A three-level cross-domain security protection method, device, equipment and readable storage medium

Abstract

The present application provides a three-level cross-domain security protection method, device, equipment and readable storage medium. Based on the ternary management mode, the preset security protection area is divided into a central domain, a local domain and an application domain, and a security probe is loaded in the application domain; when the security probe detects security vulnerability information, the RASP adapter is controlled to interact with the gateway, and the security vulnerability information is sent to the RASP server of the local domain through the gateway; the security vulnerability information summarized by the RASP server is sent to the central domain; and the corresponding security protection decision is executed according to the security protection instruction issued by the central domain. Through the implementation of the scheme of the present application, the security probe of the application domain transmits the security vulnerability information to the local domain. After processing the security vulnerability, the local domain summarizes the security vulnerability information and sends it to the central domain. The central domain issues the corresponding security protection decision, and through the ternary management mode, effective multi-region real-time linkage security protection is carried out, which fundamentally eliminates the blind spots of security attack protection.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a three-level cross-domain security protection method, device, equipment and readable storage medium. Background Art

[0002] Current web application security protection is basically based on a single security detection method or technology, such as DAST (dynamic application security testing), SAST (static application security testing) and IAST (interactive application security testing). The disadvantages of these technologies are: they are only applied in the testing and development stages of web applications and cannot provide real-time protection for applications on the production line; some detection methods such as SAST also require the source code of the product, which raises privacy protection issues in the confidentiality of intellectual property codes.

[0003] The current patents based on RASP (Runtime Application Self-Protection) basically use the rule matching of WAF (web application firewall) and hardware, such as RASP-based firewalls. Most of these technologies are based on hardware combination, starting from the perspective of analyzing network traffic, without really going deep into the application code level, the source of security vulnerability information is single, and the security of web applications cannot be fully and timely protected. The security protection rules are single and lack flexible change capabilities. Summary of the invention

[0004] The embodiments of the present application provide a three-level cross-domain security protection method, device, equipment and readable storage medium, which can at least solve the problem that related technologies cannot perform real-time large-scale linkage security attack protection.

[0005] The first aspect of the embodiment of the present application provides a three-level cross-domain security protection method, including:

[0006] Based on the ternary management mode, a central domain, a local domain and an application domain are divided in a preset security protection area, and a security probe is loaded in the application domain; wherein the local domain is a sub-area of ​​the central domain, and the application domain is a sub-area of ​​the local domain;

[0007] When the security probe detects security vulnerability information, controlling the RASP adapter to interact with the gateway, and sending the security vulnerability information to the RASP server of the local domain through the gateway;

[0008] Sending the security vulnerability information summarized by the RASP server to the central domain;

[0009] Execute corresponding security protection decisions according to the security protection instructions issued by the central domain.

[0010] A second aspect of an embodiment of the present application provides a three-level cross-domain security protection device, including:

[0011] A division module, used to divide the preset security protection area into a central domain, a local domain and an application domain based on the ternary management mode, and load a security probe in the application domain; wherein the local domain is a sub-area of ​​the central domain, and the application domain is a sub-area of ​​the local domain;

[0012] An interaction module, configured to control the RASP adapter to interact with the gateway when the security probe detects security vulnerability information, and send the security vulnerability information to the RASP server of the local domain through the gateway;

[0013] A sending module, used for sending the security vulnerability information summarized by the RASP server to the central domain;

[0014] The execution module is used to execute corresponding security protection decisions according to the security protection instructions issued by the central domain.

[0015] A third aspect of an embodiment of the present application provides an electronic device, characterized in that it includes a memory and a processor, wherein the processor is used to execute a computer program stored on the memory, and when the processor executes the computer program, each step in the three-level cross-domain security protection method provided in the first aspect of the embodiment of the present application is performed.

[0016] The fourth aspect of an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, each step of the three-level cross-domain security protection method provided in the first aspect of the embodiment of the present application is implemented.

[0017] As can be seen from the above, according to the three-level cross-domain security protection method, device, equipment and readable storage medium provided by the scheme of the present application, the central domain, local domain and application domain are divided in the preset security protection area based on the ternary management mode, and the security probe is loaded in the application domain; wherein the local domain is a sub-area of ​​the central domain, and the application domain is a sub-area of ​​the local domain; when the security probe detects security vulnerability information, the RASP adapter is controlled to interact with the gateway, and the security vulnerability information is sent to the RASP server of the local domain through the gateway; the security vulnerability information summarized by the RASP server is sent to the central domain; and the corresponding security protection decision is executed according to the security protection instruction issued by the central domain. Through the implementation of the scheme of the present application, when the security probe of the application domain detects a security vulnerability, the security vulnerability information is transmitted to the local domain through the gateway. After the local domain processes the security vulnerability, it summarizes the security vulnerability information and sends it to the central domain. The central domain issues the corresponding security protection decision based on the summarized information, and performs effective multi-region real-time linkage security protection through the ternary management mode, fundamentally eliminating the blind spots of security attack protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A schematic diagram of the basic process of the three-level cross-domain security protection method provided in the first embodiment of the present application;

[0019] Figure 2 A schematic diagram of a three-level regional security protection system provided in the first embodiment of the present application;

[0020] Figure 3 A detailed flowchart of the three-level cross-domain security protection method provided in the second embodiment of the present application;

[0021] Figure 4 A schematic diagram of a program module of a three-level cross-domain security protection device provided in the third embodiment of the present application;

[0022] Figure 5 A schematic diagram of the structure of an electronic device provided in the fourth embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the purpose, features, and advantages of the invention of this application more obvious and easy to understand, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0024] In order to solve the problem that the related art cannot perform real-time large-scale linkage security attack protection, the first embodiment of the present application provides a three-level cross-domain security protection method, such as Figure 1 The basic flow chart of the three-level cross-domain security protection method provided in this embodiment includes the following steps:

[0025] Step 101: Divide the preset security protection area into a central domain, a local domain, and an application domain based on the ternary management mode, and load a security probe in the application domain.

[0026] Specifically, the ternary management model includes central security officers, domain-level security officers, and application security officers. It should be noted here that the three-level cross-domain model can be used as a global model or as a basic unit to be expanded according to business needs. The preset security protection area can be understood as the company that develops network security products and the user company. The central domain can be the network security regulatory department, the local domain can be the user company, and the application domain can be the various departments of the user company. It can also be understood as dividing the central domain, local domain, and application domain within the local area network or wide area network. In this embodiment, if Figure 2 The figure shows a schematic diagram of the three-level regional security protection system provided by the present embodiment. According to the combination of the RASP distributed structure and the ternary management mode, the entire system is divided into a central domain, a local domain and an application domain. The central domain corresponds to the area where the central security officer is located, that is, the highest area of ​​this protection unit. There is generally only one, which is named L1 layer here. The local domain corresponds to the area where the domain-level security officer is located. There are 1 to N (N≥1) possibilities in the local domain, which is named L2 layer here. The application domain corresponds to the area where the application security officer is located. There are also 1 to N (N≥1) possibilities in the application domain, which is named L3 layer here. After the system deployment is completed, the security probe is loaded on the web container in the application domain, and then the RASP adapter and the probe communicate in real time.

[0027] In an optional implementation of the present embodiment, after the step of loading the security probe in the application domain, it also includes: controlling the RASP adapter to select security detection rules and corresponding configuration instructions according to the security level of the application; if the security level of the application is higher than the preset security level threshold, controlling the RASP adapter to send the security detection rules and corresponding configuration instructions to the corresponding security probe separately; if the security level of the application is lower than or equal to the preset security level threshold, controlling the RASP adapter to send security detection rules and corresponding configuration instructions to multiple corresponding security probes.

[0028] Specifically, in this embodiment, the RASP adapter is controlled to select security detection rules and corresponding configuration instructions according to the security level of the application, wherein the security level can be understood as risk tolerance. For example, the financial department of a company is of high importance. If it is invaded by a security vulnerability, it may cause huge losses. The tolerance is low, so the corresponding security detection rules need to be relatively strict. The technical department specializes in dealing with various security attack incidents. Sometimes it is necessary to let go of the detection of certain security vulnerabilities according to business needs. The tolerance is high, so the security detection rules are relatively relaxed compared to other departments. In addition, the configuration instructions include but are not limited to the communication mode between the RASP adapter and the security probe. If the security level of the application is higher than the preset security level threshold, the RASP adapter is controlled to communicate with the corresponding security probe in one-to-one real-time; if the security level of the application is lower than or equal to the preset security level threshold, the RASP adapter is controlled to communicate with the corresponding security probe in one-to-many real-time. Flexible control of the communication mode between the RASP adapter and the security probe is conducive to improving the communication efficiency between the RASP adapter and the security probe and reducing unnecessary waste of resources.

[0029] Step 102: When the security probe detects security vulnerability information, the RASP adapter is controlled to interact with the gateway, and the security vulnerability information is sent to the RASP server in the local domain through the gateway.

[0030] Specifically, in this embodiment, the gateway (GateWay) often only plays the role of transmitting information. Figure 2 As shown, when the security probe detects security vulnerability information, the RASP adapter will first interact with the gateway to determine the security vulnerabilities that the gateway can open and the security vulnerabilities that need to be protected in the security vulnerability information, and send the security vulnerability information to the RASP server in the main area through the gateway.

[0031] In an optional implementation of the present embodiment, before the step of controlling the RASP adapter to interact with the gateway, it also includes: uploading the security vulnerability information to the Portal end of the application domain; wherein the Portal end is an application terminal for the application security officer to monitor the security probe; and performing security protection operations on the security vulnerabilities corresponding to the security vulnerability information according to the security instructions sent by the Portal end in response to the security vulnerability information.

[0032] Specifically, in this embodiment, the Portal end is an application terminal for application security officers to monitor security probes. Application security officers can monitor the probes in real time through the application domain. At the same time, the security information of the probe end can be synchronized to the Portal end in real time. The application security officer can send the security vulnerability information to be protected to the probe through the Portal end, and can choose to protect these security vulnerabilities at different levels, including but not limited to attack blocking, attack reporting, and log writing modes. In the web container, the probe performs precise operations on security vulnerabilities according to the instructions sent by the Portal end, and reports the security vulnerability information to the Portal end in real time according to the user's choice of attack blocking, attack reporting, or log writing, and displays the real-time situation of the attack event on the background server end.

[0033] It should be noted that the security protection of this embodiment includes the first security protection based on the security vulnerability information specified by the application security officer at this stage, the second security protection based on the security configuration of the gateway for the security vulnerability information, and the third security protection based on the security protection decision issued by the central domain.

[0034] In an optional implementation of the present embodiment, the step of controlling the RASP adapter to interact with the gateway includes: when the RASP adapter obtains security vulnerability information, controlling the RASP adapter to access the security configuration information of the gateway corresponding to the security vulnerability information; wherein the security configuration information includes: a security vulnerability whitelist and a security vulnerability blacklist; if there is a first security vulnerability corresponding to the security vulnerability whitelist in the security vulnerability information, then controlling the gateway to respond to the access request containing the first security vulnerability in the RASP adapter; if there is a second security vulnerability corresponding to the security vulnerability blacklist in the security vulnerability information, then controlling the gateway to intercept the access request containing the second security vulnerability in the RASP adapter.

[0035] Specifically, in the present embodiment, the gateway is provided with security configuration information corresponding to the security vulnerability information, including but not limited to a security vulnerability whitelist and a security vulnerability blacklist. The security vulnerability whitelist is a collection of security vulnerabilities that are allowed to be accessed according to business requirements, while the security vulnerability blacklist is a collection of security vulnerabilities that are known to pose security risks to customer applications. When the RASP adapter obtains the security vulnerability information, the RASP adapter is controlled to access the security configuration of the gateway. If there is a first security vulnerability corresponding to the security vulnerability whitelist in the security vulnerability information, an access request containing the first security vulnerability is allowed to access. If there is a second security vulnerability corresponding to the security vulnerability blacklist in the security vulnerability information, an access request containing the second security vulnerability is denied to access. Real-time interactive integration between the RASP adapter and the gateway can improve the efficiency of detecting security vulnerabilities.

[0036] Step 103: Send the security vulnerability information summarized by the RASP server to the central domain.

[0037] Specifically, in this embodiment, after receiving the security vulnerability information sent by the application domain, the RASP server of the local domain will summarize the security vulnerability information and present it to the domain-level security officer of the local domain. The domain-level security officer can issue security rules or perform relevant instructions according to relevant business needs.

[0038] Step 104: Execute corresponding security protection decisions according to the security protection instructions issued by the central domain.

[0039] Specifically, in this embodiment, the central domain is the highest execution area of ​​the present invention. Regardless of whether it is an application domain or a local domain, after security protection is performed on security vulnerabilities, the security protection data needs to be uploaded to the central domain. The central security officer analyzes the security vulnerability information and security protection data, and the corresponding security protection instructions are given below. The application domain and the local domain then execute security protection decisions based on the security protection instructions.

[0040] In an optional implementation of the present embodiment, the step of executing corresponding security protection decisions according to the security protection instructions issued by the central domain includes: determining the corresponding security protection decision according to security vulnerability information and security protection data of the local domain; wherein the security protection data includes: application management data and server management data; after receiving the security protection instructions issued by the central domain corresponding to the security protection decision, controlling the local domain to execute the security protection decision.

[0041] Specifically, in this embodiment, the L1 layer central domain collects L2 layer local domain protection data, including but not limited to security attack events, application management, and server management. For different aspects of security protection data, there are corresponding security protection decisions in the central domain. The central security officer can issue corresponding security protection instructions based on the security vulnerabilities and specific information of the protection decision. After receiving the security protection instructions issued by the central domain corresponding to the security protection decision, the local domain is controlled to execute the security protection decision.

[0042] In an optional implementation of the present embodiment, the steps of determining corresponding security protection decisions based on security vulnerability information and security protection data of the local domain include: summarizing and analyzing the security vulnerability information of the application domain and the local domain; determining potential security vulnerabilities of the third-party library based on the analysis results, and determining security protection decisions corresponding to the potential security vulnerabilities through the CVE and CNNVD security vulnerability databases; or, determining security attacks corresponding to the security vulnerability information based on the security vulnerability information and information management data at different levels, and generating security protection decisions corresponding to the security attacks.

[0043] Specifically, in this embodiment, in terms of application management, the L1 layer can summarize all security attack information including the L2 and L3 layers, among which decisions can be made on potential security attacks such as CVE and CNNVD of third-party libraries; or, for server management, specifically including information management at the server name, IP address, Web container management, most recent active time and other levels, to determine the security attacks corresponding to the security vulnerability information, so as to effectively perform real-time protection against security attacks.

[0044] In an optional implementation of the present embodiment, after receiving the security protection instruction issued by the central domain corresponding to the security protection decision, after the step of controlling the local domain to execute the security protection decision, it also includes: after the security protection instruction is issued, detecting whether the local domain responds to the security protection instruction within a preset time period; if the local domain does not respond to the security protection instruction, directly controlling the application domain to execute the security protection decision according to the security protection instruction.

[0045] Specifically, in this embodiment, under the decision of the central security officer, the decision on security protection is made, which includes the data collection of the local domain and the issuance of relevant security policies. The relationship between the central domain and the local domain is a 1 to N relationship, and the final decision is made by the central domain. If the central domain fails to notify the local domain to perform relevant security protection within the preset time, it can directly replace the local domain and directly perform relevant security attack protection operations on the application domain.

[0046] Based on the implementation scheme of the above application, the central domain, local domain and application domain are divided in the preset security protection area based on the ternary management mode, and the security probe is loaded in the application domain; wherein, the local domain is a sub-area of ​​the central domain, and the application domain is a sub-area of ​​the local domain; when the security probe detects security vulnerability information, the RASP adapter is controlled to interact with the gateway, and the security vulnerability information is sent to the RASP server of the local domain through the gateway; the security vulnerability information summarized by the RASP server is sent to the central domain; and the corresponding security protection decision is executed according to the security protection instruction issued by the central domain. Through the implementation of the scheme of this application, when the security probe of the application domain detects a security vulnerability, the security vulnerability information is transmitted to the local domain through the gateway. After processing the security vulnerability, the local domain summarizes the security vulnerability information and sends it to the central domain. The central domain issues the corresponding security protection decision based on the summarized information, and through the ternary management mode, effective multi-region real-time linkage security protection is carried out, which fundamentally eliminates the blind spots of security attack protection.

[0047] Figure 3 The method in is a refined three-level cross-domain security protection method provided in the second embodiment of the present application, and the three-level cross-domain security protection method includes:

[0048] Step 301: Divide the preset security protection area into a central domain, a local domain, and an application domain based on the ternary management mode, and load a security probe in the application domain.

[0049] Specifically, in this embodiment, the local domain is a sub-area of ​​the central domain, and the application domain is a sub-area of ​​the local domain. The central domain corresponds to the area where the central safety officer is located, that is, the highest area of ​​this protection unit. The local domain corresponds to the area where the domain-level safety officer is located, and there are possibilities of 1 to N (N≥1) in the local domain. The application domain corresponds to the area where the application safety officer is located, and there are possibilities of 1 to N (N≥1) in the application domain.

[0050] Step 302: Control the security probe to perform security vulnerability detection according to the security detection rules and corresponding configuration instructions sent by the RASP adapter.

[0051] Step 303: When the security probe detects security vulnerability information, the security vulnerability information is sent to the RASP adapter.

[0052] Step 304: When the RASP adapter receives the security vulnerability information, an interaction instruction is triggered, and information is interacted with the gateway according to the interaction instruction. After the interaction is completed, the security vulnerability information is sent to the RASP server in the local domain through the gateway.

[0053] Step 305: Send the security vulnerability information summarized by the RASP server to the central domain.

[0054] Step 306: Determine a corresponding security protection decision based on the security vulnerability information and the security protection data of the local domain.

[0055] Step 307: After receiving the security protection instruction corresponding to the security protection decision issued by the central domain, control the local domain to execute the security protection decision.

[0056] Step 308: If the local domain does not respond to the security protection instruction, directly control the application domain to execute the security protection decision according to the security protection instruction.

[0057] According to the three-level cross-domain security protection method provided by the present application, the security probe is controlled to perform security vulnerability detection according to the security detection rules and corresponding configuration instructions sent by the RASP adapter; the security probe is controlled to perform security vulnerability detection according to the security detection rules and corresponding configuration instructions sent by the RASP adapter; when the security probe detects security vulnerability information, the security vulnerability information is sent to the RASP adapter; when the RASP adapter receives the security vulnerability information, the interaction instruction is triggered, and information is interacted with the gateway according to the interaction instruction, and after the interaction is completed, the security vulnerability information is sent to the RASP server of the local domain through the gateway; the security vulnerability information summarized by the RASP server is sent to the central domain. Determine the corresponding security protection decision based on the security vulnerability information and the security protection data of the local domain; after receiving the security protection instruction corresponding to the security protection decision issued by the central domain, control the local domain to execute the security protection decision; if the local domain does not respond to the security protection instruction, directly control the application domain to execute the security protection decision according to the security protection instruction. Through the implementation of the present application scheme, when the security probe of the application domain detects a security vulnerability, the security vulnerability information is transmitted to the local domain through the gateway. After the local domain processes the security vulnerability, the security vulnerability information is summarized and sent to the central domain. The central domain issues corresponding security protection decisions based on the summarized information, and performs effective multi-region real-time linkage security protection through the ternary management model, fundamentally eliminating the blind spots of security attack protection.

[0058] Figure 4 A three-level cross-domain security protection device is provided in the third embodiment of the present application. The three-level cross-domain security protection device can be used to implement the three-level cross-domain security protection method in the above-mentioned embodiment. Figure 4 As shown, the three-level cross-domain security protection device mainly includes:

[0059] The division module 401 is used to divide the preset security protection area into a central domain, a local domain and an application domain based on the ternary management mode, and load the security probe in the application domain; wherein the local domain is a sub-area of ​​the central domain, and the application domain is a sub-area of ​​the local domain;

[0060] The interaction module 402 is used to control the RASP adapter to interact with the gateway when the security probe detects security vulnerability information, and send the security vulnerability information to the RASP server of the local domain through the gateway;

[0061] A sending module 403, configured to send the security vulnerability information summarized by the RASP server to the central domain;

[0062] The execution module 404 is used to execute corresponding security protection decisions according to the security protection instructions issued by the central domain.

[0063] In an optional implementation of the present embodiment, the three-level cross-domain security protection device also includes: a selection module. The selection module is used to: control the RASP adapter to select security detection rules and corresponding configuration instructions according to the security level of the application. The sending module is also specifically used to: if the security level of the application is higher than the preset security level threshold, control the RASP adapter to send security detection rules and corresponding configuration instructions to the corresponding security probe alone; if the security level of the application is lower than or equal to the preset security level threshold, control the RASP adapter to send security detection rules and corresponding configuration instructions to multiple corresponding security probes.

[0064] In an optional implementation of this embodiment, the three-level cross-domain security protection device also includes: an upload module and a protection module. The upload module is used to upload security vulnerability information to the Portal end of the application domain; wherein the Portal end is an application terminal for the application security officer to monitor the security probe. The protection module is used to perform security protection on the security vulnerability corresponding to the security vulnerability information according to the security instructions sent by the Portal end in response to the security vulnerability information.

[0065] In an optional implementation of the present embodiment, the interaction module is specifically used to: when the RASP adapter obtains security vulnerability information, control the RASP adapter to access the security configuration information corresponding to the security vulnerability information of the gateway; wherein the security configuration information includes: a security vulnerability whitelist and a security vulnerability blacklist; if there is a first security vulnerability corresponding to the security vulnerability whitelist in the security vulnerability information, then control the gateway to respond to the access request containing the first security vulnerability in the RASP adapter; if there is a second security vulnerability corresponding to the security vulnerability blacklist in the security vulnerability information, then control the gateway to intercept the access request containing the second security vulnerability in the RASP adapter.

[0066] In an optional implementation of the present embodiment, the execution module is specifically used to: determine a corresponding security protection decision based on security vulnerability information and security protection data of the local domain; wherein the security protection data includes: application management data and server management data; after receiving a security protection instruction corresponding to the security protection decision issued by the central domain, control the local domain to execute the security protection decision.

[0067] Furthermore, in an optional implementation of the present embodiment, when the execution module performs the function of determining the corresponding security protection decision based on the security vulnerability information and the security protection data of the local domain, it is specifically used to: summarize and analyze the security vulnerability information of the application domain and the local domain; determine the potential security vulnerabilities of the third-party library based on the analysis results, and determine the security protection decision corresponding to the potential security vulnerability through the CVE and CNNVD security vulnerability database; or, determine the security attack corresponding to the security vulnerability information based on the security vulnerability information and information management data at different levels, and generate a security protection decision corresponding to the security attack.

[0068] Furthermore, in another optional implementation of this embodiment, the three-level cross-domain security protection device also includes: a judgment module. The judgment module is used to: after the security protection instruction is issued, detect whether the local domain responds to the security protection instruction within a preset time period. The execution module is also specifically used to: if the local domain does not respond to the security protection instruction, directly control the application domain to execute the security protection decision according to the security protection instruction.

[0069] According to the three-level cross-domain security protection device provided by the present application scheme, the central domain, local domain and application domain are divided in the preset security protection area based on the ternary management mode, and the security probe is loaded in the application domain; wherein, the local domain is a sub-area of ​​the central domain, and the application domain is a sub-area of ​​the local domain; when the security probe detects security vulnerability information, the RASP adapter is controlled to interact with the gateway, and the security vulnerability information is sent to the RASP server of the local domain through the gateway; the security vulnerability information summarized by the RASP server is sent to the central domain; and the corresponding security protection decision is executed according to the security protection instruction issued by the central domain. Through the implementation of the present application scheme, when the security probe of the application domain detects a security vulnerability, the security vulnerability information is transmitted to the local domain through the gateway. After processing the security vulnerability, the local domain summarizes the security vulnerability information and sends it to the central domain. The central domain issues the corresponding security protection decision based on the summarized information, and through the ternary management mode, effective multi-region real-time linkage security protection is carried out to fundamentally eliminate the blind spots of security attack protection.

[0070] Figure 5 An electronic device is provided in the fourth embodiment of the present application. The electronic device can be used to implement the three-level cross-domain security protection method in the above-mentioned embodiment, mainly including:

[0071] A memory 501, a processor 502, and a computer program 503 stored in the memory 501 and executable on the processor 502, the memory 501 and the processor 502 are connected by communication. When the processor 502 executes the computer program 503, the three-level cross-domain security protection method in the aforementioned embodiment is implemented. The number of processors may be one or more.

[0072] The memory 501 may be a high-speed random access memory (RAM) memory, or a non-volatile memory, such as a disk memory. The memory 501 is used to store executable program codes, and the processor 502 is coupled to the memory 501 .

[0073] Furthermore, the present application also provides a computer-readable storage medium, which may be provided in the electronic device in the above embodiments. Figure 5 Memory in the illustrated embodiment.

[0074] The computer readable storage medium stores a computer program, and when the program is executed by the processor, the three-level cross-domain security protection method in the aforementioned embodiment is implemented. Furthermore, the computer storable medium can also be a U disk, a mobile hard disk, a read-only memory (ROM), a RAM, a magnetic disk or an optical disk, and other media that can store program codes.

[0075] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0076] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0077] In addition, each functional module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.

[0078] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a readable storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned readable storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0079] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described action sequence, because according to the present application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0080] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0081] The above is a description of the three-level cross-domain security protection method, device, equipment and readable storage medium provided by this application. For technical personnel in this field, according to the ideas of the embodiments of this application, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on this application.

Claims

1. A three-level cross-domain security protection method, characterized in that: include: Based on the ternary management mode, a central domain, a local domain and an application domain are divided in a preset security protection area, and a security probe is loaded in the application domain; wherein the local domain is a sub-area of ​​the central domain, and the application domain is a sub-area of ​​the local domain; When the security probe detects security vulnerability information, the RASP adapter is controlled to interact with the gateway, and the security vulnerability information is sent to the RASP server of the local domain through the gateway; wherein the security probe and the RASP adapter are independently set, and the RASP adapter is used to receive the security vulnerability information detected by the security probe; Sending the security vulnerability information summarized by the RASP server to the central domain; Execute corresponding security protection decisions according to the security protection instructions issued by the central domain; wherein the execution subject of the security protection decision includes the application domain and / or the local domain.

2. The three-level cross-domain security protection method according to claim 1 is characterized in that: After the step of loading the security probe in the application domain, the method further includes: Control the RASP adapter to select security detection rules and corresponding configuration instructions according to the security level of the application; If the security level of the application is higher than the preset security level threshold, controlling the RASP adapter to send security detection rules and corresponding configuration instructions to the corresponding security probe alone; If the security level of the application is lower than or equal to a preset security level threshold, the RASP adapter is controlled to send security detection rules and corresponding configuration instructions to a plurality of corresponding security probes.

3. The three-level cross-domain security protection method according to claim 1 is characterized in that: Before the step of controlling the RASP adapter to interact with the gateway, the method further includes: Upload the security vulnerability information to the portal end of the application domain; wherein the portal end is an application terminal for the application security officer to monitor the security probe; According to the security instruction sent by the Portal end in response to the security vulnerability information, security protection is performed on the security vulnerability corresponding to the security vulnerability information.

4. The three-level cross-domain security protection method according to claim 1 is characterized in that: The step of controlling the RASP adapter to interact with the gateway includes: When the RASP adapter obtains the security vulnerability information, the RASP adapter is controlled to access the security configuration information of the gateway corresponding to the security vulnerability information; wherein the security configuration information includes: a security vulnerability whitelist and a security vulnerability blacklist; If there is a first security vulnerability corresponding to the security vulnerability whitelist in the security vulnerability information, controlling the gateway to respond to the access request containing the first security vulnerability in the RASP adapter; If a second security vulnerability corresponding to the security vulnerability blacklist exists in the security vulnerability information, the gateway is controlled to intercept the access request containing the second security vulnerability in the RASP adapter.

5. The three-level cross-domain security protection method according to claim 1 is characterized in that: The step of executing a corresponding security protection decision according to the security protection instruction issued by the central domain includes: Determine a corresponding security protection decision according to the security vulnerability information and the security protection data of the local domain; wherein the security protection data includes: application management data and server management data; After receiving the security protection instruction corresponding to the security protection decision issued by the central domain, the local domain is controlled to execute the security protection decision.

6. The three-level cross-domain security protection method according to claim 5 is characterized in that: The step of determining a corresponding security protection decision according to the security vulnerability information and the security protection data of the local domain includes: Summarizing and analyzing the security vulnerability information of the application domain and the local domain; Determine potential security vulnerabilities in the third-party library based on the analysis results, and determine security protection decisions corresponding to the potential security vulnerabilities through the CVE and CNNVD security vulnerability databases; Or, based on the security vulnerability information and information management data at different levels, determine the security attack corresponding to the security vulnerability information, and generate a security protection decision corresponding to the security attack.

7. The three-level cross-domain security protection method according to claim 5 is characterized in that: After the step of controlling the local domain to execute the security protection decision after receiving the security protection instruction issued by the central domain corresponding to the security protection decision, the method further includes: After the security protection instruction is issued, detecting whether the local domain responds to the security protection instruction within a preset time period; If the local domain does not respond to the security protection instruction, the application domain is directly controlled to execute the security protection decision according to the security protection instruction.

8. A three-level cross-domain security protection device, characterized in that: include: A division module, used to divide the preset security protection area into a central domain, a local domain and an application domain based on the ternary management mode, and load a security probe in the application domain; wherein the local domain is a sub-area of ​​the central domain, and the application domain is a sub-area of ​​the local domain; An interaction module, used for controlling the RASP adapter to interact with the gateway when the security probe detects security vulnerability information, and sending the security vulnerability information to the RASP server of the local domain through the gateway; wherein the security probe and the RASP adapter are independently provided, and the RASP adapter is used for receiving the security vulnerability information detected by the security probe; A sending module, used for sending the security vulnerability information summarized by the RASP server to the central domain; An execution module is used to execute corresponding security protection decisions according to the security protection instructions issued by the central domain; wherein the execution subject of the security protection decision includes an application domain and / or a local domain.

9. An electronic device, characterized in that: The device comprises a memory and a processor, wherein: The processor is used to execute the computer program stored in the memory; When the processor executes the computer program, the steps in the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps in the method according to any one of claims 1 to 7 are implemented.

Images