Access request processing method, device, computer equipment and storage medium

Abstract

The present application relates to an access request processing method, device, computer equipment, storage medium and computer program product. The method includes: receiving a resource access request from a user, obtaining user identification information and target resource identification information in the resource access request; obtaining user security tag information corresponding to the user identification information, and resource security tag information corresponding to the target resource identification information; performing security tag information determination on the resource access request according to the user security tag information and the resource security tag information, and obtaining a security tag information determination result; when the security tag information determination result is that the resource access request is passed, replacing the target resource identification information in the resource access request with the target resource path, thereby sending the target resource's response result to the resource access request to the user. The use of this method can accurately and effectively verify the legitimacy of the user's access behavior.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an access request processing method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] With the development of information security technology, power monitoring systems that detect user access security have emerged.

[0003] However, the existing power monitoring system has little control over user access behavior and cannot accurately and effectively verify whether the user's access behavior is legal and compliant, resulting in frequent security issues such as unauthorized access to resources, non-valid access, and cross-level access, resulting in low detection accuracy of access security. Summary of the invention

[0004] Based on this, it is necessary to provide an access request processing method, apparatus, computer device, computer-readable storage medium and computer program product that can enhance access security in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for processing an access request. The method comprises:

[0006] Receive a resource access request from a user, and obtain user identification information and target resource identification information in the resource access request;

[0007] Acquire user security marking information corresponding to the user identification information, and resource security marking information corresponding to the target resource identification information; the user security marking information includes a user preset indicator, and the resource security marking information includes a target resource preset indicator;

[0008] Performing security tag information determination on the resource access request according to the user security tag information and the resource security tag information to obtain a security tag information determination result;

[0009] If the security tag information determines that the resource access request is approved, the target resource identification information in the resource access request is replaced with a target resource path, and the replaced resource access request is forwarded to the target resource corresponding to the target resource path;

[0010] The response result of the target resource to the resource access request is sent to the user.

[0011] In one embodiment, performing security tag information determination on the resource access request according to the user security tag information and the resource security tag information to obtain the security tag information determination result includes:

[0012] Compare each of the user preset indicators in the user security marking information with each of the target resource preset indicators in the resource security marking information to obtain a comparison result corresponding to each of the user preset indicators;

[0013] When the comparison results corresponding to the respective user preset indicators are all judged as passed, it is confirmed that the security mark information judgment result is that the resource access request is passed.

[0014] In one embodiment, the user preset indicators include a first access level, a first organization, a first region, a first role, a first access validity period, and a list of accessible resources corresponding to the user, and the target resource preset indicators include a second access level, a second organization, a second region, a second role, and a second access validity period;

[0015] When the comparison results corresponding to the preset indicators are all judged as passed, confirming that the security mark information judgment result is that the resource access request is passed includes:

[0016] When the first access level is greater than or equal to the second access level, the first organization is included in the second organization, the first region is included in the second region, the first role is the same as the second role, the access time corresponding to the resource access request is within the first access validity period and the second access validity period, and the list of accessible resources includes the target resource identification information, confirm that the security tag information judgment result is that the resource access request is approved.

[0017] In one embodiment, before obtaining the user security tag information corresponding to the user identification information and the resource security tag information corresponding to the target resource identification information, the method further includes:

[0018] Verifying the user identification information to obtain the identity authentication result of the user;

[0019] The acquiring of user security marking information corresponding to the user identification information and resource security marking information corresponding to the target resource identification information includes:

[0020] When the identity authentication result is that the identity authentication of the user is passed, user security marking information corresponding to the user identification information and resource security marking information corresponding to the target resource identification information are acquired.

[0021] In one embodiment, the verifying the user identification information to obtain the identity verification result of the user includes:

[0022] Obtaining first user identity information in the user identification information and second user identity information in the certificate;

[0023] comparing the first user identity information and the second user identity information;

[0024] When the first user identity information and the second user identity information are the same, confirm that the identity authentication result is that the identity authentication of the user is passed.

[0025] In one embodiment, before sending the response result of the target resource to the resource access request to the user, the method further includes:

[0026] Recording the user's access behavior to the target resource; the method further includes:

[0027] In the case that an abnormality occurs in the target resource, an abnormal user is identified from users accessing the target resource according to the recorded access behavior.

[0028] In a second aspect, the present application also provides an access request processing device. The device comprises:

[0029] A request receiving module, used to receive a resource access request from a user, and obtain user identification information and target resource identification information in the resource access request;

[0030] An information acquisition module, used to acquire user security tag information corresponding to the user identification information, and resource security tag information corresponding to the target resource identification information; the user security tag information includes a preset indicator for the user, and the resource security tag information includes a preset indicator for the target resource;

[0031] A result determination module, configured to perform security tag information determination on the resource access request according to the user security tag information and the resource security tag information, and obtain a security tag information determination result;

[0032] A request forwarding module, configured to replace the target resource identification information in the resource access request with a target resource path, and forward the replaced resource access request to a target resource corresponding to the target resource path, if the security tag information determines that the resource access request is passed;

[0033] The resource sending module is used to send the response result of the target resource corresponding to the target resource path to the resource access request to the user.

[0034] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0035] Receive a resource access request from a user, and obtain user identification information and target resource identification information in the access request;

[0036] Acquire user security marking information corresponding to the user identification information, and resource security marking information corresponding to the target resource identification information; the user security marking information includes a user preset indicator, and the resource security marking information includes a target resource preset indicator;

[0037] Performing security tag information determination on the resource access request according to the user security tag information and the resource security tag information to obtain a security tag information determination result;

[0038] If the security tag information determines that the resource access request is approved, the target resource identification information in the resource access request is replaced with a target resource path, and the replaced resource access request is forwarded to the target resource corresponding to the target resource path;

[0039] The response result of the target resource to the resource access request is sent to the user.

[0040] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0041] Receive a resource access request from a user, and obtain user identification information and target resource identification information in the access request;

[0042] Acquire user security marking information corresponding to the user identification information, and resource security marking information corresponding to the target resource identification information; the user security marking information includes a user preset indicator, and the resource security marking information includes a target resource preset indicator;

[0043] Performing security tag information determination on the resource access request according to the user security tag information and the resource security tag information to obtain a security tag information determination result;

[0044] If the security tag information determines that the resource access request is approved, the target resource identification information in the resource access request is replaced with a target resource path, and the replaced resource access request is forwarded to the target resource corresponding to the target resource path;

[0045] The response result of the target resource to the resource access request is sent to the user.

[0046] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0047] Receive a resource access request from a user, and obtain user identification information and target resource identification information in the access request;

[0048] Acquire user security marking information corresponding to the user identification information, and resource security marking information corresponding to the target resource identification information; the user security marking information includes a user preset indicator, and the resource security marking information includes a target resource preset indicator;

[0049] Performing security tag information determination on the resource access request according to the user security tag information and the resource security tag information to obtain a security tag information determination result;

[0050] If the security tag information determines that the resource access request is approved, the target resource identification information in the resource access request is replaced with a target resource path, and the replaced resource access request is forwarded to the target resource corresponding to the target resource path;

[0051] The response result of the target resource to the resource access request is sent to the user.

[0052] The access request processing method, device, computer equipment, storage medium and computer program product described above, by receiving a resource access request from a user, obtains the user identification information and the target resource identification information in the access request; then obtains the user security tag information corresponding to the user identification information, and the resource security tag information corresponding to the target resource identification information, the user security tag information includes a user preset index, and the resource security tag information includes a target resource preset index; then, according to the user security tag information and the resource security tag information, the resource access request is subjected to security tag information determination, and a security tag information determination result is obtained; finally, when the security tag information determination result is that the resource access request is passed, the target resource identification information in the resource access request is replaced with the target resource path, and the replaced resource access request is forwarded to the target resource corresponding to the target resource path; the target resource's response result to the resource access request is sent to the user. In this way, when verifying the legality of the user's access behavior, a variety of indicators are used for comprehensive verification, which can accurately and effectively verify whether the user's access behavior is legal and compliant, and reduce the occurrence of illegal access phenomena such as unauthorized access to resources, non-valid access, and cross-level access. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 An application environment diagram of an access request processing method in an embodiment;

[0054] Figure 2 A schematic diagram of a flow chart of an access request processing method in one embodiment;

[0055] Figure 3 A flowchart of an access request processing method in another embodiment;

[0056] Figure 4 A flowchart of a method for processing an access request in another embodiment;

[0057] Figure 5 is a structural block diagram of an access request processing device in one embodiment;

[0058] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0060] The access request processing method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown in FIG. 1 , the dynamic evaluation system 102 communicates with the user terminal 101 and the target resource 103 through the network. Figure 1 , the dynamic evaluation system 102 receives the resource access request of the user terminal 101, and obtains the user identification information and the target resource identification information in the resource access request; the dynamic evaluation system 102 then obtains the user security tag information corresponding to the user identification information, and the resource security tag information corresponding to the target resource identification information; the dynamic evaluation system 102 performs security tag information determination on the resource access request according to the user security tag information and the resource security tag information, and obtains the security tag information determination result; when the security tag information determination result is that the resource access request is passed, the dynamic evaluation system 102 replaces the target resource identification information in the resource access request with the target resource path, and forwards the replaced resource access request to the target resource 103 corresponding to the target resource path; the dynamic evaluation system 102 finally sends the response result of the target resource 103 to the resource access request to the user terminal 101. Among them, the user terminal 101 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices, and the Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc.

[0061] In one embodiment, Figure 2 As shown, a method for processing an access request is provided, which is applied to Figure 1 The dynamic evaluation system in is taken as an example to illustrate, which includes the following steps:

[0062] Step S201: receiving a resource access request from a user, and obtaining user identification information and target resource identification information in the resource access request.

[0063] Among them, resource access request refers to the request initiated by the user to the dynamic assessment system through the network to access the target resource. Resource refers to various resources in the network. For example, an application system, a picture, a file or a web page can be regarded as a resource; user identification information includes user identity information and user actual status, the status includes but is not limited to the access validity period, the list of accessible resources, historical access records and corresponding role permissions, etc.; target resource identification information includes the actual status of the target resource, the status includes but is not limited to the access level, access validity period, affiliated organization and affiliated region, etc.

[0064] Specifically, the dynamic evaluation system generates an information acquisition instruction carrying the identification of information to be acquired in response to a resource access request initiated by a user, and acquires the user identification information and the target resource identification information in the resource access request according to the instruction.

[0065] For example, the target resource that the user needs to access is a web page. In response to the web page access request initiated by the user, the dynamic evaluation system generates an information acquisition instruction carrying the information identifier to be obtained, and obtains the user identification information and the target resource identification information in the resource access request according to the instruction.

[0066] Step S202, obtaining user security marking information corresponding to the user identification information and resource security marking information corresponding to the target resource identification information; the user security marking information includes user preset indicators, and the resource security marking information includes target resource preset indicators.

[0067] Among them, user preset indicators include organization, region, role, access level, validity period and list of accessible resources; target resource preset indicators include organization, region, role, access level and validity period.

[0068] Specifically, the dynamic assessment system obtains user security tag information corresponding to the user identification information and resource security tag information corresponding to the target resource identification information according to the information acquisition instruction; the user security tag information includes user preset indicators, and the resource security tag information includes target resource preset indicators.

[0069] For example, the dynamic assessment system obtains the organization, region, role, access level, validity period and accessible resource list in the user security tag information, as well as the organization, region, role, access level and validity period in the resource security tag information according to the information acquisition instruction.

[0070] Step S203: Perform security tag information determination on the resource access request according to the user security tag information and the resource security tag information to obtain a security tag information determination result.

[0071] Among them, security tag information determination refers to the determination operations performed on the organization, region, role, access level, validity period, and accessible resource list.

[0072] Specifically, the dynamic assessment system receives a security tag information determination instruction, and performs a security tag information determination on the resource access request according to the instruction requirement to obtain a security tag information determination result.

[0073] For example, the dynamic assessment system receives a security tag information determination instruction, performs a security tag information determination on a resource access request, and obtains a security tag information determination result that the resource access request is approved.

[0074] Step S204, when the security tag information determines that the resource access request is approved, the target resource identification information in the resource access request is replaced with the target resource path, and the replaced resource access request is forwarded to the target resource corresponding to the target resource path.

[0075] The target resource path refers to the service address. For example, we need a service to access a web page or download a picture. The service address here is the target resource path. The target resource refers to various resources on the network. For example, an application system, a picture, a file or a web page can be regarded as a resource.

[0076] Specifically, when the security tag information determines that the resource access request is passed, the dynamic assessment system receives a resource forwarding instruction, and according to the instruction requirements, replaces the target resource identification information in the resource access request with the target resource path, and forwards the replaced resource access request to the target resource corresponding to the target resource path.

[0077] For example, if the target resource identifier is: keymanagement, the target resource path after replacement is: https: / / mbd.baidu.com, if the address requested by the user is: https: / / keymanagement / newspage / data / landingsuper, then the address that the dynamic evaluation system needs to forward is: https: / / mbd.baidu.com / newspage / data / landingsuper.

[0078] Step S205: Send the response result of the target resource to the resource access request to the user.

[0079] Specifically, the dynamic evaluation system receives a result forwarding instruction, receives a response result of a target resource corresponding to the target resource path to a resource access request according to the instruction requirement, and forwards the response result to the resource access request to the user.

[0080] For example, the dynamic evaluation system receives a result forwarding instruction, receives a response result of a target resource corresponding to a target resource path to a resource access request https: / / mbd.baidu.com / newspage / data / landingsuper, and forwards the response result to a user.

[0081] In the above access request processing method, by receiving the resource access request of the user, the user identification information and the target resource identification information in the access request are obtained; then the user security tag information corresponding to the user identification information and the resource security tag information corresponding to the target resource identification information are obtained, the user security tag information includes the user preset index, and the resource security tag information includes the target resource preset index; then according to the user security tag information and the resource security tag information, the resource access request is subjected to security tag information determination to obtain the security tag information determination result; finally, when the security tag information determination result is that the resource access request is passed, the target resource identification information in the resource access request is replaced with the target resource path, and the replaced resource access request is forwarded to the target resource corresponding to the target resource path; the response result of the target resource to the resource access request is sent to the user. In this way, when verifying the legality of the user's access behavior, the use of multiple indicators for comprehensive verification can accurately and effectively verify whether the user's access behavior is legal and compliant, and reduce the occurrence of illegal access phenomena such as unauthorized access to resources, non-valid access, and cross-level access.

[0082] In one embodiment, the above step S203 performs security tag information determination on the resource access request based on the user security tag information and the resource security tag information to obtain a security tag information determination result, which specifically includes the following contents: comparing each user preset indicator in the user security tag information with each target resource preset indicator in the resource security tag information to obtain a comparison result corresponding to each user preset indicator; when the comparison results corresponding to each user preset indicator are all passed, confirming that the security tag information determination result is that the resource access request is passed.

[0083] Among them, user preset indicators include organization, region, role, access level, validity period and list of accessible resources; target resource preset indicators include organization, region, role, access level and validity period.

[0084] Specifically, the dynamic assessment system receives a preset indicator comparison instruction, and according to the instruction requirements, compares each user preset indicator in the user security tag information with each target resource preset indicator in the resource security tag information to obtain a comparison result corresponding to each user preset indicator; when the comparison results corresponding to each user preset indicator are all judged to be passed, the security tag information judgment result is confirmed to be that the resource access request is passed.

[0085] For example, the dynamic assessment system receives a preset indicator comparison instruction. According to the instruction requirements, the organization, region, role, access level, and validity period in the user security tag information are compared with the organization, region, role, access level, and validity period in the resource security tag information. The comparison results corresponding to the preset indicators of each user are all judged to be passed, and the security tag information judgment result is confirmed to be that the resource access request is passed.

[0086] In this embodiment, by comparing each user preset indicator in the user security tag information with each target resource preset indicator in the resource security tag information, the comparison result corresponding to each user preset indicator is obtained. In this way, when determining the security tag information of a resource access request, a comprehensive comparison using multiple indicators can accurately and effectively verify whether the user's access behavior is legal and compliant.

[0087] In one embodiment, the user preset indicators include a first access level, a first organization, a first region, a first role, a first access validity period and a list of accessible resources corresponding to the user, and the target resource preset indicators include a second access level, a second organization, a second region, a second role and a second access validity period; in the above steps, when the comparison results corresponding to each user preset indicator are all judged as passed, confirming that the security tag information judgment result is that the resource access request is passed, and specifically also includes the following content: when the first access level is greater than or equal to the second access level, the first organization is included in the second organization, the first region is included in the second region, the first role is the same as the second role, the access time corresponding to the resource access request is within the first access validity period and the second access validity period, and the list of accessible resources includes the target resource identification information, confirming that the security tag information judgment result is that the resource access request is passed.

[0088] Among them, the first organization and the first region refer to the organization and region to which the user belongs respectively; the second organization and the second region refer to the organization and region to which the user belongs respectively; and the accessible resource list refers to the content list of resources that the user can currently access.

[0089] Specifically, the dynamic assessment system recognizes that when the first access level is greater than or equal to the second access level, the first organization is included in the second organization, the first region is included in the second region, the first role is the same as the second role, the access time corresponding to the resource access request is within the first access validity period and the second access validity period, and the list of accessible resources includes the target resource identification information, the security tag information judgment result is confirmed to be that the resource access request is passed.

[0090] In this embodiment, by comparing each user preset indicator in the user security tag information with each target resource preset indicator in the resource security tag information, the comparison result corresponding to each user preset indicator is obtained. In this way, when determining the security tag information of a resource access request, a comprehensive comparison using multiple indicators can accurately and effectively verify whether the user's access behavior is legal and compliant, and reduce the occurrence of illegal access phenomena such as unauthorized access to resources, non-valid access, and access beyond the level.

[0091] In one embodiment, the above-mentioned step S202, before obtaining the user security tag information corresponding to the user identification information and the resource security tag information corresponding to the target resource identification information, also includes: verifying the user identification information to obtain the user's identity authentication result; obtaining the user security tag information corresponding to the user identification information and the resource security tag information corresponding to the target resource identification information, including: when the identity authentication result is that the user's identity authentication is passed, obtaining the user security tag information corresponding to the user identification information and the resource security tag information corresponding to the target resource identification information.

[0092] The identity verification result refers to the result obtained by verifying the identity information of the user based on the user identification information.

[0093] Specifically, the dynamic evaluation system receives the identity authentication instruction, verifies the user identification information according to the instruction requirements, and obtains the user's identity authentication result.

[0094] For example, the dynamic assessment system receives an identity authentication instruction, verifies the user identification information according to the instruction requirements, and obtains the user's identity authentication result that the user's identity authentication is passed; then obtains the user security tag information corresponding to the user identification information, and the resource security tag information corresponding to the target resource identification information.

[0095] In this embodiment, the user's identity authentication result is obtained by verifying the user's identification information; and when the identity authentication result is that the user's identity authentication is passed, the user security tag information corresponding to the user identification information and the resource security tag information corresponding to the target resource identification information are obtained. In this way, before obtaining the user security tag information corresponding to the user identification information and the resource security tag information corresponding to the target resource identification information, verifying the user identification information can accurately and effectively verify whether the user's access behavior is legal and compliant.

[0096] In one embodiment, the above steps verify the user identification information to obtain the user's identity authentication result, which specifically includes the following contents: obtaining the first user identity information in the user identification information and the second user identity information in the certificate; comparing the first user identity information and the second user identity information; when the first user identity information and the second user identity information are the same, confirming that the identity authentication result is that the user's identity authentication is passed.

[0097] Among them, the certificate stores identity information and public keys, while the user has a private key that is virtually stored; certificate authentication uses a digital certificate issued by a certificate authority and public key encryption to verify the user's identity.

[0098] Specifically, the dynamic evaluation system receives an identity information verification instruction, obtains the first user identity information in the user identification information and the second user identity information in the certificate according to the instruction requirements, and compares the first user identity information with the second user identity information.

[0099] For example, the dynamic assessment system receives an identity information verification instruction, and according to the instruction requirements, obtains the first user identity information in the user identification information and the second user identity information in the certificate; compares the first user identity information and the second user identity information, and obtains the result that the first user identity information and the second user identity information are the same, and then confirms that the identity authentication result is that the user's identity authentication is passed.

[0100] In this embodiment, the first user identity information in the user identification information and the second user identity information in the certificate are obtained; the first user identity information and the second user identity information are compared; if the first user identity information and the second user identity information are the same, the identity authentication result is confirmed to be that the user's identity authentication has passed. In this way, verifying the user identity information by certificate verification can effectively verify whether the user's access behavior is legal and compliant.

[0101] In one embodiment, before sending the response result of the target resource to the resource access request to the user, the following contents are specifically included: recording the user's access behavior to the target resource; and in the event that an abnormality occurs to the target resource, identifying abnormal users from the users accessing the target resource based on the recorded access behavior.

[0102] Among them, the record of the user's access behavior to the target resource can be queried in the future.

[0103] Specifically, the dynamic evaluation system receives an access behavior recording instruction and records the user's access behavior to the target resource according to the instruction requirements.

[0104] In this embodiment, by recording the user's access behavior to the target resource, it is convenient to query the user's access behavior in the future.

[0105] In one embodiment, Figure 3 As shown, another access request processing method is provided, which is applied to Figure 1 The dynamic evaluation system in is taken as an example to illustrate, which includes the following steps:

[0106] Step S301: receiving a resource access request from a user, and obtaining user identification information and target resource identification information in the access request.

[0107] Step S302, obtaining the first user identity information in the user identification information and the second user identity information in the certificate; comparing the first user identity information and the second user identity information, and obtaining the user's identity verification result.

[0108] Step S303: when the identity authentication result is that the user's identity authentication is passed, obtain user security tag information corresponding to the user identification information and resource security tag information corresponding to the target resource identification information.

[0109] Step S304: Perform security tag information determination on the resource access request according to the user security tag information and the resource security tag information to obtain a security tag information determination result.

[0110] Step S305, when the security tag information determines that the resource access request is approved, the target resource identification information in the resource access request is replaced with the target resource path, and the replaced resource access request is forwarded to the target resource corresponding to the target resource path.

[0111] Step S306: Send the response result of the target resource to the resource access request to the user.

[0112] The access request processing method described above receives a resource access request from a user, obtains the user identification information and the target resource identification information in the access request; then obtains the user security tag information corresponding to the user identification information, and the resource security tag information corresponding to the target resource identification information, wherein the user security tag information includes a user preset index, and the resource security tag information includes a target resource preset index; then, according to the user security tag information and the resource security tag information, the resource access request is subjected to security tag information determination, and a security tag information determination result is obtained; finally, when the security tag information determination result is that the resource access request is passed, the target resource identification information in the resource access request is replaced with the target resource path, and the replaced resource access request is forwarded to the target resource corresponding to the target resource path; and the target resource's response result to the resource access request is sent to the user. In this way, when verifying the legality of the user's access behavior, the use of a variety of indicators for comprehensive verification can accurately and effectively verify whether the user's access behavior is legal and compliant, and reduce the occurrence of illegal access phenomena such as unauthorized access to resources, non-valid access, and cross-level access.

[0113] In order to more clearly illustrate the access request processing method provided by the embodiment of the present application, the access request processing method is specifically described below with a specific embodiment. Figure 4 As shown, the present application also provides another access request processing method, which specifically includes the following steps:

[0114] Step 1: The user initiates a request to access resources, and the dynamic evaluation system receives the user's request to access resources.

[0115] Step 2: Verify the legitimacy of the user's identity through the certificate, and analyze it based on the user's security tag and the security tag of the target resource. Only when it is analyzed that the user has the corresponding authority to access the target resource, the user is allowed to access the corresponding target resource and perform the corresponding operation.

[0116] Step 3: Perform behavioral analysis on the user's access request, obtain the user information and access target resource information from the request, analyze and determine the user's security tag information and the security tag information of the target resource that the user expects to access, and evaluate whether the user's access behavior matches the user's permissions.

[0117] Step 4: Analyze and judge based on the user's security tag and resource security tag, and comprehensively evaluate the user's identity through the determination of the security tag.

[0118] Step 5: Based on the determination result, determine whether the user access request has the corresponding authority, and then comprehensively evaluate whether the user access request received this time is legal.

[0119] Step 6: When the user access is deemed legitimate, the target resource identifier in the user access request is replaced with the target resource path, and the user access request is sent to the corresponding target resource for access.

[0120] The access request processing method described above receives a resource access request from a user, obtains the user identification information and the target resource identification information in the access request; then obtains the user security tag information corresponding to the user identification information, and the resource security tag information corresponding to the target resource identification information, wherein the user security tag information includes a user preset index, and the resource security tag information includes a target resource preset index; then, according to the user security tag information and the resource security tag information, the resource access request is subjected to security tag information determination, and a security tag information determination result is obtained; finally, when the security tag information determination result is that the resource access request is passed, the target resource identification information in the resource access request is replaced with the target resource path, and the replaced resource access request is forwarded to the target resource corresponding to the target resource path; and the target resource's response result to the resource access request is sent to the user. In this way, when verifying the legality of the user's access behavior, the use of a variety of indicators for comprehensive verification can accurately and effectively verify whether the user's access behavior is legal and compliant, and reduce the occurrence of illegal access phenomena such as unauthorized access to resources, non-valid access, and cross-level access.

[0121] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0122] Based on the same inventive concept, the embodiment of the present application also provides an access request processing device for implementing the access request processing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more access request processing device embodiments provided below can refer to the limitations on the access request processing method above, and will not be repeated here.

[0123] In one embodiment, Figure 5As shown, an access request processing device is provided, including: a request receiving module 501, an information obtaining module 502, a result determining module 503, a request forwarding module 504 and a resource sending module 505, wherein:

[0124] The request receiving module 501 is used to receive a resource access request from a user and obtain the user identification information and the target resource identification information in the resource access request.

[0125] The information acquisition module 502 is used to acquire user security tag information corresponding to the user identification information and resource security tag information corresponding to the target resource identification information; the user security tag information includes preset indicators for the user, and the resource security tag information includes preset indicators for the target resource.

[0126] The result determination module 503 is used to perform security tag information determination on the resource access request according to the user security tag information and the resource security tag information to obtain a security tag information determination result.

[0127] The request forwarding module 504 is used to replace the target resource identification information in the resource access request with the target resource path when the security tag information determines that the resource access request is passed, and forward the replaced resource access request to the target resource corresponding to the target resource path.

[0128] The resource sending module 505 is used to send the response result of the target resource corresponding to the target resource path to the resource access request to the user.

[0129] In one embodiment, the result determination module 503 is also used to compare each user preset indicator in the user security tag information with each target resource preset indicator in the resource security tag information to obtain a comparison result corresponding to each user preset indicator; when the comparison results corresponding to each user preset indicator are all judged as passed, the security tag information judgment result is confirmed to be that the resource access request is passed.

[0130] In one embodiment, the result determination module 503 is also used to confirm that the security tag information determination result is that the resource access request is approved when the first access level is greater than or equal to the second access level, the first organization is included in the second organization, the first region is included in the second region, the first role is the same as the second role, the access time corresponding to the resource access request is within the first access validity period and the second access validity period, and the list of accessible resources includes the target resource identification information.

[0131] In one embodiment, the information acquisition module 502 is also used to verify the user identification information to obtain the user's identity authentication result.

[0132] In one embodiment, the information acquisition module 502 is also used to obtain the first user identity information in the user identification information and the second user identity information in the certificate; compare the first user identity information and the second user identity information; and when the first user identity information and the second user identity information are the same, confirm that the identity authentication result is that the user's identity authentication is successful.

[0133] Each module in the access request processing device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0134] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as user identification information, user security tag information, target resource identification information and resource security tag information. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an access request processing method is implemented.

[0135] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory and a network interface connected by a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, an access request processing method is implemented.

[0136] Those skilled in the art will understand that Figure 6The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0137] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0138] Receive a resource access request from a user, and obtain user identification information and target resource identification information in the resource access request;

[0139] Acquire user security tag information corresponding to the user identification information, and resource security tag information corresponding to the target resource identification information; the user security tag information includes user preset indicators, and the resource security tag information includes target resource preset indicators;

[0140] According to the user security tag information and the resource security tag information, the security tag information of the resource access request is determined to obtain a security tag information determination result;

[0141] If the security tag information determines that the resource access request is approved, the target resource identification information in the resource access request is replaced with the target resource path, and the replaced resource access request is forwarded to the target resource corresponding to the target resource path;

[0142] The target resource's response to the resource access request is sent to the user.

[0143] In one embodiment, when the processor executes the computer program, the following steps are also implemented: comparing each user preset indicator in the user security tag information with each target resource preset indicator in the resource security tag information to obtain a comparison result corresponding to each user preset indicator; when the comparison results corresponding to each user preset indicator are all judged as passed, confirming that the security tag information judgment result is that the resource access request is passed.

[0144] In one embodiment, when the processor executes the computer program, the following steps are also implemented: when the first access level is greater than or equal to the second access level, the first organization is included in the second organization, the first region is included in the second region, the first role is the same as the second role, the access time corresponding to the resource access request is within the first access validity period and the second access validity period, and the list of accessible resources includes the target resource identification information, confirm that the security tag information judgment result is that the resource access request is passed.

[0145] In one embodiment, when the processor executes the computer program, the following steps are also implemented: verifying the user identification information to obtain the user's identity authentication result; obtaining the user security tag information corresponding to the user identification information, and the resource security tag information corresponding to the target resource identification information, including: when the identity authentication result is that the user's identity authentication is passed, obtaining the user security tag information corresponding to the user identification information, and the resource security tag information corresponding to the target resource identification information.

[0146] In one embodiment, when the processor executes the computer program, the following steps are also implemented: obtaining the first user identity information in the user identification information and the second user identity information in the certificate; comparing the first user identity information and the second user identity information; and when the first user identity information and the second user identity information are the same, confirming that the identity authentication result is that the user's identity authentication is passed.

[0147] In one embodiment, when the processor executes the computer program, the following steps are also implemented: recording the user's access behavior to the target resource; when an abnormality occurs to the target resource, identifying abnormal users from the users accessing the target resource based on the recorded access behavior.

[0148] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0149] Receive a resource access request from a user, and obtain user identification information and target resource identification information in the resource access request;

[0150] Acquire user security tag information corresponding to the user identification information, and resource security tag information corresponding to the target resource identification information; the user security tag information includes user preset indicators, and the resource security tag information includes target resource preset indicators;

[0151] According to the user security tag information and the resource security tag information, the security tag information of the resource access request is determined to obtain a security tag information determination result;

[0152] If the security tag information determines that the resource access request is approved, the target resource identification information in the resource access request is replaced with the target resource path, and the replaced resource access request is forwarded to the target resource corresponding to the target resource path;

[0153] The target resource's response to the resource access request is sent to the user.

[0154] In one embodiment, when the processor executes the computer program, the following steps are also implemented: comparing each user preset indicator in the user security tag information with each target resource preset indicator in the resource security tag information to obtain a comparison result corresponding to each user preset indicator; when the comparison results corresponding to each user preset indicator are all judged as passed, confirming that the security tag information judgment result is that the resource access request is passed.

[0155] In one embodiment, when the processor executes the computer program, the following steps are also implemented: when the first access level is greater than or equal to the second access level, the first organization is included in the second organization, the first region is included in the second region, the first role is the same as the second role, the access time corresponding to the resource access request is within the first access validity period and the second access validity period, and the list of accessible resources includes the target resource identification information, confirm that the security tag information judgment result is that the resource access request is passed.

[0156] In one embodiment, when the processor executes the computer program, the following steps are also implemented: verifying the user identification information to obtain the user's identity authentication result; obtaining the user security tag information corresponding to the user identification information, and the resource security tag information corresponding to the target resource identification information, including: when the identity authentication result is that the user's identity authentication is passed, obtaining the user security tag information corresponding to the user identification information, and the resource security tag information corresponding to the target resource identification information.

[0157] In one embodiment, when the processor executes the computer program, the following steps are also implemented: obtaining the first user identity information in the user identification information and the second user identity information in the certificate; comparing the first user identity information and the second user identity information; and when the first user identity information and the second user identity information are the same, confirming that the identity authentication result is that the user's identity authentication is passed.

[0158] In one embodiment, when the processor executes the computer program, the following steps are also implemented: recording the user's access behavior to the target resource; when an abnormality occurs to the target resource, identifying abnormal users from the users accessing the target resource based on the recorded access behavior.

[0159] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0160] Receive a resource access request from a user, and obtain user identification information and target resource identification information in the resource access request;

[0161] Acquire user security tag information corresponding to the user identification information, and resource security tag information corresponding to the target resource identification information; the user security tag information includes user preset indicators, and the resource security tag information includes target resource preset indicators;

[0162] According to the user security tag information and the resource security tag information, the security tag information of the resource access request is determined to obtain a security tag information determination result;

[0163] If the security tag information determines that the resource access request is approved, the target resource identification information in the resource access request is replaced with the target resource path, and the replaced resource access request is forwarded to the target resource corresponding to the target resource path;

[0164] The target resource's response to the resource access request is sent to the user.

[0165] In one embodiment, when the processor executes the computer program, the following steps are also implemented: comparing each user preset indicator in the user security tag information with each target resource preset indicator in the resource security tag information to obtain a comparison result corresponding to each user preset indicator; when the comparison results corresponding to each user preset indicator are all judged as passed, confirming that the security tag information judgment result is that the resource access request is passed.

[0166] In one embodiment, when the processor executes the computer program, the following steps are also implemented: when the first access level is greater than or equal to the second access level, the first organization is included in the second organization, the first region is included in the second region, the first role is the same as the second role, the access time corresponding to the resource access request is within the first access validity period and the second access validity period, and the list of accessible resources includes the target resource identification information, confirm that the security tag information judgment result is that the resource access request is passed.

[0167] In one embodiment, when the processor executes the computer program, the following steps are also implemented: verifying the user identification information to obtain the user's identity authentication result; obtaining the user security tag information corresponding to the user identification information, and the resource security tag information corresponding to the target resource identification information, including: when the identity authentication result is that the user's identity authentication is passed, obtaining the user security tag information corresponding to the user identification information, and the resource security tag information corresponding to the target resource identification information.

[0168] In one embodiment, when the processor executes the computer program, the following steps are also implemented: obtaining the first user identity information in the user identification information and the second user identity information in the certificate; comparing the first user identity information and the second user identity information; and when the first user identity information and the second user identity information are the same, confirming that the identity authentication result is that the user's identity authentication is passed.

[0169] In one embodiment, when the processor executes the computer program, the following steps are also implemented: recording the user's access behavior to the target resource; in the event of an abnormality in the target resource, identifying the abnormal user from the users accessing the target resource based on the recorded access behavior. It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0170] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0171] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0172] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for processing an access request, characterized in that: The method comprises: Receive a resource access request from a user, and obtain user identification information and target resource identification information in the resource access request; Acquire user security marking information corresponding to the user identification information, and resource security marking information corresponding to the target resource identification information; the user security marking information includes a user preset indicator, and the resource security marking information includes a target resource preset indicator; Compare each of the user preset indicators in the user security tag information with each of the target resource preset indicators in the resource security tag information to obtain a comparison result corresponding to each of the user preset indicators; the user preset indicators include a first access level, a first organization, a first region, a first role, a first access validity period and an accessible resource list corresponding to the user, and the target resource preset indicators include a second access level, a second organization, a second region, a second role and a second access validity period; when the first access level is greater than or equal to the second access level, the first organization is included in the second organization, the first region is included in the second region, the first role is the same as the second role, the access time corresponding to the resource access request is within the first access validity period and the second access validity period, and the accessible resource list includes the target resource identification information, confirm that the security tag information judgment result is that the resource access request is passed; If the security tag information determines that the resource access request is approved, the target resource identification information in the resource access request is replaced with a target resource path, and the replaced resource access request is forwarded to the target resource corresponding to the target resource path; The response result of the target resource to the resource access request is sent to the user.

2. The method according to claim 1, characterized in that Before acquiring the user security tag information corresponding to the user identification information and the resource security tag information corresponding to the target resource identification information, the method further includes: Verifying the user identification information to obtain the identity authentication result of the user; The acquiring of user security marking information corresponding to the user identification information and resource security marking information corresponding to the target resource identification information includes: When the identity authentication result is that the identity authentication of the user is passed, user security marking information corresponding to the user identification information and resource security marking information corresponding to the target resource identification information are acquired.

3. The method according to claim 2, characterized in that The verifying the user identification information to obtain the identity authentication result of the user includes: Obtaining first user identity information in the user identification information and second user identity information in the certificate; comparing the first user identity information and the second user identity information; When the first user identity information and the second user identity information are the same, confirm that the identity authentication result is that the identity authentication of the user is passed.

4. The method according to any one of claims 1 to 3, characterized in that: Before sending the response result of the target resource to the resource access request to the user, the method further includes: Recording the user's access behavior to the target resource; the method further includes: In the case that an abnormality occurs in the target resource, an abnormal user is identified from users accessing the target resource according to the recorded access behavior.

5. An access request processing device, characterized in that: The device comprises: A request receiving module, used to receive a resource access request from a user, and obtain user identification information and target resource identification information in the resource access request; An information acquisition module, used to acquire user security tag information corresponding to the user identification information, and resource security tag information corresponding to the target resource identification information; the user security tag information includes a preset indicator for the user, and the resource security tag information includes a preset indicator for the target resource; A result determination module is configured to compare each of the user preset indicators in the user security tag information with each of the target resource preset indicators in the resource security tag information to obtain a comparison result corresponding to each of the user preset indicators; the user preset indicators include a first access level, a first organization, a first region, a first role, a first access validity period and an accessible resource list corresponding to the user, and the target resource preset indicators include a second access level, a second organization, a second region, a second role and a second access validity period; when the first access level is greater than or equal to the second access level, the first organization is included in the second organization, the first region is included in the second region, the first role is the same as the second role, the access time corresponding to the resource access request is within the first access validity period and the second access validity period, and the accessible resource list includes the target resource identification information, confirm that the security tag information determination result is that the resource access request is passed; A request forwarding module, configured to replace the target resource identification information in the resource access request with a target resource path, and forward the replaced resource access request to a target resource corresponding to the target resource path, if the security tag information determines that the resource access request is passed; The resource sending module is used to send the response result of the target resource corresponding to the target resource path to the resource access request to the user.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

8. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images