the first strategy and the second strategy according to the target attribute sequence; a computing unit, configured to, in response to the third attribute sequence not including K second elements, perform an OR operation on the first attribute sequence and the second attribute sequence to obtain a fourth attribute sequence; The determining unit is specifically configured to determine, in response to the third attribute sequence being equal to the fourth attribute sequence, that the detection results of the first policy and the second policy are at a high risk level.

11. The device according to claim 10, characterized in that The determining unit is specifically configured to determine, in response to the third attribute sequence including K second elements, that the detection results of the first strategy and the second strategy are at a low risk level.

12. The device according to claim 10, characterized in that The determining unit is specifically configured to determine, in response to the third attribute sequence being not equal to the fourth attribute sequence, that the detection results of the first policy and the second policy are at a medium risk level.

13. The device according to claim 10, characterized in that The device further comprises: The feedback unit is configured to feed back an error prompt after determining that the detection results of the first strategy and the second strategy are at a high risk level, where the error prompt is used to indicate that a high risk level exists between the first strategy and the second strategy.

14. The device according to claim 12, characterized in that The determination unit is further used to determine the first attribute processing rule corresponding to the first policy after determining that the detection results of the first policy and the second policy are at a medium risk level; determine the second attribute processing rule corresponding to the second policy; and determine the risk event set corresponding to the medium risk level based on the first attribute processing rule and the second attribute processing rule, wherein the risk event set includes at least one risk event, each risk event is related to a first attribute and a second attribute, the first attribute is derived from the first policy, and the second attribute is derived from the second policy.

15. The device according to claim 11, characterized in that The device further comprises: The determination unit is further used to determine the first attribute processing rule corresponding to the first policy after determining that the detection results of the first policy and the second policy are at a low risk level; determine the second attribute processing rule corresponding to the second policy; and determine the risk event set corresponding to the low risk level based on the first attribute processing rule and the second attribute processing rule, wherein the risk event set includes at least one risk event, each risk event is related to a first attribute and a second attribute, the first attribute is derived from the first policy, and the second attribute is derived from the second policy.

16. The device according to any one of claims 10 to 15, characterized in that The device further comprises: a creating unit, configured to create the first policy, wherein the first policy includes a first execution action and a first execution result; The acquisition unit is further configured to acquire a policy to be matched, wherein the policy to be matched includes a second execution action and a second execution result; The determining unit is further configured to, in response to the first execution action being the same as the second execution action, and the first execution result being different from the second execution result, determine that the to-be-matched policy is the second policy; A triggering unit is used to trigger the step of obtaining the first strategy and the second strategy.

17. The device according to any one of claims 10 to 15, characterized in that The device further comprises: A receiving unit, configured to receive timing configuration information; A configuration unit is used to configure a timer according to the timing configuration information, and the timer is used to regularly trigger the step of obtaining the first strategy and the second strategy.

18. The device according to claim 10 or 13, characterized in that The device further comprises: A processing unit is configured to delete the first policy or the second policy after determining that the detection results of the first policy and the second policy are at a high risk level; or to lower the priority of the first policy or the second policy.

19. A computer device, characterized in that: The computer device includes a processor and a memory: The memory is used to store program code; the processor is used to execute the security policy detection method according to any one of claims 1 to 9 according to instructions in the program code.

20. A computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is executed, the computer is caused to execute the security policy detection method according to any one of claims 1 to 9.

21. A computer program product, characterized in that The method comprises computer instructions, which are stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the security policy detection method described in any one of claims 1 to 9 above.

Images