Data processing method and device, computer, readable storage medium and program product

Abstract

The embodiment of the application discloses a kind of data processing method, device, computer and readable storage medium, the method includes: in response to service access request for target service, obtain service access policy hash table;According to the target service address information of service access request, the N service address information of service address item is traversed;If there is candidate service address information matching the target service address information in N service address information, then the service policy group associated with candidate service address information in service access policy hash table is determined as candidate service policy group;Based on the policy priority of service access policy in candidate service policy group, from candidate service policy group, the target service access policy matched with service access request is acquired, and the target access mode of the target service server corresponding to target service is determined based on target service access policy for target service.Using the present application, the efficiency of data processing and the security of service access can be improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data processing method, apparatus, computer, readable storage medium, and program product. Background Technology

[0002] Due to limitations imposed by the enterprise environment or the environment in which the equipment is located, it is often necessary to restrict client devices' access to business systems. In other words, under specific circumstances, some business systems may be inaccessible, or access to certain business systems may be granted under certain conditions. This necessitates the management and control of access to business systems. Typically, static rules are used to control access, specifically by generating a global, single control policy on the server side. Different policy rules are preset based on the role of the accessing subject, the attributes of enterprise resources, and the characteristics of the user's environment. These preset policy rules manage the process of client devices accessing business systems. Therefore, as enterprises grow and businesses expand, the scenarios involving permission division increase, leading to a greater number of policy rules. Static rules, however, lack flexibility, and the sheer number of policy rules can result in inefficient rule lookup and application. Summary of the Invention

[0003] This application provides a data processing method, apparatus, computer, readable storage medium, and program product, which can improve the accuracy of data processing and detection efficiency.

[0004] One embodiment of this application provides a data processing method, the method comprising:

[0005] Respond to a business access request for the target business and obtain the business access policy hash table; the business access request includes the target business address information corresponding to the target business; the business access policy hash table includes business address entries, each of which includes N distinct business address information, where N is a positive integer; each business address information in the business address entry is associated with a corresponding business policy group;

[0006] Traverse the N business address information entries in the business address field based on the target business address information;

[0007] If there is a candidate service address that matches the target service address among the N service address information, then the service policy group associated with the candidate service address information in the service access policy hash table is determined as the candidate service policy group.

[0008] Obtain the policy priority of the business access policy in the candidate business policy group, obtain the target business access policy that matches the business access request from the candidate business policy group based on the policy priority, and determine the target access method for the target business server corresponding to the target business based on the target business access policy.

[0009] One embodiment of this application provides a data processing apparatus, the apparatus comprising:

[0010] The request and response module is used to respond to business access requests for the target business and obtain the business access policy hash table. The business access request includes the target business address information corresponding to the target business. The business access policy hash table includes business address entries, and each business address entry includes N distinct business address information, where N is a positive integer. Each business address information in the business address entry is associated with a corresponding business policy group.

[0011] The address traversal module is used to traverse N business address information in the business address item based on the target business address information;

[0012] The address matching module is used to determine the business policy group associated with the candidate business address information in the business access policy hash table as the candidate business policy group if there is a candidate business address information that matches the target business address information among N business address information.

[0013] The strategy selection module is used to obtain the strategy priority of the business access strategy in the candidate business strategy group, and to obtain the target business access strategy that matches the business access request from the candidate business strategy group based on the strategy priority.

[0014] The method determination module is used to determine the target access method for the target business server corresponding to the target business based on the target business access policy.

[0015] The device also includes:

[0016] The policy acquisition module is used to acquire M service access policies sent by the management server and the service address information corresponding to each service access policy; M is a positive integer.

[0017] The policy grouping module is used to group M service access policies into N service policy groups based on the service address information corresponding to each service access policy; the service address information corresponding to each service access policy in a service policy group is matched.

[0018] The strategy sorting module is used to sort the business address information corresponding to N business strategy groups respectively, and obtain a business address item containing N sorted and distinct business address information.

[0019] The strategy association module is used to associate N business strategy groups with the corresponding business address information in the business address item;

[0020] The table generation module is used to determine the business address entries associated with N business policy groups into a business access policy hash table.

[0021] The sorting module of this strategy includes:

[0022] The attribute acquisition unit is used to obtain the address type and address range of the business address information corresponding to N business policy groups respectively.

[0023] The numerical sorting unit is used to sort the service address information corresponding to the N service policy groups based on the numerical value of the address range of the service address information corresponding to the N service policy groups, if the address type is a network interconnection address type, so as to obtain a service address item containing N sorted and different service address information.

[0024] The character sorting unit is used to perform a coarse sorting of the business address information corresponding to N business strategy groups based on the string order if the address type is a domain name address type. Then, it re-sorts the business address information with the same first character among the coarsely sorted business address information corresponding to the N business strategy groups according to the address range, so as to obtain a business address item containing N sorted and distinct business address information.

[0025] The strategy grouping module includes:

[0026] The basic grouping unit is used to group M service access policies based on the service address information corresponding to each service access policy, resulting in d basic policy groups; d is a positive integer, and the service address information of the service access policies included in each basic policy group is the same.

[0027] The relationship acquisition unit is used to acquire the service address information corresponding to each of the d basic policy groups and to acquire the address association relationship between the d service address information.

[0028] The strategy merging unit is used to merge the basic strategy group corresponding to the first service address information and the basic strategy group corresponding to the second service address information if there are first service address information and second service address information with address coverage relationship among d service address information information, so as to obtain N service strategy groups.

[0029] The strategy association module includes:

[0030] The priority sorting unit is used to obtain the policy priority of the business access policies included in the i-th business policy group, sort the business access policies included in the i-th business policy group based on the policy priority, and form a business policy linked list corresponding to the i-th business policy group based on the sorting result; i is a positive integer less than or equal to N.

[0031] The strategy association unit is used to associate the business strategy linked list corresponding to the i-th business strategy group with the business address information corresponding to the i-th business strategy group in the business address item.

[0032] The device also includes:

[0033] The entry creation module is used to obtain M service access policies and the service address information corresponding to each service access policy, and create service address entries; M is a positive integer;

[0034] The location determination module is used to obtain the service address information corresponding to the j-th service access policy, and determine the address insertion position of the j-th service address information in the service address item based on the address type and address range of the j-th service address information; j is a positive integer less than or equal to M;

[0035] The location association module is used to associate the j-th service access policy with the service address information at the address insertion location if there is a service address information at the address insertion location that matches the j-th service address information.

[0036] The policy insertion module is used to associate the j-th service address information with the j-th service access policy and insert it into the address insertion position of the service address item if there is no service address information that matches the j-th service address information at the address insertion position.

[0037] The table generation module is also used to add M service access policies to the service address item to obtain a service access policy hash table.

[0038] The device also includes:

[0039] The service acquisition module is used to acquire the target service from the target service server and send the target service to the service request device that sent the service access request if the target access method is direct access.

[0040] The exception sending module is used to interrupt the service access request and send a request exception message to the service requesting device if the target access method is the blocking access method.

[0041] The information verification module is used to send an information authentication request to the service requesting device if the target access method is an authentication access method, obtain the access association information of the service requesting device based on the information authentication request, perform information verification processing on the access association information, and when the information verification processing is successful, obtain the target service from the target service server and send the target service to the service requesting device.

[0042] The exception sending module includes:

[0043] The interruption request unit is used to interrupt the service access request if the target access method is the blocking access method, and to obtain the service access information carried in the service access request.

[0044] The exception generation unit is used to generate a request exception message based on the service interruption information triggered by the target policy triggering conditions in the target service access policy, and send the request exception message to the service request device.

[0045] The request-response module includes:

[0046] The authentication request unit is used to obtain the business access request for the target business sent by the business request device through the access proxy component, and send the access authentication request for the business access request to the management client component.

[0047] The credential acquisition unit is used to perform a first detection process on the business access request through the management client component to obtain a first detection result. If the first detection result is a valid result, it sends an access credential acquisition request to the management server so that the management server performs a second detection process on the business access request to obtain a second detection result. When the second detection result is a valid result, it generates a business access credential for the business access request.

[0048] This credential acquisition unit is also used to acquire the business access credentials sent by the management server, and based on the business access credentials, to acquire the business access policy hash table.

[0049] The device also includes:

[0050] The proxy access module is used to send business access requests to the access proxy component through the management client component if the target access method is proxy access.

[0051] The credential sending module is used to send business access credentials to the access gateway through the access proxy component, so that the access gateway can verify the business access credentials and establish a network connection with the access proxy component when the business access credentials are verified.

[0052] The gateway request module is used to send a service access request to the access gateway if a network connection is established with the access gateway, so that the access gateway can access the target service server corresponding to the target service based on the service access request.

[0053] The device also includes:

[0054] The history traversal module is used to traverse historical access data based on the target business address information;

[0055] The history acquisition module is used to obtain the policy position corresponding to the candidate service address information from the historical access data if there is candidate service address information that matches the target service address information. Based on the policy position, the module obtains the target service access policy that matches the service access request from the service access policy hash table. Based on the target service access policy, the module determines the target access method for the target service server corresponding to the target service.

[0056] The historical matching module is used to retrieve the service access policy hash table if no candidate service address information matching the target service address information is found in the historical access data.

[0057] The historical access data includes a historical access cache; the device also includes:

[0058] The record generation module is used to generate historical access records based on the target business address information and its address position in the business access policy hash table.

[0059] The address lookup module is used to obtain the policy trigger time of the target business access policy and search for the target business address information in the historical access cache.

[0060] The record update module is used to update the number of address accesses of the target business address information based on the historical access records if the target business address information exists in the historical access cache, and associate the policy triggering time with the target business address information in the historical access cache.

[0061] The record addition module is used to add historical access records to the historical access cache if the target business address information does not exist in the historical access cache.

[0062] The historical access data also includes a hash index table; the device also includes:

[0063] The cache retrieval module is used to retrieve cached service address information included in the historical access cache, as well as cache record information associated with the cached service address information; the cache record information includes the number of cache address accesses and the cache policy trigger time of the cached service address information.

[0064] The cache transfer module is used to add cache record information to the hash index table if the number of accesses to a cache address is greater than or equal to the access threshold.

[0065] The device also includes:

[0066] The conflict detection module is used to obtain the policy triggering conditions of the business access policies included in the business access policy hash table, and to perform conflict detection on the candidate business policy group based on the business address information corresponding to the business access policy and the policy triggering conditions.

[0067] The exception feedback module is used to obtain the abnormal service access policy from the first service access policy and the second service access policy if there are conflicting policies in the candidate service policy group, obtain the policy association device associated with the abnormal service access policy, and send a policy exception message to the policy association device. The abnormal service access policy refers to the service access policy in the first service access policy and the second service access policy that has an abnormal trigger probability or cannot be triggered.

[0068] One embodiment of this application provides a computer device, including a processor, a memory, and an input / output interface;

[0069] The processor is connected to a memory and an input / output interface, respectively. The input / output interface is used to receive and output data, the memory is used to store computer programs, and the processor is used to call the computer programs so that the computer device containing the processor executes the data processing method in one aspect of the embodiments of this application.

[0070] One aspect of this application provides a computer-readable storage medium storing a computer program adapted to be loaded and executed by a processor, so that a computer device having the processor performs the data processing method of one aspect of this application.

[0071] One aspect of this application provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in various optional embodiments of this application. In other words, when the computer instructions are executed by the processor, they implement the methods provided in various optional embodiments of this application.

[0072] Implementing the embodiments of this application will have the following beneficial effects:

[0073] In this embodiment, a service access policy hash table can be obtained in response to a service access request for a target service. The service access request includes target service address information corresponding to the target service. The service access policy hash table includes service address entries, each containing N distinct service address information, where N is a positive integer. Each service address information in the service address entry is associated with a corresponding service policy group. The N service address information in the service address entry are traversed based on the target service address information. If there is a candidate service address information among the N service address information that matches the target service address information, the service policy group associated with the candidate service address information in the service access policy hash table is determined as a candidate service policy group. The policy priority of the service access policy in the candidate service policy group is obtained. Based on the policy priority, the target service access policy that matches the service access request is obtained from the candidate service policy group. Based on the target service access policy, the target access method for the target service server corresponding to the target service is determined. Through the above process, a business access policy hash table exists. This hash table uses N distinct business address information entries as business address entries, which can act as an index. This allows business access policies with the same or matching business address information to be aggregated together. When detecting business access requests, the business address information can be filtered first, and then the target business access policy matching the request can be found. This makes the business access policy storage records more organized and improves the efficiency of business access policy lookup. Moreover, when there are many business access policies, these policies may often be uploaded by different management objects, making conflicts between business access policies more likely. Policy priority can effectively reduce lookup conflicts, thereby improving data processing efficiency. Simultaneously, detecting business access requests based on this business access policy improves the security of business access. Attached Figure Description

[0074] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0075] Figure 1a This is a network interaction architecture diagram for data processing provided in an embodiment of this application;

[0076] Figure 1b This is another network interaction architecture diagram for data processing provided in the embodiments of this application;

[0077] Figure 2 This is a schematic diagram of a data processing scenario provided in an embodiment of this application;

[0078] Figure 3 This is a flowchart of a data processing method provided in an embodiment of this application;

[0079] Figure 4 This is a schematic diagram of a specific data processing method provided in an embodiment of this application;

[0080] Figure 5 This application provides a schematic diagram of a service access strategy.

[0081] Figure 6 This is a schematic diagram of a business access policy management provided in an embodiment of this application;

[0082] Figure 7 This is a service access policy hash table provided in an embodiment of this application;

[0083] Figure 8 This is a schematic diagram of a strategy merging scenario provided in an embodiment of this application;

[0084] Figure 9 This is a schematic diagram of another business access strategy hash table generation scenario provided in the embodiments of this application;

[0085] Figure 10 This is a schematic diagram of a historical search scenario provided in an embodiment of this application;

[0086] Figure 11 This is a schematic diagram of a historical access data processing scenario provided in an embodiment of this application;

[0087] Figure 12 This is a schematic diagram of a strategy detection scenario provided in an embodiment of this application;

[0088] Figure 13 This is a schematic diagram of a zero-trust network architecture provided in an embodiment of this application;

[0089] Figure 14 This is a schematic diagram of an authentication configuration scenario provided in an embodiment of this application;

[0090] Figure 15a This is a schematic diagram of a login method provided in an embodiment of this application;

[0091] Figure 15b This is a schematic diagram of another login method provided in an embodiment of this application;

[0092] Figure 16 This is another schematic diagram of business access policy management provided in the embodiments of this application;

[0093] Figure 17 This is a schematic diagram of a strategy configuration scenario provided in an embodiment of this application;

[0094] Figure 18 This is a schematic diagram of a request-response message display scenario provided in an embodiment of this application;

[0095] Figure 19 This is a schematic diagram of a data processing device provided in an embodiment of this application;

[0096] Figure 20 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0097] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0098] The following is an explanation of some of the terms used in this application:

[0099] 1. Trusted Application: An application carrier authorized by the management end (including management server and management device, etc.) that allows the business requesting device to access the business server, including but not limited to the application name, application key and signature information.

[0100] 2. Reachable Area: A list of business servers that the requesting device can access through a zero-trust network.

[0101] 3. Login credentials: After an object successfully logs into the management device, the management server assigns an encrypted string to the object, representing the object's login authorization information, including but not limited to object information and authorization validity period, which is encrypted and stored in the management device.

[0102] 4. Business Access Credentials: Authorization information issued by the management server for a single business access request, used to identify the authorization status of the business access request.

[0103] 5. Business Access Policy: This consists of information such as the processes that an object can use (trusted applications) and the business servers that can be accessed (reachable areas). With the permissions granted, an object can access any reachable area through any trusted application.

[0104] 6. Access Gateway: Deployed at the entry point of applications and data resources, it is responsible for verifying and forwarding each session request (i.e., business access request, etc.) to access the business server.

[0105] 7. Access Proxy: An access proxy is a terminal agent deployed on a controlled device to initiate secure access. It is responsible for initiating requests for trusted authentication of the access subject. Once the identity is verified, an encrypted access connection can be established with the access gateway.

[0106] 8. Direct Access: In a zero-trust network access architecture, when an application initiates a business access request to a business server, the access proxy intercepts the traffic and then initiates a business access request to the target business server through the access proxy, that is, it initiates a direct connection access. The access proxy then sends the network response from the target business server to the application. This access mode is called direct access.

[0107] 9. Proxy Access: In a zero-trust network access architecture, when an application initiates a business access request to a business server, the access proxy intercepts the traffic and then forwards it to the access gateway. The access gateway then proxies the access to the target business server. After the access is completed, the access gateway sends the network response from the target business server to the access proxy, which then forwards the network response from the target business server to the application. This access mode is called proxy access.

[0108] 10. Access Subject: In the network, the party that initiates the access, such as a person / device / application, is a digital entity composed of or combined with factors such as people, devices, or applications.

[0109] 11. Accessed Object: In a network, the party being accessed, namely the business server, includes applications, systems (development and testing environments, operation and maintenance environments, and production environments, etc.), data, interfaces, and functions.

[0110] In the embodiments of this application, please refer to Figure 1a , Figure 1aThis is a network interaction architecture diagram for data processing provided in an embodiment of this application. This embodiment can be implemented by a management device. The devices involved in this application can be considered as forming a data processing system, including a service request device 101, a management device 102, and a service server 103, etc. The solution implemented in this embodiment can be considered as being implemented by the management device 102. The management device 102 can obtain service access requests for a target service sent by the service request devices 101, such as service request devices 101a, 101b, and 101c, etc., where the service request device 101 can be considered the access subject. The management device 102 can obtain a service access request for a target service from any of the service request devices and respond to the request. It searches a service access policy hash table to find the target service access policy matching the request, and then detects the request based on the policy to obtain the target access method for the target service server. If the target access method is not a blocking access method, the target service server in the service server 103 is accessed through the target access method. For example, the service server 103 may include, but is not limited to, service servers 103a, 103b, and 103c. Assuming that the target service server is service server 103b, the management device 102 can access service server 103b through the target access method. The number of service servers can be one or at least two, and the number of service requesting devices can be one or at least two.

[0111] Optional, see below Figure 1b , Figure 1b This is another network interaction architecture diagram for data processing provided in an embodiment of this application. For example... Figure 1bAs shown, the service request device 104 can send a service access request for a target service to the management device 105. The management device 105 may include a management client component and an access proxy component, etc. The management device can respond to the service access request and obtain the service access policy hash table. Optionally, the various service access policies included in the service access policy hash table may be sent by the management server 106. The management server 106 includes, but is not limited to, a policy center, a submission service, and a credential center, etc. The policy center is used to generate and manage service access policies, etc.; the submission service is used to detect service access requests, etc.; the credential center is used to generate and manage service access credentials for service access requests, etc. Optionally, the management server 106 may also include other functional components, and the functional components mentioned above can be added or modified as needed to implement the functions. The management device 105 can search for the target service access policy that matches the service access request from the service access policy hash table. If the target service access policy is found, the target access method for the target service server (which can be considered to belong to the service server 108) corresponding to the target service is determined based on the target service access policy. Optionally, if the target access method is a proxy access method, the management device 105 can access the target business server through the access gateway 107. Optionally, the access gateway 107 can determine the legality of the business access credentials of the business access request through the management server 106.

[0112] For details, please see Figure 2 , Figure 2 This is a schematic diagram of a data processing scenario provided in an embodiment of this application. For example... Figure 2As shown, the service requesting device 201 can send a service access request to the management device 202, which can respond to the service access request and obtain the service access policy hash table 203. The service access policy hash table 203 includes service address entries, each containing N distinct service address information, where N is a positive integer, such as service address information 1, ..., and service address information N. Each service address information is associated with a service policy group, for example, service policy group 1 associated with service address information 1, ..., and service policy group N associated with service address information N, etc. This allows service access policies to be aggregated based on service address information, reducing the amount of data required for searching service address information. Furthermore, aggregating service access policies with matching service address information allows potentially conflicting service access policies to be searched together, reducing the difficulty of finding conflicting service access policies. The management device 202 iterates through the N service address information in the service address entries according to the target service address information included in the service access request. If among N service address information, there exists a candidate service address information that matches the target service address information, assuming this candidate service address information is service address information P, then the management device 202 can determine the service policy group P associated with service address information P as a candidate service policy group. Assuming that service policy group P includes service access policy 1 and service access policy 2, etc., the target service access policy matching the service access request is obtained from the service access policies included in the candidate service policy group. Based on the target service access policy, the target access method for the target service server corresponding to the target service is determined, thereby realizing the detection of the service access process and improving the security of service access.

[0113] It is understood that the business request device, management device, and business server mentioned in the embodiments of this application can all be a type of computer device. The computer device in the embodiments of this application includes, but is not limited to, terminal devices or servers. In other words, the computer device can be a server or a terminal device, or a system composed of servers and terminal devices. The terminal device mentioned above can be an electronic device, including but not limited to mobile phones, tablets, desktop computers, laptops, handheld computers, in-vehicle devices, augmented reality / virtual reality (AR / VR) devices, head-mounted displays, smart TVs, wearable devices, smart speakers, digital cameras, webcams, and other mobile internet devices (MIDs) with network access capabilities, or terminal devices in scenarios such as trains, ships, and flights. Figure 1a As shown, the terminal device can be a laptop (as shown in service request device 101b) or a mobile phone (as shown in service request device 101c), etc. Figure 1a Only a portion of the equipment is listed. The servers mentioned above can be standalone physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, vehicle-to-everything (V2X) communication, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0114] Optionally, the data involved in the embodiments of this application may be stored in a computer device or may be stored based on cloud storage technology, without any limitation.

[0115] Further, please see Figure 3 , Figure 3 This is a flowchart of a data processing method provided in an embodiment of this application. Figure 3 As shown, the description uses a business access request as an example. In other words, in Figure 3 In the described method embodiment, the data processing procedure includes the following steps:

[0116] Step S301: Respond to the business access request for the target business and obtain the business access policy hash table.

[0117] In this embodiment, the management device can receive and respond to a service access request for a target service sent by a service requesting device. The service access request may include target service address information corresponding to the target service. To detect the service access request, the management device can obtain a service access policy hash table. This hash table includes service address entries, each containing N distinct service address information, where N is a positive integer. Each service address information in the hash table is associated with a corresponding service policy group; that is, the service address information in the service access policies included in the service policy group matches the associated service address information. The service access policies included in the hash table may be sent from a management server to the management device. When the management device receives a service access policy from the management server, it can aggregate the service access policies based on the service address information corresponding to each policy to obtain the hash table. The service access policies may include, but are not limited to, policy triggering conditions and access methods.

[0118] Optionally, when generating the service access policy hash table, the management device can obtain the service address information for each service access policy, aggregate the service access policies based on the service address information to obtain N service policy groups, and combine the N service policy groups to obtain the service access policy hash table. Each service policy group corresponds to different service address information, and the service address information of the service access policies included in a service policy group is matched.

[0119] Optionally, when generating the service access policy hash table, the management device can obtain the service address information for each service access policy, aggregate the service access policies based on the service address information, and obtain d basic policy groups, where d is a positive integer. The service address information corresponding to each of the d basic policy groups is different, but the service address information of the service access policies included in a basic policy group is the same. Further, the management device can merge the basic policy groups corresponding to service address information that has address overlap relationships among the service address information corresponding to the d basic policy groups, obtaining N service policy groups. At this point, the service address information corresponding to each service policy group is different, and the service address information of the service access policies included in a service policy group is not necessarily the same, but the service address information of the service access policies included in a service policy group is matched. For example, the business address information 1 corresponding to basic policy group 1 contains the business address information 2 corresponding to basic policy group 2. Basic policy group 1 and basic policy group 2 can be merged to obtain business policy group 1. The business address information of the business access policies included in business policy group 1 includes business address information 1 and business address information 2. That is, the business address information of the business access policies included in business policy group 1 may not be the same, but they match, that is, business address information 1 contains business address information 2.

[0120] Optionally, the management device may include historical access data, which represents data generated during historical service access processes detected by the management device. This historical access data is equivalent to logs from historical service access processes and may include mappings between historical service access requests and historical service access policies. Specifically, the management device can respond to service access requests for a target service and, based on the historical access data, search for a target service access policy that matches the request. If a target service access policy is found based on the historical access data, the target access method for the target service server corresponding to the target service is determined based on the target service access policy. If no target service access policy is found based on the historical access data, a service access policy hash table is obtained. Specifically, the management device can iterate through the historical access data based on the target service address information. If there are candidate service address information that matches the target service address information in the historical access data, then the policy position corresponding to the candidate service address information is obtained from the historical access data. Based on the policy position, the target service access policy that matches the service access request is obtained from the service access policy hash table. Based on the target service access policy, the target access method for the target service server corresponding to the target service is determined. If there are no candidate service address information that matches the target service address information in the historical access data, then the process of obtaining the service access policy hash table is executed.

[0121] Optionally, the generation or updating process of historical access data can be implemented asynchronously with the various steps mentioned in the embodiments of this application. In other words, the management device can also update the historical access data while searching for the target service access policy based on the historical access data. Specifically, during the historical access process, the management device can obtain the historical service address information corresponding to the historical service access request, and the historical service access policy found when traversing the service access policy hash table based on the historical service address information, and the historical address position in the service access policy hash table. This historical address position can be the position information of the service address information that matches the historical service address information in the service access policy hash table. The management device can generate a historical access entry based on the historical service address information and the historical address position, and add the historical access entry to the historical access data. The historical access entry can also include the entry association time, which can be the entry generation time, the trigger time of the historical service access process, or the end time of the historical service access process, etc., without limitation.

[0122] Step S302: Based on the target service address information of the service access request, traverse the N service address information in the service address item.

[0123] In this embodiment, the management device can traverse the N service address information entries in the service address field based on the target service address information of the service access request, in order to find service address information that is the same as or contains the target service address information. In other words, the management device can sequentially compare the N service address information entries in the service address field with the target service address information to find the service address information that matches the target service address information.

[0124] Step S303: If there is a candidate service address information that matches the target service address information among the N service address information, then the service policy group associated with the candidate service address information in the service access policy hash table is determined as the candidate service policy group.

[0125] In this embodiment, if there is a candidate service address information among the N service address information that matches the target service address information, then the service policy group associated with the candidate service address information in the service access policy hash table can be determined as the candidate service policy group. Here, the candidate service address information refers to the service address information that contains the target service address information; that is, the candidate service address information can be the same as the target service address information, or the candidate service address information can include the target service address information, etc.

[0126] Step S304: Obtain the policy priority of the business access policy in the candidate business policy group; based on the policy priority, obtain the target business access policy that matches the business access request from the candidate business policy group; and based on the target business access policy, determine the target access method for the target business server corresponding to the target business.

[0127] In this embodiment, the management device can obtain the policy priority of the service access policies in the candidate service policy group. Based on the policy priority, it can obtain the target service access policy that matches the service access request from the candidate service policy group. Since there may be one or more service access policies in the candidate service policy group that can match the service access request, the target service access policy can be determined based on the policy priority of each service access policy. The service access policy includes policy triggering conditions and access methods, and the service access request includes service access environment information. The management device can compare the policy triggering conditions of the service access policies in the candidate service policy group with the service access environment information, and determine the service access policy containing the policy triggering conditions that match the service access environment information as the target service access policy. Optionally, the service access policies in the candidate service policy group can be denoted as candidate service access policies, and the policy triggering conditions in the target service access policy can be denoted as target policy triggering conditions. Further, the management device can determine the access method in the target service access policy as the target access method for the target service server corresponding to the target service.

[0128] In this embodiment, a service access policy hash table can be obtained in response to a service access request for a target service. The service access request includes target service address information corresponding to the target service. The service access policy hash table includes service address entries, each containing N distinct service address information, where N is a positive integer. Each service address information in the service address entry is associated with a corresponding service policy group. The N service address information in the service address entry are traversed based on the target service address information. If there is a candidate service address information among the N service address information that matches the target service address information, the service policy group associated with the candidate service address information in the service access policy hash table is determined as a candidate service policy group. The policy priority of the service access policy in the candidate service policy group is obtained. Based on the policy priority, the target service access policy that matches the service access request is obtained from the candidate service policy group. Based on the target service access policy, the target access method for the target service server corresponding to the target service is determined. Through the above process, a business access policy hash table exists. This hash table uses N distinct business address information entries as business address entries, which can act as an index. This allows business access policies with the same or matching business address information to be aggregated together. When detecting business access requests, the business address information can be filtered first, and then the target business access policy matching the request can be found. This makes the business access policy storage records more organized and improves the efficiency of business access policy lookup. Moreover, when there are many business access policies, these policies may often be uploaded by different management objects, making conflicts between business access policies more likely. Policy priority can effectively reduce lookup conflicts, thereby improving data processing efficiency. Simultaneously, detecting business access requests based on this business access policy improves the security of business access.

[0129] Further, see Figure 4 , Figure 4 This is a schematic diagram of a specific data processing method provided in an embodiment of this application. For example... Figure 4 As shown, the process includes the following steps:

[0130] Step S401: Receive the service access policy sent by the management server.

[0131] In this embodiment of the application, the management device can receive service access policies sent by the management server, such as... Figure 1bAs shown, when generating a service access policy, the management server 106 can send the service access policy to the management device 105. The management device 105 can then execute step S402 based on the obtained service access policy to create a service access policy hash table. This service access policy includes service address information, which represents the access address of the service server managed by the policy. The service access policy may also include policy triggering conditions and access methods, etc. For example, see... Figure 5 , Figure 5 This is a schematic diagram of a service access strategy provided in an embodiment of this application. For example... Figure 5As shown, the triggering conditions for this policy include, but are not limited to, trusted application information, port configuration, policy priority, limiting conditions, and protocol type, etc., which are not restricted here. The business address information in the business access policy refers to the IP address or domain name of the corresponding business server. Port configuration refers to the configuration information of the specified port list or all ports of the business server targeted by the business access policy. Trusted application information may include, but is not limited to, trusted application attributes, such as application process name, copyright information, and signature information. Trusted application information can be used to indicate that when the business access policy is triggered, the trusted application indicated by the trusted application information can access the business server indicated by the business address information in the business access policy by default; for example, if the trusted application information in business access policy 1 includes trusted application 1, then when accessing the target business server requested by the business access request through trusted application 1, it can be directly considered that business access policy 1 has been triggered, and the triggered access method is an access method other than the blocking access method. Optionally, the policy triggering conditions may also include object login rules, such as any one or at least two of the following: login object name, login object identifier, or login object login credentials; the policy triggering conditions may also include device policy rules, such as device identifier, device asset number, and device name. Optionally, the policy triggering conditions may also include business policy information, such as business name, business address type (domain name address type, network interconnection address type, and network interconnection address range type, etc.), business packet information, and protocol type (such as transport layer protocols in the network protocol stack), etc., without limitation. Optionally, the transport layer protocol includes, but is not limited to, Transmission Control Protocol (TCP) or User Datagram Protocol (UDP). Optionally, the policy triggering conditions can be added, deleted, or modified as needed, without limitation. Optionally, the management device can obtain device characteristics (i.e., the characteristics of the device requesting the business) and login object (i.e., the object that initiates the business access request to log in to the zero-trust network) based on the business access request, and perform compliance checks on the device characteristics and login object. If the compliance test passes, business access policies can be issued to the logged-in objects that pass the test. This means that the business access policies issued by the management server can be the same or different for different devices or different logged-in objects. Since business access policies are dynamic measures that control business operations by combining factors such as device information, security level, network area (i.e., the network area to which the device making the business request belongs), compliance test results, and object access behavior, different access behaviors may occur for the same business server in different device scenarios. The management server can audit the effectiveness and availability of business access policies to assess their rationality and practicality.

[0132] Optional, see below Figure 6 , Figure 6 This is a schematic diagram of a business access policy management method provided in an embodiment of this application. For example... Figure 6 As shown, managed objects can upload new business access policies or modify existing business access policies through the policy management page. For example, the policy management page may include a policy addition component (such as...). Figure 6 The "Add Business Access Policy" component, "Copy Below" component, and "Create Below" component shown herein can optionally include the following: The "Add Business Access Policy" component can insert a new business access policy at the default add position on the policy management page. This default add position can be a pre-set fixed position or a dynamic relative position (such as after all existing business access policies). The "Copy Below" component can refer to copying the business access policy it targets. For example, if the "Copy Below" component associated with the business access policy in sequence 1 is triggered, then the business access policy in sequence 1 will be copied to obtain the same business access policy as the business access policy in sequence 1. The "Create Below" component can refer to creating a new blank business access policy. For example, if the "Create Below" component associated with the business access policy in sequence 2 is triggered, then a blank business access policy can be created after the business access policy in sequence 2. Optionally, the policy management page may also include editing and deletion components, such as an editing component for updating associated business access policies and a deletion component for deleting associated business access policies. The policy management page allows users to partially or fully display business access policies in the default policy display state. The display format can be changed as needed. Figure 6 The page displays the order, name, access method, working status ("enabled" or "disabled"), and operation of business access policies. Optionally, it can respond to a details display operation for any business access policy on the policy management page, displaying the policy details of the business access policy triggered by that operation, such as... Figure 6 As shown, assuming the response is a details display operation for service access policy number 4, the policy details for service access policy number 4 will be displayed, including but not limited to policy triggering conditions, service address information, and access method, etc. Figure 6 The triggering conditions for the business access policy in sequence 4 can include object groups (used to configure objects that can access the business server and objects that cannot access the business server, etc.), the access method is authentication access (i.e., "access after verification"), and the business address information can refer to reachable areas, etc. The business groups that can be reached under different triggering conditions are not limited here.

[0133] Optionally, in response to an upload request for a newly created service access policy, the policy priority of the newly created service access policy and its newly created service address information can be obtained. The associated service address information matching the newly created service address information can be searched in the service access policy hash table. If associated service address information is found, it is checked whether a service access policy with the same policy priority exists in the service policy group corresponding to that associated service address information; this is then used as the policy priority of the newly created service access policy. If no service access policy with the same policy priority as the newly created service access policy is detected, the newly created service access policy is associated with the associated service address information based on its policy priority. If a service access policy with the same policy priority as the newly created service access policy is detected, a policy priority conflict message is output. Optionally, this policy priority conflict message may include the service access policy with the same policy priority as the newly created service access policy. Further, if no associated service address information is found, the newly created service access policy can be associated with the newly created service address information and inserted into the service access policy hash table.

[0134] Step S402: Create a business access policy hash table.

[0135] In this embodiment, the management device can obtain M service access policies sent by the management server, and the service address information corresponding to each service access policy. The service access policy includes the corresponding service address information, and M is a positive integer. The management device can aggregate the M service access policies based on the service address information corresponding to each service access policy to obtain N service policy groups, and combine the N service policy groups to obtain a service access policy hash table; alternatively, the management device can create an initial hash table, and based on the service address information corresponding to each service access policy, sequentially add the M service access policies to the initial hash table to obtain the service access policy hash table, etc. When aggregating the M service access policies, service access policies with the same service address information can be grouped into the same service policy group until the M service access policies are aggregated into N service policy groups; alternatively, service access policies corresponding to service address information with address matching relationships can be grouped into the same service policy group until the M service access policies are aggregated into N service policy groups. The service address information with address matching relationships is matched, and this address matching relationship includes address coverage relationships and address sameness relationships, etc.

[0136] Specifically, a method for generating a service access policy hash table involves a management device obtaining M service access policies sent by a management server and the corresponding service address information for each policy; M is a positive integer. Based on the service address information for each service access policy, the M policies are grouped into N policy groups; the service address information for each policy within a policy group is matched. The service address information for each of the N policy groups is sorted to obtain N distinct sorted service address entries. The N policy groups are then associated with the corresponding service address information in each service address entry, and the service address entries associated with these N policy groups constitute the service access policy hash table.

[0137] For example, please see Figure 7 , Figure 7 This is a service access policy hash table provided in the embodiments of this application, such as... Figure 7 As shown, M service access policies 701 are obtained. Assume the M service access policies 701 include: service access policy "Service address information: 10.11.56.12, policy priority: 2;...", service access policy "Service address information: 10.11.56.14, policy priority: *;...", service access policy "Service address information: 10.11.56.28, policy priority: 23;...", and service access policy "Service address information: 10.11.56.26-10.11.56.51, policy priority...". Examples of business access policies include: "Business address information: abc.oa.com, policy priority: 5;...", "Business address information: edf.oa.com, policy priority: *;...", "Business address information: *c.oa.com, policy priority: 8;...", "Business address information: *c.oa.com, policy priority: 9;...", and "Business address information: *c.oa.com, policy priority: 12;...". Among these, Figure 7The values ​​in "[]" indicate the policy priority of the corresponding business access policy. Based on the service address information corresponding to each service access policy, the M service access policies 701 are grouped to obtain N service policy groups 702. For example, service policy group 1 corresponds to the service address information "10.11.56.12", including the service access policy "Service address information: 10.11.56.12, policy priority: 2;..."; service policy group 2 corresponds to the service address information "10.11.56.28", including the service access policy "Service address information: 10.11.56.28, policy priority: 23;..."; ...; service policy group N corresponds to the service address information "*c.oa.com", including the service access policies "Service address information: *c.oa.com, policy priority: 8;...", "Service address information: *c.oa.com, policy priority: 9;...", and "Service address information: *c.oa.com, policy priority: 12;...", etc. See details. Figure 7 The N service policy groups 702 are shown in the table. The service address information corresponding to the N service policy groups is sorted to obtain N service address items 703 containing N different sorted service address information. The N service policy groups 702 are associated with the service address information corresponding to the service address items 703 to obtain the service access policy hash table 704.

[0138] Specifically, when sorting the service address information corresponding to N service policy groups to obtain N distinct service address items, the management device can acquire the address type and address range of the service address information corresponding to each of the N service policy groups. Based on the address type and address range, the management device sorts the service address information corresponding to the N service policy groups to obtain N distinct service address items. Specifically, the management device can divide the service address information corresponding to the N service policy groups into f service address blocks based on the address type, where f is a positive integer. Then, it sorts the service address information in each service address block according to the address range to obtain N distinct service address items. The address type can include, but is not limited to, Internet Protocol Address (IP address) and domain name address types.

[0139] Specifically, if the address type is a network interconnection address type, then based on the numerical values ​​of the address ranges of the service address information corresponding to the N service policy groups, the service address information corresponding to the N service policy groups is sorted to obtain N service address items containing N sorted and distinct service address information. The network interconnection address type can include a single IP address (i.e., only one IP address is configured in a single service access policy), multiple IP addresses (multiple IP addresses are configured in a single service access policy), and IP address ranges (such as IP1-IP2, or 10.80.92.60-10.80.98.66), etc.

[0140] If the address type is a domain name address, then the business address information corresponding to the N business strategy groups is coarsely sorted based on string order. Then, based on the address range, the business address information with the same first character among the coarsely sorted N business strategy groups is re-sorted to obtain N distinct sorted business address items. If the address type includes both network interconnection address type and domain name address type, then the business address information corresponding to the N business strategy groups can be divided into f business address blocks based on the network interconnection address type and domain name address type. Each business address block contains business address information of the same address type, and f is a positive integer. That is, in this case, the business address information corresponding to the N business strategy groups is divided into two business address blocks, i.e., f is 2. One business address block corresponds to the network interconnection address type, and the other corresponds to the domain name address type. Based on the above sorting methods for network interconnection address type and domain name address type, the business address information is further sorted. The business address information contained in each business address block is sorted. For example, based on the numerical value of the address range of the business address information in the business address block corresponding to the network interconnection address type, the business address information in the business address block corresponding to the network interconnection address type is sorted. The business address information in the business address block corresponding to the domain name address type is coarsely sorted based on string order. Then, based on the address range, the business address information with the same first character in the coarsely sorted business address information in the business address block corresponding to the domain name address type is re-sorted. Based on f sorted business address blocks, a business address item containing N sorted and distinct business address information is obtained. The domain name address type can include exact domain names (such as domain names without wildcards, such as www.oa.com) and wildcard domain names (such as domain names with wildcards, such as *.oa.com).

[0141] For example, for network interconnection address types, the service address information can be sorted based on the numerical value of the address range. Optionally, the sorting rules for service address information of network interconnection address types may include, but are not limited to, the following sorting rules: (1) Sort the service address information according to the numerical value of the address range; wherein, the sorting can be done from smallest to largest address range. For example, sorting the service address information "10.11.56.12", service address information "10.11.56.28", and service address information "10.11.56.14" will result in the order of service address information "10.11.56.12" → service address information "10.11.56.12". "10.11.56.14" → Business address information "10.11.56.28"; or, it can be sorted from largest to smallest address range. For example, sorting business address information "10.11.56.12", business address information "10.11.56.28", and business address information "10.11.56.14" will result in the order "10.11.56.28" → "10.11.56.14" → "10.11.56.12", etc. (2) Sort the business address information according to the address ranges within the address ranges; the sorting can be done from smallest to largest address range. For example, sorting the business address information "10.11.56.28" and the business address information "10.11.56.26-10.11.56.51" will result in the order "10.11.56.28" -> "10.11.56.26". -10.11.56.51”; The address information can be sorted from largest to smallest within the address range. For example, sorting the service address information “10.11.56.28” and the service address information “10.11.56.26-10.11.56.51” will result in the order: service address information “10.11.56.26-10.11.56.51” -> service address information “10.11.56.28”, etc. Optionally, the sorting rules are not limited to the above rules; the management device can perform a comprehensive sorting of the service address information according to one or more of the sorting rules.

[0142] For domain name address types, business address information can be sorted based on the address range and string order of the business address information. Optionally, the sorting rules for business address information of domain name address types may include, but are not limited to, the following sorting rules: (1) Sorting according to string order; for example, it can be sorted in ascending order, such as sorting business address information "abc.oa.com" and business address information "edf.oa.com", resulting in the order "abc.oa.com" → business address information "edf.oa.com"; it can be sorted in descending order, such as sorting business address information "abc.oa.com" and business address information "edf.oa.com", resulting in the order "edf.oa.com" → business address information "abc.oa.com", etc. (2) Sort the service address information according to the address ranges within the address ranges. Sort can be done from smallest to largest address range, for example, sorting service address information "*c.oa.com" and service address information "abc.oa.com" will result in the order "abc.oa.com" -> "*c.oa.com"; or sorting can be done from largest to smallest address range, for example, sorting service address information "*c.oa.com" and service address information "abc.oa.com" will result in the order "*c.oa.com" -> "abc.oa.com", etc. Optionally, the sorting rules are not limited to the above rules; the management device can perform a comprehensive sorting of the service address information according to one or at least two of the sorting rules.

[0143] For f address types, the business address information can be sorted according to the address type. This sorting rule for the f address types can be a default type order, etc. For example, if the default type order is network interconnection address type -> domain name address type, then the business address information of the network interconnection address type can be arranged before the business address information of the domain name address type, and there is no overlap between the business address information of the two address types. For example, sorting the business address information "abc.oa.com", business address information "10.11.56.28", and business address information "edf.oa.com" will result in the order "10.11.56.28" -> "abc.oa.com" -> "edf.oa.com", etc.

[0144] Optionally, the order rules mentioned above are only some examples, and the sorting of business address information is not limited to the above order rules.

[0145] Optionally, when grouping M service access policies into N service policy groups based on the service address information corresponding to each service access policy, the management device can directly group the M service access policies into N service policy groups based on the service address information corresponding to each service access policy. Alternatively, the M service access policies can be grouped into d basic policy groups, and then further merged to obtain N service policy groups. Specifically, the management device can group the M service access policies into d basic policy groups based on the service address information corresponding to each service access policy; d is a positive integer, and the service address information of the service access policies included in each basic policy group is the same. The service address information corresponding to each of the d basic policy groups is obtained, and the address association relationship between the d service address information is obtained. If there are first and second service address information with address coverage relationships among the d service address information, then the basic policy group corresponding to the first service address information and the basic policy group corresponding to the second service address information are merged to obtain N service policy groups. For example, if the first service address information contains the second service address information, the basic policy group corresponding to the second service address information can be merged into the basic policy group corresponding to the first service address information; conversely, if the second service address information contains the first service address information, the basic policy group corresponding to the first service address information can be merged into the basic policy group corresponding to the second service address information. Since policy conflicts may occur between the service access policies corresponding to the first and second service address information that have address coverage relationships, merging these policies allows for the aggregation of conflicting service access policies. This makes it easier to compare conflicting policies when searching for service access policies, improving the efficiency and accuracy of policy search, and consequently enhancing the efficiency and convenience of policy conflict detection.

[0146] In this process, when associating N service policy groups with the corresponding service address information in the service address field, the management device can obtain the policy priority of the service access policies included in the i-th service policy group, sort the service access policies included in the i-th service policy group based on the policy priority, and form a service policy linked list corresponding to the i-th service policy group based on the sorting result. Each service access policy can be considered as a policy item structure entity in the service policy linked list; i is a positive integer less than or equal to N. The service policy linked list corresponding to the i-th service policy group is associated with the service address information corresponding to the i-th service policy group in the service address field. Optionally, if the i-th service policy group contains a service access policy, it is not necessary to generate a service policy linked list corresponding to the i-th service policy group; the service access policy contained in the i-th service policy group can be directly written into the service address information corresponding to the service address field, such as... Figure 7 The structure of the service address information "10.11.56.14" is illustrated; or the service address information corresponding to the i-th service policy group in the service address item can point to a linked list of service policies containing a policy item structure entity, such as... Figure 7 The structure of the business address information "10.11.56.12" is shown in the diagram.

[0147] Optionally, the management device can group the M service access policies based on the service address information corresponding to each service access policy, resulting in d basic policy groups. The service address information corresponding to each of the d basic policy groups is then sorted to obtain initial address entries. The d basic policy groups are then associated with the corresponding service address information in the initial address entries to obtain an initial hash table. Based on the service address information in the initial address entries of the initial hash table, the d basic policy groups are merged to obtain a service access policy hash table. (See also...) Figure 8 , Figure 8 This is a schematic diagram of a strategy merging scenario provided in an embodiment of this application. For example... Figure 8As shown, an initial hash table 801 is obtained. The initial address entries in the initial hash table 801 contain business address information with address matching relationships, such as business address information "10.11.56.28" and business address information "10.11.56.26-10.11.56.51", business address information "abc.oa.com" and business address information "*c.oa.com", as shown by the dotted line in area 802. The basic policy group corresponding to business address information "10.11.56.28" can be merged into the basic policy group corresponding to business address information "10.11.56.26-10.11.56.51"; the basic policy group corresponding to business address information "abc.oa.com" can be merged into the basic policy group corresponding to business address information "*c.oa.com", resulting in a business access policy hash table 803.

[0148] A method for generating a service access policy hash table involves a management device acquiring M service access policies and their corresponding service address information, creating service address entries; M is a positive integer. The device acquires the service address information corresponding to the j-th service access policy, and determines the insertion position of the j-th service address information within the service address entry based on its address type and address range; j is a positive integer less than or equal to M. If a matching service address exists at the insertion position, the j-th service access policy is associated with that address. If no matching service address exists at the insertion position, the j-th service address is associated with the j-th service access policy and inserted at the insertion position of the service address entry. This process continues until all M service access policies are added to the service address entries, resulting in a service access policy hash table. The matching service address information can be identical to the j-th service address or have an address overlap relationship with it.

[0149] For example, please see Figure 9 , Figure 9This is a schematic diagram of another scenario for generating a hash table for service access policies provided in this application embodiment. Assuming M service access policies 901 are obtained, these M service access policies 901 may include: Service access policy 1 "Service address information: 10.11.56.12, policy priority: 2;...", Service access policy 2 "Service address information: 10.11.56.28, policy priority: 23;...", Service access policy 3 "Service address information: 10.11.56.14, policy priority: *;...", Service access policy 4 "Service address information: 10.11.56.26-10.11.56.51, policy priority...", and Service access policy 901 "Service address information: 10.11.56.26-10.11.56.51, policy priority: 23;...". The following are examples of business access policies: "*;...", "Business address information: abc.oa.com, policy priority: 5;...", "Business address information: edf.oa.com, policy priority: *;...", "Business address information: *c.oa.com, policy priority: 8;...", "Business address information: *c.oa.com, policy priority: 9;...", and "Business address information: *c.oa.com, policy priority: 12;...", etc.

[0150] The management device can create service address entries, obtain the service address information "10.11.56.12" for service access policy 1, determine that the address insertion position of service access policy 1 in the service address entry is the first position, then insert service access policy 1 and service address information "10.11.56.12" into this address insertion position, obtaining the service access policy hash table 9021; obtain the service address information "10.11.56.28" for service access policy 2, determine that the address insertion position of service address information "10.11.56.28" in the service address entry is service address information "10.11.56.12", then associate service access policy 2 and service address information "10.11.56.28" and insert them into this address insertion position (i.e., service address information "10.11.56.12"). After 1.56.12, the business access policy hash table 9022 is obtained; the business address information "10.11.56.14" of business access policy 3 is obtained, and the address insertion position of the business address information "10.11.56.14" in the business address field is determined to be between the business address information "10.11.56.12" and the business address information "10.11.56.28". Then, business access policy 3 is associated with the business address information "10.11.56.14" and inserted into the address insertion position (i.e., between the business address information "10.11.56.12" and the business address information "10.11.56.28"), resulting in the business access policy hash table 9023; ...; until M business access policies are added to the business address field, the business access policy hash table 903 is obtained.

[0151] Optionally, if the management device already has a service access policy hash table when it receives the pending service access policy from the management server, it can traverse the service address entries in the hash table based on the pending service address information of the pending service access policy. If a service address matching the pending service address information exists in the service address entries, the pending service access policy can be associated with that matching service address information. Alternatively, based on the pending policy priority of the pending service address information, the association position of the matching service address information can be determined, and the pending service access policy can be associated with that matching service address information based on the association position. If no matching service address information exists in the service address entries, the insertion position of the pending service address information in the service address entries is determined, and the pending service address information is associated with the pending service access policy and inserted into the service address entries based on the insertion position, resulting in an updated service access policy hash table.

[0152] Step S403: Respond to the business access request for the target business and obtain the business access policy hash table.

[0153] In this embodiment, the management device can obtain the service access request for the target service sent by the service requesting device through the access proxy component, and send an access authentication request for the service access request to the management client component. The management client component performs a first detection process on the service access request to obtain a first detection result. If the first detection result is valid, an access credential acquisition request is sent to the management server, so that the management server performs a second detection process on the service access request to obtain a second detection result. If the second detection result is valid, a service access credential for the service access request is generated. The service access credential sent by the management server is obtained, and a service access policy hash table is obtained based on the service access credential.

[0154] Optionally, the management device can traverse historical access data based on the target service address information. If candidate service address information matching the target service address information exists in the historical access data, the policy position corresponding to the candidate service address information is obtained from the historical access data. Based on the policy position, the target service access policy matching the service access request is obtained from the service access policy hash table. Based on the target service access policy, the target access method for the target service server corresponding to the target service is determined. Specifically, the management device can obtain candidate service address information matching the service access request from the service address entries in the service access policy hash table based on the policy position, and search for the target service access policy matching the service access request from the service policy group corresponding to the candidate service address information. If no candidate service address information matching the target service address information exists in the historical access data, the process of obtaining the service access policy hash table is executed. This historical access data may include a historical access cache or a hash index table, or may include both a historical access cache and a hash index table.

[0155] For example, such as Figure 10 As shown, Figure 10 This is a schematic diagram of a historical search scenario provided in an embodiment of this application. For example... Figure 10 As shown, the management device can traverse the historical access cache 1001 based on the target service address information. If a candidate service address matching the target service address information exists in the historical access cache 1001, the policy position corresponding to the candidate service address information is obtained from the historical access cache 1001. Based on the policy position, the target service access policy matching the service access request is obtained from the service access policy hash table 1003. Based on the target service access policy, the target access method for the target service server corresponding to the target service is determined. If no candidate service address matching the target service address information exists in the historical access cache 1001, the hash index table 1002 can be traversed based on the target service address information. If a candidate service address matching the target service address information exists in hash index table 1002, the policy position corresponding to the candidate service address information is obtained from hash index table 1002. Based on the policy position, the target service access policy matching the service access request is obtained from the service access policy hash table. Based on the target service access policy, the target access method for the target service server corresponding to the target service is determined. If no target service address information exists in hash index table 1002, the process of obtaining the service access policy hash table is executed.

[0156] Step S404: Based on the target business address information of the business access request, traverse the N business address information in the business address item.

[0157] In this embodiment, the management device can traverse the N service address information entries in the service address field based on the target service address information of the service access request. Specifically, it compares each of the N service address information entries sequentially with the target service address information to obtain the address association between them. If a service address information matching the target service address information is found among the N service address information entries, it is identified as a candidate service address information. If no matching service address information is found among the N service address information entries, it is determined that no candidate service address information matching the target service address information exists, and the default access method can be determined as the target access method for the target service server corresponding to the target service. The address matching relationship includes address similarity and address coverage relationships. In other words, candidate service address information refers to service address information that is identical to or contains the target service address information.

[0158] Step S405: If there is a candidate service address information that matches the target service address information among the N service address information, then the service policy group associated with the candidate service address information in the service access policy hash table is determined as the candidate service policy group.

[0159] In the embodiments of this application, see [reference needed]. Figure 3 The specific description of step S303 in the above steps will not be repeated here. For example, in... Figure 8 In the business access policy hash table shown, assuming the target business address information is "ac.oa.com", the candidate business address information "*c.oa.com" that matches the target business address information can be obtained, and the business policy group associated with the candidate business address information "*c.oa.com" is determined as the candidate business policy group.

[0160] Step S406: Obtain the policy priority of the business access policy in the candidate business policy group; based on the policy priority, obtain the target business access policy that matches the business access request from the candidate business policy group; and based on the target business access policy, determine the target access method for the target business server corresponding to the target business.

[0161] In this embodiment, the management device can obtain the policy priority of the service access policies in the candidate service policy group, compare them sequentially with the service access requests based on the policy priority, and determine the service access policy whose policy trigger condition is met as the target access method for the target service server corresponding to the target service. Optionally, if there is no service access policy whose policy trigger condition is met among the service access policies included in the candidate service policy group, the default access method can be determined as the target access method for the target service server corresponding to the target service. Wherein, if the information carried in the service access request satisfies the policy trigger condition in the service access policy, the policy trigger condition in the service access policy can be considered met. For example, in... Figure 8 In the business access policy hash table shown, the business policy group associated with the candidate business address information "*c.oa.com" is the candidate business policy group. The business access policy with policy priority 8, "Business address information: *c.oa.com, policy priority: 8;...", is compared with the business access request. Assuming that the policy triggering condition in the business access policy with policy priority 8 is not matched by the business access request, the business access policy with policy priority 9, "Business address information: *c.oa.com, policy priority: 9;...", is compared with the business access request. Assuming that the policy triggering condition in the business access policy with policy priority 9 is matched by the business access request, the business access policy with policy priority 9 is determined as the target business access policy that matches the business access request.

[0162] Step S407: Determine the processing result of the business access request based on the target access method.

[0163] In this embodiment of the application, the processing result is used to indicate responding to a service access request (i.e., obtaining the data requested by the service access request) or blocking (i.e., interrupting the service access request), etc.

[0164] Specifically, if the target access method is direct access, the target service is obtained from the target service server and sent to the service requesting device that sent the service access request.

[0165] If the target access method is blocking access, the service access request is interrupted, and a request exception message is sent to the requesting device. Specifically, if the target access method is blocking access, the service access request is interrupted, and the service access information carried in the request is obtained. The service interruption information triggered by the target policy triggering condition in the target service access policy is used to generate a request exception message, which is then sent to the requesting device. For example, if the target policy triggering condition in the target service access policy includes "Accessing port 8080 from 15:00 to 18:00 will result in blocking access (i.e., blocking access method)," and the service access request accesses port 8080 at 16:20, triggering this policy rule, then the service interruption information triggered by the target policy triggering condition, which states "Accessing port 8080 from 15:00 to 18:00 will result in blocking access (i.e., blocking access method)," is used to generate a request exception message, which is then sent to the requesting device.

[0166] If the target access method is authentication access, an authentication request is sent to the requesting device. Based on the authentication request, the access association information of the requesting device is obtained, and the access association information is verified. If the verification passes, the target service is retrieved from the target service server and sent to the requesting device. Authentication access means that secondary verification is required to ensure that the requesting device is a legitimate device and that the login object corresponding to the requesting device has a legitimate identity before proceeding with subsequent access.

[0167] If the target access method is proxy access, the management client component sends the business access request to the access proxy component. The access proxy component then sends business access credentials to the access gateway, allowing the gateway to verify the credentials. If the credentials are successfully verified, a network connection is established with the access proxy component. If a network connection is established with the access gateway, the business access request is sent to the gateway, enabling the gateway to access the target business server corresponding to the target business based on the request. Specifically, if... Figure 1bAs shown, if the target access method is proxy access, the management client component can send the business access request to the access proxy component. The access proxy component then sends the business access credential to the access gateway 107. The access gateway 107 verifies the business access credential, specifically by requesting the verification result from the management server 106. If the business access credential verification is successful, a network connection is established with the access proxy component. The access proxy component establishes a network connection with the access gateway 107 and sends the business access request to the access gateway 107. Based on the business access request, the access gateway 107 accesses the target business server corresponding to the target business.

[0168] Step S408: Generate or update the historical access cache.

[0169] In this embodiment, historical access data includes a historical access cache. Specifically, the management device can generate historical access records based on the target service address information and its address position in the service access policy hash table. The policy trigger time of the target service access policy is obtained, and the target service address information is searched in the historical access cache. If the target service address information exists in the historical access cache, the address access count of the target service address information is updated based on the historical access record, and the policy trigger time is associated with the target service address information in the historical access cache. If the target service address information does not exist in the historical access cache, the historical access record is added to the historical access cache.

[0170] If no historical access cache is found, it can be created, and the historical access records can be added to it. Optionally, if there is no free space in the historical access cache, the cache entry with the longest storage time can be retrieved and deleted. Optionally, since this step refers to adding the relevant data of the business access process shown in steps S403 to S407 of this embodiment to the historical cache data, it describes the processing of target business address information, etc. This step is also applicable to other scenarios of updating the historical access cache, and is not limited here.

[0171] Step S409: Generate or update the hash index table.

[0172] In this embodiment, the historical access data further includes a hash index table. Specifically, the cached service address information and the cache record information associated with the cached service address information are obtained from the historical access cache. The cache record information includes the number of cache address accesses and the cache policy trigger time of the cached service address information. If the number of cache address accesses is greater than or equal to the access threshold, the cache record information is added to the hash index table. Optionally, if there is no free space in the hash index table, the hash index entry with the longest storage time in the hash index table can be obtained and deleted.

[0173] See Figure 11 , Figure 11 This is a schematic diagram of a historical access data processing scenario provided in an embodiment of this application. For example... Figure 11 As shown, ① the management device can generate historical access records based on the target service address information and the address position of the target service address information in the service access policy hash table; obtain the policy trigger time of the target service access policy, and add the historical access records and policy trigger time to the historical access cache 1101 based on the target service address information, as shown in step S408.

[0174] Optionally, the cached service address information included in the historical access cache, as well as the cached record information associated with the cached service address information, can be obtained. The cache record information includes the number of times the cached service address information is accessed and the cache policy trigger time. If the number of cached address accesses is greater than or equal to the access threshold, such as the number of cached address accesses of the cached service address information "gbc.oa.com:27900"② being greater than or equal to the access threshold, then the cached record information of the cached service address information "gbc.oa.com:27900"② is added to the hash index table 1102, as shown in hash index entry ③.

[0175] Optionally, assuming the target service address information is "gbc.oa.com:27900", based on the above process, candidate service address information matching the target service address information is found from hash index table 1102, as shown in the service address information in hash index entry ③. The policy position "51" corresponding to the candidate service address information is obtained from hash index table 1102. Based on policy position "51", the service policy group corresponding to the candidate service address information is obtained from service access policy hash table 1103. The target service access policy matching the service access request is found from the service policy group. Assuming the determined target service access policy is service access policy ④, the target access method for the target service server corresponding to the target service can be determined based on service access policy ④. Optionally, the cache address access count corresponding to the target service address information in the hash index table can be updated based on this access. Optionally, the cache entries of each service address information can be sorted based on the cache address access count corresponding to the service address information included in hash index table 1102. For example, the cache entries with a large cache address access count are arranged before the cache entries with a small cache address access count. For example, the business address information corresponding to cache entry 1 is "10.11.56.12", and the cache address access count is 5; the business address information corresponding to cache entry 2 is "10.11.56.14", and the cache address access count is 10; then in hash index table 1102, the two can be arranged as "cache entry 2 -> cache entry 1".

[0176] Among them, if there is no free space in the hash index table, the hash index entry with the longest storage time in the hash index table can be obtained and deleted.

[0177] Optional, the above Figure 11 Each segment can be considered an independent process, which can be implemented asynchronously, and there are no restrictions on the order of implementation.

[0178] Step S410: Perform conflict detection on the business policy group and provide an error response when a conflict occurs in the business access policy.

[0179] In this embodiment of the application, the management device can obtain the policy triggering conditions of the service access policies included in the service access policy hash table, and perform conflict detection on the candidate service policy group based on the service address information corresponding to the service access policy and the policy triggering conditions.

[0180] If there are conflicting first and second service access policies in the candidate service policy group, then the abnormal service access policy is obtained from the first and second service access policies, the policy association device associated with the abnormal service access policy is obtained, and a policy abnormal message is sent to the policy association device. The abnormal service access policy refers to the service access policy in the first and second service access policies that has an abnormal trigger probability or cannot be triggered.

[0181] Optionally, during the acquisition of the target service access policy, the management device can asynchronously detect and report the matching process of the service access policy. Specifically, the management device can acquire the service access policies corresponding to candidate service address information that match the target service address information (which can be simply considered as the service access policies that match the target service address information). From the service access policies that match the target service address information, it can acquire the service access policies to be tested, excluding the target service access policy, obtain the matching failure message of the service access policy to be tested, and report the matching failure message so that the management object can obtain the matching failure message and then process the service access policy to be tested, such as retaining it, deleting it, or modifying it.

[0182] For example, please see Figure 12 , Figure 12 This is a schematic diagram of a strategy detection scenario provided in an embodiment of this application. Figure 12 As shown, the following information was obtained: Service access policy 1 "Service address information: 10.11.56.12; Policy priority: 2;...", Service access policy 2 "Service address information: abc.oa.com; Policy priority: 5;...", and Service access policy 3 "Service address information: *c.oa.com; Policy priority: 9;...".

[0183] In one scenario①, assuming the target address information is "10.11.56.12", the service access request is used to access "10.11.56.12:26990". However, the service access policy 1 to be tested only allows access to several ports other than port 26990. That is, the access methods for these ports other than port 26990 are direct access, proxy access, or authentication access. Therefore, the port in the service access request does not match the port in the policy triggering condition of the service access policy 1 to be tested, resulting in a mismatch between the service access policy 1 to be tested and the service access request. In other words, a matching failure message "The port in the service access request does not match the port in the policy triggering condition of the service access policy 1 to be tested" is obtained.

[0184] In scenario ②, assuming the target business access policy determined in the business access policy hash table 1201 is "Business address information: *c.oa.com; Policy priority: 8;...", the policy priority of the business access policy to be tested 2 is higher than that of the target business access policy. However, the business access policy with a final policy priority of 8 is determined as the target business access policy. If the business access request does not match the policy triggering condition of the business access policy to be tested 2 (e.g., the business access request is sent via the external network, while the policy triggering condition of the business access policy to be tested 2 is for the internal network area), then a matching failure message "The business access request does not match the policy triggering condition of the business access policy to be tested 2" can be obtained.

[0185] In scenario ③, assuming the target business access policy determined in the business access policy hash table 1201 is "Business address information: *c.oa.com; Policy priority: 8;...", the policy priority of the business access policy 3 to be tested is lower than that of the target business access policy. This means that if the target business access policy has already been matched, the business access policy 3 to be tested will not be matched. Therefore, a matching failure message "The policy priority of the business access policy 3 to be tested is low" can be obtained.

[0186] Optionally, other matching failure scenarios can also be included, which will not be elaborated here. The management device can generate policy matching feedback information 1202 based on the matching failure message and report this policy matching feedback information. Through the above process, the utilization rate of business access policies can be improved.

[0187] Optionally, the management device can report historical policy matching information of the audit business access policy to the management server. This historical policy matching information includes, but is not limited to, the historical hit count of the audit business access policy, matching failure messages of the associated business access policies of the audit business access policy, and historical policy matching details. Optionally, the management device can also obtain device information of the business requesting device, including but not limited to device environment status. Based on the historical policy matching information and device information, the management device can generate an audit view and monitoring model for the audit business access policy. This audit view and monitoring model are used to detect the audit business access policy. Further, the management device can obtain preset policy matching information of the audit business access policy. This preset policy matching information includes, but is not limited to, the hit count and policy matching probability. By comparing the historical policy matching information with the preset policy matching information, if the difference between the historical policy matching information and the preset policy matching information is greater than or equal to the policy anomaly threshold, it is determined that the audit business access policy is abnormal, and the abnormal information of the audit business access policy can be fed back. This abnormal information can be used to process the audit business access policy, such as adding, deleting, or updating it. The audit business access policy can be any business access policy included in the business access policy hash table. The number of audit business access policies can be one or at least two, without limitation. Through the above process, the audit target can be detected. The audit target includes, but is not limited to, the following aspects:

[0188] (1) Audit which service access policies should be matched for specific device information and the distribution characteristics of traffic control for service access requests.

[0189] (2) Audit whether the distribution of business access policies with policy relationships is reasonable and whether there are any ineffective business access policies.

[0190] (3) Audit whether there are any business access policies that can be merged, and make a merge request for business access policies that can be merged, so as to reduce policy matching overhead and potential risks.

[0191] (4) Audit whether the policy triggering conditions in the business access policy are reasonable and whether the policy priority needs to be adjusted.

[0192] Further, see Figure 13 , Figure 13 This is a schematic diagram of a zero-trust network architecture provided in an embodiment of this application. Figure 13As shown, this zero-trust network consists of management devices and a management server, etc. The access subject refers to the service requesting device, and the access object refers to the service server. The zero-trust network can provide a unified entry point for the access subject to request services from the access object through the network, and the zero-trust network provides authentication operations for this unified entry point. Optionally, the access subject can use an access gateway to proxy the access to the actual service server.

[0193] Specifically, such as Figure 1b As shown, the data processing procedure may include the following steps:

[0194] (1) The service request device 104 can initiate a service access request to the target service server through the application, and the management device 105 can obtain the service access request through the access proxy component.

[0195] (2) The management device 105 initiates an authentication request to the management client component through the access proxy component. That is, the access proxy component requests the business access credential for the business access request from the management client component. Optionally, the authentication request may include, but is not limited to, the source address information of the business requesting device (such as the IP address information or domain name information of the business requesting device), the source port of the business requesting device that sends the business access request, the target business address information (such as the IP address information or domain name information of the target business server), the port requested by the business access request (i.e., the target port), and the process identifier corresponding to the application.

[0196] (3) The management device 105 can collect the process key, process path (including but not limited to the application installation path and data transmission path), process modification time, application copyright information and signature information of the application process corresponding to the application through the management client component.

[0197] (4) Furthermore, the management device 105 can send the source address information, source port, target service address information and target port corresponding to the service access request to the management server 106 through the management client component.

[0198] (5) The management server 106 performs a second detection process on the business access request to obtain a second detection result. If the second detection result is valid, a business access credential for the business access request is generated and sent to the management client component in the management device 105. This business access credential may include, but is not limited to, the number of times the credential has been used and its validity period. The second detection process refers to performing detection based on dynamic factors such as device information, compliance checks, and object access behavior.

[0199] (6) The management device 105 sends the business access credentials to the access agent component through the management client component.

[0200] (7) The access proxy component sends a credential verification request to the access gateway 107. The credential verification request may include business access credentials, etc.

[0201] (8) Access gateway 107 can obtain business access credentials from the credential verification request and verify the business access credentials with management server 106.

[0202] (9) The management server 106 verifies the business access credentials. If the verification is successful, it sends a credential verification success message to the access gateway 107.

[0203] (10) When the access gateway 107 receives the credential verification success message, it establishes a network connection with the access proxy component, obtains the business access request, and sends the business access request to the target business server (included in the business server 108) corresponding to the target business.

[0204] (11) Access gateway 107 to obtain the target service from the target service server.

[0205] (12) Access gateway 107 sends the target service to the access proxy component.

[0206] (13) Access the proxy component to forward the target service to the service request device 104.

[0207] If the access gateway 107 fails to verify the service access credentials, the access gateway 107 will disconnect the network connection with the access proxy component. Optionally, for applications outside the service access policy, the access proxy component can directly initiate a network connection request to the target service server, obtain the target service from the target service server, and send the target service to the service request device 104.

[0208] The business access policy defines the specific control information for access subjects to access services. It can be authorized by the management end (including management devices and management servers, etc.) and can be composed of the application carrier (trusted application) that the business requesting device can access, the accessible business server (reachable area), device information, and object login rules. Under the condition of complying with the business access policy, an object (such as a user) can access any business server in any reachable area using any trusted application in the business access policy on a trusted application.

[0209] Optionally, the mapping between objects and devices changes frequently, resulting in a large amount of stored data. It is not advisable to configure all compliant devices and legitimate authenticated object information into the business access policy. Therefore, the business access policy can be stored on the management server; that is, the business access policy can be used as the basic data storage in the management server's cache or database. Based on the compliance of the business requesting device, the management server issues business access policies to the managed devices at the granularity of the login object or the object group to which the login object belongs. This allows different login objects to access the services configured in the business access policy through different trusted applications on compliant business requesting devices. The business access policies mentioned above refer to any existing business access policy.

[0210] Optionally, due to overlapping or conflicting relationships between business access policies, the management server can also configure policy priorities based on the coverage (i.e., the range of address ranges) of the business address information. For example, the policy priority for business address information "www.oa.com" can be considered higher than that for business address information "*.oa.com" because "*.oa.com" covers "www.oa.com". Generally, it is more meaningful to have a higher policy priority for a business access policy with a smaller coverage than one with a larger coverage. The management object can also adjust the policy priority of existing business access policies.

[0211] Among them, policy conflicts include, but are not limited to, policy item overriding relationships and policy conflict relationships, as shown below:

[0212] (1) Policy item coverage relationship: If the first service address information of the first service access policy can include the second service address information of the second service access policy, or the second service address information of the second service access policy includes the first service address information of the first service access policy, and the access method of the first service access policy is the same as that of the second service access policy, then it is considered that there is a policy item coverage relationship between the first service access policy and the second service access policy. For example, for service access policy P1 and service access policy P2, if the combination of the domain name or IP address and port of the service server in P1 can include the combination of the domain name or IP address and port of the service server in P2, and the access methods of the two are the same, it can be considered that there is a policy item coverage relationship between P1 and P2; or, if the combination of the domain name or IP address and port of the service server in P2 can include the combination of the domain name or IP address and port of the service server in P1, and the access methods of the two are the same, it can be considered that there is a policy item coverage relationship between P1 and P2.

[0213] For example, a business access policy named "L1" is configured for "*.oa.com", with port configuration ignoring port verification (i.e., all ports can be matched), and access method set to allow access, which can be, but is not limited to, direct connection access, proxy access, or authenticated access. A business access policy named "L2" is configured for "www.oa.com", with port configuration only allowing access on ports 27800 and 27900. Therefore, there is a policy item overriding relationship between the "L1" and "L2" business access policies.

[0214] (2) Policy conflict relationship: If there is some overlap or the same between the first service address information of the first service access policy and the second service address information of the second service access policy, and the access methods of the two are different, then it can be considered that there is a policy conflict relationship between the first service access policy and the second service access policy.

[0215] For example, a service access policy named "L1" is configured for "*.oa.com", with port verification ignored (i.e., all ports can be matched), and access is blocked. A service access policy named "L2" is configured for "www.oa.com", with port settings that only allow access on ports 27800 and 27900. Therefore, there is a policy conflict between the "L1" and "L2" service access policies.

[0216] Optionally, the management device can be configured for authentication; see [link / reference]. Figure 14 , Figure 14 This is a schematic diagram of an authentication configuration scenario provided in an embodiment of this application. For example... Figure 14 As shown, in the authentication configuration area, the management device can configure login authentication information. This login authentication information can include login method, bound authentication source, applicable scope, authentication information configuration status, and operations. Login methods include, but are not limited to, account-password login, QR code login, token login, and third-party login. For details, please refer to [link to relevant documentation]. Figures 15a to 15b , Figure 15a This is a schematic diagram of a login method provided in an embodiment of this application. Figure 15b This is a schematic diagram illustrating another login method provided in an embodiment of this application. For example... Figure 15aAs shown, on the account login page 1501, users can log in to the management device using an object name and password. On the third-party login page 1502, the management device can respond to trigger operations on the third-party login component, displaying a third-party application link. This link is used to obtain the login information of the corresponding third-party application and feed it back to the third-party login page 1502. Login to the management device is then achieved based on the obtained login information. Figure 15b As shown, on the token login page 1503, users can log in to the management device using a password or token. On the QR code login page 1504, the system responds to QR code scanning operations, obtains QR code login information, and logs in to the management device based on this information. Specifically, this can be considered as logging into a zero-trust network. The bound authentication sources include, but are not limited to, Lightweight Directory Access Protocol, remote dialing, and Jade Tokens.

[0217] In the login method configuration area, you can configure basic authentication and two-factor authentication. The basic authentication configuration specifies the login methods available during basic authentication, and the two-factor authentication configuration specifies the login methods available during two-factor authentication. For example, Figure 14 In the basic authentication configuration, if account-password login, token login, and third-party login are configured, then when performing basic authentication on a business access request, login verification can be performed through account-password login, token login, or third-party login; for example, if token login is configured in the secondary authentication configuration, then when performing secondary authentication on a business access request, login verification can be performed through token login.

[0218] Optional, see below Figure 16 , Figure 16 This is another schematic diagram of service access policy management provided in an embodiment of this application. For example... Figure 16 As shown, see also Figure 6 The page description shown indicates that, optionally, the management object can distinguish between access to sensitive and non-sensitive business servers while configuring business access policies. It can also display the hit count of business access policies on the policy management page, which refers to the number of times the corresponding business access policy is triggered.

[0219] Optional, see below Figure 17 , Figure 17 This is a schematic diagram of a strategy configuration scenario provided in an embodiment of this application. For example... Figure 17As shown, the managed object can configure service access policies through the policy configuration page. The managed object can input the content of the service access policy on this page, such as the policy name, object login rules, access methods, and service groups. The service access policy can also include device policy rules (such as specifying terminal systems), trusted application information, and network zones. The management device can respond to upload requests for the service access policy, obtain the content entered on the policy configuration page, generate the service access policy based on the content entered on the policy configuration page, and store the service access policy. Optionally, the management device can respond to modification operations on the policy configuration page and modify the service access policy indicated on the policy configuration page.

[0220] Optionally, the management device sends the target service to the service requesting device, which can then output service access permission information. For example, see... Figure 18 , Figure 18 This is a schematic diagram illustrating a request-response message display scenario provided in an embodiment of this application. For example... Figure 18 As shown, the service requesting device can output service access permission information 1802 in the request response page 1801, such as "You have connected to the target service server and can access the target service". Optionally, the service requesting device can also output an access protection message 1803, which may include real-time protection information, protection engine information, and security hardening information, etc. The real-time protection information may include application entry protection information and system underlying protection information, etc.

[0221] Further, please see Figure 19 , Figure 19 This is a schematic diagram of a data processing apparatus provided in an embodiment of this application. The data processing apparatus can be a computer program (including program code, etc.) running on a computer device; for example, the data processing apparatus can be application software. The apparatus can be used to execute corresponding steps in the methods provided in the embodiments of this application. Figure 19 As shown, the data processing device 1900 can be used for Figure 3 Specifically, the computer device in the corresponding embodiment may include: a request response module 11, an address traversal module 12, an address matching module 13, a strategy selection module 14, and a method determination module 15.

[0222] The request and response module 11 is used to respond to business access requests for the target business and obtain the business access policy hash table. The business access request includes the target business address information corresponding to the target business. The business access policy hash table includes business address entries, and each business address entry includes N distinct business address information, where N is a positive integer. Each business address information in the business address entry is associated with a corresponding business policy group.

[0223] Address traversal module 12 is used to traverse N business address information in the business address item according to the target business address information;

[0224] The address matching module 13 is used to determine the business policy group associated with the candidate business address information in the business access policy hash table as the candidate business policy group if there is a candidate business address information that matches the target business address information among the N business address information.

[0225] The strategy selection module 14 is used to obtain the strategy priority of the business access strategy in the candidate business strategy group, and to obtain the target business access strategy that matches the business access request from the candidate business strategy group based on the strategy priority.

[0226] The method determination module 15 is used to determine the target access method for the target business server corresponding to the target business based on the target business access policy.

[0227] The device 1900 also includes:

[0228] The policy acquisition module 16 is used to acquire M service access policies sent by the management server and the service address information corresponding to each service access policy; M is a positive integer;

[0229] The policy grouping module 17 is used to group M service access policies based on the service address information corresponding to each service access policy, resulting in N service policy groups; the service address information corresponding to each service access policy in a service policy group is matched.

[0230] The strategy sorting module 18 is used to sort the service address information corresponding to N service strategy groups respectively, and obtain a service address item containing N sorted and distinct service address information.

[0231] The strategy association module 19 is used to associate N business strategy groups with the corresponding business address information in the business address item;

[0232] The table generation module 20 is used to determine the business address items associated with N business policy groups as a business access policy hash table.

[0233] The strategy sorting module 18 includes:

[0234] The attribute acquisition unit 181 is used to acquire the address type and address range of the business address information corresponding to N business strategy groups respectively.

[0235] The numerical sorting unit 182 is used to sort the service address information corresponding to the N service policy groups based on the numerical value of the address range of the service address information corresponding to the N service policy groups, if the address type is a network interconnection address type, so as to obtain a service address item containing N sorted and different service address information.

[0236] The character sorting unit 183 is used to perform coarse sorting of the business address information corresponding to N business strategy groups based on string order if the address type is a domain name address type, and then re-sort the business address information with the same first character among the coarsely sorted business address information corresponding to the N business strategy groups according to the address range, so as to obtain a business address item containing N sorted and different business address information.

[0237] The strategy grouping module 17 includes:

[0238] The basic grouping unit 171 is used to group M service access policies based on the service address information corresponding to each service access policy, to obtain d basic policy groups; d is a positive integer, and the service address information of the service access policies included in each basic policy group is the same.

[0239] The relationship acquisition unit 172 is used to acquire the service address information corresponding to each of the d basic policy groups and to acquire the address association relationship between the d service address information.

[0240] The strategy merging unit 173 is used to merge the basic strategy group corresponding to the first service address information and the basic strategy group corresponding to the second service address information if there are first service address information and second service address information with address coverage relationship among d service address information, to obtain N service strategy groups.

[0241] The strategy association module 19 includes:

[0242] The priority sorting unit 191 is used to obtain the policy priority of the business access policies included in the i-th business policy group, sort the business access policies included in the i-th business policy group based on the policy priority, and form a business policy linked list corresponding to the i-th business policy group based on the sorting result; i is a positive integer less than or equal to N.

[0243] The strategy association unit 192 is used to associate the business strategy linked list corresponding to the i-th business strategy group with the business address information corresponding to the i-th business strategy group in the business address item.

[0244] The device 1900 also includes:

[0245] The entry creation module 21 is used to obtain M service access policies and the service address information corresponding to each service access policy, and create service address entries; M is a positive integer;

[0246] The location determination module 22 is used to obtain the service address information corresponding to the j-th service access strategy, and determine the address insertion position of the j-th service address information in the service address item based on the address type and address range of the j-th service address information; j is a positive integer less than or equal to M;

[0247] The location association module 23 is used to associate the j-th service access policy with the service address information at the address insertion location if there is service address information at the address insertion location that matches the j-th service address information.

[0248] The policy insertion module 24 is used to associate the j-th service address information with the j-th service access policy and insert it into the address insertion position of the service address item if there is no service address information matching the j-th service address information at the address insertion position.

[0249] The table generation module 20 is also used to add M service access policies to the service address item to obtain a service access policy hash table.

[0250] The device 1900 also includes:

[0251] The service acquisition module 25 is used to acquire the target service from the target service server and send the target service to the service request device that sent the service access request if the target access method is direct access.

[0252] The exception sending module 26 is used to interrupt the service access request and send a request exception message to the service requesting device if the target access method is the blocking access method.

[0253] The information verification module 27 is used to send an information authentication request to the service requesting device if the target access method is an authentication access method, obtain the access association information of the service requesting device based on the information authentication request, perform information verification processing on the access association information, and when the information verification processing is successful, obtain the target service from the target service server and send the target service to the service requesting device.

[0254] The exception sending module 26 includes:

[0255] The interruption unit 261 is used to interrupt the service access request if the target access method is the blocking access method, and to obtain the service access information carried in the service access request.

[0256] The exception generation unit 262 is used to generate a request exception message based on the service interruption information triggered by the target policy triggering condition in the target service access policy, and send the request exception message to the service request device.

[0257] The request-response module 11 includes:

[0258] The authentication request unit 111 is used to obtain the service access request for the target service sent by the service request device through the access proxy component, and send the access authentication request for the service access request to the management client component.

[0259] The credential acquisition unit 112 is used to perform a first detection process on the business access request through the management client component to obtain a first detection result. If the first detection result is a valid result, it sends an access credential acquisition request to the management server so that the management server performs a second detection process on the business access request to obtain a second detection result. When the second detection result is a valid result, it generates a business access credential for the business access request.

[0260] The credential acquisition unit 112 is also used to acquire the business access credentials sent by the management server, and based on the business access credentials, acquire the business access policy hash table.

[0261] The device 1900 also includes:

[0262] The proxy access module 28 is used to send the business access request to the access proxy component through the management client component if the target access method is proxy access.

[0263] The credential sending module 29 is used to send business access credentials to the access gateway through the access proxy component, so that the access gateway can verify the business access credentials and establish a network connection to the access proxy component when the business access credentials are verified.

[0264] The gateway request module 30 is used to send a service access request to the access gateway if a network connection is established with the access gateway, so that the access gateway can access the target service server corresponding to the target service based on the service access request.

[0265] The device 1900 also includes:

[0266] The history traversal module 31 is used to traverse historical access data based on the target business address information;

[0267] The history acquisition module 32 is used to obtain the policy position corresponding to the candidate service address information from the historical access data if there is candidate service address information that matches the target service address information in the historical access data, obtain the target service access policy that matches the service access request from the service access policy hash table based on the policy position, and determine the target access method for the target service server corresponding to the target service based on the target service access policy.

[0268] The historical matching module 33 is used to execute the process of obtaining the service access policy hash table if there is no candidate service address information that matches the target service address information in the historical access data.

[0269] The historical access data includes a historical access cache; the device 1900 also includes:

[0270] The record generation module 34 is used to generate historical access records based on the target service address information and the address position of the target service address information in the service access policy hash table.

[0271] Address lookup module 35 is used to obtain the policy trigger time of the target business access policy and look up the target business address information in the historical access cache.

[0272] The record update module 36 is used to update the address access count of the target business address information based on the historical access record if the target business address information exists in the historical access cache, and associate the policy triggering time with the target business address information in the historical access cache.

[0273] The record addition module 37 is used to add the historical access record to the historical access cache if the target business address information does not exist in the historical access cache.

[0274] The historical access data also includes a hash index table; the device 1900 also includes:

[0275] The cache acquisition module 38 is used to acquire the cached service address information included in the historical access cache, as well as the cache record information associated with the cached service address information; the cache record information includes the number of cache address accesses and the cache policy trigger time of the cached service address information.

[0276] The cache transfer module 39 is used to add cache record information to the hash index table if the number of accesses to the cache address is greater than or equal to the access threshold.

[0277] The device 1900 also includes:

[0278] The conflict detection module 40 is used to obtain the policy triggering conditions of the business access policies included in the business access policy hash table, and to perform conflict detection on the candidate business policy group based on the business address information and policy triggering conditions corresponding to the business access policies.

[0279] The anomaly feedback module 41 is used to obtain an abnormal service access policy from the first service access policy and the second service access policy if there are conflicting policies in the candidate service policy group, obtain the policy association device associated with the abnormal service access policy, and send a policy anomaly message to the policy association device. The abnormal service access policy refers to the service access policy in the first service access policy and the second service access policy that has an abnormal trigger probability or cannot be triggered.

[0280] This application provides a data processing apparatus that can respond to a service access request for a target service and obtain a service access policy hash table. The service access request includes target service address information corresponding to the target service. The service access policy hash table includes service address entries, each containing N distinct service address information, where N is a positive integer. Each service address information in the service address entries is associated with a corresponding service policy group. The apparatus iterates through the N service address information in the service address entries based on the target service address information. If a candidate service address information matching the target service address information exists among the N service address information, the service policy group associated with the candidate service address information in the service access policy hash table is determined as a candidate service policy group. The policy priority of the service access policy in the candidate service policy group is obtained. Based on the policy priority, the target service access policy matching the service access request is obtained from the candidate service policy group. Based on the target service access policy, the target access method for the target service server corresponding to the target service is determined. Through the above process, a business access policy hash table exists. This hash table uses N distinct business address information entries as business address entries, which can act as an index. This allows business access policies with the same or matching business address information to be aggregated together. When detecting business access requests, the business address information can be filtered first, and then the target business access policy matching the request can be found. This makes the business access policy storage records more organized and improves the efficiency of business access policy lookup. Moreover, when there are many business access policies, these policies may often be uploaded by different management objects, making conflicts between business access policies more likely. Policy priority can effectively reduce lookup conflicts, thereby improving data processing efficiency. Simultaneously, detecting business access requests based on this business access policy improves the security of business access.

[0281] See Figure 20 , Figure 20 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 20 As shown, the computer device in this embodiment may include one or more processors 2001, a memory 2002, and an input / output interface 2003. The processor 2001, memory 2002, and input / output interface 2003 are connected via a bus 2004. The memory 2002 stores a computer program, which includes program instructions. The input / output interface 2003 receives and outputs data, such as for data interaction between a service request device and a management device, or between a management device and a management server, or between a management server and an access gateway, or between an access gateway and a service server, etc. The processor 2001 executes the program instructions stored in the memory 2002.

[0282] The processor 2001 can perform the following operations:

[0283] Respond to a business access request for the target business and obtain the business access policy hash table; the business access request includes the target business address information corresponding to the target business; the business access policy hash table includes business address entries, each of which includes N distinct business address information, where N is a positive integer; each business address information in the business address entry is associated with a corresponding business policy group;

[0284] Traverse the N business address information entries in the business address field based on the target business address information;

[0285] If there is a candidate service address that matches the target service address among the N service address information, then the service policy group associated with the candidate service address information in the service access policy hash table is determined as the candidate service policy group.

[0286] Obtain the policy priority of the business access policy in the candidate business policy group, obtain the target business access policy that matches the business access request from the candidate business policy group based on the policy priority, and determine the target access method for the target business server corresponding to the target business based on the target business access policy.

[0287] In some feasible implementations, the processor 2001 may be a central processing unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0288] The memory 2002 may include read-only memory and random access memory, and provides instructions and data to the processor 2001 and input / output interface 2003. A portion of the memory 2002 may also include non-volatile random access memory. For example, the memory 2002 may also store device type information.

[0289] In practice, the computer device can perform actions such as these through its built-in functional modules. Figure 3 or Figure 4 For details on the implementation methods provided for each step, please refer to [the relevant documentation / document / etc.]. Figure 3 or Figure 4 The implementation methods provided for each step are not elaborated here.

[0290] This application provides a computer device including a processor, an input / output interface, and a memory. The processor retrieves a computer program from the memory and executes it. Figure 3 Each step of the method shown involves data processing operations. This application embodiment implements a business access policy hash table. This hash table uses N distinct business address information entries as business address entries, which can act as an index. This allows business access policies with the same or matching business address information to be aggregated together. When detecting business access requests, the business address information can be filtered first, and then the target business access policy matching the request can be found. This makes the business access policies more organized in storage records, improving the efficiency of business access policy lookup. Furthermore, when there are many business access policies, these policies may often be uploaded by different management objects, making conflicts between business access policies more likely. Policy priority can effectively reduce lookup conflicts, thereby improving data processing efficiency. Simultaneously, detecting business access requests based on this business access policy improves the security of business access.

[0291] This application also provides a computer-readable storage medium storing a computer program adapted to be loaded and executed by a processor. Figure 3 or Figure 4 For details on the data processing methods provided in each step, please refer to the document. Figure 3 or Figure 4 The implementation methods provided for each step are not repeated here. Furthermore, the beneficial effects of using the same method are also not repeated. For technical details not disclosed in the computer-readable storage medium embodiments involved in this application, please refer to the description of the method embodiments of this application. As an example, a computer program may be deployed to execute on a single computer device, or on multiple computer devices located in one location, or on multiple computer devices distributed across multiple locations and interconnected via a communication network.

[0292] The computer-readable storage medium can be the data processing apparatus provided in any of the foregoing embodiments or the internal storage unit of the computer device, such as the hard disk or memory of the computer device. The computer-readable storage medium can also be an external storage device of the computer device, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., provided on the computer device. Furthermore, the computer-readable storage medium can include both internal storage units and external storage devices of the computer device. The computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0293] This application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform... Figure 3 or Figure 4The method provided among the various optional approaches implements a business access policy hash table. This hash table uses N distinct business address information entries as indexes, allowing business access policies with identical or matching address information to be grouped together. When detecting business access requests, the business address information can be filtered first, and then the target business access policy matching the request can be found. This makes the storage records of business access policies more organized and improves the efficiency of business access policy lookups. Furthermore, when there are many business access policies, they may often be uploaded by different management objects, making conflicts between business access policies more likely. Policy priority can effectively reduce lookup conflicts, thereby improving data processing efficiency. Simultaneously, detecting business access requests based on this business access policy enhances the security of business access.

[0294] The terms "first," "second," etc., in the specification, claims, and drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the term "comprising," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or modules, but may optionally include steps or modules not listed, or may optionally include other step units inherent to these processes, methods, apparatuses, products, or devices.

[0295] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0296] The methods and related apparatus provided in this application are described with reference to the method flowcharts and / or structural diagrams provided in this application. Specifically, each block of the method flowcharts and / or structural diagrams, as well as combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing device, create means for implementing the functions specified in one or more blocks of the flowcharts and / or one or more blocks of the structural diagrams. These computer program instructions can also be stored in a computer-readable storage medium capable of directing a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more blocks of the flowcharts and / or one or more blocks of the structural diagrams. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more blocks in the structural diagram.

[0297] The steps in the method of this application embodiment can be adjusted, combined, or deleted according to actual needs.

[0298] The modules in the device of this application embodiment can be merged, divided, and deleted according to actual needs.

[0299] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. A data processing method, characterized in that, The method includes: Obtain the M service access policies sent by the management server and the service address information corresponding to each service access policy; M is a positive integer; Based on the service address information corresponding to each service access policy, the M service access policies are grouped to obtain N service policy groups; the service address information corresponding to each service access policy in a service policy group is matched. The service address information corresponding to the N service strategy groups is sorted to obtain a service address item containing N sorted and distinct service address information. The N service policy groups are associated with the corresponding service address information in the service address items, and the service address items associated with the N service policy groups are determined as a service access policy hash table. In a zero-trust network, in response to a service access request for a target service, the service access policy hash table is obtained; the service access request includes target service address information corresponding to the target service; the service access policy hash table includes service address entries, each service address entry includes N distinct service address information, where N is a positive integer, and each service address entry is an index entry in the service access policy hash table; each service address information in the service address entry is associated with a corresponding service policy group; Traverse the N service address information in the service address item according to the target service address information; If among the N service address information, there is candidate service address information that matches the target service address information, then the service policy group associated with the candidate service address information in the service access policy hash table is determined as the candidate service policy group; the candidate service address information refers to the service address information that contains the target service address information; Obtain the policy priority of the service access policy in the candidate service policy group; based on the policy priority, obtain the target service access policy that matches the service access request from the service policy chain list corresponding to the candidate service policy group; and determine the target access method for the target service server corresponding to the target service based on the target service access policy. Based on the target access method, the processing result of the service access request is determined; the processing result is used to indicate whether to respond to or block the service access request.

2. The method as described in claim 1, characterized in that, The step of sorting the service address information corresponding to the N service strategy groups to obtain N distinct sorted service address items includes: Obtain the address type and address range of the service address information corresponding to the N service policy groups respectively; If the address type is a network interconnection address type, then based on the numerical value of the address range of the service address information corresponding to the N service policy groups, the service address information corresponding to the N service policy groups is sorted to obtain a service address item containing N sorted and distinct service address information. If the address type is a domain name address type, then the business address information corresponding to the N business strategy groups is coarsely sorted based on string order. Then, the business address information with the same first character among the coarsely sorted N business strategy groups is re-sorted according to the address range, resulting in a business address item containing N sorted and distinct business address information.

3. The method as described in claim 1, characterized in that, Based on the service address information corresponding to each service access policy, the M service access policies are grouped to obtain N service policy groups, including: Based on the service address information corresponding to each service access policy, the M service access policies are grouped to obtain d basic policy groups; d is a positive integer, and the service address information of the service access policies included in each basic policy group is the same. Obtain the service address information corresponding to each of the d basic policy groups, and obtain the address association relationship between the d service address information; If there are first service address information and second service address information with address coverage relationship among the d service address information, then the basic policy group corresponding to the first service address information and the basic policy group corresponding to the second service address information are merged to obtain the N service policy groups.

4. The method as described in claim 1, characterized in that, The step of associating the N service policy groups with the corresponding service address information in the service address item includes: Obtain the policy priority of the service access policies included in the i-th service policy group, sort the service access policies included in the i-th service policy group based on the policy priority, and form a service policy linked list corresponding to the i-th service policy group based on the sorting result; i is a positive integer less than or equal to N; Associate the business policy linked list corresponding to the i-th business policy group with the business address information corresponding to the i-th business policy group in the business address item.

5. The method as described in claim 1, characterized in that, The method further includes: Obtain M service access policies and the service address information corresponding to each service access policy, and create a service address entry; M is a positive integer; Obtain the service address information corresponding to the j-th service access policy, and determine the address insertion position of the j-th service address information in the service address item based on the address type and address range of the j-th service address information; j is a positive integer less than or equal to M; If there is a service address that matches the j-th service address at the address insertion position, then the j-th service access policy is associated with the service address at the address insertion position. If there is no service address information matching the j-th service address information at the address insertion position, then the j-th service address information and the j-th service access policy are associated and inserted at the address insertion position of the service address item; The process continues until the M service access policies are added to the service address item, thus obtaining the service access policy hash table.

6. The method as described in claim 1, characterized in that, Determining the processing result of the service access request based on the target access method includes: If the target access method is a direct access method, then the target service is obtained from the target service server and the target service is sent to the service request device that sent the service access request; If the target access method is a blocking access method, then the service access request is interrupted and a request exception message is sent to the service requesting device; If the target access method is an authentication access method, an information authentication request is sent to the service requesting device. Based on the information authentication request, the access association information of the service requesting device is obtained. The access association information is verified. When the information verification is successful, the target service is obtained from the target service server and sent to the service requesting device.

7. The method as described in claim 6, characterized in that, If the target access method is a blocking access method, then the service access request is interrupted, and a request exception message is sent to the service requesting device, including: If the target access method is a blocking access method, then the service access request is interrupted, and the service access information carried by the service access request is obtained; The service interruption information triggered by the target policy triggering condition in the target service access policy is used to generate a request exception message based on the service interruption information, and the request exception message is sent to the service requesting device.

8. The method as described in claim 1, characterized in that, In a zero-trust network, responding to a service access request for a target service and obtaining the service access policy hash table includes: In a zero-trust network, the access proxy component obtains the service access request sent by the service requesting device for the target service, and sends an access authentication request for the service access request to the management client component. The management client component performs a first detection process on the business access request to obtain a first detection result. If the first detection result is a valid result, an access credential acquisition request is sent to the management server so that the management server performs a second detection process on the business access request to obtain a second detection result. If the second detection result is a valid result, a business access credential for the business access request is generated. Obtain the service access credential sent by the management server, and based on the service access credential, obtain the service access policy hash table.

9. The method as described in claim 8, characterized in that, Determining the processing result of the service access request based on the target access method includes: If the target access method is a proxy access method, then the business access request is sent to the access proxy component through the management client component; The access proxy component sends the service access credential to the access gateway, so that the access gateway can verify the service access credential and establish a network connection with the access proxy component when the service access credential is successfully verified. If a network connection is established with the access gateway, the service access request is sent to the access gateway so that the access gateway can access the target service server corresponding to the target service based on the service access request.

10. The method as described in claim 1, characterized in that, The method further includes: The historical access data is traversed based on the target service address information; If there is candidate service address information in the historical access data that matches the target service address information, then the policy position corresponding to the candidate service address information is obtained from the historical access data, the target service access policy matching the service access request is obtained from the service access policy hash table based on the policy position, and the target access method for the target service server corresponding to the target service is determined based on the target service access policy. If no candidate service address information matching the target service address information is found in the historical access data, then the process of obtaining the service access policy hash table is executed.

11. The method as described in claim 10, characterized in that, The historical access data includes a historical access cache; the method further includes: Based on the target service address information and its address position in the service access policy hash table, a historical access record is generated. Obtain the policy trigger time of the target service access policy, and search for the target service address information in the historical access cache; If the target service address information exists in the historical access cache, then update the address access count of the target service address information based on the historical access records, and associate the policy triggering time with the target service address information in the historical access cache; If the target service address information is not present in the historical access cache, the historical access record is added to the historical access cache.

12. The method as described in claim 11, characterized in that, The historical access data also includes a hash index table; the method further includes: Obtain the cached service address information included in the historical access cache, and the cache record information associated with the cached service address information; the cache record information includes the number of cache address accesses and the cache policy trigger time of the cached service address information; If the number of accesses to the cached address is greater than or equal to the access threshold, the cached record information is added to the hash index table.

13. The method as described in claim 1, characterized in that, The method further includes: Obtain the policy triggering conditions of the business access policies included in the business access policy hash table, and perform conflict detection on the candidate business policy group based on the business address information corresponding to the business access policy and the policy triggering conditions; If there are conflicting first and second service access policies in the candidate service policy group, then an abnormal service access policy is obtained from the first and second service access policies, the policy association device associated with the abnormal service access policy is obtained, and a policy abnormal message is sent to the policy association device; the abnormal service access policy refers to a service access policy among the first and second service access policies that has an abnormal trigger probability or cannot be triggered.

14. A data processing apparatus, characterized in that, The device includes: The policy acquisition module is used to acquire M service access policies sent by the management server and the service address information corresponding to each service access policy; M is a positive integer. The policy grouping module is used to group the M service access policies into N service policy groups based on the service address information corresponding to each service access policy; the service address information corresponding to each service access policy in a service policy group is matched. The strategy sorting module is used to sort the service address information corresponding to the N service strategy groups respectively, and obtain a service address item containing N sorted and distinct service address information. The strategy association module is used to associate the N business strategy groups with the corresponding business address information in the business address item; The table generation module is used to determine the business address items associated with the N business policy groups as a business access policy hash table; The policy table acquisition module is used in a zero-trust network to respond to a service access request for a target service and acquire the service access policy hash table. The service access request includes target service address information corresponding to the target service. The service access policy hash table includes service address entries, each of which includes N distinct service address information, where N is a positive integer. Each service address information in the service address entry is associated with a corresponding service policy group. The address traversal module is used to traverse N business address information in the business address item according to the target business address information; The address matching module is used to determine the business policy group associated with the candidate business address information in the business access policy hash table as a candidate business policy group if there is candidate business address information that matches the target business address information among the N business address information; the candidate business address information refers to business address information that contains the target business address information. The strategy selection module is used to obtain the strategy priority of the business access strategy in the candidate business strategy group, and based on the strategy priority, obtain the target business access strategy that matches the business access request from the business strategy chain list corresponding to the candidate business strategy group. The method determination module is used to determine the target access method for the target service server corresponding to the target service based on the target service access policy. The device is further configured to determine the processing result of the service access request based on the target access method; the processing result is used to indicate whether to respond to or block the service access request.

15. A computer device, characterized in that, Includes processor, memory, and input / output interfaces; The processor is connected to the memory and the input / output interface respectively, wherein the input / output interface is used to receive data and output data, the memory is used to store computer programs, and the processor is used to call the computer programs so that the computer device executes the method according to any one of claims 1-13.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded and executed by a processor to cause a computer device having the processor to perform the method of any one of claims 1-13.

17. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the method described in any one of claims 1-13.

Images