Network access control method and apparatus, computer readable medium, and electronic device

Abstract

The application discloses a network access control method and device, a computer readable medium and an electronic device. The method comprises: obtaining a service access request for accessing a site, and determining a process identifier of an access process corresponding to the service access request; searching in a process feature cache according to the process identifier of the access process to obtain a process feature corresponding to the access process; matching in a blocked process cache according to the process feature of the access process to determine whether the access process is a blocked process; and if the access process is not a blocked process, determining an access mode of the service access request to the site according to a second preset access condition. The application improves the efficiency of obtaining the process feature of the access process, improves the filtering efficiency of the blocked process, and increases the convenience of network access control. The application can be applied to various scenes such as cloud technology, artificial intelligence, intelligent transportation and auxiliary driving.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of Internet and computer technology, and particularly relates to a network access control method and device, a computer readable medium and an electronic device. BACKGROUND

[0002] With the development of Internet technology, the security of network access is paid more and more attention. At present, the control of network access is usually implemented by a gateway. When a network request or traffic arrives at the gateway, the gateway judges whether the network request or traffic is secure. If the network request or traffic is judged to be secure, the network request or traffic is forwarded to the corresponding target address. If the network request or traffic is judged to be not in compliance with the forwarding requirement, which means that the network request or traffic is not secure, the gateway does not send the network request or traffic to the corresponding target address. However, the gateway usually does not detect all received network requests, but only detects specific network requests, which leads to a certain limitation of the control range of the gateway control.

[0003] It should be noted that the information disclosed in the above background section is only used to strengthen the understanding of the background of the present application, and therefore can include information that does not constitute prior art known to those of ordinary skill in the art. SUMMARY

[0004] The purpose of the present application is to provide a network access control method and device, a computer readable medium and an electronic device, to solve the problem of limited control range when network access is controlled by a gateway in the related art.

[0005] Other characteristics and advantages of the present application will become apparent from the following detailed description, or will be learned by practice of the present application.

[0006] According to an aspect of an embodiment of the present application, a network access control method is provided, comprising:

[0007] obtaining a service access request for accessing a site, and determining a process identifier of an access process corresponding to the service access request;

[0008] finding in a process characteristic cache according to the process identifier of the access process to obtain a process characteristic corresponding to the access process; the process characteristic cache is used to store process identifiers of a plurality of processes and process characteristics associated with each process identifier;

[0009] matching in a blocked process cache according to the process characteristic of the access process to determine whether the access process is a blocked process; the blocked process cache is used to store process characteristics corresponding to processes that meet a first preset access condition; the first preset access condition includes a control mode when the access site is a public site;

[0010] if the access process is not the blocking process, determining an access mode of the service access request to the access site according to a second preset access condition; the second preset access condition comprises a management mode when the access site is an intranet site.

[0011] According to an aspect of an embodiment of the present application, a network access control device is provided, comprising:

[0012] an access request obtaining module, configured to obtain a service access request to an access site, and determine a process identifier of an access process corresponding to the service access request;

[0013] a process characteristic obtaining module, configured to search in a process characteristic cache according to the process identifier of the access process, and obtain a process characteristic corresponding to the access process; the process characteristic cache is configured to store process identifiers of multiple processes and process characteristics associated with the process identifiers;

[0014] a process characteristic matching module, configured to match in a blocking process cache according to the process characteristic of the access process, to determine whether the access process is a blocking process; the blocking process cache is configured to store process characteristics corresponding to processes meeting a first preset access condition; the first preset access condition comprises a management mode when the access site is a public site;

[0015] an access mode determining module, configured to, if the access process is not the blocking process, determine an access mode of the service access request to the access site according to a second preset access condition; the second preset access condition comprises a management mode when the access site is an intranet site.

[0016] In an embodiment of the present application, the device further comprises a process characteristic cache construction module, configured to obtain process identifiers of multiple first processes and process characteristics corresponding to the first processes; the first process refers to a process in a terminal device which has been created and not exited and which initiates the service access request; the process identifiers and the process characteristics corresponding to the first processes are stored in a form of a bidirectional linked list, forming the process characteristic cache.

[0017] In an embodiment of the present application, the process characteristic cache construction module is specifically configured to: when a core layer of the terminal device detects that a process is created, take the currently created process as a first process, and obtain a process identifier of the first process; according to the process identifier of the first process and a local cache process characteristic loaded by an application layer of the terminal device, obtain a process characteristic corresponding to the first process.

[0018] In an embodiment of the present application, the process feature cache construction module is further configured to: determine the key feature of the first process according to the process identifier of the first process; search in the local cache process feature according to the key feature of the first process to determine whether the process feature of the first process exists in the local cache process feature; if the cache feature identical to the key feature of the first process exists in the local cache process feature, take the process feature corresponding to the cache feature in the local cache process feature as the process feature of the first process; and if the cache feature identical to the key feature of the first process does not exist in the local cache process feature, acquire the process feature corresponding to the first process through the application layer.

[0019] In an embodiment of the present application, the first preset access condition comprises a process blocking rule; and the apparatus further comprises:

[0020] The blocking process cache construction module is configured to acquire the process identifier and the process feature of a second process, the second process being a process created in a terminal device initiating the service access request; if the process feature of the second process meets the process blocking rule, store the process identifier and the process feature of the second process in the form of a double-linked list to form the blocking process cache.

[0021] In an embodiment of the present application, the second preset access condition comprises a direct access condition, a proxy access condition and a forced authentication access condition; and the access mode determination module comprises:

[0022] The direct access unit is configured to, if the service access request meets the direct access condition, send the service access request to the access site through a proxy client;

[0023] The proxy access unit is configured to, if the service access request meets the proxy access condition, send the service access request to the access site through a gateway;

[0024] The forced authentication access unit is configured to, if the service access request meets the forced authentication access condition, send the service access request to the access site through the gateway after security verification of the access site process.

[0025] In an embodiment of the present application, the proxy access unit is specifically configured to: initiate a credential acquisition request for the service access request to a client initiating the service access request through a proxy client, so that the client returns an access credential acquired from a corresponding server based on the credential acquisition request; and forward the access credential and the service access request to the gateway through the proxy client, so that the gateway sends the service access request to the access site when successfully verifying the access credential.

[0026] According to an aspect of the embodiments of the present application, a computer readable medium is provided, and the computer readable medium stores a computer program, and the computer program is executed by a processor to implement the network access control method in the above technical solution.

[0027] According to an aspect of the embodiments of the present application, an electronic device is provided, and the electronic device comprises: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the network access control method in the above technical solution via executing the executable instructions.

[0028] According to an aspect of the embodiments of the present application, a computer program product or a computer program is provided, and the computer program product or the computer program comprises computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device executes the network access control method in the above technical solution.

[0029] In the technical solution provided by the embodiments of the present application, the process characteristic is obtained by searching the process characteristic cache according to the process identifier of the access process corresponding to the service access request. Since the process characteristics in the process characteristic cache have been pre-calculated, there is no need to calculate the process characteristics of the access process in real time, thereby improving the acquisition efficiency of the process characteristics of the access process. By matching the process characteristics in the blocking process cache, it is determined whether the access process is a blocking process that meets the first preset access condition, so that it can be quickly determined whether the access process is a blocking process, thereby improving the filtering efficiency of the blocking process. When there are many access processes to be processed (i.e., the network traffic is large), the access delay can be effectively reduced. Finally, the service access request is further judged by the second preset access condition, so that the control of the public network access and the control of the intranet access are unified, thereby increasing the convenience of network access control.

[0030] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF DRAWINGS

[0031] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0032] Figure 1An exemplary system architecture block diagram to which the technical solutions of the present application are applied is schematically shown.

[0033] Figure 2 A flowchart of a network access control method provided by the embodiments of the present application is schematically shown.

[0034] Figure 3A A setting mode schematic diagram of a site blocking rule provided by the embodiments of the present application is schematically shown.

[0035] Figure 3B A setting mode schematic diagram of a process blocking rule provided by the embodiments of the present application is schematically shown.

[0036] Figure 3C A setting details page schematic diagram of a process blocking rule provided by the embodiments of the present application is schematically shown.

[0037] Figure 4 A system architecture diagram to which the technical solutions provided by the embodiments of the present application are applied is schematically shown.

[0038] Figure 5A A gateway configuration schematic diagram for executing a zero trust access control policy provided by the embodiments of the present application is shown.

[0039] Figure 5B A configuration schematic diagram of a trusted application and a business system (intranet site) provided by the embodiments of the present application is shown.

[0040] Figure 5C A details page diagram of a business system configuration provided by the embodiments of the present application is shown.

[0041] Figure 5D A configuration schematic diagram of a business system and a related gateway provided by the embodiments of the present application is shown.

[0042] Figure 6 A structural block diagram of a network access control device provided by the embodiments of the present application is schematically shown.

[0043] Figure 7 A computer system structural block diagram of an electronic device suitable for implementing the embodiments of the present application is schematically shown. DETAILED DESCRIPTION

[0044] Example implementations will now be described more fully with reference to the accompanying drawings. Example implementations may, however, be implemented in many different forms and should not be construed as limited to the examples set forth herein; rather, these implementations are provided so that this disclosure will be thorough and complete, and will fully convey the scope of example implementations to those skilled in the art.

[0045] Moreover, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of embodiments of the application. One skilled in the relevant art will recognize, however, that the application can be practiced without one or more of the specific details, or with other methods, components, materials, and so forth. In other instances, well-known structures, devices, implementations, or operations are not shown or described in detail to avoid obscuring aspects of the application.

[0046] The block diagrams in the drawings show only the functionality of the features and can not imply that the functionality must be implemented in the particular correlated order indicated. Further, the illustrated functionality of a block can be implemented by one or more hardware or software modules. Also, the illustrated functionality of a block can be implemented by one or more software modules operating on one or more hardware processors.

[0047] The flow diagrams depicted herein are examples of sequences of operations that can be performed by one or more computing devices. The illustrated operations can not necessarily be executed in the order shown, and can include additional or fewer operations than those depicted. Further, the illustrated operations can be executed in parallel, or in different sequences, than those depicted.

[0048] Figure 1 An exemplary system architecture block diagram to which the techniques of this application can be applied is schematically illustrated.

[0049] As Figure 1 illustrated, the system architecture 100 can include a terminal device 110, a network 120, and a server 130. The terminal device 110 can include a smartphone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, a smart voice interaction device, a smart home appliance, a vehicle-mounted terminal, an aircraft, and the like, but is not limited thereto. The server 130 can be a standalone physical server, a server cluster or a distributed system composed of multiple physical servers, a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDNs, and basic cloud computing services such as big data and artificial intelligence platforms. The network 120 can be a communication medium of various connection types capable of providing a communication link between the terminal device 110 and the server 130, such as a wired communication link or a wireless communication link.

[0050] According to implementation requirements, the system architecture in the embodiments of the present application can have any number of terminal devices, networks and servers. For example, the server 130 can be a server group composed of multiple server devices. The technical solutions provided by the embodiments of the present application can be applied to the terminal device 110, can be applied to the server 130, or can be jointly implemented by the terminal device 110 and the server 130, and the present application does not make special limitations on this.

[0051] For example, the network access control method provided by the embodiments of the present application is implemented by the terminal device 110. When it is detected that there is a service access request initiation, the terminal device 110 can obtain the service access request and determine the process identifier of the access process corresponding to the service access request. Then, the terminal device 110 looks up the process characteristic cache according to the process identifier of the access process to obtain the process characteristic corresponding to the access process; the process characteristic cache is used to store the process identifiers of multiple processes and the process characteristics associated with each process identifier. Next, the terminal device 110 matches in the blocked process cache according to the process characteristic of the access process to determine whether the access process is a blocked process; the blocked process cache is used to store the process characteristics corresponding to the processes that meet the first preset access condition; the first preset access condition includes the management and control mode when the access site is a public site. Finally, if the access process is not a blocked process, the terminal device 110 determines the access mode of the service access request to the access site according to the second preset access condition; the second preset access condition includes the management and control mode when the access site is an internal site.

[0052] The network access control method provided by the present application will be described in detail in combination with the specific implementation manner.

[0053] Figure 2 The flowchart of the network access control method provided by the embodiments of the present application is schematically shown. The embodiments of the present application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, intelligent transportation, and auxiliary driving. As shown in the figure, Figure 2 The steps 210 to 240, specifically as follows:

[0054] Step 210, obtaining a service access request to an access site, and determining the process identifier of the access process corresponding to the service access request.

[0055] Specifically, the access site refers to a party accessed in network access, that is, the final receiving party of the business access request. The access site can be enterprise intranet business resources, data, development test environment, operation and maintenance environment, etc. The access site can also be referred to as an access object. The party initiating access in network access is referred to as an access subject, which can be an entity formed by a single account, device, application program or combination thereof. When communication with the access site is required, the access subject initiates a business access request (the business access request is also referred to as traffic) to the access site.

[0056] A process is a running activity of a program on a certain data set in an electronic device, and is a basic execution entity of program code. When a business access request is initiated, the process for executing the business access request is an access process. The process identifier (PID) is also referred to as a process ID, which is equivalent to a code of the process. Each process has a non-negative unique process ID.

[0057] In an embodiment of the present application, the business access request includes five-tuple information: source IP or domain name, source port, destination IP or domain name, destination port, and access application. The source IP or domain name refers to the IP address (Internet Protocol Address, Internet Protocol Address) or domain name of the access subject or the device where the access subject is located. The source port refers to the port occupied by the access subject or the device where the access subject is located when executing the business access request. The destination IP or domain name refers to the IP address (Internet Protocol Address, Internet Protocol Address) or domain name of the access site or the device where the access site is located. The destination port refers to the port occupied by the access site or the device where the access site is located when receiving the business access request. The access application refers to the application program initiating the business access request. For example, the access subject is an account, and the access application is an application program client registered by the account, which can be set in a terminal device.

[0058] In an embodiment of the present application, after the device where the access subject is located obtains the business access request, the corresponding access process can be determined through the source port and the access application in the business access request, and the process identifier of the access process can be obtained.

[0059] In an embodiment of the present application, the device where the access subject is located is deployed with a proxy client, which is used to control the security of access. When the access subject initiates a business access request to the access site through an application program client (hereinafter referred to as an application client), the proxy client obtains the business access request and the process identifier of the access process corresponding to the business access request, and executes the control method of network access provided in the embodiment of the present application.

[0060] Step 220, according to the process identification of the access process, find in the process feature cache, obtain the process feature corresponding to the access process; the process feature cache is used for storing process identifications of multiple processes and process features associated with each process identification.

[0061] Specifically, the process feature refers to process-related information such as process description information, process name, process signature, version number, copyright information, etc. The process feature cache stores the process features pre-recorded by the access subject in the device, which includes process identifications of multiple processes and process features associated with each process identification. For subsequent distinction, the process identification in the process feature cache is referred to as a cache process identification, and the process feature in the process feature cache is referred to as a cache process feature. When searching in the process feature cache according to the process identification, if there is a cache process identification in the process feature cache that is the same as the process identification of the access process, it indicates that the process feature of the access process has been pre-stored in the process feature cache, and the cache process feature corresponding to the cache process identification is the process feature corresponding to the access process.

[0062] In an embodiment of the present application, the process feature cache creation process includes: obtaining process identifications of multiple first processes and process features corresponding to each process; the first process refers to a process in a terminal device that initiates the service access request and has been created and not exited; storing each process identification and the process feature corresponding to each first process in the form of a double-linked list to form a process feature cache.

[0063] Specifically, the process feature cache stores process features of all created and not exited processes of the terminal device that initiates the service access request. Created and not exited is a process state, indicating a process that has been created, is executing or waiting to execute. The created and not exited process is referred to as a first process, and the process identification and process feature of the first process are stored in the form of a double-linked list to form a process feature cache.

[0064] A node in the linked list represents a process identification and a process feature corresponding to a process. Each data node in the double-linked list has two pointers, pointing to the direct successor and direct predecessor, respectively. Therefore, starting from any node in the double-linked list, the predecessor node and successor node of the node can be easily accessed, which is very convenient for data query. The double-linked list structure in the embodiment of the present application can be a LIST_ENTRY double-linked list structure of the Windows kernel.

[0065] In an embodiment of the present application, the process feature cache is constantly updated, which is equivalent to a dynamic cache. When a new process is detected to be created in the device, the currently created process is regarded as a first process, and a node is added in the double-linked list, which is used to record the process identifier and the process feature of the first process. When a process is detected to exit in the process feature cache, the node corresponding to the first process in the double-linked list is deleted, that is, the process identifier and the process feature corresponding to the first process to be exited are deleted from the process feature cache. In this way, through the dynamic update of the process feature cache, it is ensured that the process identifier and the process feature of the first process are stored in the process feature cache.

[0066] In an embodiment of the present application, the process of acquiring the process feature specifically includes: when the core layer of the terminal device detects that a process is created, acquiring the process identifier of the first process; and acquiring the process feature corresponding to the first process according to the process identifier of the first process and the local cache process feature loaded by the application layer of the terminal device.

[0067] Specifically, the privilege level of the CPU (Centre Process Unit) of the electronic device has four levels: Ring0, Ring1, Ring2 and Ring3, and the larger the number is, the lower the permission is. Windows generally uses Ring0 and Ring3, Ring0 is only used for operating system and is called core layer, ring 0 layer; Ring3 is also called application layer, ring 3 layer, and can be used for application program.

[0068] When the core layer detects that a process is created, the currently created process is equivalent to a process that has been created and not exited, that is, the first process, and then the process identifier of the first process is acquired. In an embodiment of the present application, the core layer detects the creation and exit of the process by using the API (Application Program Interface) interface function PsSetCreateProcessNotifyRoutineEx provided by WDK (Windows Driver Kit), and the notification of the creation and exit of all processes of the device can be acquired by setting the callback function.

[0069] Specifically, when a new process is created, the callback function can obtain the process body, process ID, and process characteristics of the newly created process (hereinafter referred to as the new process) through parameters. The process characteristics include, for example, the parent process ID of the new process, the process ID of the process that created the new process (CreatingThreadId->UniqueProcess), the thread ID of the process that created the new process (CreatingThreadId->UniqueThread), the file object of the executable file corresponding to the new process, the absolute path of the exe file, the command line parameters of the process creation, and the state of the process creation (which indicates whether the process can be controlled and whether the process is allowed to be created). These process characteristics can be obtained through the PPS_CREATE_NOTIFY_INFO type parameter of the callback function. When it is detected that a process is about to exit (i.e., the first process is about to exit), the process ID of the process that is about to exit can be obtained according to the HANDLE type parameter of the callback function, and the process body of the process that is about to exit can be obtained according to the PEPROCESS type parameter, which indicates a pointer to the process object of the process that is about to exit.

[0070] After obtaining the process identifier of the first process, the process characteristics of the first process need to be obtained according to the process identifier and the locally cached process characteristics loaded by the application layer. This includes two parts: the first process characteristic cache and the update of the process characteristic cache.

[0071] When the process feature cache is created for the first time, the core layer sends the process information (such as the process ID, process name and converted process absolute path) of the first process to the application layer in addition to the process features described above, and the application layer obtains the process features of the first process in the application layer according to the process information, such as the last modification time, description information, size and copyright information of the process executable file, the version number and signature information of the process. For example, the application layer calculates the last modification time (updatetime) of the process executable file according to the process ID and the absolute path (procpath) of the process, obtains the version number (filever) of the process, the description information (filedesc) of the process executable file, the size (filesize) of the process executable file and the copyright information (copyright) of the process according to the absolute path (procpath) of the process. The application layer can also calculate the digest (MD5 value) and other HASH values (such as SHA256) of the process according to the absolute path (procpath) of the process, calculate the signer name (sign_issuer) in the digital signature of the process executable file and the local signature verification result (sign_check_rst). The local signature verification result includes: digital signature verification passed (SIGN_CHECK_PASS), digital signature verification failed (SIGN_CHECK_FAILED), digital signature verification timeout (SIGN_CHECK_TIMEOUT) and process without digital signature (PROC_NO_SIGN_INFO).

[0072] Through the communication between the application layer and the core layer, all the process features of the first process can be obtained, and the process features are stored in association with the process ID in the bidirectional linked list constructed by the core layer to form the process feature cache.

[0073] When the process feature cache is updated, the process features that have been successfully calculated before the update are stored in the device locally in an encrypted manner to form the local cache process features. At this time, the process of obtaining the process features includes: determining the key features of the first process according to the process identifier of the first process; searching in the local cache process features according to the key features of the first process to determine whether the process features of the first process exist in the local cache process features; if the same cache features as the key features of the first process exist in the local cache process features, the process features corresponding to the cache features in the local cache process features are taken as the process features of the first process; if the same cache features as the key features of the first process do not exist in the local cache process features, the process features corresponding to the first process are obtained through the application layer.

[0074] Specifically, when the core layer detects that a process is created, the core layer calculates the key feature according to the process identifier of the first process, and then sends the key feature to the application layer, where the key feature can be one or more process features of the first process. When the service of the application layer is started, the application layer first loads the local cache process features. Then, when the application layer receives the key feature sent by the core layer, the application layer searches the loaded local cache process features according to the key feature, so as to determine whether the process features of the first process exist in the local cache process features. For the convenience of distinction, the process features in the local cache process features are referred to as cache features.

[0075] When the cache feature in the local cache process features is the same as the key feature, it indicates that the process features of the first process have been calculated (or the first process is an "old process"). At this time, there is no need to recalculate, and the cache feature in the local cache process features can be directly stored as the corresponding process feature in the process feature cache. If the cache feature in the local cache process features is not the same as the key feature, it indicates that the process features of the first process have not been calculated, and the application layer needs to calculate the process features of the first process. The specific calculation method is described above in the first creation of the process feature cache.

[0076] In an embodiment of the present application, the key feature can be the absolute path and the latest modification time of the process file of the first process. When the absolute path of the process file is unchanged and the latest modification time is unchanged, it is considered that the process is not changed, and thus the cache feature in the local cache process features can be used as the process feature of the process. The local cache process features enable the process feature cache to obtain the process features through data matching when the data is updated, without the need to calculate the corresponding process features for each process, thereby reducing the calculation amount and improving the efficiency of the construction and update of the process feature cache.

[0077] In step 230, the process feature of the access process is matched in the blocking process cache to determine whether the access process is a blocking process. The blocking process cache is used to store the process features of processes that meet the first preset access condition. The first preset access condition includes the management mode when the access site is a public site.

[0078] Specifically, the blocking process cache stores process features of processes that meet the first preset access condition, and processes that meet the first preset access condition are referred to as blocking processes. Therefore, the blocking process cache stores process features of the existing blocking processes. According to the matching of the process features of the access process in the blocking process cache, whether the same process features of the access process are stored in the blocking process cache is determined, to determine whether the access process is a blocking process. The blocking process refers to a process that needs to be blocked from execution. When the access process is determined to be a blocking process, the access process cannot be executed, and the business access request corresponding to the access process is prevented from being sent to the access site.

[0079] In an embodiment of the present application, the blocking process cache has stored process features of processes that are determined to be blocking processes. When the access process is determined, the process features of the access process are matched with the process features of each blocking process in the blocking process cache. When a blocking process in the blocking process cache is found to have the same process features as the access process, it is indicated that the access process is a blocking process. If the process features of any blocking process in the blocking process cache are different from the process features of the access process, the access process is not considered to be a blocking process.

[0080] The first preset access condition is an access control mode for public websites. Public network is a large-scale network that accesses the Internet through a modem dial or a dedicated line, or communicates with the Internet through a VPN (Virtual Private Network) and a router. The computers of the public network and other computers on the Internet can access each other at will. The public network corresponds to the internal network, which is also called a local area network (LAN). The internal network is a computer communication network that connects various computers, external devices, and databases in a local geographical range (such as a school, factory, or government office, generally within a few kilometers). Generally, due to the less restrictions of the public network, the gateway performs security detection on the business access request for accessing the internal network, and does not perform security detection on the business access request for accessing the public network.

[0081] In one embodiment of this application, the first preset access condition includes access site blocking rules and process blocking rules. Access site blocking rules can be set using blacklists and whitelists of access sites. Blacklists and whitelists are mutually exclusive; only one is required. That is, if a blacklist is set, a whitelist does not need to be set, and vice versa. The blacklist represents a list of public website sites that are prohibited from access by the accessing entity, while public website sites not on the blacklist are allowed to be accessed by the accessing entity. The whitelist represents a list of public website sites that are only allowed to be accessed by the accessing entity, while public website sites not on the whitelist represent a list of public website sites that are prohibited from access by the accessing entity. For example, the access site blocking rules are set as follows: Figure 3A As shown, through Figure 3A Use button 301 to select a blacklist or whitelist, and button 302 to add specific rules, such as... Figure 3A In the system, the access blocking rule is an access site blacklist, which includes two access sites with HOST addresses of "*.abc.com" and "www.test.com".

[0082] Similarly, process blocking rules are set using process blacklists and whitelists. A blacklist or whitelist is used to block access to a specific site. A blacklist prohibits a user from using processes on the blacklist to access the corresponding site, while allowing access to a site using processes not on the blacklist. A whitelist restricts access to a site to processes on the whitelist, prohibiting access to a site using processes not on the whitelist. For example, process blocking rules are set up as follows: Figure 3B and Figure 3C As shown, through Figure 3B Button 303 in the middle selects the process whitelist or process blacklist. Figure 3B Example: Selecting a process blacklist, via Figure 3B Add specific rules for the 304 error button. (Through...) Figure 3C Configure the process characteristics (i.e., the specific rule content) of processes in the process blacklist, by... Figure 3C Button 305 adds specific process characteristics, such as "process name equals abc" or "process signature contains abc".

[0083] In one embodiment of this application, access site blocking rules and process blocking rules can be configured individually or in combination. For example, it is possible to configure rules to block only processes outside a certain range (process whitelist) from accessing certain public website sites (access site blacklist), or to configure rules to block processes within a certain range (process blacklist) from accessing public website sites that do not meet a certain characteristic (access site whitelist).

[0084] In the embodiments of the present application, the process meeting the first preset access condition refers to the process determined as the blocked process according to the process blocking rule. When the process blocking rule is the process blacklist, the processes indicated by the process blacklist are the blocked processes. When the process blocking rule is the process whitelist, the processes not meeting the processes indicated by the process whitelist are the blocked processes.

[0085] In an embodiment of the present application, the creation of the blocked process cache is synchronized with the creation of the process feature cache. The process of creating the blocked process cache includes: obtaining the process identifier and the process feature of a second process, the second process being the process created in the terminal device initiating the service access request; if the process feature of the second process meets the process blocking rule, storing the process identifier and the process feature of the second process in the form of a double-linked list to form the blocked process cache.

[0086] Specifically, the data storage structure in the blocked process cache is the same as that in the process feature cache, both being in the form of a double-linked list. First, the process identifier and the process feature of a second process are obtained, the second process including the process created in the terminal device, without considering whether the process exits or not. In some cases, the second process can be the same as the first process, for example, the process created at present belongs to both the first process and the second process. Then, the process feature of the second process is matched with the process blocking rule to determine whether the second process is the blocked process. If yes, the process identifier and the process feature of the second process are stored in a node in the double-linked list. It should be noted that the process state of the process in the blocked process cache is created, regardless of whether the process exits or not, that is, the blocked process cache can include the process created but not exited (the first process) or the process that has exited.

[0087] In an embodiment of the present application, when the process blocking rule is updated, the blocked process cache needs to be updated synchronously. For example, before the process blocking rule is updated, a process is determined as the blocked process and stored in the blocked process cache. After the process blocking rule is updated, the process is no longer the blocked process, and the process feature of the process is deleted from the blocked process cache.

[0088] In an embodiment of the present application, it further comprises determining whether the access site corresponding to the service access request is a blocked access site according to the access site blocking rule. When the access site blocking rule is an access site blacklist, if the access site corresponding to the service access request is an access site in the access site blacklist, the access site corresponding to the service access request is considered as a blocked access site. When the access site blocking rule is an access site whitelist, if the access site corresponding to the service access request is not an access site in the access site whitelist, the access site corresponding to the service access request is considered as a blocked access site. When it is determined as a blocked access site, the service access request is blocked. The determination of the blocked access site can be synchronized with the determination of the blocked process according to the blocked process cache, or it can be performed before or after the determination of the blocked process.

[0089] In an embodiment of the present application, the process feature cache and the blocked process cache can also be in the form of a database, for example, storing the process features or the blocked processes in a relational database. In short, a database can be regarded as an electronic file cabinet, a place for storing electronic files, and users can add, query, update, delete, and perform other operations on the data in the files. A "database" is a collection of data stored together in a certain way, shared by multiple users, with as little redundancy as possible, and independent of application programs.

[0090] A database management system (DBMS) is a computer software system designed to manage databases, generally with basic functions such as storage, interception, security, backup, etc. Database management systems can be classified according to the database model they support, such as relational, XML (Extensible Markup Language), or according to the type of computer they support, such as server clusters, mobile phones, or according to the query language they use, such as SQL (Structured Query Language), XQuery, or according to the performance focus, such as maximum size, highest speed, or other classification methods. Regardless of the classification method used, some DBMSs can cross categories, such as supporting multiple query languages at the same time.

[0091] In step 240, if the access process is not a blocked process, the access mode of the service access request to the access site is determined according to the second preset access condition; the second preset access condition includes the management and control mode when the access site is an internal site.

[0092] Specifically, if the access process is not the blocking process, it indicates that the business access request has passed the judgment of the public website access control mode, and the next step is to further judge the business access request according to the second preset access condition for the intranet website control mode, so as to determine the access mode of the business access request to the access site.

[0093] The access mode of the business access request to the access site includes three modes: direct access, proxy access, and forced authentication access. Direct access refers to sending the business access request directly to the access site through the proxy client of the access subject, and receiving the response data of the access site through the client. Proxy access refers to forwarding the business access request to the access site through the gateway, and forwarding the response data of the access site to the client through the gateway. Forced authentication access refers to performing real-time security verification (such as SMS verification, face verification, etc.) on the access subject initiating the business access request, and sending the business access request to the access site in the proxy access mode when the verification is passed.

[0094] In an embodiment of the present application, the second preset access condition includes direct access condition, proxy access condition and forced authentication access condition, which correspond to the above-mentioned three access modes of the business access request to the access site. Then, the process of determining the sending mode of the business access request according to the second preset access condition includes: if the business access request meets the direct access condition, sending the business access request to the access site through the proxy client; if the business access request meets the proxy access condition, sending the business access request to the access site through the gateway; if the business access request meets the forced authentication access condition, performing security verification on the access site process, and then sending the business access request to the access site through the gateway.

[0095] In an embodiment of the present application, the second preset access condition is a zero trust access control policy. The zero trust access control policy is composed of process information (trusted application) available to the account, intranet sites (reachable area) accessible, device information, login account information, protocol type corresponding to the business access request, etc. In the case of meeting the zero trust access control policy, the account can access any intranet site through any trusted application. The granularity of the zero trust access control policy is the login account, and different zero trust policies can be formulated for different login accounts.

[0096] In the zero-trust access control policy, internal websites, login accounts, trusted applications, devices, etc. can be configured. The internal website is the business system or business resource of the enterprise. When the internal website is configured, the internal website name, internal website category (domain name category, IP category or IP segment), specific internal website domain name or IP, port (including specified port list or all ports), internal website grouping, protocol type (transport layer protocol in network protocol stack), etc. can be configured. When setting up a login account, the login account name, login account ID, etc. can be configured. A trusted application is an application program carrier that the management end trusts and that the terminal can access the internal business system, including application program name, application program MD5, signature information, etc. The management of the trusted application can be configured by configuring the trusted application attribute, and the trusted application attribute includes process name (application name), copyright information, signature information, etc. A device is a terminal device that initiates a business access request, which can be identified by a device unique identifier.

[0097] According to the above configuration of the zero-trust access control policy, the direct access condition, the proxy access condition and the forced authentication access condition can be a combination of any of them. For example, when the application program that initiates the business access request is a trusted application, the proxy access condition is used; when the access site corresponding to the business access request is a specific internal website, the forced authentication access condition is used; and in other cases, the direct access condition is used.

[0098] In an embodiment of the present application, the zero-trust access control policy is a static access control rule, and the second preset access condition can be set based on the zero-trust access control policy in combination with dynamic factors such as terminal environment state, compliance detection, specific network area, access frequency of an account to the internal network, access time period, etc. For example, after the compliance detection passes (i.e., the device is determined to be a device that meets the regulations), when the application program that initiates the business access request is a trusted application, the proxy access condition is used; when the access subject of the business access request is in a specific network area, the direct access condition is used; when the initiation time of the business access request is in a specific time period and the access site is a specific internal website (e.g., the access site is a payroll system), the forced authentication access condition is used; and when the access frequency of the account to the internal network is too high within a time period, the access is blocked, which means that the business access request is blocked and cannot be sent to the access site.

[0099] In one embodiment of this application, the device where the accessing subject is located is equipped with an application client and a proxy client. The specific process of proxy access includes: initiating a credential acquisition request for the business access request to the client through the proxy client of the client where the accessing subject is located, so that the client returns the access credentials obtained from the corresponding server based on the credential acquisition request; and forwarding the access credentials and the business access request to the gateway through the proxy client, so that the gateway sends the business access request to the access site when the access credentials are successfully verified.

[0100] Specifically, when a proxy access is identified, the proxy client initiates a credential retrieval request to the client. Upon receiving the request, the client requests access credentials from the corresponding server and then returns the credentials to the proxy client. The access credential is authorization information issued by the server for a single network service access request, used to identify the authorization status of that request. Next, the proxy client sends the access credential and the service access request to the gateway. The gateway verifies the access credential's validity. The verification process is as follows: the gateway initiates a credential verification request to the server based on the access credential. The server verifies whether the access credential was issued by the server. If it is, the server sends a verification success message to the gateway; otherwise, it sends a verification failure message. Upon receiving a verification success message (i.e., successful access credential verification), the gateway forwards the service access request to the access site. Simultaneously, the gateway receives the access site's response to the service access request and returns the response to the proxy client, which then relays it to the access subject, thus enabling the access subject to access the access site.

[0101] In the technical solution provided in this application embodiment, process features are obtained by searching the process feature cache based on the process identifier of the access process corresponding to the business access request. Since the process features in the process feature cache have been pre-calculated, there is no need to calculate the process features of the access process in real time, which improves the efficiency of obtaining the process features of the access process. By matching the process features in the blocking process cache, it is determined whether the access process is a blocking process that meets the first preset access condition. This can quickly determine whether the access process is a blocking process, improving the filtering efficiency of blocking processes. When there are many access processes to be processed (i.e., large network traffic), it can effectively reduce access latency. Finally, the business access request is further judged by the second preset access condition, which unifies the control of public network access and the control of internal network access, increasing the convenience of network access control.

[0102] The following example illustrates the specific implementation process of the technical solution of this application using the network access control method provided in the embodiment of this application in the iOA (Intelligent Office Automation, also known as intelligent management information system) system.

[0103] Figure 4 A system architecture diagram illustrating the application of the technical solutions provided in the embodiments of this application is shown schematically, such as... Figure 4 As shown, the system includes a terminal device 410, an iOA server 420, a gateway 430, a business system 440, and a public network 450. The terminal device 410 includes an application 411, an iOA client 412, and a proxy client 413. The business system 440 represents a collection of internal website sites, which may include multiple business servers, each of which can be an access site. The public network 450 represents a collection of public website sites, which may include multiple servers.

[0104] First, configure the first and second preset access conditions through the iOA management terminal and store them on the iOA server 420. The configuration of the first preset access condition can be found in [reference needed]. Figures 3A-3B The configuration reference for the second preset access conditions. Figures 5A-5D , Figure 5A This diagram illustrates a gateway configuration for implementing a zero-trust access control policy. Figure 5A Add a gateway configuration using button 501. Figure 5B This diagram illustrates the configuration of trusted applications and business systems (internal sites). Figure 5B Region 502 configuration trusted applications, through Figure 5B Configure the business system in region 503. Figure 5C The diagram shows a detailed page of the business system configuration, for example, through... Figure 5C Zone 504 allows you to select the resource category (internal site category), zone 505 allows you to select the port, and zone 506 allows you to select the protocol type, etc. Figure 5D This diagram illustrates the configuration of the business system and its associated gateway. Figure 5D Configure the gateway in zone 507, through Figure 5DThe region 508 configures a gateway access sequence. The iOA server 420 underwrites the first preset access condition and the second preset access condition to the iOA client 412, so that the iOA client 412 constructs an access blocking rule. It should be noted that, for the configuration of the login account and the device in the zero trust access control policy, both are dynamically changed, and the data scale is large, so the two configuration rules will be stored in the iOA server 420, and the iOA server 420 underwrites the zero trust access control policy in the granularity of the login account or the group to which the login account belongs after detecting the device compliance through compliance detection, vulnerability detection, and device security baseline detection.

[0105] The iOA client 412 pre-constructs the process feature cache and the blocked process cache according to the first preset access condition. The specific creation process can refer to the related description in the foregoing, and will not be described here. The process feature cache and the blocked process cache are stored in the terminal device 410.

[0106] When the technical scheme of the present application runs, the access subject initiates a business access request for an access site through the application program 411. The proxy client 413 obtains the business access request and determines the process identifier of the corresponding access process. Next, the proxy client 413 obtains the process feature corresponding to the access process according to the process feature cache stored in the terminal device 410, and matches in the blocked process cache stored in the terminal device 410 according to the process feature of the access process, so as to determine whether the access process is a blocked process. If it is determined that the access process is a blocked process, the business access request is blocked. If the access process is not a blocked process, it is judged whether the access site is a blocked access site according to the access site blocking rule in the first preset access condition. If the access site is a blocked access site, the business access request is blocked. If the access site is not a blocked access site, it is judged whether the access site is a public website. If the access site is a public website, the proxy client 413 sends the business access request to the access site in the public network 450 (direct access). If the access site is not a public website (i.e., the access site is an intranet site), the business access request is judged according to the second preset access condition.

[0107] If it is judged that the business access request meets the direct access condition, the proxy client 413 sends the business access request to the access site in the business system 440 (direct access).

[0108] If it is judged that the business access request meets the proxy access condition, the proxy client 413 initiates a credential acquisition request (also referred to as a ticket request) to the iOA client 412, the iOA client 412 applies for an access credential to the iOA server 420, the iOA server 420 returns the access credential to the iOA client 412, the iOA client 412 sends the access credential to the proxy client 413, and the proxy client 413 sends the access credential and the business access request to the gateway 430. After the gateway 430 receives the information sent by the proxy client 413, it initiates a credential verification request to the iOA server 420, the iOA server 420 verifies the access credential, and feeds back the verification result to the gateway 430. When the gateway 430 receives the result of the verification passing, it sends the business access request to the access site in the business system 440 (proxy access).

[0109] If it is judged that the business access request meets the forced authentication access condition, the proxy client 413 initiates forced authentication information to the application program 411, and when it is detected that the forced authentication passes, the business access request is sent to the access site in the business system 440 through the gateway 430 according to the proxy access process described above.

[0110] In an embodiment of the present application, the step of judging the service access request according to the second preset access condition can also be performed by the iOA server 420. Specifically, when the proxy client 413 determines that the access site is not a public site, it means that the service access request needs to be judged according to the second preset access condition, at this time, the proxy client 413 initiates a traffic authentication request to the iOA client 412, and the traffic authentication is an operation of verifying the authenticity of the service access request, for example, verifying whether the identity of the initiator of the service access request is legal. When the iOA client 412 receives the traffic authentication request sent by the proxy client 413, the iOA client 412 collects the device characteristics of the terminal device 410, the process characteristics of the access process, the login account information and the terminal environment state, and initiates a credential acquisition request to the iOA server 420. At the same time, the terminal device 410 sends information such as environment perception, compliance detection, network state, etc. to the iOA server 420, and the iOA server 420 receives the credential acquisition request, judges the service access request according to the terminal environment state, access process compliance detection result, terminal security baseline and other dynamic factors, combines the second preset access condition, determines the access mode (direct access, proxy access, forced authentication access and blocking access) of the service access request to the access site, and further determines whether to return the access credential to the iOA client 412. Generally, when the iOA server 420 determines to block access, it does not return the access credential to the iOA client 412, but returns a command (denoted as blocking command) to block the service access request to the iOA client 412. Then the iOA client 412 sends the blocking command to the proxy client 413, and the iOA client 412 specifies a blocking validity period to the proxy client 413 according to the configuration parameters of the iOA server 420, and blocks the service access request within the blocking validity period. And within the blocking validity period, the same type of service access request that meets the conditions is directly blocked at the proxy client 413 side, and does not need to be judged as blocking by the iOA client 412 and the iOA server 420.

[0111] It can be understood that if the access mode of the service access request changes, the iOA client 412 can notify the agent client 413 to adjust the access mode for the type of service access request. For example, the network area where the terminal device 410 is located changes, and the compliance detection changes from the non-compliant state to the compliant state by repairing the violation item, so that the service access request judged to be blocked access can be adjusted to other access modes. The agent client 412 can also shorten the blocking validity period or directly change the access mode to non-blocking, so that when the agent client 412 obtains the same type of service access request, it does not take the operation of directly blocking, but sends the related information of the service access request to the iOA client 412, performs traffic authentication, and controls the access mode of the service access request through the iOA client 412 and the iOA server 420.

[0112] It should be noted that although the steps of the method in the present application are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired result. In addition or alternatively, some steps can be omitted, a plurality of steps can be combined into one step, and / or one step can be divided into a plurality of steps, etc.

[0113] The device embodiment of the present application is introduced below, which can be used to execute the network access control method in the above-mentioned embodiments of the present application. Figure 6 The structure block diagram of the network access control device provided by the embodiments of the present application is schematically shown. As shown in Figure 6 The network access control device provided by the embodiments of the present application includes:

[0114] The access request obtaining module 610 is configured to obtain a service access request for accessing a website, and determine a process identifier of an access process corresponding to the service access request;

[0115] The process feature obtaining module 620 is configured to search in a process feature cache according to the process identifier of the access process, and obtain a process feature corresponding to the access process; the process feature cache is configured to store process identifiers of a plurality of processes and process features associated with the process identifiers;

[0116] The process feature matching module 630 is configured to match in a blocked process cache according to the process feature of the access process, to determine whether the access process is a blocked process; the blocked process cache is configured to store process features corresponding to processes that meet a first preset access condition; the first preset access condition includes a management mode when the access website is a public website;

[0117] The access mode determination module 640 is configured to, if the access process is not the blocking process, determine an access mode of the service access request to the access site according to a second preset access condition; the second preset access condition includes a management mode when the access site is an internal site.

[0118] In an embodiment of the present application, the apparatus further includes a process feature cache construction module configured to acquire process identifiers of a plurality of first processes and process features corresponding to the first processes; the first process refers to a process that has been created and not exited in a terminal device initiating the service access request; the process identifiers and the process features corresponding to the first processes are stored in a form of a double-linked list to form the process feature cache.

[0119] In an embodiment of the present application, the process feature cache construction module is specifically configured to: when a core layer of the terminal device detects that a process is created, take the currently created process as a first process, and acquire a process identifier of the first process; acquire the process feature corresponding to the first process according to the process identifier of the first process and a locally cached process feature loaded by an application layer of the terminal device.

[0120] In an embodiment of the present application, the process feature cache construction module is further configured to: determine a key feature of the first process according to the process identifier of the first process; search in the locally cached process feature according to the key feature of the first process to determine whether the process feature of the first process exists in the locally cached process feature; if a cached feature same as the key feature of the first process exists in the locally cached process feature, take a process feature corresponding to the cached feature in the locally cached process feature as the process feature of the first process; if the cached feature same as the key feature of the first process does not exist in the locally cached process feature, acquire the process feature corresponding to the first process through the application layer.

[0121] In an embodiment of the present application, the first preset access condition includes a process blocking rule; the apparatus further includes:

[0122] A blocking process cache construction module configured to acquire a process identifier and a process feature of a second process; the second process is a process that has been created in a terminal device initiating the service access request; if the process feature of the second process meets the process blocking rule, store the process identifier and the process feature of the second process in a form of a double-linked list to form the blocking process cache.

[0123] In an embodiment of the present application, the second preset access condition includes a direct access condition, a proxy access condition and a forced authentication access condition; the access mode determination module 640 includes:

[0124] a direct access unit, configured to send the service access request to the access site through a proxy client if the service access request meets a direct access condition;

[0125] a proxy access unit, configured to send the service access request to the access site through a gateway if the service access request meets a proxy access condition;

[0126] a forced authentication access unit, configured to send the service access request to the access site through the gateway after security check of the access site if the service access request meets a forced authentication access condition.

[0127] In an embodiment of the present application, the proxy access unit is specifically configured to: initiate a credential acquisition request for the service access request to the client through the proxy client, so that the client returns an access credential acquired from a corresponding server based on the credential acquisition request; and forward the access credential and the service access request to the gateway through the proxy client, so that the gateway sends the service access request to the access site when the access credential is successfully checked.

[0128] The specific details of the network access control apparatus provided in the embodiments of the present application have been described in detail in the corresponding method embodiments, and will not be repeated here.

[0129] Figure 7 A computer system structure block diagram of an electronic device for implementing the embodiments of the present application is schematically shown.

[0130] It should be noted that, Figure 7 The computer system 700 of the electronic device shown is only an example, and should not impose any limitation on the functions and use range of the embodiments of the present application.

[0131] As Figure 7 shown, the computer system 700 includes a central processing unit 701 (CPU), which can perform various appropriate actions and processes according to programs stored in a read-only memory 702 (ROM) or loaded from a storage portion 708 to a random access memory 703 (RAM). Various programs and data required for system operation are also stored in the random access memory 703. The central processing unit 701, the read-only memory 702 and the random access memory 703 are connected to each other through a bus 704. An input / output interface 705 (I / O interface) is also connected to the bus 704.

[0132] The following components are connected to the input / output interface 705: an input portion 706 including input devices such as a keyboard and mouse; an output portion 707 including output devices such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and a speaker; a storage portion 708 including a hard disk; and a communication portion 709 including a network interface card such as a Local Area Network card, a modem, and the like. The communication portion 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the input / output interface 705 as necessary. A removable media 711 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like is attached to the drive 710 as necessary, so that a computer program read therefrom is installed in the storage portion 708 as necessary.

[0133] In particular, according to embodiments of the present application, the processes described in the various method flowcharts can be implemented as a computer software program. For example, embodiments of the present application include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program code for executing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication portion 709, and / or installed from the removable media 711. When the computer program is executed by the central processing unit 701, various functions defined in the system of the present application are performed.

[0134] It should be noted that the computer-readable medium in the embodiments of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination thereof. The computer-readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination thereof. More specific examples of the computer-readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (Compact Disc Read-Only Memory, CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, device or apparatus. In this application, the computer-readable signal medium can include a data signal carried in a baseband or as a part of a carrier wave, which carries computer-readable program code. Such a propagated data signal can take on many forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than the computer-readable storage medium that can send, propagate or transmit the program for use by or in connection with an instruction execution system, device or apparatus. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, or the like, or any suitable combination thereof.

[0135] The flowcharts and block diagrams in the drawings illustrate the possible implementation architectures, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, a program segment, or a portion of code that contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different orders than that shown in the figures. For example, two blocks noted in succession can actually be executed substantially concurrently, or they can sometimes be executed in reverse order, depending on the functionality involved. It should also be noted that each block in the flowcharts or block diagrams, and combinations of blocks in the flowcharts or block diagrams, can be implemented by special-purpose hardware-based systems that perform the specified functions or operations, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0136] It should be noted that, although several modules or units for a device for action execution are mentioned in the above detailed description, such a division is not mandatory. Indeed, according to an embodiment of the application, the features and functionalities of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functionalities of one module or unit described above can be further divided into several modules or units embodied.

[0137] Those skilled in the art can easily understand, through the above description of the embodiments, that the example embodiments described herein can be implemented by software, or by software in combination with necessary hardware. Therefore, the technical solutions according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a U disk, a mobile hard disk, etc.) or a network, and includes several instructions to make a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) execute the methods according to the embodiments of the present application.

[0138] Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the present application cover any and all variations of the application that come within the scope of the present application, along with all equivalents thereof. It is intended that the application not be limited to the described embodiments but that it include all changes coming within the scope of the application.

[0139] It should be understood that the application is not limited to the precise construction that has been described above and illustrated in the accompanying drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the application. The scope of the application should only be limited by the appended claims.

Claims

1. A method for controlling network access, characterized in that, include: Obtain the business access request to the access site, and determine the process identifier of the access process corresponding to the business access request; The process feature corresponding to the accessing process is obtained by searching the process feature cache based on the process identifier of the accessing process; the process feature cache is used to store the process identifiers of multiple processes and the process features associated with each process identifier. The process characteristics of the accessing process are matched against the blocking process cache to determine whether the accessing process is a blocking process; the blocking process cache is used to store the process characteristics corresponding to processes that meet the process blocking rules in the first preset access conditions; the first preset access conditions include the control method when the accessed site is a public website site. If the access process is not a blocking process, the access site is not a public site, and the access site is determined not to be a blocked access site according to the access site blocking rules in the first preset access conditions, then the access method of the service access request to the access site is determined according to the second preset access conditions; the second preset access conditions include the control method when the access site is an internal site.

2. The network access control method according to claim 1, characterized in that, Before searching in the process feature cache based on the process identifier of the accessing process, the method further includes: Obtain the process identifiers of multiple first processes and the process characteristics corresponding to each first process; the first process refers to the process that has been created and has not exited in the terminal device that initiated the service access request; The process feature cache is formed by storing the process identifiers and process characteristics corresponding to each first process in the form of a doubly linked list.

3. The network access control method according to claim 2, characterized in that, Obtain the process identifiers of multiple first processes and the corresponding process characteristics of each process, including: When the core layer of the terminal device detects that a process has been created, it takes the currently created process as the first process and obtains the process identifier of the first process. Based on the process identifier of the first process and the local cache process characteristics loaded by the application layer of the terminal device, the process characteristics corresponding to the first process are obtained.

4. The network access control method according to claim 3, characterized in that, Based on the process identifier of the first process and the local cache process characteristics loaded by the application layer of the terminal device, the process characteristics corresponding to the first process are obtained, including: The key characteristics of the first process are determined based on the process identifier of the first process; Based on the key characteristics of the first process, search in the local cache process characteristics to determine whether the process characteristics of the first process exist in the local cache process characteristics; If there is a cache feature in the local cache process features that is the same as the key feature of the first process, then the process feature corresponding to the cache feature in the local cache process features shall be used as the process feature of the first process. If the local cache process features do not contain any cache features that are identical to the key features of the first process, then the process features corresponding to the first process are obtained through the application layer.

5. The network access control method according to claim 1, characterized in that, The first preset access condition includes process blocking rules; before matching in the blocking process cache based on the process characteristics of the accessing process, the method further includes: Obtain the process identifier and process characteristics of the second process, wherein the second process is a process already created in the terminal device that initiated the service access request; If the process characteristics of the second process match the process blocking rules, the process identifier and process characteristics of the second process are stored in the form of a doubly linked list to form the blocking process cache.

6. The network access control method according to any one of claims 1-5, characterized in that, The second preset access conditions include direct access conditions, proxy access conditions, and mandatory authentication access conditions; Determining the access method of the service access request to the access site based on the second preset access conditions includes: If the service access request meets the direct access conditions, the service access request is sent to the access site through the proxy client; If the service access request meets the proxy access conditions, the service access request is sent to the access site through the gateway; If the service access request meets the mandatory authentication access conditions, the service access request will be sent to the access site through the gateway after the security verification of the access site process.

7. The network access control method according to claim 6, characterized in that, Sending the service access request to the access site through the gateway includes: The proxy client initiates a credential retrieval request for the business access request to the client that initiated the business access request, so that the client returns the access credentials obtained from the corresponding server based on the credential retrieval request. The proxy client forwards the access credentials and the service access request to the gateway, so that when the gateway successfully verifies the access credentials, it sends the service access request to the access site.

8. A network access control device, characterized in that, include: The access request acquisition module is used to acquire business access requests to the access site and determine the process identifier of the access process corresponding to the business access request. The process feature acquisition module is used to search in the process feature cache according to the process identifier of the accessing process to obtain the process feature corresponding to the accessing process; the process feature cache is used to store the process identifiers of multiple processes and the process features associated with each process identifier; The process feature matching module is used to match the process features of the accessing process in the blocking process cache to determine whether the accessing process is a blocking process; the blocking process cache is used to store the process features corresponding to processes that meet the process blocking rules in the first preset access conditions; the first preset access conditions include the control method when the access site is a public website site. The access method determination module is used to determine the access method of the service access request to the access site according to the second preset access conditions if the access process is not a blocking process, the access site is not a public site, and the access site is determined not to be a blocked access site according to the access site blocking rules in the first preset access conditions; the second preset access conditions include the control method when the access site is an internal site.

9. A computer-readable medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the network access control method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor executes the executable instructions to cause the electronic device to perform the network access control method according to any one of claims 1 to 7.

11. A computer program product, characterized in that, The computer program product or computer program includes computer instructions stored in a computer-readable storage medium; The processor of the computer device reads the computer instructions from a computer-readable storage medium, and executes the computer instructions to cause the computer device to perform the network access control method according to any one of claims 1 to 7.

Images