Horizontal overreach detection method and apparatus

Abstract

The embodiment of the present specification provides a horizontal privilege detection method and device, wherein the horizontal privilege detection method comprises: scanning a data entry instruction, determining data flow information of a target user identifier and a target resource identifier; extracting a database operation instruction from the data flow information; scanning the database operation instruction to obtain a target instruction parameter; matching the target user identifier, the target resource identifier and the target instruction parameter, and determining whether there is a horizontal privilege risk according to the matching result. By scanning the data entry instruction, the data flow information of the target user identifier and the target resource identifier is determined, the target user identifier, the target resource identifier and the target instruction parameter obtained by scanning and extracting from the data flow information are matched, and it is determined whether there is a horizontal privilege risk. The above process starts from the data entry instruction and determines whether there is a horizontal privilege risk through operation, and does not rely on other external conditions, so that the efficiency of determining whether there is a horizontal privilege risk is higher.

Description

Technical Field

[0001] The embodiments in this specification relate to the field of data security technology, and in particular to a method for detecting horizontal unauthorized access. Background Technology

[0002] With the rapid development of network technology, information security is facing enormous challenges, and user privacy is also facing significant challenges. User privacy is often accessed without authorization by others, leading to information leaks. Therefore, users will conduct unauthorized access risk checks when accessing data on various websites and platforms to prevent information leaks.

[0003] Horizontal privilege escalation detection typically employs black-box testing. This involves creating two accounts with identical privilege levels. The first account performs a legitimate test to obtain a valid test request URL. Based on this URL, the second account performs a control test request to obtain the corresponding control test request result. This control test request result is then compared with the permissions of the first account to determine if a horizontal privilege escalation vulnerability exists. However, this method requires pre-creating accounts and then conducting separate tests, making deployment cumbersome and inefficient. Therefore, a more efficient horizontal privilege escalation detection method is urgently needed. Summary of the Invention

[0004] In view of this, embodiments of this specification provide a method for detecting horizontal privilege escalation. One or more embodiments of this specification also relate to a horizontal privilege escalation detection device, a computing device, a computer-readable storage medium, and a computer program, to address the technical deficiencies existing in the prior art.

[0005] According to a first aspect of the embodiments of this specification, a method for detecting horizontal unauthorized access is provided, comprising:

[0006] Scan data entry commands to determine the data flow information of the target user identifier and the target resource identifier;

[0007] Extract database operation instructions from the data stream information;

[0008] Scan the database for operation commands to obtain the target command parameters;

[0009] The target user identifier, target resource identifier, and target command parameters are matched, and the results are used to determine whether there is a risk of horizontal privilege escalation.

[0010] According to a second aspect of the embodiments of this specification, a horizontal unauthorized access detection device is provided, comprising:

[0011] The determination module is configured to scan data entry commands to determine the data flow information of the target user identifier and the target resource identifier;

[0012] The extraction module is configured to extract database operation instructions from the data stream information;

[0013] The acquisition module is configured to scan database operation commands to obtain target command parameters.

[0014] The matching module is configured to match the target user identifier, the target resource identifier, and the target instruction parameters, and determine whether there is a risk of horizontal privilege escalation based on the matching results.

[0015] According to a third aspect of the embodiments of this specification, a computing device is provided, comprising:

[0016] Memory and processor;

[0017] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions, which, when executed by the processor, implement the steps of the above-described horizontal privilege escalation detection method.

[0018] According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided that stores computer-executable instructions that, when executed by a processor, implement the steps of the above-described horizontal privilege escalation detection method.

[0019] According to a fifth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the above-described horizontal privilege escalation detection method.

[0020] One embodiment of this specification determines the data flow information of the target user identifier and the target resource identifier by scanning data entry instructions; extracts database operation instructions from the data flow information; scans the database operation instructions to obtain target instruction parameters; matches the target user identifier, the target resource identifier, and the target instruction parameters; and determines whether a horizontal privilege escalation risk exists based on the matching result. By scanning data entry instructions to determine the data flow information of the target user identifier and the target resource identifier, the process of compiling the data entry instructions is omitted. Database operation instructions are extracted from this data flow information, and target instruction parameters are obtained by scanning these instructions. The target user identifier, the target resource identifier, and the target instruction parameters are matched, and the existence of a horizontal privilege escalation risk is determined based on the matching result. In other words, the above process determines the existence of a horizontal privilege escalation risk by starting with the data entry instructions and performing operations, without relying on other external conditions, making the determination of whether a horizontal privilege escalation risk exists more efficient. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of the interaction process under a horizontal privilege escalation detection system architecture provided in one embodiment of this specification;

[0022] Figure 2 This is a flowchart of a horizontal unauthorized access detection method provided in one embodiment of this specification;

[0023] Figure 3 This is a flowchart illustrating the processing procedure of a horizontal unauthorized access detection method provided in one embodiment of this specification;

[0024] Figure 4a This is an example diagram of the instructions for a horizontal unauthorized access detection method provided in one embodiment of this specification under a risk-free condition;

[0025] Figure 4b This is an example diagram illustrating the instructions for a horizontal privilege escalation detection method provided in one embodiment of this specification under risky conditions (no target user identifier is matched);

[0026] Figure 4c This is an example diagram of an instruction provided in one embodiment of the present specification for a horizontal privilege escalation detection method under risky conditions (the target instruction parameter does not include the target user identifier);

[0027] Figure 4d This is an example diagram illustrating the instructions for a horizontal privilege escalation detection method provided in one embodiment of this specification under risky conditions (the target user identifier does not meet the preset matching conditions);

[0028] Figure 5 This is a schematic diagram of the structure of a horizontal unauthorized access detection device provided in one embodiment of this specification;

[0029] Figure 6 This is a structural block diagram of a computing device provided in one embodiment of this specification. Detailed Implementation

[0030] Many specific details are set forth in the following description to provide a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0031] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of this specification. The singular forms “a,” “described,” and “the” as used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0032] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this specification, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0033] First, the terms and concepts used in one or more embodiments of this specification will be explained.

[0034] Horizontal privilege escalation: refers to an attacker attempting to access resources held by a user with the same privileges as them, such as accessing or manipulating data that does not belong to them.

[0035] Static scanning: The code is scanned directly without being compiled.

[0036] Source point: The entry point for data, typically used to execute initialization documents.

[0037] Vulnerability trigger point (sink point): also called tainted sensitive point, is a system call point where tainted data may be misused.

[0038] Tainted parameters: Parameters passed in from the front end are called tainted parameters from a security perspective. A tainted parameter means that the user can modify it themselves. Similarly, non-tainted parameters are not parameters passed in from the front end, meaning that the user cannot modify them arbitrarily.

[0039] With the rapid development of network technology, information security is facing enormous challenges, and user privacy is also facing significant challenges. User privacy is often accessed without authorization by others, leading to information leaks. Therefore, major websites and platforms conduct unauthorized access risk detection when users access data to prevent information leaks.

[0040] There are generally two methods for detecting horizontal privilege escalation vulnerabilities: one is black-box detection, which involves creating two accounts with the same privilege level. The first account performs a legitimate test to obtain a legitimate test request URL. Based on this URL, the second account performs a control test to obtain the corresponding control test request result. This control test result is then compared with the permissions of the first account to determine if a horizontal privilege escalation vulnerability exists. However, this method requires pre-creating accounts and then conducting separate tests, making deployment cumbersome and inefficient. The other method is Interactive Application Security Testing (IAST), which combines database resource parsing of SQL (Structured Query Language) statements with a detection model to detect horizontal privilege escalation. However, this method also heavily relies on external conditions, such as the detection model, making deployment cumbersome and inefficient.

[0041] To address the aforementioned issues, this embodiment of the specification determines the data flow information of the target user identifier and target resource identifier by scanning data entry instructions; extracts database operation instructions from the data flow information; scans the database operation instructions to obtain target instruction parameters; and matches the target user identifier, target resource identifier, and target instruction parameters to determine whether a horizontal privilege escalation risk exists based on the matching result. By scanning data entry instructions to determine the data flow information of the target user identifier and target resource identifier, the process of compiling the data entry instructions is omitted. Furthermore, database operation instructions are extracted from this data flow information, and target instruction parameters are obtained by scanning these instructions. The target user identifier, target resource identifier, and target instruction parameters are then matched to determine whether a horizontal privilege escalation risk exists based on the matching result. In other words, the above process determines the existence of a horizontal privilege escalation risk by starting with the data entry instructions and performing operations, without relying on other external conditions, making the determination of whether a horizontal privilege escalation risk exists more efficient.

[0042] This specification provides a method for detecting horizontal privilege escalation, and also relates to a horizontal privilege escalation detection device, a computing device, and a computer-readable storage medium, which will be described in detail in the following embodiments.

[0043] See Figure 1 , Figure 1 This diagram illustrates the interaction flow of a horizontal privilege escalation detection system architecture according to an embodiment of this specification, as shown below. Figure 1 As shown, the system includes server 0101 and client 0102.

[0044] Horizontal privilege escalation risk detection is performed on access requests initiated by client 0102. In real-world data access scenarios, server 0101 typically has a large amount of source code. This source code is related to locally configured access control policies and can include user login-related source code, access control policy source code, data storage source code, etc., collectively referred to as source code. Server 0101 scans the source code to identify the target user. Specifically, it can be obtained from user login-related source code (e.g., login-state code). Additionally, when a user has data access needs, they will initiate a user access request to server 0101 through client 0102. 1. Scanning user access requests yields the target resource identifier, i.e., the identifier of the resource the user wants to access. Since the user identifier and resource identifier are two core indicators in horizontal privilege escalation detection, it is necessary to track the data flow of the target user identifier and the target resource identifier to obtain their data flow information. This data flow information represents the complete data access process. To more accurately detect horizontal privilege escalation, it is necessary to extract database operation instructions from the aforementioned data flow information, scan these instructions to obtain the target instruction parameters, match the target user identifier and target resource identifier with the target instruction parameters, and determine whether a horizontal privilege escalation risk exists based on the matching results.

[0045] One possible implementation is to return the result of whether there is a risk of horizontal privilege escalation to the client 0102. If there is a risk, the client is informed that there is a risk of horizontal privilege escalation. If there is no risk, the client is shown that the access is healthy and can continue. Another possible implementation is that the server 0101 processes the user access request initiated by the client 0102 based on the access result. If there is no risk, the server 0101 allows the user access request to proceed normally. If there is a risk, the server 0101 blocks the user access request and refuses access.

[0046] Specifically, by scanning data entry commands, the data flow information of the target user identifier and target resource identifier is determined; database operation commands are extracted from the data flow information; the database operation commands are scanned to obtain target command parameters; the target user identifier, target resource identifier, and target command parameters are matched, and the existence of horizontal privilege escalation risk is determined based on the matching results. By scanning data entry commands to determine the data flow information of the target user identifier and target resource identifier, the process of compiling the data entry commands is omitted. Database operation commands are extracted from this data flow information, and the target command parameters are obtained by scanning these database operation commands. The target user identifier, target resource identifier, and target command parameters are matched, and the existence of horizontal privilege escalation risk is determined based on the matching results. In other words, the above process determines the existence of horizontal privilege escalation risk by starting with the data entry commands and performing operations, without relying on other external conditions, making the determination of horizontal privilege escalation risk more efficient.

[0047] See Figure 2 , Figure 2 A flowchart of a horizontal unauthorized access detection method according to an embodiment of this specification is shown, which specifically includes the following steps.

[0048] Step 202: Scan the data entry command to determine the data flow information of the target user identifier and the target resource identifier.

[0049] Specifically, data entry instructions refer to the software entry point for data, that is, the software program that receives / generates data. This can include source code such as login status, or code corresponding to user access requests. Target user identifiers are identifiers that represent the identity of the target user, such as the target user's login account, user ID, etc. Target resource identifiers are identifiers that represent the target resource, such as the name of the target resource, the location where the target resource is stored, etc. Data flow information refers to the complete execution code of a certain type of data. Data flow refers to the data flow direction of this type of data throughout the entire execution process. For example, information generated from the acquisition and processing of the target user identifier (e.g., acquisition, deletion, matching, etc.); information generated from the acquisition, processing, and matching of the target resource identifier, etc., until the corresponding output is generated.

[0050] Scanning data entry commands involves directly scanning the code using static scanning. One possible implementation is to scan for keywords in the data entry commands, extracting and summarizing commands containing those keywords to form data stream information. Another possible implementation is to scan through comparison. Specifically, the parameters contained in the data entry commands are broken down and extracted, then compared and filtered with the parameters that need to be identified, such as the target user identifier (uid) and the target resource identifier (resourceid). The commands corresponding to the compared parameters are then extracted and combined to form data stream information. This scanning method eliminates the need for code compilation, simplifies the detection process, and improves the efficiency of detecting horizontal privilege escalation risks.

[0051] For example, data flow information refers to the information generated by the data flow from the source point to the sink point. For instance, the data flow information of the target user identifier can be the information generated by the process of obtaining the target user identifier (uid) from the source point through the processing of intermediate data flow nodes to reach the sink point; the data flow information of the target resource identifier can be the information generated by the process of obtaining the target resource identifier (resourceid) from the source point through the processing of intermediate data flow nodes to reach the sink point.

[0052] When the target user identifier and target resource identifier are processed through intermediate data stream nodes, simple initialization, checking whether the determined target user identifier and target resource identifier conform to the preset parameter format rules, or other operations that do not affect the detection of the risk of exceeding the authority level can be performed. These operations can be selected and processed according to actual needs.

[0053] In another optional embodiment of this specification, the data entry instruction may include source code and a user access request, and the data flow information of the target user identifier and the target resource identifier can be determined by scanning the source code and the user access request. That is, when the data entry instruction includes source code and a user access request, the steps described above for scanning the data entry instruction to determine the data flow information of the target user identifier and the target resource identifier include the following specific steps:

[0054] Scan the source code, identify code features representing user identity in the source code, and determine the data stream information of the target user identifier;

[0055] Scan the user access request to determine the data stream information of the target resource identifier.

[0056] Specifically, source code, also known as source program, refers to a series of server-side access control codes generated when a user initiates an access request. It is also a series of readable computer language instructions. For example, when a user initiates an access request, the server generates code based on the request. This code can correspond to the user's access request or to the login state. The server can determine the target user's data flow information by scanning the login state code or analyzing the code in context. A user access request is a request initiated by a user through a client to access resources. For example, a user access request may include the identifier of the target resource, the location identifier of the target resource, the size identifier of the target resource, etc. Code characteristics refer to the features of the code corresponding to parameters representing the user's identity obtained by scanning the source code used for access control. For example, to obtain the data flow information of the target user identifier, the user's uid can be searched; if the uid is found, code characteristics are confirmed.

[0057] Depending on the content contained in the user access request, the parameters determined by scanning the user access request will also be different. For example, if the user access request contains only the target resource identifier as a parameter, scanning the user access request will only obtain the data stream information of the target resource identifier; if the user access request contains both the target resource identifier and the target resource's storage location identifier as parameters, scanning the user access request will obtain the data stream information of both the target resource identifier and the target resource's storage location identifier. Specifically, scanning the source code and user access request can be done by extracting keywords corresponding to the target user identifier and the target resource identifier, and using the instruction information corresponding to the keywords as their respective data stream information; alternatively, the source code and user access request can be split, and the parameters obtained from the split can be compared with the target user identifier and the target resource identifier. Parameters that match successfully, or whose comparison rate reaches a preset comparison threshold (e.g., 80%), are considered successfully matched parameters, and the instruction information corresponding to the successfully matched parameters is used as their respective data stream information.

[0058] By applying the scheme of the embodiments of this specification, when the data entry instruction includes source code and user access request, the data flow information of the target user identifier can be determined by scanning the source code, and the data flow information of the target resource identifier can be determined by scanning the user access request. The data flow information of the target user identifier and the target resource identifier are obtained through two different channels, which makes the method of determining data flow information more extensive, the scope covered more broadly, and the result of determining the horizontal privilege escalation risk more accurate.

[0059] In another optional implementation of this specification, if no code features are identified in the source code, it can be determined that there is a risk of horizontal privilege escalation. That is, after the above-described scanning of the source code, the steps further include the following specific steps:

[0060] If the code features are not identified from the source code, then a horizontal privilege escalation risk is identified.

[0061] Optionally, if no code features are identified in the source code, it indicates that the source code does not contain data flow information identifying the target user. In this case, horizontal privilege escalation detection can only be performed based on the data flow information identifying the target resource. However, horizontal privilege escalation refers to accessing or manipulating data that does not belong to the user, which necessarily requires obtaining the data flow information identifying the user. Therefore, simply determining the data flow information of the target resource is insufficient for horizontal privilege escalation detection. Both the target user and target resource identifiers must be present simultaneously when detecting horizontal privilege escalation.

[0062] The solution implemented in this specification indicates that a horizontal privilege escalation risk can be identified even when no code features are found in the source code. Furthermore, when performing horizontal privilege escalation risk detection on a particular access, it is necessary to perform detection based on both the target user identifier and the target resource identifier. Therefore, if no code features are found, the target user identifier cannot be determined, thus indicating a horizontal privilege escalation risk. This logical process is rigorous and comprehensive, avoiding situations where the risk is not identified in the main process. Instead, it chooses to make a direct judgment, thereby improving the efficiency of subsequent horizontal privilege escalation risk detection.

[0063] Step 204: Extract database operation instructions from the data stream information.

[0064] Specifically, database operation instructions refer to the codes corresponding to the steps of operating the database during the data flow process. In other words, the codes corresponding to the database operations are extracted from the codes corresponding to the information generated during the data flow process.

[0065] Database operation instructions are extracted from the data stream information of the target user identifier and the target resource identifier. Individual database operation instructions are extracted so that they can be directly processed later, such as scanning the database operation instructions to obtain the target instruction parameters.

[0066] Optionally, database operation instructions can be extracted from the data stream information. One possible implementation is to identify keywords and extract the instructions containing those keywords. For example, identify the operation instruction containing "query" in the data stream information and extract the identified operation instruction as a database operation instruction. Another possible implementation is that database operations are usually performed on the last node in the entire data stream, so the instruction corresponding to the last operation in the data stream link can be extracted directly.

[0067] By applying the scheme of the embodiments of this specification, after determining the data flow information of the target user identifier and the target resource identifier, database operation instructions are extracted from the data flow information. This allows the database operation instructions to be used to obtain parameters that match the target user identifier and the target resource identifier, thereby efficiently determining whether there is a risk of horizontal privilege escalation.

[0068] Step 206: Scan the database operation instructions to obtain the target instruction parameters.

[0069] Specifically, target instruction parameters refer to the parameters contained in database operation instructions. These parameters can be tainted or non-tainted, such as target resource identifiers, target user identifiers, etc.

[0070] Scanning database operation commands to obtain target command parameters involves static scanning of the code corresponding to the steps that perform database operations. This reveals the command parameters contained within the command. Specifically, one possible implementation is to identify relevant keywords. For example, if the database operation command is `Daoimpl.query(uid, resourceid…)`, the parameters within the parentheses "()" are extracted to obtain the target command parameters. Another possible implementation is to search and iterate through the database operation commands based on predefined parameters such as `uid`, `resourceid`, etc., to determine which parameters are included, and then use these determined parameters as the target command parameters.

[0071] The solution implemented in this specification involves scanning database operation instructions to obtain target instruction parameters, which facilitates subsequent matching with target user identifiers and target resource identifiers, thereby accelerating the determination of whether there is a risk of horizontal privilege escalation.

[0072] Step 208: Match the target user identifier, the target resource identifier, and the target instruction parameters, and determine whether there is a risk of horizontal privilege escalation based on the matching results.

[0073] Specifically, horizontal privilege escalation risk refers to the risk of accessing or manipulating data that does not belong to oneself. For example, user A and user B belong to the same role and have the same permission level. They can access their own private data (data A and data B). However, if the system only verifies the role that can access the data without further segmenting or verifying the data, user A may be able to access user B's data (data B). In this case, user A's behavior of accessing data B is called horizontal privilege escalation.

[0074] Optionally, matching the target user identifier, target resource identifier, and target instruction parameters can be implemented in several ways. One possible approach is to determine whether the target instruction parameters include both the target user identifier and the target resource identifier. Another possible approach is to first determine whether the target instruction parameters include the target resource identifier, and then analyze the other parameters in the target instruction parameters besides the target user identifier and match them with the target user identifier. Yet another possible approach is to determine that if the target instruction parameters only include the target resource identifier or do not include both the target user identifier and the target resource identifier, then the match is considered unsuccessful, indicating a risk of horizontal privilege escalation.

[0075] In another optional implementation of this specification, it can be that the target instruction parameters simultaneously include a target user identifier and a target resource identifier. If not, a horizontal privilege escalation risk is determined. That is, the step of matching the target user identifier, the target resource identifier, and the target instruction parameters, and determining whether a horizontal privilege escalation risk exists based on the matching result, includes the following specific steps:

[0076] Identify whether the target instruction parameter includes both the target user identifier and the target resource identifier;

[0077] If not, then the risk of horizontal overreach is confirmed.

[0078] Optionally, identifying whether the target instruction parameters simultaneously include both the target user identifier and the target resource identifier can be implemented in two ways. One possible implementation is to identify that the target instruction parameters only include the target user identifier and not the target resource identifier. Horizontal privilege escalation detection is usually performed only when an access request is received; it is unlikely that horizontal privilege escalation risk detection would be performed without receiving a user access request. Another possible implementation is that the target instruction parameters only include the target resource identifier and not the target user identifier. For example, when scanning the data entry instruction, the data flow information of the target user identifier is determined, but the target instruction parameters do not include the target user identifier. In this case, the target user identifier is obtained but does not contribute to the detection. Alternatively, the data flow information of the target user identifier may not be determined when scanning the data entry instruction.

[0079] There are several scenarios where the target instruction parameters only include the target resource identifier and not the target user identifier. One possible implementation is that the target user identifier has already been determined by scanning the data stream information of the data entry instruction, but the target user identifier is not involved in the process of obtaining the target instruction parameters, so the target instruction parameters do not include the target user identifier. Another possible implementation is that the target user identifier cannot be determined by the data entry instruction, so it is impossible to directly identify whether the target instruction parameters include the target user identifier.

[0080] By applying the scheme of the embodiments of this specification, by identifying the target instruction parameters, the target user identifier, and the target resource identifier, it is found that the target instruction parameters do not simultaneously include the target user identifier and the target resource identifier, thus determining the existence of horizontal privilege escalation risk. This method of determining the existence of horizontal privilege escalation risk by determining that the target user identifier and the target resource identifier do not participate in the access simultaneously, and judging the horizontal privilege escalation risk based on the access, makes the determination of the existence of horizontal privilege escalation risk more efficient.

[0081] In another optional embodiment of this specification, when the target instruction parameter includes both the target user identifier and the target resource identifier, the target release instruction is parsed to obtain preset matching conditions. Further, if the target user identifier and the target resource identifier do not meet the preset matching conditions, a horizontal privilege escalation risk is determined. That is, after the step of identifying whether the target instruction parameter includes both the target user identifier and the target resource identifier, the following specific steps are also included:

[0082] If so, the target clearance instruction is parsed to obtain the preset matching conditions for allowing clearance;

[0083] If the target user identifier and the target resource identifier do not match the preset matching conditions, a horizontal privilege escalation risk is identified.

[0084] Specifically, a target grant instruction refers to the code that controls whether an access request is granted normally. Preset matching conditions refer to pre-set conditions that need to be matched, such as whether the target user identifier is used as a judgment condition in the target grant instruction. Specifically, this can be achieved by decomposing and analyzing the target grant instruction to determine which parameters in the target grant instruction can be used as preset matching conditions, and then using those parameters as preset matching conditions.

[0085] For example, the target permission instruction could be "select * from table where resourceid = #resourceId# and uid = #uid#". By breaking down and analyzing this permission instruction, "resourceid = #resourceid# and uid = #uid#" is selected as the preset matching condition. If it does not meet the condition, there is a risk of horizontal privilege escalation.

[0086] Optionally, when the target instruction parameters include both the target user identifier and the target resource identifier, after parsing the target release instruction and obtaining the preset matching conditions for allowing release, there are several possible scenarios. In one possible implementation, the target resource identifier may meet the preset matching conditions, but the target user identifier may not, in which case there is a risk of horizontal privilege escalation. In another possible implementation, neither the target user identifier nor the target resource identifier may meet the preset matching conditions, in which case there is a risk of horizontal privilege escalation. In yet another possible implementation, both the target user identifier and the target resource identifier may meet the preset matching conditions, in which case there is no risk of horizontal privilege escalation.

[0087] The solution implemented in this specification, when the target instruction parameters include both the target user identifier and the target resource identifier, parses the target release instruction to obtain the preset matching conditions for allowing release. Furthermore, if the target user identifier and the target resource identifier do not meet the preset matching conditions, it is determined that there is a horizontal privilege escalation risk. Through multi-level judgment, the determination of whether there is a horizontal privilege escalation risk is more efficient.

[0088] In another optional implementation of this specification, if the target user identifier and the target resource identifier meet the preset matching conditions, it can be determined that there is no risk of horizontal privilege escalation. That is, after parsing the target permission instruction to obtain the preset matching conditions for permission, the steps further include the following specific steps:

[0089] If the target user identifier and the target resource identifier meet the preset matching conditions, it is determined that there is no risk of horizontal privilege escalation.

[0090] Optionally, if the target user identifier and the target resource identifier meet the preset matching conditions, it can be determined that there is no risk of horizontal privilege exceeding the limit. This can be achieved by having the target user identifier and the target resource identifier both included in the target instruction parameter, and the target user identifier and the target resource identifier meeting the preset matching conditions obtained by parsing the target release instruction.

[0091] The solution implemented in this specification determines that there is no risk of horizontal privilege escalation when the target user identifier and the target resource identifier meet the preset matching conditions. That is, the result of determining that there is no risk of horizontal privilege escalation through double comparison of the target user identifier with the target instruction parameters and with the preset matching conditions is more efficient.

[0092] In another possible implementation of this specification, it may involve obtaining a pre-set database access configuration code file and extracting the target permission instruction from the database access configuration code file. That is, before parsing the target permission instruction to obtain the preset matching conditions for permission, the steps may also include the following specific steps:

[0093] Obtain the pre-configured database access code file;

[0094] Extract the target release instruction from the database access configuration code file.

[0095] Specifically, database access configuration code files refer to pre-configured code files in the database that store various access requests. For example, the framework for operating the database data access object (DAO) layer in code software stores all database operation code statements in XML (Extensible Markup Language) format files.

[0096] The solution implemented in this specification extracts the target access instruction from a pre-set database access configuration code file, parses the target access instruction to obtain preset matching conditions, and then judges whether the target user identifier and target resource identifier meet the preset matching conditions. This judgment is based on a unified standard and will not change due to different client inputs, making the subsequent determination of whether there is a horizontal privilege escalation risk more efficient.

[0097] In another possible implementation of this specification, if the data flow information of the target user identifier cannot be determined by scanning the data entry command, a reference parameter is extracted from the target command parameters, and the reference parameter is analyzed in context within the data entry command to determine the data flow information of the target user identifier. That is, before the steps of matching the target user identifier, the target resource identifier, and the target command parameters, and determining whether there is a risk of horizontal privilege escalation based on the matching result, the following specific steps are also included:

[0098] If the data stream information of the target user identifier cannot be determined by scanning the data entry command, then a reference parameter is extracted from the target command parameter, wherein the reference parameter is a parameter other than the user identifier and the resource identifier;

[0099] In the data entry instruction, the reference parameters are analyzed in context to determine the data stream information of the target user identifier.

[0100] Specifically, reference parameters refer to parameters other than user identifiers and resource identifiers extracted from target instruction parameters, and can be non-tainted parameters.

[0101] In the data entry instruction, the reference parameters are analyzed to obtain parameters that can identify the user's identity. The obtained parameters are used as the target user identifier, and the data stream corresponding to the parameter is used as the data stream of the target user identifier.

[0102] Optionally, when the data stream information of the target user identifier is not determined in the scanning data entry command, there are several possibilities. One possible implementation is to directly extract parameters other than the user identifier and resource identifier from the target command parameters as reference parameters, and perform context analysis on the reference parameters to determine the data stream information of the target user identifier. Another possible implementation is to directly extract parameters other than the resource identifier from the target command parameters as reference parameters, check whether there are parameters used to identify the user identity in the reference parameters, and if so, use the parameter that identifies the user identity and the corresponding data stream information as the data stream information of the target user identifier.

[0103] Context analysis can involve comparing information from multiple past access requests with reference parameters to determine the data stream information of the target user identifier. For example, if the reference parameter is the location where the target resource identifier is stored, then by matching it with the resource identifier storage locations contained in past access requests, it can be determined whether there is a resource identifier storage location that is the same as the target resource identifier storage location. If so, then the user with uid11 who accessed the resource identifier storage location is taken as the target user identifier. Specifically, the matching can be done by comparing the target resource identifier storage location identifier with a preset repository that stores past access request information one by one, and filtering out resource identifier storage locations that are the same as the target resource identifier storage location.

[0104] The solution implemented in this specification does not determine the target user identifier when scanning the data entry command. Instead, it extracts other parameters besides the user identifier and resource identifier from the target command parameters as reference parameters. Then, it analyzes these reference parameters using the context in the data entry command to determine the data flow information of the target user identifier. This allows the target user identifier's data flow information to be determined even if it is not directly scanned, through reverse lookup. This enables the risk of horizontal privilege escalation in access requests to be determined from multiple perspectives.

[0105] This manual uses static scanning combined with multi-dimensional data (data flow information of target user identifier, data flow information of target resource identifier, and pre-set database access configuration code file) to analyze and judge whether there is a risk of horizontal privilege escalation in the access request by using user identity information and access information as the starting point for judgment.

[0106] The scheme implemented in this specification involves scanning data entry instructions to determine the data flow information of the target user identifier and the target resource identifier; extracting database operation instructions from the data flow information; scanning the database operation instructions to obtain target instruction parameters; matching the target user identifier, the target resource identifier, and the target instruction parameters; and determining whether a horizontal privilege escalation risk exists based on the matching results. By scanning data entry instructions to determine the data flow information of the target user identifier and the target resource identifier, the process of compiling the data entry instructions is omitted. Furthermore, database operation instructions are extracted from this data flow information, and the target instruction parameters are obtained by scanning these instructions. The target user identifier, the target resource identifier, and the target instruction parameters are then matched, and the existence of a horizontal privilege escalation risk is determined based on the matching results. In other words, the above process determines the existence of a horizontal privilege escalation risk by starting with the data entry instructions and performing operations, without relying on other external conditions, making the determination of whether a horizontal privilege escalation risk exists more efficient.

[0107] The following is in conjunction with the appendix Figure 3 Taking the application of the horizontal privilege escalation detection method provided in this specification in resource access as an example, the horizontal privilege escalation detection method will be further explained. Specifically, Figure 3 The flowchart of a horizontal unauthorized access detection method provided in one embodiment of this specification is shown, which specifically includes the following steps.

[0108] Step 302: Scan the data entry instructions to determine if the instruction "String uid=Context().getuid()" exists.

[0109] If not, proceed to step 312 to determine if there is a risk of horizontal privilege escalation; if yes, obtain the target uid, proceed to step 306, reach the intermediate data stream node, and execute "execute the operation content corresponding to the intermediate data stream node".

[0110] The processing in step 302 above can be performed as a source point: by scanning the source code, identifying code features, and determining the data flow information of the target user identifier, if no code features are identified, it is determined that there is a risk of horizontal privilege escalation; if code features are obtained by scanning, the target user identifier corresponding to the code features is obtained and input to the intermediate data flow node.

[0111] Step 304: Scan the data entry command to obtain the command "Controller.start(resourceid)".

[0112] The processing in step 304 above can be handled as a source point: by scanning user access requests, obtain the instruction "Controller.start(resourceid)" to get the target resourceid; then jump to step 306.

[0113] Step 306: Execute the operation corresponding to the intermediate data stream node.

[0114] Intermediate data stream nodes can perform simple initialization of target user identifiers and target resource identifiers, or check whether target user identifiers and target resource identifiers conform to preset parameter format rules, etc.

[0115] Step 308: Obtain the instruction “Daoimpl.query(uid, resourceid…)” and determine the number of parameters in the instruction.

[0116] If no (only one parameter), i.e. only resourceid, then proceed to step 312 to determine if there is a risk of horizontal privilege escalation; if yes (more than one parameter), then proceed to step 310.

[0117] The above steps can be processed as sink points: extract the database operation instructions and scan the database operation instructions to obtain the target instruction parameters; and identify whether the target instruction parameters include both the target user identifier and the target resource identifier. If not, proceed to step 312 to determine if there is a horizontal privilege escalation risk; if so, proceed to step 310.

[0118] Step 310: Obtain the target release command "select * from table where resourceid = #resourceid# and uid = #uid#", and determine whether the target uid and target resourceid match the #uid# and #resourceid# in the command.

[0119] Obtain the pre-set database access configuration code file; extract the target access permission instruction from the database access configuration code file, parse the target access permission instruction, obtain the preset matching conditions for allowing access, and determine whether the target user identifier and the target resource identifier meet the preset matching conditions. If not, it means that the target uid or the target resourceid does not meet the preset matching conditions, and then proceed to step 312 to determine that there is a risk of horizontal privilege escalation; if yes, it means that the target uid and the target resourceid meet the preset matching conditions, and then proceed to step 314 to determine that there is no risk of horizontal privilege escalation.

[0120] Step 312: Identify the risk of horizontal overreach.

[0121] Step 314: Determine that there is no risk of horizontal overreach.

[0122] The scheme implemented in this specification involves scanning data entry instructions to determine the data flow information of the target user identifier and the target resource identifier; extracting database operation instructions from the data flow information; scanning the database operation instructions to obtain target instruction parameters; matching the target user identifier, the target resource identifier, and the target instruction parameters; and determining whether a horizontal privilege escalation risk exists based on the matching results. By scanning data entry instructions to determine the data flow information of the target user identifier and the target resource identifier, the process of compiling the data entry instructions is omitted. Furthermore, database operation instructions are extracted from this data flow information, and the target instruction parameters are obtained by scanning these instructions. The target user identifier, the target resource identifier, and the target instruction parameters are then matched, and the existence of a horizontal privilege escalation risk is determined based on the matching results. In other words, the above process determines the existence of a horizontal privilege escalation risk by starting with the data entry instructions and performing operations, without relying on other external conditions, making the determination of whether a horizontal privilege escalation risk exists more efficient.

[0123] See Figure 4a , Figure 4b , Figure 4c , Figure 4d , Figure 4a The diagram illustrates an example instruction diagram of a horizontal unauthorized access detection method according to an embodiment of this specification in a risk-free scenario. Figure 4bThe diagram illustrates an example of instructions for a horizontal privilege escalation detection method according to an embodiment of this specification under a risky condition (no target user identifier is matched). Figure 4c The diagram illustrates an example instruction of a horizontal privilege escalation detection method according to an embodiment of this specification under a risky condition (where the target instruction parameter does not include the target user identifier). Figure 4d The diagram illustrates an example instruction for a horizontal privilege escalation detection method according to an embodiment of this specification under a risky condition (the target user identifier does not meet preset matching conditions), specifically including:

[0124] Figure 4a , Figure 4b , Figure 4c , Figure 4d Some terms in the code can be understood as follows: "@Controller" indicates that the category is a controller class; "public class Controller" refers to a controller that accesses a public class; "@RequestMapping" is an annotation used to handle request address mapping; "RequestMethod" is the request type; "@ResponseBody" is used to annotate and convert the object returned by the controller's method into the specified format using an appropriate converter before writing it to the body of the response object; "public Object query" refers to the public query object; "@RequestParam" is used to assign specified request parameters to the formal parameters in the method; "IOException" is the base class of exceptions thrown when accessing information using streams, files, and directories; "Context()" is the context query data; there are "normal query logic" and "exception query logic".

[0125] Specifically, Figure 4aThe scan identifies the data stream information of the target user by confirming the existence of the instruction "String uid=Context().getuid()". It also identifies the data stream information of the target resource by confirming the existence of the instruction "public Object query(@RequestParam("resourceId")String resourceId)throws IOException". The database operation instruction "String result=Daoimpl.query(uid、resourceid)" is extracted from this data stream information. Since the target instruction parameters in the database operation instruction are "uid、resourceid", and the target permission instruction "select*from table where resourceid=#resourceId#and uid=#uid#" is satisfied, there is no risk.

[0126] Figure 4b During the scan, the presence of the instruction "String uid=Context().getuid()" was confirmed, thus revealing the data stream information of the target user identifier. The presence of the instruction "public Object query(@RequestParam("resourceId")String resourceId)throws IOException" was also confirmed, revealing the data stream information of the target resource identifier. The database operation instruction "String result=Daoimpl.query(param、resourceid)" was extracted from the data stream information. Therefore, the target instruction parameters included the target resource identifier but not the target user identifier, which is risky.

[0127] Figure 4c During the scan, the presence of the instruction "String uid=Context().getuid()" was confirmed, thus revealing the data stream information of the target user identifier. The presence of the instruction "public Object query(@RequestParam("resourceId")String resourceId)throws IOException" was also confirmed, revealing the data stream information of the target resource identifier. The database operation instruction "String result=Daoimpl.query(param、resourceid)" was extracted from this data stream information. Therefore, the target instruction parameter is another type that includes the target resource identifier but not the target user identifier, which is risky.

[0128] Figure 4d During the scan, the presence of the instruction "String uid=Context().getuid()" was confirmed, thus identifying the data stream information of the target user identifier. The presence of the instruction "public Object query(@RequestParam("resourceId")String resourceId)throws IOException" was also confirmed, identifying the data stream information of the target resource identifier. The database operation instruction "String result=Daoimpl.query(uid、resourceid)" was extracted from the data stream information. The target instruction parameters in the database operation instruction include "uid、resourceid", but do not satisfy "select *from table where resourceid=#resourceId#", indicating a potential risk.

[0129] The scheme implemented in this specification involves scanning data entry instructions to determine the data flow information of the target user identifier and the target resource identifier; extracting database operation instructions from the data flow information; scanning the database operation instructions to obtain target instruction parameters; matching the target user identifier, the target resource identifier, and the target instruction parameters; and determining whether a horizontal privilege escalation risk exists based on the matching results. By scanning data entry instructions to determine the data flow information of the target user identifier and the target resource identifier, the process of compiling the data entry instructions is omitted. Furthermore, database operation instructions are extracted from this data flow information, and the target instruction parameters are obtained by scanning these instructions. The target user identifier, the target resource identifier, and the target instruction parameters are then matched, and the existence of a horizontal privilege escalation risk is determined based on the matching results. In other words, the above process determines the existence of a horizontal privilege escalation risk by starting with the data entry instructions and performing operations, without relying on other external conditions, making the determination of whether a horizontal privilege escalation risk exists more efficient.

[0130] Corresponding to the above method embodiments, this specification also provides embodiments of a horizontal unauthorized access detection device. Figure 5 A schematic diagram of a horizontal overreach detection device according to one embodiment of this specification is shown. Figure 5 As shown, the device includes:

[0131] The determination module 502 is configured to scan data entry instructions to determine the data flow information of the target user identifier and the target resource identifier;

[0132] Extraction module 504 is configured to extract database operation instructions from data stream information;

[0133] Module 506 is configured to scan database operation commands and obtain target command parameters.

[0134] Matching module 508 is configured to match the target user identifier, the target resource identifier, and the target instruction parameters, and determine whether there is a risk of horizontal privilege escalation based on the matching results.

[0135] Optionally, the data entry instructions include source code and user access requests; the determination module 502 is further configured to scan the source code, identify code features in the source code that represent the user's identity, and determine the data flow information of the target user identifier; and scan the user access request to determine the data flow information of the target resource identifier.

[0136] Optionally, the horizontal privilege escalation detection device further includes a first horizontal privilege escalation risk determination module, configured to determine the existence of a horizontal privilege escalation risk if no code features are identified from the source code.

[0137] Optionally, the matching module 508 is further configured to identify whether the target instruction parameters include both the target user identifier and the target resource identifier; if not, it is determined that there is a risk of horizontal privilege escalation.

[0138] Optionally, the horizontal privilege escalation detection device further includes a second horizontal privilege escalation risk determination module, which is configured to, if so, parse the target release instruction to obtain the preset matching conditions for allowing release; and determine that there is a horizontal privilege escalation risk if the target user identifier and the target resource identifier do not meet the preset matching conditions.

[0139] Optionally, the horizontal privilege escalation detection device also includes a third horizontal privilege escalation risk determination module, configured to determine that there is no horizontal privilege escalation risk if the target user identifier and the target resource identifier meet preset matching conditions.

[0140] Optionally, the horizontal unauthorized access detection device further includes an acquisition module configured to acquire a pre-set database access configuration code file; and a target release instruction extraction module configured to extract a target release instruction from the database access configuration code file.

[0141] Optionally, the horizontal unauthorized access detection device further includes a reference parameter extraction module, configured to extract reference parameters from the target instruction parameters if the data flow information of the target user identifier cannot be determined by the scan data entry instruction, wherein the reference parameters are parameters other than the user identifier and resource identifier; and also includes an analysis module, configured to perform context analysis on the reference parameters in the data entry instruction to determine the data flow information of the target user identifier.

[0142] The scheme implemented in this specification involves scanning data entry instructions to determine the data flow information of the target user identifier and the target resource identifier; extracting database operation instructions from the data flow information; scanning the database operation instructions to obtain target instruction parameters; matching the target user identifier, the target resource identifier, and the target instruction parameters; and determining whether a horizontal privilege escalation risk exists based on the matching results. By scanning data entry instructions to determine the data flow information of the target user identifier and the target resource identifier, the process of compiling the data entry instructions is omitted. Furthermore, database operation instructions are extracted from this data flow information, and the target instruction parameters are obtained by scanning these instructions. The target user identifier, the target resource identifier, and the target instruction parameters are then matched, and the existence of a horizontal privilege escalation risk is determined based on the matching results. In other words, the above process determines the existence of a horizontal privilege escalation risk by starting with the data entry instructions and performing operations, without relying on other external conditions, making the determination of whether a horizontal privilege escalation risk exists more efficient.

[0143] The above is a schematic scheme of a horizontal unauthorized access detection device according to this embodiment. It should be noted that the technical solution of this horizontal unauthorized access detection device and the technical solution of the horizontal unauthorized access detection method described above belong to the same concept. For details not described in detail in the technical solution of the horizontal unauthorized access detection device, please refer to the description of the technical solution of the horizontal unauthorized access detection method described above.

[0144] Figure 6 A structural block diagram of a computing device according to one embodiment of this specification is shown. The components of the computing device 600 include, but are not limited to, a memory 610 and a processor 620. The processor 620 is connected to the memory 610 via a bus 630, and a database 650 is used to store data.

[0145] The computing device 600 also includes an access device 640, which enables the computing device 600 to communicate via one or more networks 660. Examples of these networks include Public Switched Telephone Network (PSTN), Local Area Network (LAN), Wide Area Network (WAN), Personal Area Network (PAN), or combinations of communication networks such as the Internet. The access device 640 may include one or more of any type of wired or wireless network interface (e.g., Network Interface Card (NIC)), such as an IEEE 802.11 Wireless Local Area Networks (WLAN) interface, a Wi-MAX (World Interoperability for Microwave Access) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, and so on.

[0146] In one embodiment of this specification, the above-described components of the computing device 600 and Figure 6 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 6 The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0147] The computing device 600 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or personal computers (PCs). The computing device 600 can also be a mobile or stationary server.

[0148] The processor 620 is configured to execute the following computer-executable instructions, which, when executed by the processor, implement the steps of the above-described horizontal privilege escalation detection method.

[0149] The above is an illustrative scheme of a computing device according to this embodiment. It should be noted that the technical solution of this computing device and the technical solution of the horizontal unauthorized access detection method described above belong to the same concept. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solution of the horizontal unauthorized access detection method described above.

[0150] An embodiment of this specification also provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the above-described horizontal privilege escalation detection method.

[0151] The above is an illustrative scheme of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of this storage medium belongs to the same concept as the technical solution of the horizontal privilege escalation detection method described above. For details not described in detail in the technical solution of the storage medium, please refer to the description of the technical solution of the horizontal privilege escalation detection method described above.

[0152] An embodiment of this specification also provides a computer program, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the above-described horizontal privilege escalation detection method.

[0153] The above is an illustrative example of a computer program according to this embodiment. It should be noted that the technical solution of this computer program belongs to the same concept as the technical solution of the horizontal privilege escalation detection method described above. Details not described in detail in the computer program's technical solution can be found in the description of the technical solution of the horizontal privilege escalation detection method described above.

[0154] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0155] The computer instructions include computer program code, which may be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium may be appropriately added to or subtracted according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0156] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments in this specification are not limited to the described order of actions, because according to the embodiments in this specification, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments in this specification.

[0157] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0158] The preferred embodiments disclosed above are merely illustrative of this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the embodiments described herein. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the embodiments, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A method for detecting horizontal over-weighting, comprising: Scan the data entry command to determine the data flow information of the target user identifier and the target resource identifier, wherein the data flow information represents the information generated by the flow of the target user identifier and the target resource identifier from the data entry to the database operation command; Extract database operation instructions from the data stream information; Scan the database operation instructions to obtain the target instruction parameters; Identify whether the target instruction parameter includes both the target user identifier and the target resource identifier; If not, then the risk of horizontal overreach is confirmed; If so, the target release instruction is parsed to obtain the preset matching conditions for allowing release, wherein the target release instruction is extracted from the database access configuration code file; If the target user identifier and the target resource identifier do not match the preset matching conditions, a horizontal privilege escalation risk is identified.

2. The method according to claim 1, wherein the data entry instruction includes source code and user access request; The scan data entry command determines the data stream information of the target user identifier and the target resource identifier, including: Scan the source code, identify code features representing user identity in the source code, and determine the data stream information of the target user identifier; Scan the user access request to determine the data stream information of the target resource identifier.

3. The method according to claim 2, further comprising, after scanning the source code: If the code features are not identified from the source code, then a horizontal privilege escalation risk is identified.

4. The method according to claim 1, after parsing the target release instruction to obtain the preset matching conditions for allowing release, further comprising: If the target user identifier and the target resource identifier meet the preset matching conditions, it is determined that there is no risk of horizontal privilege escalation.

5. The method according to claim 1, further comprising, before parsing the target release instruction to obtain the preset matching conditions for allowing release: Obtain the pre-configured database access code file; Extract the target release instruction from the database access configuration code file.

6. The method according to claim 1, further comprising, before identifying whether the target instruction parameter simultaneously includes the target user identifier and the target resource identifier: If the data stream information of the target user identifier cannot be determined by scanning the data entry command, then a reference parameter is extracted from the target command parameter, wherein the reference parameter is a parameter other than the user identifier and the resource identifier; In the data entry instruction, the reference parameters are analyzed in context to determine the data stream information of the target user identifier.

7. A horizontal overreach detection device, comprising: The determination module is configured to scan data entry instructions to determine the data flow information of the target user identifier and the target resource identifier, wherein the data flow information represents the information generated by the flow of the target user identifier and the target resource identifier from the data entry to the database operation instructions; The extraction module is configured to extract database operation instructions from the data stream information; The acquisition module is configured to scan the database operation instructions to obtain the target instruction parameters; The matching module is configured to identify whether the target instruction parameter simultaneously includes the target user identifier and the target resource identifier; if not, it determines that there is a horizontal privilege escalation risk; if so, it parses the target permission instruction to obtain preset matching conditions for permission, wherein the target permission instruction is extracted from the database access configuration code file; if the target user identifier and the target resource identifier do not meet the preset matching conditions, it determines that there is a horizontal privilege escalation risk.

8. A computing device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions, which, when executed by the processor, implement the steps of the horizontal overreach detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the horizontal overreach detection method according to any one of claims 1 to 6.

10. A computer program product comprising computer-executable instructions that, when executed by a processor, implement the steps of the horizontal overreach detection method according to any one of claims 1 to 6.

Images