A method and device for identifying a global service access relationship

Abstract

The application discloses a kind of global service identification method and device, the method includes: first, all services are assigned identity identification information;Then the identity identification information of initiator service is filled in the ip packet to be sent, and the ip packet is sent out, and initiator access log is generated;Then the received ip packet is analyzed on the receiver service side and receiver access log is generated;Finally, the access relationship is generated based on the initiator access log and the receiver access log.It can accurately identify the access relationship between services in the scene where there are a large number of network address translations across data centers, across regions, etc., effectively improving network security.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a method and device for identifying global business access relationship. BACKGROUND

[0002] At present, a large number of business systems are deployed in large enterprises, cloud platforms and servers to provide various services for users, and the number of businesses in the Internet is large and the sources are diversified, which brings great challenges to network security.

[0003] In the prior art, most of the schemes for identifying business access relationship are based on flow information on network nodes for analysis and identification, for example, monitoring network traffic information to form service access relationship of source address, source port, destination address and destination port, and the identification of business access relationship is limited to service address and port. In the scene of cross-data center, cross-region and the like, there are a large number of network address conversions, and the prior art cannot process the access relationship identification under the address conversion condition, and cannot effectively improve the network security.

[0004] Therefore, how to identify the access relationship under the address conversion condition and improve the network security is a technical problem to be solved by those skilled in the art. SUMMARY

[0005] The application aims to solve the technical problem that the prior art cannot process the access relationship identification under the address conversion condition.

[0006] To achieve the above technical purpose, the application provides a method for identifying global business access relationship, which comprises the following steps:

[0007] allocating identity identification information for all businesses;

[0008] filling the identity identification information of the initiator business into an ip packet to be sent, and sending the ip packet and generating an initiator access log;

[0009] analyzing the received ip packet at the receiver business and generating a receiver access log;

[0010] generating an access relationship based on the initiator access log and the receiver access log.

[0011] Preferably, the identity identification information comprises a globally unique code and a session random code.

[0012] Preferably, the identity identification information of the initiator business is encoded into the ip packet to be sent, and specifically, the globally unique code and the session random code are filled into the optional field in the ip packet.

[0013] Preferably, the initiator access log specifically includes a proxy code, an initiator business globally unique code, a source address, a source port, a destination address, a destination port, a session random code, and a sending timestamp.

[0014] Preferably, the receiver access log specifically includes a proxy code, a globally unique code for the initiator's business, a globally unique code for the receiver's business, a source address, a source port, a destination address, a destination port, a session random code, and a receiving timestamp.

[0015] Preferably, the method further includes obtaining initial information of all services and persistently storing services that are not present in the memory based on the initial information.

[0016] Accordingly, the present invention also provides a device for identifying global business access relationships, the device comprising:

[0017] The allocation module is used to assign identity information to all services.

[0018] The filling module is used to fill the identity information of the initiator's business into the IP packet to be sent before sending the IP packet and generating the initiator's access log;

[0019] The parsing module is used to parse the received IP packets and generate the receiver access log at the receiving end's service level;

[0020] The generation module is used to generate access relationships based on the initiator's access log and the receiver's access log.

[0021] Preferably, the identity information includes a globally unique code and a session random code.

[0022] Preferably, the filling module is specifically used to fill the globally unique code and session random code into optional fields in the IP packet.

[0023] This invention provides a method and apparatus for identifying access relationships across all business domains. Compared with existing technologies, this method first assigns identity information to all businesses; then, it fills the identity information of the initiating business into the IP packet to be sent and sends the IP packet, generating an initiating access log; next, the receiving business parses the received IP packet and generates a receiving access log; finally, it generates access relationships based on the initiating and receiving access logs. This method can accurately identify access relationships between businesses in scenarios involving significant network address translation, such as cross-data center and cross-regional scenarios, effectively improving network security. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 The diagram shown is a flowchart illustrating the global business access relationship identification method provided in the embodiments of this specification.

[0026] Figure 2 The diagram shown is a structural schematic of the global service access relationship identification device provided in the embodiments of this specification. Detailed Implementation

[0027] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0028] like Figure 1 The diagram illustrates a flowchart of the method for identifying full-domain service access relationships provided in this embodiment. While this specification provides the method operation steps or device structure shown in the following embodiments or figures, based on conventional methods or without creative effort, the method or device may include more or fewer operation steps or module units after partial merging. In steps or structures where there is no logically necessary causal relationship, the execution order of these steps or the module structure of the device are not limited to the execution order or module structure shown in the embodiments or figures of this specification. When the method or module structure is applied in actual devices, servers, or terminal products, it can be executed sequentially or in parallel according to the method or module structure shown in the embodiments or figures (e.g., in a parallel processor or multi-threaded processing environment, or even in a distributed processing or server cluster implementation environment).

[0029] The global service access relationship identification method provided in this embodiment can be applied to terminal devices such as clients and servers. Figure 1 As shown, the method specifically includes the following steps:

[0030] Step S101: Assign identity recognition information to all services.

[0031] In this embodiment of the application, the identity recognition information includes a globally unique code and a session random code.

[0032] Specifically, in order to accurately identify the access relationships between services, all services can be collected through a designated collection module. The specific collection module can be a collection agent in the corresponding server that collects information through system commands such as netstat. It can collect information such as the port, process name, process ID, and physical IP of the corresponding server. Each service is assigned an ID, which includes the machine code of the server, the internal IP, and the port tag. At the same time, each service is assigned a globally unique code and a session random code and sent to the corresponding service for storage to identify different services.

[0033] In addition, the technical solution of this application also includes obtaining the initial information of all services and persistently storing services that do not exist in the memory based on the initial information.

[0034] Step S102: Fill the IP packet to be sent with the identity information of the initiator's business, and then send the IP packet and generate the initiator's access log.

[0035] In this embodiment of the application, encoding the identity information of the initiator's business into the IP packet to be sent specifically involves filling the globally unique code and the session random code into the optional fields of the IP packet.

[0036] Specifically, since the optional fields in IP packets are not intercepted or modified by operators or intermediate devices, after the IP packet is forwarded through the network and some NAT devices, the data in its optional fields will be delivered completely to the receiving service. The optional fields of IP packets are generally 40 bytes long, and their basic structure is Code(8) + Length(8) + Data (variable length). The Code (copy + class + number) is designed as follows:

[0037] Code: 0 10 11011, meaning 0: copy only the first shard, 10: for debugging and management, and 11011: a custom number.

[0038] A unique identifier for the business, occupying 16 bytes, padded with 0s if necessary;

[0039] Session random encoding: 16 bytes, randomly generated by the business initiator based on the destination IP.

[0040] The option has a fixed length of 48 bits. Therefore, it is fixed in the following format:

[0041] 01011011 00110000 [Business Unique Identifier] [Session Random Encoding].

[0042] Assume the unique identifier for the business is 03 and the random code is 100.

[0043] "03", when taken as an integer and converted to binary, is 0011. After padding with 16 bits, it becomes 0000 0000 0000 0011.

[0044] The session random number is 100, which is 0110 0100 in binary. After padding with 16 bits, it becomes 0000 0000 01100100.

[0045] The complete list of optional fields is as follows:

[0046] 01011011 00110000 0000 0000 0000 0011 0000 0000 0110 0100.

[0047] In this embodiment of the application, the initiator access log specifically includes a proxy code, an initiator business globally unique code, a source address, a source port, a destination address, a destination port, a session random code, and a sending timestamp.

[0048] Specifically, an example of an initiator's access log in a real-world application scenario is as follows:

[0049]

[0050] Step S103: The received IP packets are parsed at the receiving service and a receiving access log is generated.

[0051] In this embodiment of the application, the receiver access log specifically includes a proxy code, a globally unique code for the initiator's business, a globally unique code for the receiver's business, a source address, a source port, a destination address, a destination port, a session random code, and a receiving timestamp.

[0052] Specifically, the parsing module that parses the received IP packets at the receiving end can also be performed by the collection agent on the server where the receiving end's business resides. The parsing mainly involves parsing the optional fields in the IP packets and generating a receiving end access log. An example of this receiving end access log is as follows:

[0053]

[0054] Step S104: Generate an access relationship based on the initiator's access log and the receiver's access log.

[0055] Specifically, the required access relationships can be formed based on the initiator's access logs and the receiver's access logs. An example of the access relationships in this application is as follows:

[0056]

[0057] It should be noted that the generation of access relationships can be flexibly set by those skilled in the art according to the actual situation, and is not limited to the above example.

[0058] After the above processing, it can accurately identify the access relationships between services and automatically and accurately identify the external network service IP and service port of services in situations involving a large amount of network address translation across data centers and regions, which greatly improves network security.

[0059] Based on the above-described method for identifying global business access relationships, one or more embodiments of this specification also provide a platform and terminal for identifying global business access relationships. The platform and terminal may include devices, software, modules, plug-ins, servers, clients, etc., that use the methods described in the embodiments of this specification, combined with necessary hardware implementations. Based on the same innovative concept, the systems in one or more embodiments provided in this specification are as described in the following embodiments. Since the implementation schemes and methods for solving the system problem are similar, the specific system implementations in the embodiments of this specification can refer to the implementation of the aforementioned methods. Repeated descriptions will not be repeated. The terms "unit" or "module" used below can refer to a combination of software and / or hardware that achieves a predetermined function. Although the systems described in the following embodiments are preferably implemented in software, hardware implementations, and a combination of software and hardware, are also possible and contemplated.

[0060] Specifically, Figure 2 This is a schematic diagram of the module structure of one embodiment of the global business access relationship identification device provided in this specification, as shown below. Figure 2 As shown, the device for identifying global service access relationships provided in this specification includes:

[0061] Allocation module 201 is used to allocate identity information to all services;

[0062] The filling module 202 is used to fill the identity information of the initiator's business into the IP packet to be sent and then send the IP packet, and generate the initiator's access log;

[0063] The parsing module 203 is used to parse the received IP packets and generate the receiver access log at the receiving end of the service.

[0064] The generation module 204 is used to generate access relationships based on the initiator's access log and the receiver's access log.

[0065] In some embodiments, the identification information includes a globally unique code and a session random code.

[0066] In some embodiments, the filling module is specifically used to fill the globally unique code and session random code into optional fields in the IP packet.

[0067] The initiator access log specifically includes the proxy code, the initiator's globally unique business code, the source address, the source port, the destination address, the destination port, the session random code, and the sending timestamp.

[0068] In some embodiments, the receiver access log specifically includes a proxy code, a globally unique code for the initiator's business, a globally unique code for the receiver's business, a source address, a source port, a destination address, a destination port, a session random code, and a receiving timestamp.

[0069] In some embodiments, the method further includes obtaining initial information for all services and persistently storing services that are not present in the memory based on the initial information.

[0070] It should be noted that the above-described apparatus may include other implementation methods according to the description of the corresponding method embodiments. The specific implementation methods can be referred to the description of the corresponding method embodiments above, and will not be elaborated here.

[0071] The software module provided in this application embodiment receives executable instructions from a control program. When the software module executes the executable instructions, it can assign identity information to all services; fill the identity information of the initiating service into the IP packet to be sent and send the IP packet, and generate an initiating access log; at the receiving service, it parses the received IP packet and generates a receiving access log; based on the initiating access log and the receiving access log, it generates access relationships. This enables accurate identification of access relationships between services in scenarios with a large amount of network address translation, such as cross-data center and cross-regional scenarios, effectively improving network security.

[0072] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0073] The methods or apparatus described in the embodiments provided in this specification can implement business logic through a computer program and record it on a storage medium. The storage medium can be read and executed by a computer to achieve the effects of the solutions described in the embodiments of this specification, such as:

[0074] Assign identification information to all business operations;

[0075] After filling the initiator's business identification information into the IP packet to be sent, the IP packet is sent out, and an initiator access log is generated;

[0076] The receiving party's business unit parses the received IP packets and generates the receiving party's access log;

[0077] An access relationship is generated based on the initiator's access log and the receiver's access log.

[0078] The embodiments in this specification are not limited to conforming to industry communication standards, standard computer resource data update and data storage rules, or the situations described in one or more embodiments of this specification. Slightly modified implementations based on certain industry standards or custom methods or embodiments can also achieve the same, equivalent, or similar, or predictable, implementation effects as described above. Embodiments that utilize these modified or modified methods for data acquisition, storage, judgment, and processing still fall within the scope of optional implementations of the embodiments in this specification.

[0079] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in a suitable manner in any one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0080] Those skilled in the art will recognize that the embodiments described herein are intended to help the reader understand the principles of the invention, and should be understood that the scope of protection of the invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations based on the technical teachings disclosed in this invention without departing from the spirit of the invention, and these modifications and combinations are still within the scope of protection of this invention.

Claims

1. A method for identifying global business access relationships, characterized in that, The method includes: Assign identification information to all business operations; After filling the initiator's business identification information into the IP packet to be sent, the IP packet is sent out, and an initiator access log is generated; the initiator access log contains the sender's business identification information. The receiving party's business parsed the received IP packets and generated a receiving party access log; the receiving party access log contained the identity information of the initiating party's business and the identity information of the receiving party's business. An access relationship is generated based on the initiator's access log and the receiver's access log.

2. The method for identifying global service access relationships as described in claim 1, characterized in that, The identity information includes a globally unique code and a session random code.

3. The method for identifying global service access relationships as described in claim 2, characterized in that, The step of encoding the identity information of the initiator's business into the IP packet to be sent specifically involves filling the globally unique code and the session random code into the optional fields of the IP packet.

4. The method for identifying global service access relationships as described in claim 2, characterized in that, The initiator access log specifically includes the proxy code, the initiator's globally unique business code, the source address, the source port, the destination address, the destination port, the session random code, and the sending timestamp.

5. The method for identifying global service access relationships as described in claim 2, characterized in that, The recipient access log specifically includes the proxy code, the initiator's globally unique business code, the recipient's globally unique business code, the source address, the source port, the destination address, the destination port, the session random code, and the reception timestamp.

6. The method for identifying global service access relationships as described in claim 1, characterized in that, The method further includes obtaining initial information for all services and persistently storing services that are not present in the memory based on the initial information.

7. A device for identifying global business access relationships, characterized in that, The device includes: The allocation module is used to assign identity information to all services. The filling module is used to fill the initiator's business identification information into the IP packet to be sent and then send the IP packet, and generate the initiator access log; wherein, the initiator access log contains the sender's business identification information; The parsing module is used to parse the received IP packets at the receiving end and generate the receiving end access log; the receiving end access log contains the identity information of the initiating end and the identity information of the receiving end. The generation module is used to generate access relationships based on the initiator's access log and the receiver's access log.

8. The device for identifying global service access relationships as described in claim 7, characterized in that, The identity information includes a globally unique code and a session random code.

9. The device for identifying global service access relationships as described in claim 8, characterized in that, The filling module is specifically used to fill the globally unique code and session random code into the optional fields in the IP packet.

Images