A method and device for managing function services

Abstract

The embodiment of the present application provides a function service management method and device, which is applied to a trust control center, and the method includes: receiving an access request forwarded by a trust security agent from a terminal, the trust security agent is deployed on a carrier of the function service, and the access request includes target access information; determining a target access permission level corresponding to the target access information; and sending the target access permission level to the trust security agent, so that the trust security agent controls the terminal access to the function service on the carrier according to the target security policy corresponding to the target access permission level. Applying the technical solution provided by the embodiment of the present application can improve the security of applications and data in function services.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a function service management method and device. Background Art

[0002] Function service is a new cloud computing model with a serverless architecture. Function service will be granted corresponding permissions, and function service can only perform CRUD (Create / Read / Update / Delete) operations on the database within the scope of the granted permissions. However, the permissions of function service may be for dozens or even more functions, which makes permissions a security weakness of function service. Summary of the invention

[0003] The purpose of the embodiment of the present application is to provide a function service management method and device to improve the security of applications and data in function services. The specific technical solution is as follows:

[0004] In a first aspect of an embodiment of the present application, a function service management method is provided, which is applied to a trust control center, and the method includes:

[0005] receiving an access request forwarded by a trusted security agent from a terminal, the trusted security agent being deployed on a carrier of a function service, the access request including target access information;

[0006] Determine a target access permission level corresponding to the target access information;

[0007] The target access permission level is issued to the trusted security agent, so that the trusted security agent controls the terminal to access the function service on the carrier according to the target security policy corresponding to the target access permission level.

[0008] In some embodiments, the step of determining the target access permission level corresponding to the target access information includes:

[0009] Extracting a target access category from the target access information;

[0010] The target access permission level corresponding to the target access permission category is determined according to the pre-stored correspondence between the access category and the access permission level.

[0011] In some embodiments, when the access category includes categories of multiple access types and the target access category includes access categories of multiple access types, the step of determining the target access permission level corresponding to the target access category according to the pre-stored correspondence between the access category and the access permission level includes:

[0012] Determine the sub-access right level corresponding to each target access category according to the pre-stored correspondence between the access category and the access right level;

[0013] Determine the target access level based on multiple sub-access levels.

[0014] In some embodiments, the step of determining the target access permission level according to the multiple sub-access permission levels includes:

[0015] Calculating a sum of the multiple sub-access rights levels;

[0016] According to the preset stored correspondence between the candidate level intervals and the access authority levels, the target access authority level corresponding to the candidate level interval where the sum value is located is determined.

[0017] In some embodiments, the access category includes one or more access type categories of user type, terminal type, and environment type;

[0018] The access permission level corresponding to each function service is determined based on basic information of the function service, or, alternatively, the access permission level corresponding to each function service is determined based on basic information of the function service and access information, wherein the basic information includes one or more of the number, type, importance and privacy level of the function service.

[0019] In some embodiments, the method further comprises:

[0020] Based on the access category and the access permission level corresponding to each function service under the access category, generate a security policy corresponding to the access permission level under the access category;

[0021] The correspondence between the access permission level under the access category and the security policy is sent to the trusted security agent.

[0022] In some embodiments, the basic information is information recorded by the trusted security agent when the function service is started.

[0023] In some embodiments, the method further comprises:

[0024] Identifying data in the target function service accessed by the access request to obtain the type of data accessed;

[0025] If the type of data accessed is sensitive data, the access request is associated with the target function service, and the destination and purpose of the accessed data are recorded.

[0026] In some embodiments, the step of identifying the data in the target function service accessed by the access request to obtain the accessed data type includes:

[0027] Extracting sensitive information from data in the target function service accessed by the access request, wherein the sensitive information includes one or more information of a network segment to which the data belongs, an operating environment, and a preset field in the data;

[0028] The extracted sensitive information is matched with the preset sensitive information to obtain the accessed data type.

[0029] In some embodiments, the method further comprises:

[0030] Based on the log of the trust control center, monitoring the access behavior of the terminal;

[0031] Comparing the intention of the access behavior with the target security policy and the historical access behavior to obtain a comparison result, wherein the comparison result indicates whether the terminal is abnormal;

[0032] When the comparison result indicates that the terminal is abnormal, an alarm message is output.

[0033] In some embodiments, the function services communicate with each other using a microservice framework and / or full-link bidirectional secure transport layer protocol TLS encryption.

[0034] In some embodiments, the trust control center is connected to a distributed authentication database;

[0035] The distributed authentication database stores information collected by the trust control center.

[0036] In a second aspect of an embodiment of the present application, a function service management device is provided, which is applied to a trust control center, and the device includes:

[0037] A receiving unit, configured to receive an access request forwarded by a trusted security agent from a terminal, wherein the trusted security agent is deployed on a carrier of a function service, and the access request includes target access information;

[0038] a determination unit, configured to determine a target access permission level corresponding to the target access information;

[0039] The issuing unit is used to issue the target access permission level to the trusted security agent, so that the trusted security agent controls the terminal to access the function service on the carrier according to the target security policy corresponding to the target access permission level.

[0040] In some embodiments, the determining unit is specifically configured to:

[0041] Extracting a target access category from the target access information;

[0042] The target access permission level corresponding to the target access permission category is determined according to the pre-stored correspondence between the access category and the access permission level.

[0043] In some embodiments, when the access category includes categories of multiple access types and the target access category includes access categories of multiple access types, the determining unit is specifically configured to:

[0044] Determine the sub-access right level corresponding to each target access category according to the pre-stored correspondence between the access category and the access right level;

[0045] Determine the target access level based on multiple sub-access levels.

[0046] In some embodiments, the determining unit is specifically configured to:

[0047] Calculating a sum of the multiple sub-access rights levels;

[0048] According to the preset stored correspondence between the candidate level intervals and the access authority levels, the target access authority level corresponding to the candidate level interval where the sum value is located is determined.

[0049] In some embodiments, the access category includes one or more access type categories of user type, terminal type, and environment type;

[0050] The access permission level corresponding to each function service is determined based on basic information of the function service, or, alternatively, the access permission level corresponding to each function service is determined based on basic information of the function service and access information, wherein the basic information includes one or more of the number, type, importance and privacy level of the function service.

[0051] In some embodiments, the apparatus further comprises:

[0052] A generating unit, configured to generate a security policy corresponding to the access permission level under the access category based on the access category and the access permission level corresponding to each function service under the access category;

[0053] The issuing unit is further configured to issue the corresponding relationship between the access permission level under the access category and the security policy to the trusted security agent.

[0054] In some embodiments, the basic information is information recorded by the trusted security agent when the function service is started.

[0055] In some embodiments, the apparatus further comprises:

[0056] An identification unit, used for identifying data in the target function service accessed by the access request to obtain the type of data accessed;

[0057] A recording unit is used to associate the access request with the target function service if the type of data accessed is sensitive data, and to record the destination and purpose of the accessed data.

[0058] In some embodiments, the identification unit is specifically used to:

[0059] Extracting sensitive information from data in the target function service accessed by the access request, wherein the sensitive information includes one or more information of a network segment to which the data belongs, an operating environment, and a preset field in the data;

[0060] The extracted sensitive information is matched with the preset sensitive information to obtain the accessed data type.

[0061] In some embodiments, the apparatus further comprises:

[0062] A monitoring unit, configured to monitor the access behavior of the terminal based on the log of the trust control center;

[0063] A comparison unit, configured to compare the intention of the access behavior with the target security policy and the historical access behavior to obtain a comparison result, wherein the comparison result indicates whether the terminal is abnormal;

[0064] The output unit is used to output alarm information when the comparison result indicates that the terminal is abnormal.

[0065] In some embodiments, the function services communicate with each other using a microservice framework and / or full-link bidirectional secure transport layer protocol TLS encryption.

[0066] In some embodiments, the trust control center is connected to a distributed authentication database;

[0067] The distributed authentication database stores information collected by the trust control center.

[0068] In a third aspect of an embodiment of the present application, a trust control center is provided, comprising a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement any of the method steps described above.

[0069] In a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, any of the method steps described above is implemented.

[0070] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute any of the function service management methods described above.

[0071] Beneficial effects of the embodiments of the present application:

[0072] The technical solution provided by the embodiment of the present application deploys a trust security agent on the carrier of the function service. Access to the function service can only be achieved through the trust security agent, that is, after the trust security agent obtains the corresponding access permission level from the trust control center, it controls the terminal to access the function service on the carrier according to the security policy corresponding to the access permission level. This realizes the proxy and hiding of the function service, so that the external port and application of the function service will not be exposed, and improves the security of the application and data in the function service.

[0073] Of course, implementing any product or method of the present application does not necessarily require achieving all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0075] Figure 1 A schematic diagram of the first structure of the function service management system provided in the embodiment of the present application;

[0076] Figure 2a A second structural diagram of the function service management system provided in an embodiment of the present application;

[0077] Figure 2b A third structural diagram of the function service management system provided in an embodiment of the present application;

[0078] Figure 3 A signaling flow diagram of a function service management method provided in an embodiment of the present application;

[0079] Figure 4 A detailed schematic diagram of step S33 provided in an embodiment of the present application;

[0080] Figure 5A schematic diagram of a flow chart of a data monitoring method provided in an embodiment of the present application;

[0081] Figure 6 A schematic diagram of a flow chart of an exception handling method provided in an embodiment of the present application;

[0082] Figure 7 A schematic diagram of the structure of a function service management device provided in an embodiment of the present application;

[0083] Figure 8 A schematic diagram of the structure of a trust control center provided in an embodiment of the present application. DETAILED DESCRIPTION

[0084] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field based on the present application belong to the scope of protection of the present application.

[0085] The original intention of cloud computing and the biggest problem it aims to solve is the rational allocation of computing resources. In its initial stage, cloud computing mainly solved the problem of hardware resource allocation. At the current stage, some new requirements have emerged, as follows.

[0086] 1. Pay as you go

[0087] Currently, developers still need to occupy resources and pay for service instances even if they do not call them, and there is no clear relationship between them and the number of concurrent service requests. The concept of serverless architecture can better utilize computing resources.

[0088] 2. Application-oriented

[0089] Essentially, users' expectations of the cloud are for the operating environment of applications, and they would rather only care about business logic without having to worry about other technologies and underlying resources, such as monitoring, elasticity, high availability, and log tracking. The concept of the ServerLess architecture allows users to avoid having to divide their attention.

[0090] The attack surface of the software environment includes all points where unauthorized users can enter or extract data, while the attack surface of the ServerLess architecture is fluid because the ServerLess architecture is composed of hundreds or even thousands of points. Each service or platform integrated into the ecosystem will have new unauthorized user entry points. Whenever the services in the points are expanded and modified, the attack surface will change. In addition, due to the multiple entry points and complex topology of the ServerLess architecture, the attack surface of ServerLess is multi-layered and multi-dimensional. The high complexity and volatility of the ServerLess architecture make the attack surface larger. Therefore, the ServerLess architecture can solve the above two requirements and has great advantages, but the ServerLess architecture also faces major threats.

[0091] Function service is a new cloud computing model, which is a ServerLess architecture. Function service does not require developers to manage servers. Its responsibility division model is that cloud vendors provide comprehensive server hosting. Developers only need to focus on application design and pay cloud vendors according to the number of times the application is executed.

[0092] Function services and the entire ecosystem should follow the principle of "least privilege". Specifically, function services will be granted corresponding permissions, and they can only perform CRUD (Create / Read / Update / Delete) operations on the database within the scope of the granted permissions. However, the permissions of function services may be for dozens or even more functions, which makes permissions a security weakness of function services and exposes function services to the risk of over-permission.

[0093] For example, when the function service executes business logic, it performs CRUD operations on the database; during this period, the function service is granted read and write permissions to the database. When the database is not CRUDed, the function service should be granted read-only permissions or the permission to close the function service. If the developer does not change the permissions of the function server at this time, that is, the permissions of the function service are incorrectly set to read and write operations, attackers will exploit this vulnerability to attack the database, thereby increasing the attack surface.

[0094] To solve the above problems, the present application embodiment provides a function service management system, such as Figure 1 As shown, it includes a trust control center 11 and a trust security agent 12.

[0095] In the embodiment of the present application, the trust control center 11 is a component for implementing security policy control and configuring user rules, and the trust control center 11 issues security policies to the trust security agent 12. The trust control center 11 is the only issuing place for the terminal's permissions, and all access requests from the terminal 14 need to be authenticated and authorized by the trust control center 11 to issue corresponding permissions. The trust control center 11 can be implemented by software or hardware.

[0096] The security policy is a policy for intercepting traffic, which may include but is not limited to information such as function services that the terminal 14 can access, function services that cannot be accessed, and discarded access requests. The terminal 14 may be a function service 13 or other devices other than a function service, such as a mobile phone, a personal computer, a tablet computer, a server, a switch, a router, etc.

[0097] When the terminal 14 is a function service 13, communication between function services is realized. In order to provide a better guarantee for the communication process, function services can use a general architecture such as a microservice framework to communicate and implement access authentication between function services. In order to further provide a better guarantee for the communication process, function services can also use full-link two-way TLS (Transport Layer Security) encryption for communication. There is no limitation on this.

[0098] User rules may include permission information for users to access function services, such as the correspondence between access information and access permission levels, the correspondence between access categories and access permission levels, the correspondence between access information and security policies, etc.

[0099] The trust security agent 12 is a component for implementing traffic interception, and the interception security policy is issued by the trust control center 11. The trust security agent 12 is deployed on the carrier of the function service 13. The trust security agent 12 can be implemented by software or hardware. The carrier of the function service 13 can be a container or an independent physical machine. In the embodiment of the present application, multiple carriers can be deployed in the network, and one or more function services 13 can be deployed on a carrier. Figure 1 Only one function service 13 is shown for illustration and does not serve as a limitation.

[0100] The above function service management system is a trust system. Under this trust system, the above function service management system can be implemented in the form of a container-level ServerLess architecture.

[0101] In the embodiment of the present application, a container-level function service scenario can be deployed in a Kubernetes cluster environment, such as Figure 2aAs shown, the carrier of the function server is a container at this time. The function service runs in the container of the Pod (container group), and the Pod is managed by the Kubernetes cluster. The Kubernetes cluster consists of a container network component + a traffic control platform. The traffic control platform performs access control on the Pod layer traffic, and the container network component performs access control on the container layer traffic. The authority of the data sending and receiving process is determined by the trust control center 11. The trust security agent can be implemented through the assisting agent mode, in which security policies are added to control access to the function service; the trust control center can be implemented through the component policy of the control plane in the traffic control platform.

[0102] In some embodiments, in order to facilitate the processing of access requests from other devices, the function service management system may further include a gateway agent 15, such as Figure 2a As shown. The gateway agent 15 is connected to each trust security agent 12 and the trust control center 11. The gateway agent 15 receives the forwarding route information and the like sent by the trust control center 11, and forwards the access request from the terminal 14 to the trust security agent 12 in the container based on the forwarding route information. The gateway agent 15 can be implemented by software, such as Figure 2a As shown, it can also be implemented by hardware, such as Figure 2b The terminal sends the access request to the trusted security agent through the external firewall and gateway.

[0103] In some embodiments, in order to facilitate the updating of security policies and timely discover abnormal access behaviors, the above-mentioned function service management system may also include a distributed authentication database 16, such as Figure 2a As shown. The trust control center 11 is connected to the distributed authentication database 16; the distributed authentication database 16 is a non-relational database used to store the authentication information and authentication results in each process, such as security policies, user rules, and logs collected by the trust control center 11. All authentication information of the request for receiving and sending data needs to be collected, analyzed by the trust control center 11, and then stored in the distributed authentication database 16.

[0104] The authentication request information may include but is not limited to the IP (Internet Protocol) address of the terminal accessing the function service, the user type accessing the function service, the login location, the access time period, the duration of the access, the terminal type accessing the function service, the account password login method, the information indicating whether the trust control center is operating normally, the biometric identification and the authorization certificate, etc. The account password login method may include but is not limited to the login methods such as static password, dynamic password, token and authorization card, the biometric identification is the information to verify whether the function service is accessed by a biometric, and the authorization certificate is a table item form of permission information.

[0105] The distributed authentication database 16 is deployed in a multi-node manner, saves data from each process, records data for continuous trust evaluation, and provides a data basis for dynamic analysis in the background.

[0106] In an embodiment of the present application, the trust control center 11 can perform security reviews on the distributed authentication database 16 at regular intervals, record the operations and accesses to the distributed authentication database 16, the executed scripts and commands, and analyze the records on a regular basis, which is conducive to data tracing and query, so as to issue corresponding alarms for suspected illegal accesses, execute measures in the security policy, and minimize the risk of internal data problems.

[0107] Based on the above function service management system, the present application embodiment provides a function service management method, such as Figure 3 As shown, the following steps are included:

[0108] Step S31: The terminal sends an access request to the function service, wherein the access request includes target access information.

[0109] In the embodiment of the present application, the target access information is the access information included in the access request. The access information may include but is not limited to the IP address of the terminal, user type, login location, terminal type, account number, password, environment type, etc.

[0110] Step S32: The trust security agent intercepts the access request and sends the access request to the trust control center.

[0111] In an embodiment of the present application, in order to improve the security of the function server, the trust security agent can send all intercepted access requests to the trust control center.

[0112] In order to reduce the burden on the trust control center and improve access efficiency, the trust security agent can send access requests received through a designated port to the trust control center. The designated port can be a port with a higher probability of attack.

[0113] In some embodiments, the trust control center can send a forwarding policy to the gateway proxy, and the forwarding policy indicates that the access request received through the specified port is sent to the trusted security proxy, and the access request received through other ports is discarded. In this case, the gateway proxy will send all the access requests received through the specified port to the trusted security proxy, and the trusted security proxy will then send all the received access requests to the trust control center.

[0114] In some other embodiments, the trust control center may send a forwarding policy to the trust security agent, and the forwarding policy indicates that the access request received through the designated port is sent to the trust control center. In this case, the trust security agent screens out the access request received through the designated port from all the received access requests, and then sends the access request received through the designated port to the trust control center.

[0115] Step S33: The trust control center determines the target access permission level corresponding to the target access information.

[0116] In the embodiment of the present application, different access rights levels correspond to different access modes, and accordingly, to different security policies. In one example, the setting of the access rights level can be shown in Table 1.

[0117] Table 1

[0118] Access Levels Access method 1 Full access 2 Partial access 3 access denied

[0119] In Table 1, the larger the value of the access authority level is, the lower the access authority level is. The setting information of these access authority levels can be stored in a distributed authentication database.

[0120] The access rights level of each terminal can be changed at any time. The trust control center can extract the target access information from the access request, query the distributed authentication database based on the target access information, and dynamically infer the access rights level assigned to the terminal, i.e., the target access rights level, by querying the system security, access methods of specific access devices, access locations, access time patterns, and access geographical locations stored in the distributed authentication database.

[0121] In some embodiments, the correspondence between access information and access permission levels is pre-stored. In this case, the above step S33 may be: determining the target access permission level corresponding to the target access information according to the pre-stored correspondence between access information and access permission levels.

[0122] In other embodiments, the correspondence between access categories and access permission levels is pre-stored. Among them, the access categories include one or more access type categories of user types, terminal types, and environment types. In the embodiment of the present application, the access categories of user types may include customers, engineers, operation and maintenance personnel, managers, etc., the access categories of terminal types may include mobile phones, computers, servers, etc., and the access categories of environment types may include the geographical location of access, network type, etc. Based on the pre-stored correspondence between access categories and access permission levels, the trust control center determines the target access permission level corresponding to the target access information. This will be described in detail later and will not be introduced in detail here.

[0123] Step S34: The trust control center sends the target access permission level to the trust security agent.

[0124] After obtaining the target access permission level, the trust control center sends the target access permission level to the trust security agent. The trust security agent can run an authorization engine, which authorizes access requests at runtime, for example, receives the target access permission level sent by the trust control center, obtains the security policy corresponding to the target access permission level as the target security policy, and controls the terminal to access the function service on the carrier according to the target security policy.

[0125] For example, the target security policy indicates that function services 1-3 can be accessed, but function service 4 cannot be accessed. The authorization engine evaluates the context of the access request and determines that the terminal accesses function service 4. Based on the target security policy, the authorization result is access denied. At this point, the authorization engine can discard the access request, or feed back an access response indicating access failure to the terminal.

[0126] Step S35 , the trusted security agent controls the terminal to access the function service on the carrier according to the target security policy corresponding to the target access authority level.

[0127] In some embodiments, the correspondence between access rights levels and security policies is stored in the trusted security agent. The security policy indicates the function services that can be accessed and the function services that cannot be accessed, etc. Each function service corresponds to a corresponding access rights level. When the target access rights level is greater than or equal to the access rights level corresponding to a function service, the terminal can access the function service. In this case, the access rights level corresponding to each function service can be determined based on the basic information of the function service, and the basic information includes one or more information of the number, type, importance and privacy level of the function service. After obtaining the target access rights level, the trusted security agent can determine the security policy corresponding to the target access rights level as the target security policy based on the correspondence between the access rights level and the security policy stored in advance.

[0128] Based on the determination of the access rights level corresponding to the above function services, the trust control center can generate security policies corresponding to the access rights level based on the access rights level corresponding to each function service, and send the correspondence between the access rights level and the security policy to the trust security agent. At this time, the trust security agent records the correspondence between the access rights level and the security policy, which facilitates the subsequent access control of terminals with different access rights levels.

[0129] In other embodiments, the correspondence between access categories, access rights levels and security policies is stored in the trusted security agent. In this case, the access rights level corresponding to each function service can be determined based on the basic information of the function service and the access category. The basic information includes one or more of the number, type, importance and privacy level of the function service. After obtaining the target access rights level, the trusted security agent can determine the security policy corresponding to the target access category and the target access rights level as the target security policy based on the pre-stored correspondence between the access categories, access rights levels and security policies. In an embodiment of the present application, the trusted security agent performs fine control over the access to the terminal according to the access category.

[0130] Based on the determination of the access permission level corresponding to the above function service, the trust control center can generate the security policy corresponding to the access permission level under the access category based on the access category and the access permission level corresponding to each function service under the access category; and send the correspondence between the access permission level under the access category and the security policy to the trust security agent. At this time, the trust security agent records the correspondence between the access category, the access permission level and the security policy, so as to facilitate the subsequent access control of terminals with different access categories and different access permission levels.

[0131] In an embodiment of the present application, the trust control center may periodically generate a correspondence between access permission levels and security policies or a correspondence between access categories, access permission levels and security policies, and send the generated correspondence to the trust security agent, and store the generated correspondence in a distributed authentication database to facilitate subsequent control of terminal access and to analyze and update the correspondence between access information, access categories, access permission levels, etc.

[0132] In the embodiment of the present application, the basic information of the function service may be the information recorded by the trust security agent when the function service is started. Specifically, when the function service is started, the trust security agent records the basic information of the function service, assigns a number to the function service, and adds the number to the basic information of the function service, and then reports the basic information of the function service to the trust control center to generate a security policy, monitor the function service, and dynamically adjust the security policy corresponding to the access permission level.

[0133] The basic information of the function service can also be configured and adjusted by the administrator on the trust control center side, and there is no restriction on this.

[0134] The technical solution provided by the embodiment of the present application deploys a trust security agent on the carrier of the function service. Access to the function service can only be achieved through the trust security agent, that is, after the trust security agent obtains the corresponding access permission level from the trust control center, it controls the terminal to access the function service on the carrier according to the security policy corresponding to the access permission level. This realizes the proxy and hiding of the function service, so that the external port and application of the function service will not be exposed, and improves the security of the application and data in the function service.

[0135] In addition, in the technical solution provided in the embodiment of the present application, the execution end of the trust security protection is sunk into the carrier of the function service, making threatening or suspicious scouting activities easier to detect, further improving the security of applications and data in the function service.

[0136] In some embodiments, the correspondence between access categories and access rights levels is pre-stored. This pre-stored information can be recorded in a distributed authentication database or stored in a trust control center. Figure 4 As shown, the above step S33 may be steps S41-S42.

[0137] Step S41, extracting the target access category from the target access information.

[0138] The target access information may include, but is not limited to, the IP address of the terminal, the user type, the login location, the terminal type, the account number, the password, the environment type, etc. After obtaining the target access information, the trust control center may extract the target access category from the target access information. For example, the trust control center extracts the target access category of the user type as a customer from the target access information, or extracts the target access category of the terminal type as a computer from the target access information.

[0139] Step S42: determining a target access permission level corresponding to the target access type according to a pre-stored correspondence between access categories and access permission levels.

[0140] After obtaining the target access category, the trust control center may search for a correspondence relationship including the target access category from pre-stored correspondence relationships between access categories and access authority levels, and use the access authority level in the searched correspondence relationship as the target access authority level.

[0141] In some embodiments, when the access category includes categories of multiple access types and the target access category includes access categories of multiple access types, the above step S42 may be: determining the access permission level corresponding to each target access category, that is, the sub-access permission level, according to the pre-stored correspondence between the access category and the access permission level; and determining the target access permission level according to the multiple sub-access permission levels.

[0142] In one example, the trust control center may calculate the sum of multiple access rights levels, and determine the access right level corresponding to the candidate level interval where the calculated sum is located as the target access right level according to the preset stored correspondence between the candidate level interval and the access right level.

[0143] For example, the trust control center determines that the target access category includes a user type of client and a terminal type of mobile phone. The trust control center determines that the sub-access right level corresponding to the user type of client is 2, and the sub-access right level corresponding to the terminal type of mobile phone is 3. The sum of multiple sub-access right levels is calculated to be 2+3=5, and the access right level corresponding to the candidate level interval where 5 is located is determined as the target access right level.

[0144] In another example, the trust control center may calculate the average of multiple access rights levels, and determine the access rights level corresponding to the candidate level interval where the calculated average is located as the target access rights level based on the preset stored correspondence between the candidate level interval and the access rights level.

[0145] In the embodiment of the present application, the trust control center may also determine the target access permission level in other ways, for example, selecting the lowest sub-access permission level from multiple sub-access permission levels as the target access permission level.

[0146] One access permission level is configured with one permission, and a large number of access requests can correspond to the same access category. Based on this, in the technical solution provided by the embodiment of the present application, the trust control center divides the access permission levels according to the access categories. Compared with the permission configuration method based on function services, the technical solution provided by the embodiment of the present application increases the granularity of permission configuration, reduces the possibility of errors and improper configuration, and thus reduces the possibility of attackers gaining access to services beyond their own permission scope.

[0147] In some embodiments, the present application also provides a data monitoring method, such as Figure 5 As shown, the following steps may be included.

[0148] Step S51, identifying the data in the target function service accessed by the access request to obtain the accessed data type.

[0149] When a terminal accesses a function service, the trust control center identifies the data in the target function service accessed by the access request and determines the type of the accessed data, which can be divided into sensitive data and non-sensitive data.

[0150] In some embodiments, the above step S51 may be: extracting sensitive information from the data in the target function service accessed by the access request, where the sensitive information may include one or more information in the network segment to which the data belongs, the operating environment, and a preset field in the data; matching the extracted sensitive information with the preset sensitive information to obtain the accessed data type. If the extracted sensitive information matches the preset sensitive information, the accessed data type is sensitive data; if the extracted sensitive information does not match the preset sensitive information, the accessed data type is non-sensitive data.

[0151] Step S52: If the type of data accessed is sensitive data, the access request is associated with the target function service, and the destination and purpose of the accessed data are recorded.

[0152] When the type of data being accessed is sensitive data, the trust control center associates the access request with the target function service, and associates the traffic of sensitive data with the target function service corresponding to the business. This can clearly determine which businesses often access and transmit sensitive data.

[0153] In addition, the Trust Control Center records the whereabouts and purpose of accessed sensitive data.

[0154] In the embodiment of the present application, the access request is associated with the target function service, and the destination and purpose of the accessed data can be recorded in the distributed authentication database. This helps the trust control center to conduct security review, update security policies and access permission levels that meet actual needs, thereby improving the accuracy of access control and further solving the problem of over-authorization.

[0155] In the embodiment of the present application, the information recorded in the above-mentioned distributed authentication database can be used as a log of the trust control center. Based on this, the embodiment of the present application also provides an exception handling method, such as Figure 6 As shown, the following steps may be included.

[0156] Step S61: monitor the access behavior of the terminal based on the log of the trust control center.

[0157] In the embodiment of the present application, the log of the trust control center can be divided into the following three aspects of data.

[0158] 1) User data

[0159] User's network login time, IP information, user's environment information, operating system information, anti-virus software information, user's verification information, access request information, etc.

[0160] 2) Server data

[0161] The Trust Control Center will record every user's access information, as well as each user's access permission level, access status, alarm information, etc.

[0162] 3) Control center data

[0163] Operation logs, including logs of access behavior of internal / external personnel, etc.

[0164] The Trust Control Center analyzes the logs of the Trust Control Center to obtain the access behavior of the terminal, such as frequent changes in account logins, changes in login locations, multiple changes in login devices, the number of login failures exceeding the threshold, access during abnormal time periods, brute force password cracking, port scanning, etc.

[0165] Step S62, comparing the intention of the access behavior with the target security policy and the historical access behavior to obtain a comparison result, which indicates whether the terminal is abnormal.

[0166] Abnormal situations include abnormal user access behavior, abnormal network intrusion, and abnormal internal threat.

[0167] After obtaining the access behavior of the terminal, the trust control center analyzes the access behavior intent, and then compares the access behavior intent with the target security policy and historical access behavior to determine whether it complies with user rules and historical access characteristics, and then determines whether the terminal is abnormal and whether to release the access request.

[0168] When it is determined that the terminal is abnormal, the trust control center can instruct the trust security agent to refuse to release the access request; when it is determined that the terminal is normal, the trust control center can instruct the trust security agent to release the access request. Through the above steps S61-S62, the trust control center can implement dynamic execution of security policies. For example, for internal developers, when accessing the data center, they need to submit an application each time and obtain permission before they can access the data center.

[0169] Step S63: When the comparison result indicates that the terminal is abnormal, an alarm message is output.

[0170] In the embodiment of the present application, outputting the alarm information may include, but is not limited to, outputting the alarm information by text message, email, prompt box, etc.

[0171] In the technical solution provided in the embodiment of the present application, function services are managed through a permission authorization method, which solves the problem of secure access to function services and reduces the risk of permission abuse and cross-border access from outside and inside the function services.

[0172] Corresponding to the above-mentioned function service management method, the embodiment of the present application also provides a function service management device, such as Figure 7 As shown, it is applied to the trust control center, including:

[0173] A receiving unit 71 is used to receive an access request forwarded by a trusted security agent from a terminal, the trusted security agent is deployed on a carrier of a function service, and the access request includes target access information;

[0174] A determination unit 72, configured to determine a target access permission level corresponding to the target access information;

[0175] The issuing unit 73 is used to issue the target access permission level to the trusted security agent, so that the trusted security agent controls the terminal to access the function service on the carrier according to the target security policy corresponding to the target access permission level.

[0176] In some embodiments, the determining unit 72 may be specifically configured to:

[0177] Extracting a target access category from the target access information;

[0178] The target access permission level corresponding to the target access permission level is determined according to the pre-stored correspondence between the access permission level and the access permission level.

[0179] In some embodiments, when the access category includes categories of multiple access types and the target access category includes access categories of multiple access types, the determining unit 72 may be specifically configured to:

[0180] Determine the sub-access right level corresponding to each target access category according to the pre-stored correspondence between the access category and the access right level;

[0181] Determine the target access level based on multiple sub-access levels.

[0182] In some embodiments, the determining unit 72 may be specifically configured to:

[0183] Calculate the sum of multiple access rights levels;

[0184] According to the preset stored correspondence between the candidate level interval and the access permission level, the target access permission level corresponding to the candidate level interval where the sum value is located is determined.

[0185] In some embodiments, the access category may include one or more of a user type, a terminal type, and an environment type;

[0186] The access permission level corresponding to each function service can be determined based on the basic information of the function service, or based on the basic information of the function service and access information. The basic information includes one or more of the number, type, importance and privacy level of the function service.

[0187] In some embodiments, the function service management device may further include:

[0188] A generating unit, configured to generate a security policy corresponding to the access permission level under the access category based on the access category and the access permission level corresponding to each function service under the access category;

[0189] The issuing unit is further used to issue the corresponding relationship between the access permission level under the access category and the security policy to the trusted security agent.

[0190] In some embodiments, the basic information may be information recorded by the trust security agent when the function service is started.

[0191] In some embodiments, the function service management device may further include:

[0192] An identification unit, used for identifying data in a target function service accessed by an access request, and obtaining the type of data accessed;

[0193] The recording unit is used to associate the access request with the target function service if the type of data accessed is sensitive data, and to record the destination and purpose of the accessed data.

[0194] In some embodiments, the identification unit may be specifically configured to:

[0195] Extract sensitive information from the data in the target function service accessed by the access request, where the sensitive information includes the network segment to which the data belongs, the operating environment, and one or more information in the preset fields in the data;

[0196] The extracted sensitive information is matched with the preset sensitive information to obtain the accessed data type.

[0197] In some embodiments, the function service management device may further include:

[0198] A monitoring unit, used to monitor the access behavior of the terminal based on the log of the trust control center;

[0199] A comparison unit, used to compare the intention of the access behavior with the target security policy and the historical access behavior to obtain a comparison result, which indicates whether the terminal is abnormal;

[0200] The output unit is used to output alarm information when the comparison result indicates that the terminal is abnormal.

[0201] In some embodiments, function services can communicate with each other using a microservice framework and / or full-link two-way TLS encryption.

[0202] The technical solution provided by the embodiment of the present application deploys a trust security agent on the carrier of the function service. Access to the function service can only be achieved through the trust security agent, that is, after the trust security agent obtains the corresponding access permission level from the trust control center, it controls the terminal to access the function service on the carrier according to the security policy corresponding to the access permission level. This realizes the proxy and hiding of the function service, so that the external port and application of the function service will not be exposed, and improves the security of the application and data in the function service.

[0203] Corresponding to the above-mentioned function service management method, the embodiment of the present application also provides a trust control center, such as Figure 8 As shown, the system includes a processor 81 and a machine-readable storage medium 82, wherein the machine-readable storage medium 82 stores machine-executable instructions that can be executed by the processor 81, and the processor 81 is prompted by the machine-executable instructions to: implement Figure 3-6 Any of the method steps described.

[0204] The machine-readable storage medium may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk storage. Optionally, the machine-readable storage medium may also be at least one storage device located away from the aforementioned processor.

[0205] The processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0206] In another embodiment provided in the present application, a computer-readable storage medium is further provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the above-mentioned Figure 3-6 Any of the method steps described.

[0207] In another embodiment provided by the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute the above Figure 3-6 Any of the method steps described.

[0208] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0209] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0210] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, trust control center, storage medium, and computer program product embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0211] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. A function service management method, characterized in that: Applied to a trust control center, the method includes: receiving an access request from a terminal forwarded by a trusted security agent, wherein the trusted security agent is deployed on a carrier of a function service, and the access request includes target access information; Extracting a target access category from the target access information; When the access category includes categories of multiple access types and the target access category includes access categories of multiple access types, determining the sub-access right level corresponding to each target access category according to a pre-stored correspondence between the access category and the access right level; Calculating a sum of the multiple sub-access rights levels; Determine the target access permission level corresponding to the candidate level interval where the sum value is located according to the preset stored correspondence relationship between the candidate level interval and the access permission level; The target access permission level is issued to the trusted security agent, so that the trusted security agent controls the terminal to access the function service on the carrier according to the target security policy corresponding to the target access permission level.

2. The method according to claim 1, characterized in that The access category includes one or more access type categories among user type, terminal type and environment type; The access permission level corresponding to each function service is determined based on basic information of the function service, or, alternatively, the access permission level corresponding to each function service is determined based on basic information of the function service and access information, wherein the basic information includes one or more of the number, type, importance and privacy level of the function service.

3. The method according to claim 2, characterized in that The method further comprises: Based on the access category and the access permission level corresponding to each function service under the access category, generate a security policy corresponding to the access permission level under the access category; The correspondence between the access permission level under the access category and the security policy is sent to the trusted security agent.

4. The method according to claim 3, characterized in that The basic information is the information recorded by the trusted security agent when the function service is started.

5. The method according to claim 1, characterized in that The method further comprises: Identifying data in the target function service accessed by the access request to obtain the type of data accessed; If the type of data accessed is sensitive data, the access request is associated with the target function service, and the destination and purpose of the accessed data are recorded.

6. The method according to claim 5, characterized in that The step of identifying the data in the target function service accessed by the access request to obtain the accessed data type includes: Extracting sensitive information from data in the target function service accessed by the access request, wherein the sensitive information includes one or more information of a network segment to which the data belongs, an operating environment, and a preset field in the data; The extracted sensitive information is matched with the preset sensitive information to obtain the accessed data type.

7. The method according to claim 1, characterized in that The method further comprises: Based on the log of the trust control center, monitoring the access behavior of the terminal; Comparing the intention of the access behavior with the target security policy and the historical access behavior to obtain a comparison result, wherein the comparison result indicates whether the terminal is abnormal; When the comparison result indicates that the terminal is abnormal, an alarm message is output.

8. The method according to any one of claims 1 to 7, characterized in that: The function services communicate with each other using a microservice framework and / or full-link two-way secure transport layer protocol TLS encryption.

9. The method according to any one of claims 1 to 7, characterized in that: The trust control center is connected to a distributed authentication database; The distributed authentication database stores information collected by the trust control center.

10. A function service management device, characterized in that: Applied to a trust control center, the device comprises: A receiving unit, configured to receive an access request forwarded by a trusted security agent from a terminal, wherein the trusted security agent is deployed on a carrier of a function service, and the access request includes target access information; a determination unit, configured to extract a target access category from the target access information; when the access category includes categories of multiple access types and the target access category includes access categories of multiple access types, determine the sub-access right level corresponding to each target access category according to a pre-stored correspondence between the access category and the access right level; calculate a sum of the multiple sub-access right levels; and determine the target access right level corresponding to the candidate level interval where the sum value is located according to a preset stored correspondence between the candidate level interval and the access right level; The issuing unit is used to issue the target access permission level to the trusted security agent, so that the trusted security agent controls the terminal to access the function service on the carrier according to the target security policy corresponding to the target access permission level.

Images