Authentication method and device for access request, storage medium and electronic device

Abstract

The application discloses an authentication method and device of an access request, a storage medium and an electronic device. The method comprises the following steps: when detecting a user data protocol (UDP) access request initiated by a first process, acquiring a process identifier of the first process; acquiring first process information of the first process in a dynamic information storage space according to the process identifier; searching for process information matched with the first process information in an exception information storage space; when the process information matched with the first process information is found in the exception information storage space, determining that the first process is a malicious process, and interrupting transmission of the UDP access request. The application solves the technical problem that the UDP access request cannot be authenticated in the related art.

Description

Technical Field

[0001] This invention relates to the field of computers, and more specifically, to an authentication method and apparatus for access requests, a storage medium, and an electronic device. Background Technology

[0002] In the network access authentication process of related technologies, an access proxy intercepts all access requests sent by the access subject to the access object, and then sends the intercepted access requests to the corresponding security control process for network access authentication according to the protocol type.

[0003] For User Data Protocol (UDP) access requests, related technologies require first collecting process information of the process initiating the UDP access request. The access proxy then sends a ticket request to the security control process. Only after receiving the ticket from the server does the access proxy allow the UDP access request to access the network. However, because UDP is a connectionless protocol, the failure rate for collecting process information of the process initiating the UDP access request is high, leading to either failure to perform network access authentication or errors in network access authentication, thus reducing network access security.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides an authentication method and apparatus for access requests, a storage medium, and an electronic device to at least solve the technical problem in the related art that UDP access requests cannot be authenticated.

[0006] According to one aspect of the present invention, an authentication method for an access request is provided, comprising: upon detecting a User Data Protocol (UDP) access request initiated by a first process, obtaining a process identifier of the first process; based on the process identifier, obtaining first process information of the first process in a dynamic information storage space, wherein the first process information is process information collected when the first process is created, and the dynamic information storage space records process information of processes that have been created and have not exited; searching for process information matching the first process information in an abnormal information storage space, wherein the abnormal information storage space records process information of malicious processes; and when process information matching the first process information is found in the abnormal information storage space, determining that the first process is a malicious process and interrupting the transmission of the UDP access request.

[0007] Optionally, before the first process initiates a UDP access request, the method further includes: when the first process is detected to be created, collecting the first process information; and recording the first process information into the dynamic information storage space.

[0008] Optionally, the method further includes: when no process information matching the first process information is found in the abnormal information storage space, searching for second process information corresponding to the process identifier of the second process in the dynamic information storage space, wherein the second process is the parent process of the first process or the process that created the first process, and the second process information is the process information of the second process collected when the second process is created; searching for process information matching the second process information in the abnormal information storage space; when process information matching the second process information is found in the abnormal information storage space, determining that the first process is a malicious process, and interrupting the transmission of the UDP access request.

[0009] Optionally, the method further includes: when no process information matching the first process information or the second process information can be found in the abnormal information storage space, sending the first process information to the server, wherein the server stores a list of malicious processes, and the list of malicious processes records the process information of malicious processes; obtaining the identification result sent by the server, wherein the identification result is used to indicate whether the first process is a malicious process.

[0010] Optionally, the method further includes: obtaining the first process information on the server; searching for process information matching the first process information in the malicious process list, wherein the process information matching the first process information includes: the process name of the first process, the path information of the first process, and the most recent modification time of the executable file of the first process; when a process information matching the first process information is found in the malicious process list, sending an identification result, wherein the identification result is used to indicate that the first process is a malicious process.

[0011] Optionally, the method further includes: obtaining the second process information on the server, wherein the second process information is the process information sent to the server when no process information matching the first process information is found in the abnormal information storage space; searching for process information matching the second process information in the malicious process list, wherein the process information matching the second process information includes: the process name of the second process, the path information of the second process, and the last modification time of the executable file of the second process; and sending an identification result when a process information matching the second process information is found in the malicious process list, wherein the identification result is used to indicate that the second process and the first process are malicious processes.

[0012] Optionally, the method further includes: detecting the first process created on the target terminal through API interface functions at the kernel layer of the target operating system, wherein the target operating system is the operating system of the target terminal; when the first process created on the target terminal is detected, collecting the process information of the first process, wherein the process information of the first process includes: the process identifier of the first process, the process name of the first process, the process identifier of the parent process of the first process, the process identifier of the process that created the first process, the path information of the first process, and the most recent modification time of the executable file of the first process; and recording the process information of the first process in the dynamic information storage space.

[0013] Optionally, recording the process information of the first process into the dynamic information storage space includes: recording the process information of the first process into the first node of the first doubly linked list, wherein the dynamic information storage space includes the first doubly linked list, and each node in the first doubly linked list is used to record the process information of a process that has been created and has not exited.

[0014] Optionally, the method further includes: deleting the first node of the first doubly linked list when the first process is detected to have exited.

[0015] Optionally, after recording the process information of the created process in the dynamic information storage space, the method further includes: asynchronously transmitting the process information in the dynamic information storage space to the server through the application layer of the target operating system, wherein the server is used to determine whether the process in the dynamic information storage space is a malicious process based on the process information in the dynamic information storage space; and recording the process information of the process marked as a malicious process by the server in the abnormal information storage space, wherein the abnormal information storage space records the process information of the malicious process.

[0016] Optionally, recording the process information marked as a malicious process by the server into the abnormal information storage space includes: recording the process information marked as a malicious process by the server into the second node of the second doubly linked list, wherein the abnormal information storage space includes the second doubly linked list, and each node in the second doubly linked list is used to record the process information marked as a malicious process by the server within a predetermined time range.

[0017] According to another aspect of the present invention, an authentication device for an access request is also provided, comprising: a first acquisition module, configured to acquire a process identifier of the first process when a User Data Protocol (UDP) access request initiated by a first process is detected; a second acquisition module, configured to acquire first process information of the first process in a dynamic information storage space based on the process identifier, wherein the first process information is process information collected when the first process is created, and the dynamic information storage space records process information of processes that have been created and have not exited; a search module, configured to search for process information matching the first process information in an abnormal information storage space, wherein the abnormal information storage space records process information of malicious processes; and an interruption module, configured to determine that the first process is a malicious process and interrupt the transmission of the UDP access request when process information matching the first process information is found in the abnormal information storage space.

[0018] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer program, and the computer program is configured to execute the authentication method for the access request described above when it is run.

[0019] According to another aspect of the present invention, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to execute the authentication method for the access request described above through the computer program.

[0020] In this embodiment of the invention, process information of the process used to send UDP access requests is collected when the process is created. Thus, when the process initiates a UDP access request, the pre-collected process information can be obtained through the process identifier. This process information can then be used to authenticate the UDP access request, solving the technical problem in related technologies where the inability to collect process information in a timely manner when initiating a UDP access request leads to the inability to authenticate the UDP access request, thereby improving network access security. Attached Figure Description

[0021] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0022] Figure 1 This is a schematic diagram of an application environment for an optional access request authentication method according to an embodiment of the present invention;

[0023] Figure 2 This is a flowchart of an optional access request authentication method according to an embodiment of the present invention;

[0024] Figure 3 This is a network architecture diagram of an optional access request authentication method according to an embodiment of the present invention.

[0025] Figure 4 This is a schematic diagram of an optional access request authentication method according to an embodiment of the present invention;

[0026] Figure 5 This is a schematic diagram of the device structure according to an embodiment of the present invention;

[0027] Figure 6 This is a schematic diagram illustrating an optional relationship between a device and a server according to an embodiment of the present invention;

[0028] Figure 7 This is a schematic diagram of an optional information interaction between a client and a server according to an embodiment of the present invention;

[0029] Figure 8 This is a schematic diagram of an optional client-server information interaction according to an embodiment of the present invention. Figure 1 ;

[0030] Figure 9 This is a schematic diagram of an optional client-server information interaction according to an embodiment of the present invention. Figure 2 ;

[0031] Figure 10 This is a schematic diagram of an optional dynamic information storage space structure according to an embodiment of the present invention;

[0032] Figure 11 This is a schematic diagram illustrating information interaction between an optional proxy client and a security client according to an embodiment of the present invention;

[0033] Figure 12 This is a schematic diagram of an optional access request authentication device according to an embodiment of the present invention.

[0034] Figure 13 This is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present invention. Detailed Implementation

[0035] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0036] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0037] First, some nouns or terms that appear in the description of the embodiments of this application shall be interpreted as follows:

[0038] Trusted Applications: Applications authorized by the management end that can be accessed by terminals within the internal business system, including application name, application MD5, signature information, etc.

[0039] Reachable Area: End users can access a list of internal sites set up by the enterprise through a zero-trust network.

[0040] Login credentials: After a user successfully logs into the secure client, the security server assigns an encrypted string to that user, representing the user's login authorization information, including user information and authorization validity period. This encryption is stored on the client side.

[0041] Access Request Credentials: Authorization information issued by the security server for a single access request, used to identify the authorization status of that access request.

[0042] Zero-trust access control policies consist of information about user-accessible processes (trusted applications) and accessible business sites (reachable areas). With authorized permissions, a user can access any reachable area through any trusted application. The granularity of zero-trust access control policies is based on logged-in users, allowing for different zero-trust policies to be formulated for different logged-in users.

[0043] Access Proxy: An endpoint access proxy is an endpoint agent deployed on a controlled device to initiate secure access. It is responsible for initiating requests for trusted authentication of the access subject. Once the identity is verified, an encrypted access connection can be established with the access gateway. It is also the point of enforcement of access control policies.

[0044] Direct access: In a zero-trust network access architecture, when an application initiates a network access request to a site, the full traffic proxy intercepts the traffic and then initiates a network access to the target site through the full traffic proxy, that is, it initiates a direct connection access. The full traffic proxy then sends the network response from the target site to the application. This access mode is called direct access.

[0045] Proxy access: In a zero-trust network access architecture, when an application initiates a network access request to a site, the full traffic proxy intercepts the traffic and then forwards it to the smart gateway. The smart gateway then proxies the access to the target business site. After the access is completed, the smart gateway sends the network response of the target site to the full traffic proxy, which then forwards the network response of the target site to the application. This access mode is called proxy access.

[0046] Access subject: In the network, the party that initiates the access, the person / device / application that accesses internal network business resources, is a digital entity composed of or combined with a person, device, application, etc.

[0047] Accessed object: In the network, the party being accessed, namely the enterprise's internal network business resources, data, development and testing environment, operation and maintenance environment, etc.

[0048] Service addressing: In a distributed cascading deployment, different services are deployed on different servers. The process of finding the server connection address of the backend service that the different business modules of the client are concerned with is called service addressing.

[0049] Cache thrashing occurs when a task is preempted. The contents of the cache need to be overwritten by the next process to gain execution rights. The next process needs time to warm up the cache to achieve optimal performance. Simultaneously, data in the cache becomes invalid during the saving and restoring of the context. This period between the cache's invalidated state and its final usable state is called cache thrashing.

[0050] Atomic operations: One or more operations supported by the processor that cannot be interrupted, including CAS (Compare & Set) and FAA (Fetch and Add).

[0051] White-box cryptography: White-box cryptography is a cryptographic technique that can resist white-box attacks. White-box cryptography can be divided into two categories in terms of implementation: static white-box and dynamic white-box.

[0052] Dynamic Challenges: Dynamic detection targeting real clients, either automatically by the server or manually by the management. The system determines whether a client is real by issuing dynamic commands, verifying the runtime context, and checking for correctly returned challenge information.

[0053] Static key white box: The key of the algorithm is bound and obfuscated with the specified encryption algorithm to generate a key white box. One key corresponds to one key white box, which exists in the form of a file. When developing an application, it needs to be integrated into the project and compiled to generate a binary file.

[0054] Sensitive information includes user login information such as user ID and password, as well as login credentials (large ticket) and network access credentials (small ticket).

[0055] CI system: Provides an automated system for software products, including processes such as automatic compilation, building, packaging, distribution, deployment and testing.

[0056] Business modules: A collection of multiple files that perform specific functions. The concept of modules not only provides a clearer description of the product but also makes it easier to specify which modules to install or uninstall. For example, you can specify to install only a "Threat Response" module or an "Application Software Management" module.

[0057] Plugins: These represent various business execution modules, mainly existing in the form of DLLs. Typically, this DLL manages multiple sub-modules.

[0058] Persistence library: Data persistence is the general term for converting in-memory data structures or object models into relational models, XML, JSON, binary streams, etc., as well as converting storage models into in-memory data models. A persistence library is a storage medium for the content of relational models, XML, JSON, binary streams, etc., converted from in-memory data structures or object models, stored in disk files or data files on the local device. It can be implemented using encrypted files, embedded databases, etc.

[0059] Policy: A set of rules issued by the administrator on the management terminal for enterprise endpoint management. This includes patch fixing, zero-trust network control, and security hardening policies. Policies may contain sensitive information such as tickets, expiration dates, and the number of valid entries.

[0060] WFP: A filtering platform introduced by Windows since Vista, which includes a series of services and system APIs to provide platform support for network packet filtering.

[0061] TDI: Transport Layer Driver Interface, used for transport layer packet filtering. It was supported from Windows 2000 to Windows Vista, but was subsequently replaced by the WFP filtering platform in Vista.

[0062] CRC32 encoding: CRC stands for Cyclic Redundancy Check. Like MD5 and SHA1, CRC32 is a type of hash algorithm. CRC32's advantage is its speed, but it has a higher probability of collisions.

[0063] The present invention will now be described with reference to the embodiments:

[0064] According to one aspect of the present invention, an authentication method for access requests is provided. Optionally, in this embodiment, the above-described authentication method for access requests can be applied to, for example... Figure 1 The hardware environment shown consists of server 112 and user equipment 102. For example... Figure 1 As shown, server 112 is connected to user equipment 102 via network 110 and can be used to provide services to user terminals or clients installed on user terminals. Clients can be video clients, instant messaging clients, browser clients, educational clients, game clients, etc. Database 114 can be set up on the server or independently of the server to provide data storage services for server 112. The aforementioned network can include, but is not limited to, wired networks and wireless networks. The wired network includes local area networks (LANs), metropolitan area networks (MANs), and wide area networks (WANs). The wireless network includes Bluetooth, Wi-Fi, and other networks that enable wireless communication. User equipment 102 can be a terminal configured with an application, specifically including a display 108, a processor 106, and a memory 104. It can include, but is not limited to, at least one of the following: mobile phones (such as Android phones, iOS phones, etc.), laptops, tablets, PDAs, MIDs (Mobile Internet Devices), PADs, desktop computers, smart TVs, wearable devices, and other computer devices. The aforementioned server can be a single server, a server cluster consisting of multiple servers, or a cloud server.

[0065] The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc., but is not limited to these. The terminal and server can be directly or indirectly connected via wired or wireless communication, which is not restricted herein.

[0066] Combination Figure 1 As shown, the authentication method for the above access request can be implemented on server 112 through the following steps:

[0067] S1, when a UDP access request initiated by the first process is detected, the process identifier of the first process is obtained;

[0068] S2, based on the process identifier, obtain the first process information of the first process in the dynamic information storage space, wherein the first process information is the process information collected when the first process is created, and the dynamic information storage space records the process information of processes that have been created and have not exited.

[0069] S3, search for process information that matches the first process information in the abnormal information storage space, wherein the abnormal information storage space records the process information of malicious processes;

[0070] S4, when a process information matching the first process information is found in the abnormal information storage space, the first process is determined to be a malicious process, and the transmission of the UDP access request is interrupted.

[0071] Optionally, in this embodiment, the authentication method for the access request described above can also be used by a client configured on the server, including but not limited to.

[0072] Optionally, in this embodiment, the authentication method for the access request described above can be applied to a blockchain architecture. Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include a blockchain underlying platform, a platform product service layer, and an application service layer.

[0073] The underlying blockchain platform can include processing modules such as user management, basic services, smart contracts, and operational monitoring. The user management module is responsible for managing the identity information of all blockchain participants, including maintaining public and private key generation (account management), key management, and maintaining the correspondence between user real identities and blockchain addresses (access management). Furthermore, under authorization, it monitors and audits transactions of certain real identities and provides risk control rule configuration (risk control audit). The basic services module is deployed on all blockchain node devices to verify the validity of business requests. After consensus is reached on valid requests, they are recorded in storage. For a new business request, the basic services first perform interface adaptation parsing and authentication (interface adaptation), and then encrypt the business information through a consensus algorithm (consensus management). After encryption, the data is transmitted completely and consistently to the shared ledger (network communication) and recorded and stored. The smart contract module is responsible for contract registration, issuance, triggering, and execution. Developers can define contract logic using a programming language and publish it to the blockchain (contract registration). According to the contract terms, the key or other events are invoked to trigger execution and complete the contract logic. It also provides functions for contract upgrades and cancellations. The operation monitoring module is mainly responsible for deployment, configuration modification, contract settings, cloud adaptation, and real-time status visualization output during product release, such as alarms, monitoring network conditions, and monitoring the health status of node devices.

[0074] The platform's product service layer provides the basic capabilities and implementation frameworks for typical applications. Developers can leverage these basic capabilities, along with the specific characteristics of their business needs, to implement blockchain-based business logic. The application service layer provides blockchain-based application services to business stakeholders.

[0075] Alternatively, as an alternative implementation method, such as Figure 2 As shown, the authentication methods for the above access requests include:

[0076] S202, when a User Data Protocol (UDP) access request initiated by the first process is detected, the process identifier of the first process is obtained;

[0077] The entity performing the above steps can be a device, such as a user's terminal device (target terminal). A security client may be installed on the device. When the device detects a UDP access request, it determines that the request originated from the first process and obtains the process identifier (ID) of that first process.

[0078] S204, based on the process identifier, obtain the first process information of the first process in the dynamic information storage space, wherein the first process information is the process information collected when the first process is created, and the dynamic information storage space records the process information of processes that have been created and have not exited.

[0079] The aforementioned dynamic information storage space can be the device's local storage space. When a process is created, the process information of the newly created first process is collected, and the identifier and process information of the first process are recorded in the dynamic information storage space. The process information of the first process can be found in the device's locally stored dynamic information storage space using the first process identifier. When a process terminates, the process information of the terminated process is deleted from the dynamic information storage space; that is, the dynamic information storage space records the process information of processes that have been created but not yet terminated.

[0080] S206, Search for process information that matches the first process information in the abnormal information storage space, wherein the abnormal information storage space records the process information of malicious processes;

[0081] The aforementioned abnormal information storage space can be the device's local storage space. This abnormal information storage space records the process information of malicious processes. If process information matching that of the first process is found in the abnormal information storage space, then the first process is a malicious process.

[0082] S208, when a process information matching the first process information is found in the abnormal information storage space, the first process is determined to be a malicious process, and the transmission of the UDP access request is interrupted.

[0083] Figure 3 This is a network architecture diagram of an optional access request authentication method according to an embodiment of the present invention, such as... Figure 3 As shown, the core modules mainly include a security client, a security server, an access proxy, and a smart gateway.

[0084] 1. Security Client: The security agent installed on the device is responsible for verifying the trusted identity of the user on the device, verifying whether the device and the application are trustworthy; and requesting the server to send unknown processes for inspection.

[0085] 2. Access Proxy: It hijacks device access requests through the TUN / TAP virtual network card, and after authentication by the security client, it is responsible for forwarding the access request to the smart gateway. If the authentication fails, it will either connect directly or disconnect.

[0086] 3. Smart Gateway: Deployed at the entry point of applications and data resources, responsible for verifying, authorizing, and forwarding each access request.

[0087] 4. Security Server: Also known as the backend server, it uses a policy control engine to securely schedule business traffic and authorizes traffic at the user-device-software-application granularity. The authentication module verifies user identity, the device trust module verifies device hardware information and security status, and the application detection module checks the security of application processes, such as for vulnerabilities, viruses, and Trojans. The backend server periodically sends service information to the target cloud server (also known as the threat intelligence cloud) or periodically initiates file checks via TAV. If malicious processes are identified, the security client is notified to perform asynchronous blocking operations. The servers in this application include the aforementioned backend server and the target cloud server.

[0088] The general process is as follows: The accessing entity initiates an access request for the accessed object through a secure client. The secure client intercepts the access request through a proxy client. The proxy client then sends an authentication request to the secure client (i.e., the proxy requests credentials for the current access request from the secure client). The request parameters include the source internet address or domain name, source port, destination internet address or domain name, destination port, and the process ID (PID) of the application. The secure client collects the process's MD5 hash, process path, last modified time, copyright information, signature information, etc., from the process PID sent by the proxy. Together with the source internet address or domain name, source port, destination internet address or domain name, and destination port of the access request transmitted from the proxy client, the secure client requests a ticket from the secure server (backend server). If the request is successful, the secure client sends the ticket, the maximum number of times the ticket can be used, and the ticket's validity period as a response to the proxy client. The proxy client first sends an HTTPS request to the access gateway, including the access request credentials (ticket) passed by the security client in the Authorization header field. Upon receiving the request, the access gateway parses the ticket from the header field and verifies it with the security server. If the verification is successful, the access gateway and the proxy client establish a connection. The proxy client then sends the original access request to the access gateway, which forwards it to the corresponding business server, proxying the actual application network access. If the access gateway fails to verify the ticket, the connection between the proxy client and the access gateway is interrupted. For traffic from applications outside the zero-trust policy accessing specific sites, the proxy client directly initiates a network access request to the target business server to achieve a direct connection.

[0089] For example, Figure 4 This is a schematic diagram of an optional access request authentication method according to an embodiment of the present invention, as shown below. Figure 4 As shown, it specifically includes:

[0090] Zero Trust Network Security Service Provider 402: Through Zero Trust proxy and access gateway, a unified entry point is provided for access subjects to access object resources through access requests. Zero Trust Network Security Service Provider provides authentication operations for the unified entry point. Only access requests that have passed authentication can be forwarded by Zero Trust proxy to access gateway, and access gateway proxies access to the actual business system.

[0091] Zero Trust Gateway 404: Deployed at the entry point of enterprise applications and data resources, it is responsible for verifying and forwarding every session request that accesses enterprise resources.

[0092] Access Subject 406: In the network, the party initiating the access is the person / device / application that accesses internal network business resources.

[0093] 408 Access Object: In the network, the accessed party is the enterprise's internal network business resources, data, development and testing environment, operation and maintenance environment, etc.

[0094] The aforementioned network environment can be implemented using, but is not limited to, cloud technology:

[0095] Cloud computing is a computing model that distributes computing tasks across a large pool of computers, enabling various application systems to access computing power, storage space, and information services as needed. The network providing these resources is called the "cloud." From the user's perspective, resources in the "cloud" appear infinitely scalable, readily available, on-demand, and expandable, with payment based on usage.

[0096] As a provider of fundamental cloud computing capabilities, a cloud resource pool (referred to as a cloud platform, generally called an IaaS (Infrastructure as a Service) platform) is established. Various types of virtual resources are deployed in the resource pool for external customers to choose from. The cloud resource pool mainly includes: computing devices (virtualized machines containing operating systems), storage devices, and network devices.

[0097] Based on logical function, a PaaS (Platform as a Service) layer can be deployed on top of the IaaS (Infrastructure as a Service) layer, and a SaaS (Software as a Service) layer can be deployed on top of the PaaS layer. Alternatively, SaaS can be deployed directly on top of IaaS. PaaS is a platform for running software, such as databases and web containers. SaaS refers to various types of business software, such as web portals and bulk SMS senders. Generally speaking, SaaS and PaaS are upper layers compared to IaaS.

[0098] Specifically, the authentication methods for the aforementioned access requests can be applied, but are not limited to, in the field of cloud security:

[0099] Cloud security refers to the collective term for security software, hardware, users, organizations, and security cloud platforms based on cloud computing business models. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and the identification of unknown virus behavior. Through a large network of clients, it monitors abnormal software behavior on the network, obtains the latest information on Trojans and malware on the internet, sends it to the server for automatic analysis and processing, and then distributes solutions for viruses and Trojans to each client.

[0100] The main research directions in cloud security include: 1. Cloud computing security, which mainly studies how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, and compliance auditing; 2. Cloudification of security infrastructure, which mainly studies how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building a large-scale security event and information collection and processing platform through cloud computing technology to achieve the collection and correlation analysis of massive amounts of information and improve the ability to control network-wide security events and risks; 3. Cloud security services, which mainly studies various security services provided to users based on cloud computing platforms, such as antivirus services.

[0101] Optionally, before the first process initiates a UDP access request, the method further includes: when the first process is detected to be created, collecting the first process information; and recording the first process information into the dynamic information storage space.

[0102] As an optional approach, the device acts as the access subject. The aforementioned first process is a newly created process within the device. When the first process (corresponding to the first process mentioned above) is created, its process information is collected, including but not limited to: the process identifier of the first process, the process name of the first process, the process identifier of the parent process of the first process, the process identifier of the process that created the first process, the path information of the first process, and the last modification time of the executable file of the first process. The thread identifier of the process that created the first process (CreatingThreadId->UniqueThread), the file object of the first process's .exe file, the absolute path of the .exe file, the command-line arguments for process creation, and the process creation status (which controls whether the process is allowed to be created) are also collected. As the access subject, the device caches the process information of all created but not yet exited device processes in its dynamic information storage space.

[0103] Optionally, the method further includes: when no process information matching the first process information is found in the abnormal information storage space, searching for second process information corresponding to the process identifier of the second process in the dynamic information storage space, wherein the second process is the parent process of the first process or the process that created the first process, and the second process information is the process information of the second process collected when the second process is created; searching for process information matching the second process information in the abnormal information storage space; when process information matching the second process information is found in the abnormal information storage space, determining that the first process is a malicious process, and interrupting the transmission of the UDP access request.

[0104] As an optional implementation, if the process information of the first process cannot be found in the device's error information storage space, the process information of the parent process (second process) of the first process and the process information of the process that created the first process (second process) are searched in the error information storage space. If the process information of the parent process is found in the error information storage space, then the child process (first process) of the parent process is a malicious process. If the process information of the process that created the first process is found in the error information storage space, then the process that created the first process and the created first process are malicious processes, and the first process's UDP access request is interrupted.

[0105] As an optional implementation, such as Figure 5The diagram illustrates a device structure according to an optional embodiment of the present invention, with a security client installed on the device. The device's R0 layer (kernel layer) includes a dynamic information storage space and an exception information storage space. When a process is created, the target callback function can obtain the process body and process information of the newly created first process through parameters, and record the process information in the dynamic information storage space. The process information recorded in the dynamic information storage space includes: the process identifier of the first process, the process name of the first process, the process identifier of the parent process of the first process, the process identifier of the process that created the first process, the path information of the first process, and the last modification time of the executable file of the first process. It also includes the thread identifier of the process that created the first process (CreatingThreadId->UniqueThread), the file object of the first process's .exe file, the absolute path of the .exe file, the command-line parameters for process creation, and the process creation status (which controls whether the process is allowed to be created), etc. When a process exits, the callback function can obtain the process identifier (obtained from the HANDLE parameter) and process body (obtained from the PEPROCESS type parameter, which represents a pointer to the process object of the process to be exited) of the process to be exited, and delete the process information of the exited process in the dynamic information storage space.

[0106] The anomaly information storage space in layer R0 stores process information of malicious processes. These malicious processes can be those detected by secure clients in historical timeframes, or they can be detected by backend servers or cloud servers. For example... Figure 6The diagram illustrates the relationship between a device and a server according to an optional embodiment of the present invention. The backend server can connect to multiple devices via a network and is also connected to a target cloud server. The process information of malicious processes in the devices, the backend server, and the cloud server can be synchronized in real time. For malicious processes detected by a device, the process information can be sent to the backend server. The backend server records the obtained process information of the malicious process in a malicious process list and sends it to the target cloud server, which then records the process information. For malicious processes detected by the backend server, the backend server sends the process information of the detected malicious process to each device connected to it via the network, as well as to the target cloud server. Each device and the target cloud server save the received process information of the malicious process. For malicious processes detected by the target cloud server, the process information of the malicious process is sent to the backend server. The backend server records the process information of the malicious process in a malicious process list and sends it to each connected device. Each device records the process information of the malicious process in an abnormal information storage space. Thus, the process information of malicious processes stored in each device, the backend server, and the cloud server is synchronized.

[0107] Optionally, searching for process information matching the first process information in the cached exception information storage space includes: searching for process information matching the first process information in the exception information storage space, wherein the process information matching the first process information includes: the process name of the first process, the path information of the first process, and the most recent modification time of the executable file of the first process.

[0108] Optionally, the method further includes: when no process information matching the first process information or the second process information can be found in the abnormal information storage space, sending the first process information to the server, wherein the server stores a list of malicious processes, and the list of malicious processes records the process information of malicious processes; obtaining the identification result sent by the server, wherein the identification result is used to indicate whether the first process is a malicious process.

[0109] As an optional implementation, firstly, the system searches for process information matching the first process information in the device's local anomaly information storage space. If no matching process information is found in the anomaly information storage space, it searches for process information matching the parent process of the first process, as well as the process information of the process that created the first process. If process information matching the first process information, or process information matching the parent process, or process information of the process that created the first process is found in the anomaly information storage space, then the first process is confirmed to be a malicious process. If no matching process information matching the first process, parent process, or process information of the process that created the first process is found in the malicious process information, then the first process information, the process information of the process that created the first process, and the process information of the parent process of the first process are sent to the backend server. The backend server identifies the process information. If the identification result indicates that the first process, or the parent process, or the process that created the first process is a malicious process, then the first process is a malicious process, and the terminal initiates a UDP request.

[0110] As an optional implementation, such as Figure 7 The diagram illustrates information interaction between a client and a server according to an optional embodiment of the present invention, including a security client, a backend server, and a target cloud server. The security client can be installed on a device. When a new process is created on the device, process information of the newly created first process is collected and cached in a dynamic information storage space, which records information of processes that have been created and have not exited. When a UDP access request is detected from the first process, the process information of the first process initiating the UDP access request is retrieved from the dynamic information storage space. The security client searches its anomaly information storage space for a process that matches the first process information; if a match is found, the first process is confirmed to be malicious. If no matching process information is found in the security client's anomaly information storage space, the security client sends the first process information to the backend server, which searches its anomaly information storage space for a matching process. If a matching process information is found in the backend server's anomaly information storage space, the first process is confirmed to be malicious, and the backend server returns the search result to the security client. If no process information matching the first process information is found on the backend server, the backend server will send the first process information to the target cloud server. The target cloud server will then search its abnormal information storage space for a process information matching the first process. The target cloud server will then confirm whether the first process is malicious and return the identification result to the security client.

[0111] As an optional implementation, the backend server does not store the process information of the first process in its own cache. The security server can initiate an actual inspection request to the threat intelligence cloud query service (corresponding to the target cloud server) and update its own inspection cache according to the response result of the threat intelligence cloud query service.

[0112] The security client collects the process information of the first process and then asynchronously sends the process information of the first process to the background server. The background server pushes the process information of the first process to the threat intelligence cloud query service (corresponding to the target cloud server) to detect the security of the process files. If it is identified as a malicious process, the threat intelligence cloud query service responds to the background, and the background server pushes the list of malicious processes to the security client.

[0113] Optionally, the method further includes: obtaining the second process information on the server, wherein the second process information is the process information sent to the server when no process information matching the first process information is found in the abnormal information storage space; searching for process information matching the second process information in the malicious process list, wherein the process information matching the second process information includes: the process name of the second process, the path information of the second process, and the last modification time of the executable file of the second process; and sending an identification result when a process information matching the second process information is found in the malicious process list, wherein the identification result is used to indicate that the second process and the first process are malicious processes.

[0114] As an optional implementation, such as Figure 8 The diagram illustrates the information interaction between a client and a server according to an optional embodiment of the present invention. Figure 1This includes a security client, a server, and a target cloud server. The security client can be installed on a device. When a new process is created on the device, the process information of the newly created second process is collected and cached in a dynamic information storage space, which records information about processes that have been created and have not exited. When a UDP access request is detected from the first process, the parent process of the first process is confirmed to be the second process, and the process information of the second process is retrieved from the dynamic information storage space. The security client searches for process information matching the second process information in its anomaly information storage space. If a match is found, the second process is confirmed to be malicious, and its child process, the first process, is also confirmed to be malicious. If no match is found in the security client's anomaly information storage space, the security client sends the second process information to the server, which searches for a match in its anomaly information storage space. If a match is found in the server's anomaly information storage space, the second process is confirmed to be malicious, and its child process, the first process, is also confirmed to be malicious. The server then returns the search results to the security client. If no matching process information is found on the server, the server sends the second process information to the target cloud server. The target cloud server then searches its abnormal information storage space for a matching process. The target cloud server then confirms whether the second process is malicious and returns the identification result to the security client.

[0115] As an optional implementation, such as Figure 9 The diagram illustrates the information interaction between a client and a server according to an optional embodiment of the present invention. Figure 2This includes a security client, a server, and a target cloud server. The security client can be installed on a device. When a new process is created on the device, the process information of the newly created second process is collected and cached in a dynamic information storage space, which records information about processes that have been created and have not exited. When a UDP access request is detected from the first process, it is confirmed that the first process was created by the second process, and the process information of the second process is retrieved from the dynamic information storage space. The security client searches for process information matching the second process information in its anomaly information storage space. If a match is found, the second process is confirmed to be malicious, and the first process created by the second process is also confirmed to be malicious. If no match is found in the security client's anomaly information storage space, the security client sends the second process information to the backend server, which searches for a match in the backend server's list of malicious processes. If a match is found in the backend server's list of malicious processes, the second process is confirmed to be malicious, and the first process created by the second process is also confirmed to be malicious. The backend server then returns the search results to the security client. If no matching process information is found on the backend server, the backend server sends the second process information to the target cloud server. The target cloud server then identifies the second process information to determine if it is a malicious process, and returns the identification result to the security client.

[0116] As an alternative implementation, the process that creates the process and the parent process can be the same process or different processes. For example, if process A calls an illegal process B to create process C, since process B is an illegal process, in this case, A is the parent process of C, while the process that creates process C is process B.

[0117] As an optional implementation, when a process in the dynamic information storage space is sent to the server-side execution process for inspection via Ring3, its parent process and creator process are also sent to the server-side execution process for inspection. If the parent process and creator process of a certain process are detected as malicious processes (either by a hit in the server's own inspection cache or by a result detected by the threat intelligence cloud query service), then that process is also considered a malicious process.

[0118] Optionally, the method further includes: detecting the first process created on the target terminal through API interface functions at the kernel layer of the target operating system, wherein the target operating system is the operating system of the target terminal; when the first process created on the target terminal is detected, collecting the process information of the first process, wherein the process information of the first process includes: the process identifier of the first process, the process name of the first process, the process identifier of the parent process of the first process, the process identifier of the process that created the first process, the path information of the first process, and the most recent modification time of the executable file of the first process; and recording the process information of the first process in the dynamic information storage space.

[0119] As an optional implementation, the device's kernel layer (R0 layer) is used to monitor process startup and shutdown, while the application layer (R3 layer) is used to initiate asynchronous process inspection. A security client is installed on the device. The security client sets a target callback function in the device's R0 layer to receive notifications of the dynamic creation and exit of all processes on the device. Specifically, the process creation and exit process can be monitored using the API function `PsSetCreateProcessNotifyRoutineEx` provided by the WDK.

[0120] When a new process (corresponding to the first process mentioned above) is created, the target callback function can obtain the process body of the newly created process and the process information (corresponding to the information of the first process mentioned above) through the parameters. The process information can be obtained by the callback function through the third parameter of type PPS_CREATE_NOTIFY_INFO.

[0121] The aforementioned process information includes, but is not limited to: the process identifier of the newly created first process, the process identifier of the parent process of the first process, the process identifier of the process that created the first process (CreatingThreadId->UniqueProcess), the thread identifier of the first process (CreatingThreadId->UniqueThread), the executable file object of the first process (e.g., the file object of the .exe file of the first process), the path information of the first process (e.g., the absolute path of the .exe file), the command-line arguments for process creation, and the status of process creation (including: the last modification time of the executable file of the first process), etc.

[0122] In this embodiment of the invention, process information of created but not yet exited processes is pre-collected and cached. This process information includes the process identifier, process name, parent process identifier, process identifier of the process that created the process, process path information, and the last modification time of the process's executable file. This allows for more comprehensive process information to determine whether a process is malicious. For example, even if the process information indicates the process is not malicious, the process information of its parent process or the process that created it can be used to determine whether the parent process or the process that created the process is malicious. Even if the parent process or the process that created the process is malicious, the process is still identified as malicious, thus making the detection of malicious processes more accurate and further improving network access security.

[0123] Optionally, recording the process information of the first process into the dynamic information storage space includes: recording the process information of the first process into the first node of the first doubly linked list, wherein the dynamic information storage space includes the first doubly linked list, and each node in the first doubly linked list is used to record the process information of a process that has been created and has not exited.

[0124] Optionally, the method further includes: deleting the first node of the first doubly linked list when the first process is detected to have exited.

[0125] As an optional implementation, when a process is about to be created or exited, specific process information can be obtained through monitoring callbacks. Several doubly linked lists (using the Windows kernel's LIST_ENTRY doubly linked list structure) can be constructed to store the current dynamic information storage space (corresponding to the aforementioned dynamic information storage space) and the exception information storage space (corresponding to the aforementioned exception information storage space) at the kernel Ring 0 layer. Each node in the doubly linked list structure of the dynamic information storage space represents information about a currently created and not yet exited process. When a process is created, the newly created process information node is added to the doubly linked list structure; when the process exits, the node is removed from the doubly linked list structure. Nodes in the dynamic information storage space may contain malicious process nodes. Each node in the doubly linked list structure of the exception information storage space (corresponding to the aforementioned exception information storage space) represents information about application processes that have been detected as having security risks in the current device's history. If the process information of the newly created first process matches the process information stored in the exception information storage space, then the newly created first process can be determined to be a malicious process. It should be noted that, unlike the dynamic information storage space, each node of the doubly linked list structure of the abnormal information storage space not only contains the current risk process information of the device, but also the risk process information in the past that has not exceeded the set time range.

[0126] As an optional implementation, the structure of the dynamic information storage space is as follows:

[0127]

[0128] The linked list node structure of the dynamic information storage space is shown below:

[0129]

[0130]

[0131] When a process's callback function captures process creation, a `DYNAMIC_PROC_ELEM` node is added to `DYNAMIC_PROC_CACHE`. When a process exit is captured, the `DYNAMIC_PROC_ELEM` node matching the process identifier is removed from `DYNAMIC_PROC_CACHE`. When the security client driver service first starts, the dynamic information storage space `DYNAMIC_PROC_CACHE` is empty. By dynamically adding and deleting nodes, information about all currently created and not yet exited processes is stored on the device.

[0132] Optionally, after recording the process information of the created process in the dynamic information storage space, the method further includes: asynchronously transmitting the process information in the dynamic information storage space to the server through the application layer of the target operating system, wherein the server is used to determine whether the process in the dynamic information storage space is a malicious process based on the process information in the dynamic information storage space; and recording the process information of the process marked as a malicious process by the server in the abnormal information storage space, wherein the abnormal information storage space records the process information of the malicious process.

[0133] As an optional implementation, the aforementioned kernel layer is the R0 layer. At the system kernel layer, the creation and deletion of device processes are monitored through a driver. The driver maintains a cache of process information using a doubly linked list, including the hash value of the process path (e.g., CRC32), the process PID, the process name, and the process MD5 value. This information is also sent to the R3 layer, which further initiates asynchronous process inspection to the background server. The inspection results are then returned from the R3 layer to the R0 layer. The system driver layer maintains dynamic information storage space and exception information storage space.

[0134] The R3 layer periodically transmits the unique identifier of the current device and the logged-in user information to the driver layer. The driver layer encapsulates the device and currently logged-in user information using a linked list. The driver then intercepts network packets by filtering. The driver layer obtains information such as the length and content of the generated packets, protocol type, process name, process ID, and data flow direction. It then filters the packets using the business system rule data structure and application process rules in the access control policy encapsulated in the driver layer. Simultaneously, it queries and checks the process information encapsulated in the driver layer to check if the process initiating the UDP packet is malicious. If the filtered UDP packet is deemed legitimate and conforms to the rules, it is considered data traffic requiring access to enterprise resources through the gateway. The iOA server immediately synchronizes the UDP access policy to the smart gateway, including business system (i.e., enterprise resource) policy rules and trusted application policy rules. The proxy client sends the UDP traffic along with the corresponding device and logged-in user information to the smart gateway for verification. After successful verification, the smart gateway forwards the UDP traffic to the enterprise business system, successfully completing the UDP data forwarding process. If the access control rules at the kernel layer are not passed, it is considered direct connection traffic, and the proxy client directly sends the traffic to the corresponding business system through the physical network card.

[0135] like Figure 10The diagram shows a schematic of the dynamic information storage space structure according to an optional embodiment of the present invention. When the dynamic information storage space DYNAMIC_PROC_CACHE synchronously adds (when a process is created) and deletes (when a process exits) linked list nodes, it asynchronously sends corresponding process information (process identifier, process name, and converted absolute process path) to the user-space process in the Ring3 layer. Upon receiving the newly created process information, the security client calculates the most recent modification time (updatetime) of the process executable file based on the process PID and the process's absolute path (procpath). Based on the process's absolute path (procpath), it obtains the process version number (filever), the description information of the process executable file (filedesc), the size of the process executable file (filesize), and the copyright information (copyright). Simultaneously, it calculates the process's MD5 hash, the signer's name (sign_issuer) in the digital signature of the process executable file, and the local signature verification result (sign_check_rst) in parallel based on the process's absolute path (procpath). Local signature verification results include: digital signature verification passed (SIGN_CHECK_PASS), digital signature verification failed (SIGN_CHECK_FAILED), digital signature verification timed out (SIGN_CHECK_TIMEOUT), and process has no digital signature (PROC_NO_SIGN_INFO).

[0136] After obtaining this information through user-space computation, the system sends updates to the signature, copyright, and MD5 hashes of each node in the dynamic information storage space DYNAMIC_PROC_CACHE to the Ring0 layer. Simultaneously, it initiates a process submission request to the backend server. The backend server then asynchronously submits a batch of processes to the threat intelligence cloud service for review. It's important to note that after receiving the response from the threat intelligence cloud service, the security server stores and refreshes the cached content set on the server side. When the user-space process of the security client sends a submission request to the backend server, the backend server first checks its own cache (corresponding to the malicious process list) to see if it stores the process information of the first process, the process information of the first process's parent process, and the process information of the process that created the first process. If the malicious process list contains the first process's process information, the cached content is directly returned as the submission result.

[0137] As an optional implementation, after receiving the list of malicious processes, the security client has the user-space process pass the information of the malicious processes to the Ring 0 layer via Ring 3, and store it in the exception information storage space. The doubly linked list structure of the exception information storage space is shown below:

[0138]

[0139]

[0140] The linked list node results for the exception information storage space are shown below.

[0141]

[0142] Each node in the doubly linked list structure of the abnormal information storage space contains not only information on currently existing risky processes on the device, but also information on risky processes in history that have not exceeded a set time range (the timestamps of the above curTime records when the nodes were added to the abnormal information storage space). When detecting whether a process that initiated an access request is a malicious process, the process identifier corresponding to the network data packet is first obtained. Then, the process information matching the process identifier is searched in the dynamic information storage space (corresponding to the dynamic information storage space, R0 stores the process information when the process is created). This includes path information crcExePathHash (i.e., the full path CRC encoding value of the executable file corresponding to the process; the scheme proposed in this invention uses the CRC32 encoding algorithm to calculate a 4-byte CRC32 hash as the hash value of the full file path), exeModifyTime (the most recent modification time of the executable file corresponding to the process, the current process identifier, and the most recent modification time of the current process), and process name exeName. The next step is to check if there is a node in the doubly linked list structure of the abnormal information storage space (corresponding to the second information set) that matches the full path CRC encoding value (corresponding to path information), process name, and file last modification time. If so, it is considered a malicious process. The security virus detection or real-time protection module will then take action against this process and suspend its network access.

[0143] Optionally, recording the process information marked as a malicious process by the server into the abnormal information storage space includes: recording the process information marked as a malicious process by the server into the second node of the second doubly linked list, wherein the abnormal information storage space includes the second doubly linked list, and each node in the second doubly linked list is used to record the process information marked as a malicious process by the server within a predetermined time range.

[0144] Zero-trust access control policies consist of information about user-accessible processes (trusted applications), accessible business sites (reachable areas), device information, logged-in user information, and the protocol types corresponding to network traffic. Under a zero-trust access control policy, a user can access any business site through any trusted application. The granularity of zero-trust access control policies is based on the logged-in user, allowing different zero-trust policies to be formulated for different logged-in users.

[0145] Zero-trust access control policies have the following items:

[0146] 1. Business system (i.e., enterprise resource) policy: including resource name, resource type (domain name, IP name or IP range), domain name or IP of specific business site, port (including specified port list or all ports), resource group and protocol type (transport layer protocol in network protocol stack).

[0147] 2. Secure login user policy: including login username, login user ID, and login ticket.

[0148] 3. Trusted Application Policy: Trusted application attributes include process name (application name), copyright information, and signature information. Trusted applications are allowed to access enterprise resources by default. Applications outside the trusted application scope cannot access enterprise resources but can directly connect to and access other resources.

[0149] 4. Device policy: including device unique identifier.

[0150] When the protocol type in the policy is UDP, the security client passes the business system policy and trusted application policy to Ring0 through Ring3, and establishes the corresponding data structure for storage at the kernel layer.

[0151] Device policies and login user policies differ from business system policies and trusted application policies. Devices and login users are dynamic, and the data volume is very large. It is impossible to record all terminals and users that can utilize zero-trust access in the zero-trust policy. A more suitable approach is to store them in a server-side cache or database. Therefore, device policies and login user policies are not sent from the backend to the devices, but are only stored on the server side.

[0152] When zero-trust network access is initiated, the current device information and logged-in user information are automatically passed from Ring 3 to Ring 0, and the driver service stores the device information and logged-in user information in a cache. The background server synchronizes the access control policy with UDP protocol type to the smart gateway.

[0153] After the zero-trust access control policy is generated or updated at the control end, the access policy with UDP protocol type is synchronized to the smart gateway in real time on the backend server. This includes business system (i.e., enterprise resource) policies and trusted application policies. Device policies and iOA login user policies are synchronized to the smart gateway from the backend server via RPC mechanism in a cached form. Device policy rules include explicitly prohibited devices and legally accessible devices. Login user policy rules include users prohibited from using the zero-trust network access function and users allowed to use the zero-trust network access function.

[0154] For unknown device policies or logged-in users, the smart gateway needs to send a detection request to the backend server. The backend server checks the baseline of legitimate devices or historical access records in the database according to the set rules. Combined with historical operation information, it determines whether the corresponding device or logged-in user is legitimately using the zero-trust network function. At the same time, the results are refreshed in the cache and synchronized to the smart gateway through the RPC mechanism.

[0155] (I) Secure network driver service captures network data packets from the device.

[0156] Windows Vista and later versions can use the relevant system APIs and services of the Windows Filtering Platform (WFP) to capture network packets. Versions prior to Vista can use network filtering frameworks such as TDI (Transport Layer Driver Interface). The following is a brief introduction to capturing UDP network packets from devices using the Windows Filtering Platform (WFP) network filtering framework.

[0157] First, the filtering engine is opened using the `FwpmEngineOpen` API function. Then, a callout interface is defined and registered with the filtering engine using the `FwpsCalloutRegister` API, making the callout interface usable by the filtering engine. After successful registration, the callout interface is added to the filtering engine using the `FwpmCalloutAdd` API. Next, sub-layers are added within the layer using the `FwpmSubLayerAdd` API, and filters are added to the filtering engine using the `FwpmFilterAddApi`, associating these filters with the callout interface and sub-layer objects created in the previous steps. When the terminal initiates a corresponding network access, the specified network event will trigger the execution of the relevant callback function within the callout interface.

[0158] In the callback function, the local port, remote port, source IP, remote IP, network protocol type (IPPROTO_ICMP, IPPROTO_UDP, or IPPROTO_TCP), and communication direction of the network packets (FWP_DIRECTION_INBOUND or FWP_DIRECTION_OUTBOUND) are obtained. Based on the network protocol type, UDP traffic is filtered out. The security of network packets is assessed, and a cache is automatically built for requests that match the proxy access criteria.

[0159] Next, the process identifier occupying the local port is obtained, which is the process identifier of the process initiating network access. The dynamic information storage space built within the driver (corresponding to the first process set) is immediately queried. Based on the process identifier, the dynamic information storage space is searched for process information matching the process ID, including `crcExePathHash` (corresponding to path information, i.e., the CRC encoding value of the full path of the executable file corresponding to the process; the proposed scheme uses the CRC32 encoding algorithm to calculate a 4-byte CRC32 hash as the hash value of the full file path), `exeModifyTime` (the last modification time of the executable file corresponding to the process), and `exeName` (the process name). The next step is to search the doubly linked list structure of the abnormal information storage space (corresponding to the abnormal information storage space) for a node matching the full path CRC encoding value, process name, and last modification time of the file. If a node is found, it is considered a malicious process. The virus detection or real-time protection module then takes action against this process and interrupts its network access. In WFP, the network access request can be intercepted by setting the actionType member of the FWPS_CLASSIFY_OUT pointer type in the callback function to FWP_ACTION_BLOCK.

[0160] Next, the driver service attempts to match the business system (i.e., enterprise resource) policy, trusted application policy rule, and device policy rule in the zero-trust access control policy based on the local port, remote port, source IP, remote IP, network protocol type (IPPROTO_ICMP, IPPROTO_UDP, or IPPROTO_TCP), and communication direction of the network packet (FWP_DIRECTION_INBOUND or FWP_DIRECTION_OUTBOUND). If the match is successful, it means that the UDP network packet needs to be redirected to the smart gateway through the proxy client, and the smart gateway performs the actual traffic proxy function. If the match is unsuccessful, the network packet is directly accessed and, after being hijacked by the full traffic proxy, directly accesses the actual site through the physical network card.

[0161] For business system policies within a zero-trust access control strategy, a successful match is considered achieved if the UDP network protocol type, remote URL, and remote port all match any one of the policy requirements.

[0162] For the trusted application policy rules in the zero-trust access control policy, the process name obtained from the dynamic information storage space in the previous step is compared with the process name, copyright information and signature information in the policy. If a specific rule item is matched in the policy, the match is considered successful.

[0163] After the business system policy and trusted application policy in the zero-trust access control strategy successfully match, the security driver service considers the network packet to be of the proxy type (a type that needs to be forwarded through a proxy client to the smart gateway, where the smart gateway performs the actual traffic proxy function). Next, it generates a hash value from the device information, logged-in user information, remote port, remote URL, and UDP network protocol type in the driver's cache. This hash value is then sent to the security client's cache for storage. The security client provides a cache lookup interface to the proxy client for sharing user-space caches. Figure 11 The diagram illustrates the information interaction between the proxy client and the security client according to an optional embodiment of the present invention. If the network data packet is identified as a direct connection type (it does not need to be forwarded to the smart gateway by the proxy client, but is directly forwarded to the target site by the proxy client through the physical network card), it is ignored directly without updating the iOA user-space cache.

[0164] As an optional implementation, the full-traffic proxy client hijacks traffic and determines whether to directly connect or proxy forward using the network packet information cache shared by the secure client. After hijacking traffic through the TUN / TAP virtual NIC, the full-traffic proxy obtains the local port, source IP, remote port, and remote IP of the network packets. It then retrieves a cached record with the same local port from the network packet cache shared by the secure client. Because the security driver service captures network packets at the transport layer, while the TUN / TAP virtual NIC hijacks traffic at the network access layer, below the transport layer in the network protocol stack, the process initiating network access will continue to occupy the local port until the network packet is fully processed. Therefore, the cached local port can be used as the query key. By checking whether a record matching the hijacked local port exists in the secure shared user-space cache, it can be determined whether the UDP network packet is a direct connection or a proxy. If no matching record is found, it is a direct connection; the UDP packet does not need to be forwarded to the smart gateway by the proxy client and is directly forwarded to the target site by the proxy client through the physical NIC. If a matching cached record is found, it is a proxy. The proxy client forwards the network packet to the smart gateway, which then performs the actual traffic proxying function.

[0165] As an optional implementation, the smart gateway checks network access requests to determine whether to perform traffic proxying. Because after the zero-trust access control policy is generated or updated at the control end, the backend server immediately synchronizes the UDP protocol access policy to the smart gateway. Therefore, upon receiving a UDP traffic request from the proxy, the smart gateway quickly determines whether the UDP traffic complies with the business system policy and trusted application policy. If it does, it quickly verifies whether the device and logged-in user originating the traffic match the cache synchronized to the smart gateway by the security backend. If a match is found and the device or logged-in user is prohibited from access, the traffic is rejected, and access is interrupted. If a match is found and the device or logged-in user is allowed legitimate access, the traffic is forwarded normally to the corresponding business system, and the response from the business system is forwarded back to the corresponding process through full traffic proxying. If the cache record is not found, for unknown device policy rules or logged-in users, the smart gateway initiates a detection request to the backend server. The backend server, based on the legitimate device baseline or historical access records in the detection database, combined with historical operation information, determines whether the corresponding device or logged-in user is legitimately using the zero-trust network function, and refreshes the cache with the result, synchronizing the cache to the smart gateway via RPC mechanism. In this scenario, similarly, if the device or logged-in user allows access, the smart gateway will forward traffic to the corresponding business system normally. Otherwise, it will refuse to forward traffic.

[0166] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0167] According to another aspect of the present invention, an authentication apparatus for an access request for implementing the above-described authentication method for access requests is also provided. For example... Figure 12As shown, the device includes: a first acquisition module 1202, used to acquire the process identifier of the first process when a User Data Protocol (UDP) access request initiated by the first process is detected; a second acquisition module 1204, used to acquire the first process information of the first process in a dynamic information storage space according to the process identifier, wherein the first process information is process information collected when the first process is created, and the dynamic information storage space records the process information of processes that have been created and have not exited; a search module 1206, used to search for process information matching the first process information in an abnormal information storage space, wherein the abnormal information storage space records the process information of malicious processes; and an interruption module 1208, used to determine that the first process is a malicious process when process information matching the first process information is found in the abnormal information storage space, and to interrupt the transmission of the UDP access request.

[0168] Optionally, the above-described apparatus is further configured to collect information about the first process before the first process initiates a UDP access request, and to record the first process information into the dynamic information storage space when the creation of the first process is detected;

[0169] Optionally, the above-described apparatus is further configured to, when no process information matching the first process information is found in the abnormal information storage space, search for second process information corresponding to the process identifier of the second process in the dynamic information storage space, wherein the second process is the parent process of the first process or the process that created the first process, and the second process information is the process information of the second process collected when the second process is created; search for process information matching the second process information in the abnormal information storage space; when process information matching the second process information is found in the abnormal information storage space, determine that the first process is a malicious process, and interrupt the transmission of the UDP access request.

[0170] Optionally, the above-described apparatus is further configured to, when no process information matching the first process information or the second process information can be found in the abnormal information storage space, send the first process information to a server, wherein the server stores a list of malicious processes, and the list of malicious processes records the process information of malicious processes; and obtain the identification result sent by the server, wherein the identification result is used to indicate whether the first process is a malicious process.

[0171] Optionally, the above-described apparatus is further configured to detect the first process created on the target terminal through API interface functions at the kernel layer of the target operating system, wherein the target operating system is the operating system of the target terminal; when the first process created on the target terminal is detected, process information of the first process is collected, wherein the process information of the first process includes: the process identifier of the first process, the process name of the first process, the process identifier of the parent process of the first process, the process identifier of the process that created the first process, the path information of the first process, and the most recent modification time of the executable file of the first process; and the process information of the first process is recorded in the dynamic information storage space.

[0172] Optionally, the above-described apparatus is further configured to record the process information of the first process into the first node of the first doubly linked list, wherein the dynamic information storage space includes the first doubly linked list, and each node in the first doubly linked list is used to record the process information of a process that has been created and has not exited.

[0173] Optionally, the above-described apparatus is further configured to delete the first node of the first doubly linked list when the first process is detected to have exited.

[0174] Optionally, the above-described apparatus is further configured to, after recording the process information of the created process into the dynamic information storage space, asynchronously transmit the process information in the dynamic information storage space to the server through the application layer of the target operating system, wherein the server is configured to determine whether the process in the dynamic information storage space is a malicious process based on the process information in the dynamic information storage space; and record the process information of processes marked as malicious processes by the server into an abnormal information storage space, wherein the abnormal information storage space records the process information of malicious processes.

[0175] Optionally, the above-described apparatus is further configured to record process information marked as malicious processes by the server into a second node of a second doubly linked list, wherein the abnormal information storage space includes the second doubly linked list, and each node in the second doubly linked list is used to record process information marked as malicious processes by the server within a predetermined time range.

[0176] According to another aspect of the present invention, a server is also provided for implementing the authentication method for the access request described above. The server is configured to obtain the first process information; search for process information matching the first process information in the malicious process list, wherein the process information matching the first process information includes: the process name of the first process, the path information of the first process, and the most recent modification time of the executable file of the first process; when a process information matching the first process information is found in the malicious process list, an identification result is sent, wherein the identification result is used to indicate that the first process is a malicious process.

[0177] Optionally, the server is further configured to obtain the second process information, wherein the second process information is the process information sent to the server when no process information matching the first process information or the process information matching the second process information is found in the abnormal information storage space; to search for process information matching the second process information in the malicious process list, wherein the process information matching the second process information includes: the process name of the second process, the path information of the second process, and the last modification time of the executable file of the second process; and to send an identification result when a process information matching the second process information is found in the malicious process list, wherein the identification result is used to indicate that the second process and the first process are malicious processes.

[0178] According to another aspect of the present invention, an electronic device for implementing the authentication method for the access request described above is also provided. This electronic device may be... Figure 1 The user equipment or server shown is illustrated in this embodiment. This example uses the electronic device as a user equipment. Figure 13 As shown, the electronic device includes a memory 1302 and a processor 1304. The memory 1302 stores a computer program, and the processor 1304 is configured to execute the steps of any of the above method embodiments through the computer program.

[0179] Optionally, in this embodiment, the aforementioned electronic device may be located in at least one of a plurality of network devices in a computer network.

[0180] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0181] S1, when a UDP access request initiated by the first process is detected, the process identifier of the first process is obtained;

[0182] S2, based on the process identifier, obtain the first process information of the first process in the dynamic information storage space, wherein the first process information is the process information collected when the first process is created, and the dynamic information storage space records the process information of processes that have been created and have not exited.

[0183] S3, search for process information that matches the first process information in the abnormal information storage space, wherein the abnormal information storage space records the process information of malicious processes;

[0184] S4, when a process information matching the first process information is found in the abnormal information storage space, the first process is determined to be a malicious process, and the transmission of the UDP access request is interrupted.

[0185] Alternatively, as those skilled in the art will understand, Figure 13 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones (such as Android phones, iOS phones, etc.), tablets, PDAs, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 13 This does not limit the structure of the aforementioned electronic devices or electronic equipment. For example, electronic devices or electronic equipment may also include components that are more... Figure 13 The more or fewer components shown (such as network interfaces, etc.), or having the same Figure 13 The different configurations shown.

[0186] The memory 1302 can be used to store software programs and modules, such as the program instructions / modules corresponding to the access request authentication method and device in this embodiment of the invention. The processor 1304 executes various functional applications and data processing by running the software programs and modules stored in the memory 1302, thereby implementing the aforementioned access request authentication method. The memory 1302 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 1302 may further include memory remotely located relative to the processor 1304, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Specifically, the memory 1302 may be used, but is not limited to, to store information such as sample characteristics of items and target virtual resource accounts. As an example, such as... Figure 13As shown, the memory 1302 may include, but is not limited to, the first acquisition module 1202, the second acquisition module 1204, the determination module 1206, and the interrupt module 1208 in the authentication device for the access request. Furthermore, it may include, but is not limited to, other module units in the authentication device for the access request, which will not be elaborated upon in this example.

[0187] Optionally, the transmission device 1306 described above is used to receive or send data via a network. Specific examples of the network described above may include wired networks and wireless networks. In one example, the transmission device 1306 includes a Network Interface Controller (NIC), which can be connected to other network devices and a router via a network cable to communicate with the Internet or a local area network. In another example, the transmission device 1306 is a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0188] In addition, the aforementioned electronic device also includes: a display 1308 for displaying the access request; and a connection bus 1310 for connecting the various module components in the aforementioned electronic device.

[0189] In other embodiments, the aforementioned terminal device or server can be a node in a distributed system, wherein the distributed system can be a blockchain system, which is a distributed system formed by connecting multiple nodes through network communication. The nodes can form a peer-to-peer (P2P) network, and any form of computing device, such as a server, terminal, or other electronic device, can become a node in the blockchain system by joining this peer-to-peer network.

[0190] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various alternative implementations described above. The computer program is configured to perform the steps in any of the method embodiments described above at runtime.

[0191] Optionally, in this embodiment, the computer-readable storage medium described above may be configured to store a computer program for performing the following steps:

[0192] S1, when a UDP access request initiated by the first process is detected, the process identifier of the first process is obtained;

[0193] S2, based on the process identifier, obtain the first process information of the first process in the dynamic information storage space, wherein the first process information is the process information collected when the first process is created, and the dynamic information storage space records the process information of processes that have been created and have not exited.

[0194] S3, search for process information that matches the first process information in the abnormal information storage space, wherein the abnormal information storage space records the process information of malicious processes;

[0195] S4, when a process information matching the first process information is found in the abnormal information storage space, the first process is determined to be a malicious process, and the transmission of the UDP access request is interrupted.

[0196] Optionally, in this embodiment, those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0197] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0198] If the integrated units in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in the aforementioned computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause one or more computer devices (which may be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0199] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0200] In the several embodiments provided in this application, it should be understood that the disclosed client can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between units or modules, and may be electrical or other forms.

[0201] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0202] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0203] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for authenticating access requests, characterized in that, include: Upon receiving a process creation request, the process creation information of the first process is obtained in the kernel layer of the current system through API interface functions; Based on the process creation information, the first process information matching the first process is stored in the dynamic information storage space, and the process information of the created and non-exited processes is recorded in the dynamic information storage space. When a UDP access request initiated by the first process is detected, the first process information of the first process is obtained from the dynamic information storage space according to the process identifier of the first process; If a first malicious process is found in the abnormal information storage space that matches the first process information, the first process is determined to be a malicious process, and the transmission of the UDP access request is interrupted. The abnormal information storage space records the malicious process information of at least one malicious process. If no process information matching the first process information is found in the abnormal information storage space, a second malicious process information is searched in the abnormal information storage space based on the second process information, wherein the second process information is the process information of the parent process of the first process; When the information of the second malicious process is found in the abnormal information storage space, the first process is determined to be the malicious process. If the first malicious process information and the second malicious process information are not found in the abnormal information storage space, a strategy for sending the network data packet is determined based on the matching result of the network data packet matching the UDP access request and the access control policy, wherein the access control policy includes usable process information.

2. The method according to claim 1, characterized in that, Prior to the UDP access request initiated by the first process, the method further includes: When the creation of the first process is detected, the information of the first process is collected; The first process information is recorded in the dynamic information storage space.

3. The method according to claim 1, characterized in that, The method further includes: If no process information matching the first process information is found in the abnormal information storage space, the second process information corresponding to the process identifier of the second process is searched in the dynamic information storage space. The second process is the parent process of the first process or the process that created the first process. The second process information is the process information of the second process collected when the second process is created. Search for process information that matches the second process information in the abnormal information storage space; When a process information matching the second process information is found in the abnormal information storage space, the first process is determined to be a malicious process, and the transmission of the UDP access request is interrupted.

4. The method according to claim 3, characterized in that, The method further includes: If no process information matching the first process information or the second process information is found in the abnormal information storage space, the first process information is sent to the server, wherein the server stores a list of malicious processes, and the list of malicious processes records the process information of the malicious processes. Obtain the identification result sent by the server, wherein the identification result is used to indicate whether the first process is a malicious process.

5. The method according to claim 4, characterized in that, The method further includes: Obtain the first process information from the server; Search the malicious process list for process information that matches the first process information, wherein the process information that matches the first process information includes: the process name of the first process, the path information of the first process, and the most recent modification time of the executable file of the first process; When a process matching the first process information is found in the list of malicious processes, an identification result is sent, wherein the identification result is used to indicate that the first process is a malicious process.

6. The method according to claim 4, characterized in that, The method further includes: The second process information is obtained from the server, wherein the second process information is the process information sent to the server when no process information matching the first process information or the second process information can be found in the abnormal information storage space. Search the malicious process list for process information that matches the second process information, wherein the process information that matches the second process information includes: the process name of the second process, the path information of the second process, and the most recent modification time of the executable file of the second process; When a process matching the second process information is found in the malicious process list, an identification result is sent, wherein the identification result is used to indicate that the second process and the first process are malicious processes.

7. The method according to any one of claims 1 to 6, characterized in that, The method further includes: The first process created on the target terminal is detected through API interface functions at the kernel layer of the target operating system, wherein the target operating system is the operating system of the target terminal; When the first process created on the target terminal is detected, the process information of the first process is collected, wherein the process information of the first process includes: the process identifier of the first process, the process name of the first process, the process identifier of the parent process of the first process, the process identifier of the process that created the first process, the path information of the first process, and the most recent modification time of the executable file of the first process. The process information of the first process is recorded in the dynamic information storage space.

8. The method according to claim 7, characterized in that, Recording the process information of the first process into the dynamic information storage space includes: The process information of the first process is recorded in the first node of the first doubly linked list, wherein the dynamic information storage space includes the first doubly linked list, and each node in the first doubly linked list is used to record the process information of a process that has been created and has not exited.

9. The method according to claim 8, characterized in that, The method further includes: When the exit of the first process is detected, the first node of the first doubly linked list is deleted.

10. The method according to claim 7, characterized in that, After recording the process information of the first process into the dynamic information storage space, the method further includes: The process information in the dynamic information storage space is asynchronously transmitted to the server through the application layer of the target operating system. The server is used to determine whether a process in the dynamic information storage space is a malicious process based on the process information in the dynamic information storage space. The process information in the dynamic information storage space includes the process information of the first process. The process information of processes marked as malicious by the server is recorded in the abnormal information storage space, wherein the abnormal information storage space records the process information of the malicious processes.

11. The method according to claim 10, characterized in that, The process information marked as malicious by the server is recorded in the abnormal information storage space, including: The process information marked as a malicious process by the server is recorded in the second node of the second doubly linked list. The abnormal information storage space includes the second doubly linked list, and each node in the second doubly linked list is used to record the process information marked as a malicious process by the server within a predetermined time range.

12. An authentication device for access requests, characterized in that, include: The first acquisition module is used to obtain the process creation information of the first process in the kernel layer of the current system through API interface functions when a process creation request is received. Based on the process creation information, the first process information matching the first process is stored in the dynamic information storage space, wherein the dynamic information storage space records the process information of processes that have been created and have not exited. The second acquisition module is used to acquire the first process information of the first process in the dynamic information storage space according to the process identifier of the first process when a UDP access request initiated by the first process is detected. The interrupt module is used to determine that the first process is a malicious process and interrupt the transmission of the UDP access request when the first malicious process information matching the first process information is found in the abnormal information storage space. The lookup module is configured to, when no process information matching the first process information is found in the abnormal information storage space, search for second malicious process information based on second process information in the abnormal information storage space, wherein the second process information is the process information of the parent process of the first process; when the second malicious process information is found in the abnormal information storage space, determine that the first process is the malicious process; when neither the first malicious process information nor the second malicious process information is found in the abnormal information storage space, determine a strategy for sending the network data packet based on the matching result of the network data packet matching the UDP access request and the access control policy, wherein the access control policy includes usable process information, and the abnormal information storage space records malicious process information of at least one malicious process.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein the program, when executed, performs the method described in any one of claims 1 to 11.

14. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to execute the method described in any one of claims 1 to 11 through the computer program.

Images