A method, apparatus, system, device and storage medium for access control

Abstract

The application provides a method, device, system, equipment and storage medium for access control. A terminal device acquires attribute information of a target application to be protected. When initiating a network request for the target application, a DNS resolution request corresponding to the network request is detected locally, DNS resolution is performed, a local IP address is allocated for the target application, the network request is diverted to a local proxy to establish a TCP connection for the network request, and the network request is sent to an edge node through a secure channel. The edge node receives the network request for the target application, determines the attribute information of the corresponding target application, and implements zero-trust access control for the network request for the target application in combination with an access control policy. Through the method, zero-trust access control can be implemented for various network applications based on TCP protocols, including Web applications, ensuring the security of access, thereby greatly expanding the application scenarios of zero-trust access control.

Description

Technical Field

[0001] This application relates to the field of computer network security technology, and in particular to an access control technology. Background Technology

[0002] Traditional network security architectures are built around network boundaries to protect network resources. However, with the development of mobile internet, the Internet of Things, and the widespread adoption of big data and cloud computing, network boundaries are becoming increasingly blurred. Meanwhile, applications based on the TCP (Transmission Control Protocol) protocol (such as web applications, as well as native applications like email and remote login services) are proliferating. Traditional network security architectures can no longer provide sufficient security protection, making zero-trust-based network resource access control methods increasingly popular and valued.

[0003] Zero-trust-based network resource access control methods ensure security for every user, every device, and every connection accessing network resources. This is achieved by authenticating users, assigning them unique identities, and then dynamically controlling access permissions based on those identities.

[0004] In related technologies, zero-trust access control is mainly provided for web applications, but it is difficult to implement zero-trust access control for other native applications based on TCP protocols and not browsers. Summary of the Invention

[0005] The purpose of this application is to provide a technical solution for access control, which addresses the technical problem of zero-trust access control for applications based on the TCP protocol.

[0006] Embodiment 1 of this application provides an access control method applied to a terminal device, wherein the method includes:

[0007] Obtain the attribute information of the target application and build a secure channel with the edge node;

[0008] Initiate a network request for the target application, and when the local system detects a DNS resolution request corresponding to the network request, allocate a local IP address to the target application.

[0009] Based on the local IP address and the attribute information of the target application, the network request is redirected to the local proxy to establish a TCP connection for the network request;

[0010] The network request is received based on the TCP connection, and the network request is sent to the edge node through the secure channel to achieve access control over the network request.

[0011] Optionally, the attribute information of the target application includes at least:

[0012] The identifier, domain name, and port of the target application.

[0013] Optionally, the step of allocating a local IP address to the target application when a DNS resolution request corresponding to the network request is detected locally includes:

[0014] When the local system intercepts the DNS resolution request corresponding to the network request, it performs DNS resolution to allocate a local IP address to the target application based on the domain name of the target application.

[0015] Optionally, after assigning a local IP address to the target application based on the domain name of the target application, the method further includes:

[0016] Establish a mapping relationship between the identifier of the target application and the local IP address.

[0017] Optionally, the step of redirecting the network request to a local proxy to establish a TCP connection for the network request based on the local IP address and the attribute information of the target application includes:

[0018] Based on the local IP address and the port of the target application, a network request based on a TCP connection is sent to the local proxy, and a TCP connection is established for the network request.

[0019] Optionally, the step of receiving the network request based on the TCP connection and sending the network request to the edge node through the secure channel to achieve access control over the network request includes:

[0020] The local IP address corresponding to the TCP connection is obtained through the local proxy;

[0021] Based on the mapping relationship, obtain the identifier of the target application corresponding to the local IP address;

[0022] The identifier of the target application is encapsulated into the data packet corresponding to the network request and then sent to the edge node through the secure channel to achieve access control of the network request based on the identifier of the target application.

[0023] Optionally, the construction of the secure channel with the edge node includes:

[0024] A request to establish a secure channel is sent to the edge node. If authentication is successful, a secure channel is established with the edge node, and the user's identity and / or the user's device security information are sent to the edge node for access control of the network request.

[0025] Optionally, the access control method further includes:

[0026] Receive the response sent by the edge node corresponding to the network request, or the security event pushed by the edge node.

[0027] Embodiment 2 of this application provides an access control method applied to an edge node, wherein the method includes:

[0028] Based on a secure channel, a network request for a target application is received from a terminal device, wherein the network request includes attribute information of the target application, the identity of the user initiating the network request, and / or the device security information of the terminal device.

[0029] Based on the attribute information of the target application, access control rules corresponding to the target application are determined from the access control policy, wherein the access control policy is obtained from the security management platform;

[0030] Based on the access control rules, the identity of the user initiating the network request and / or the device security information of the user terminal are judged, and corresponding processing is performed according to the judgment result, so as to realize access control of the network request.

[0031] Optionally, the access control policy is set based on the following information:

[0032] Attribute information of the target application;

[0033] Access control rules corresponding to the target application, wherein the access control rules set the user identity and / or device security information of the terminal device that have permission to access the target application.

[0034] Optionally, the step of performing corresponding processing based on the judgment result includes:

[0035] Based on the judgment result, if access is allowed, a response corresponding to the network request is sent to the terminal device;

[0036] If access is not permitted, a security event is pushed to the terminal device.

[0037] Embodiment 3 of this application provides an access control method applied to a security management platform, wherein the method includes:

[0038] Obtain an access control policy, wherein the access control policy includes attribute information of the target application and access control rules corresponding to the target application;

[0039] The access control policy is sent to the edge node, and the attribute information of the target application is sent to the terminal device, so that when the terminal device initiates a network request for the target application, the edge node implements access control on the network request based on the access control policy.

[0040] Embodiment 4 of this application provides an access control method applied to a terminal device, wherein the method includes:

[0041] Obtain the attribute information of the target application and build a secure channel with the edge node;

[0042] Receive DNS resolution requests corresponding to network requests for a target application, and allocate a local IP address to the target application;

[0043] Based on the local IP address and the attribute information of the target application, establish a TCP connection for the network request;

[0044] The network request is received based on the TCP connection, and the network request is sent to the edge node through the secure channel to achieve access control over the network request.

[0045] Optionally, the attribute information of the target application includes at least:

[0046] The identifier, domain name, and port of the target application.

[0047] Optionally, receiving a DNS resolution request corresponding to a network request for the target application and allocating a local IP address for the target application includes:

[0048] When a DNS resolution request corresponding to the network request is intercepted, DNS resolution is performed to allocate a local IP address to the target application based on the domain name of the target application.

[0049] Optionally, after assigning a local IP address to the target application based on the domain name of the target application, the method further includes:

[0050] Establish a mapping relationship between the identifier of the target application and the local IP address.

[0051] Optionally, establishing a TCP connection for the network request based on the local IP address and the attribute information of the target application includes:

[0052] A TCP connection is established for the network request based on the local IP address and the port of the target application.

[0053] Optionally, the step of receiving the network request based on the TCP connection and sending the network request to the edge node through the secure channel to achieve access control over the network request includes:

[0054] Obtain the local IP address corresponding to the TCP connection;

[0055] Based on the mapping relationship, obtain the identifier of the target application corresponding to the local IP address;

[0056] The identifier of the target application is encapsulated into the data packet corresponding to the network request and then sent to the edge node through the secure channel to achieve access control of the network request based on the identifier of the target application.

[0057] Optionally, the construction of the secure channel with the edge node includes:

[0058] A request to establish a secure channel is sent to the edge node. If authentication is successful, a secure channel is established with the edge node, and the user's identity and / or the user's device security information are sent to the edge node for access control of the network request.

[0059] Optionally, the access control method further includes:

[0060] Receive the response sent by the edge node corresponding to the network request, or the security event pushed by the edge node.

[0061] Embodiment 5 of this application provides an access control device deployed on a terminal device, wherein the device includes:

[0062] The acquisition module is used to obtain the attribute information of the target application and build a secure channel with the edge node;

[0063] The processing module is used to initiate network requests for the target application, and when a DNS resolution request corresponding to the network request is detected locally, it allocates a local IP address to the target application.

[0064] A connection module is used to redirect the network request to a local proxy to establish a TCP connection for the network request based on the local IP address and the attribute information of the target application.

[0065] The sending module is used to receive the network request based on the TCP connection and send the network request to the edge node through the secure channel to realize access control over the network request.

[0066] Optionally, the processing module is further configured to:

[0067] Establish a mapping relationship between the identifier of the target application and the local IP address;

[0068] The sending module is used for:

[0069] The local IP address corresponding to the TCP connection is obtained through the local proxy;

[0070] Based on the mapping relationship, obtain the identifier of the target application corresponding to the local IP address;

[0071] The identifier of the target application is encapsulated into the data packet corresponding to the network request and then sent to the edge node through the secure channel to achieve access control of the network request based on the identifier of the target application.

[0072] Optionally, the access control device further includes:

[0073] The receiving module is used to receive the response sent by the edge node in response to the network request, or the security event pushed by the edge node.

[0074] Embodiment 6 of this application provides an access control device deployed at an edge node, wherein the device includes:

[0075] The receiving module is configured to receive network requests for a target application sent by a terminal device via a secure channel, wherein the network request includes attribute information of the target application and the identity of the user initiating the network request and / or the device security information of the terminal device.

[0076] The acquisition module is used to determine the access control rules corresponding to the target application from the access control policy based on the attribute information of the target application, wherein the access control policy is acquired from the security management platform;

[0077] The access control module is used to determine the identity of the user initiating the network request and / or the device security information of the user terminal based on the access control rules, and to perform corresponding processing according to the determination result, so as to realize access control of the network request.

[0078] Embodiment 7 of this application provides an access control device deployed on a security management platform, wherein the device includes:

[0079] The acquisition module is used to acquire access control policies, wherein the access control policies include attribute information of the target application and access control rules corresponding to the target application;

[0080] The sending module is used to send the access control policy to the edge node and send the attribute information of the target application therein to the terminal device, so that when the terminal device initiates a network request for the target application, the edge node implements access control on the network request based on the access control policy.

[0081] Embodiment 8 of this application provides an access control device deployed on a terminal device, wherein the device includes:

[0082] The acquisition module is used to obtain the attribute information of the target application and build a secure channel with the edge node;

[0083] The processing module is used to receive DNS resolution requests corresponding to network requests for the target application and allocate a local IP address to the target application.

[0084] A connection module is used to establish a TCP connection for the network request based on the local IP address and the attribute information of the target application.

[0085] The sending module is used to receive the network request based on the TCP connection and send the network request to the edge node through the secure channel to realize access control over the network request.

[0086] Embodiment 9 of this application provides an access control system, wherein the system includes:

[0087] A security management platform is used to acquire access control policies, wherein the access control policies include attribute information of a target application and access control rules corresponding to the target application, and to synchronize the access control policies to edge nodes and send the attribute information of the target application to terminal devices, so that when the terminal device initiates a network request for the target application, the edge nodes implement access control on the network request based on the access control policies.

[0088] The terminal device deploys a client and a local proxy for the target application to obtain the attribute information of the target application and build a secure channel with the edge node. Based on the local proxy, when a network request for the target application is detected, a local IP address is assigned to the target application, and based on the local IP address and the attribute information of the target application, the network request is redirected to the local proxy to establish a TCP connection for the network request. The network request is received based on the TCP connection, and the network request is sent to the edge node through the secure channel.

[0089] An edge node is used to acquire network requests sent by a terminal device for a target application based on a secure channel. The network request includes attribute information of the target application and the identity of the user initiating the network request and / or the device security information of the user terminal. Based on the network request, the node determines the attribute information of the target application and, based on the attribute information of the target application, determines the access control rules corresponding to the target application from the access control policy, wherein the access control policy is obtained from the security management platform. Based on the access control rules, the node judges the identity of the user initiating the network request and / or the device security information of the user terminal and performs corresponding processing according to the judgment result.

[0090] Compared with existing technologies, this application provides an access control technical solution. First, on the security management platform side, it acquires at least the target application's attribute information and access control policies created for the target application. The access control policies at least include access control rules corresponding to the target application. This access control policy is then synchronized to edge nodes, and the target application's attribute information is sent to the terminal device. Second, on the terminal device side, a target application client and a local proxy are deployed. The terminal device acquires the target application's attribute information sent by the security management platform. The terminal device establishes a secure channel with the edge node through the local proxy. When the target application client initiates a network request for the target application, and the local device detects a DNS resolution request corresponding to this network request, it performs DNS resolution, assigns a local IP address to the target application, and, based on the local IP address and the target application's attribute information, redirects the network request to the local proxy. The system establishes a TCP connection for the network request, receives the network request through this TCP connection, and sends the network request to the edge node via a secure channel. Finally, at the edge node, based on the secure channel with the terminal device, it obtains the network request sent by the terminal device for the target application. This network request includes relevant information about the target application and the identity of the user initiating the network request and / or the device security information of the terminal device. Based on this network request, it determines the relevant information of the target application, identifies the access control rules corresponding to the target application from the access control policy, and judges the identity of the user initiating the network request and / or the device security information of the terminal device based on the access control rules. Appropriate processing is then performed according to the judgment result to achieve access control for the network request. Optionally, on the terminal device side, before sending the network request to the edge node via the secure channel, the identifier of the target application is encapsulated in the data packet of the network request, and then sent to the edge node via the secure channel to achieve access control for the network request based on the identifier of the target application.

[0091] The technical effects of the access control solution provided in this application are as follows:

[0092] By establishing a local TCP connection on the terminal device side and building a secure channel between the terminal device and the edge node, access control for various network applications based on the TCP protocol, including web applications, can be achieved through authentication of the user's identity and / or device security information initiating the network request. This ensures access security and greatly expands the application scenarios of zero-trust access control. Furthermore, encapsulating the target application's identifier into the data packet corresponding to the network request can eliminate the risks of sniffing and hijacking on the network link, making network access more secure. Attached Figure Description

[0093] Other features, objects, and advantages of the invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0094] Figure 1 This paper presents a flowchart of an access control method applied to a terminal device according to Embodiment 1 of this application;

[0095] Figure 2 This paper illustrates a flowchart of an access control method applied to an edge node according to Embodiment 2 of this application.

[0096] Figure 3 This paper illustrates a flowchart of an access control method applied to a security management platform according to Embodiment 3 of this application.

[0097] Figure 4 This paper presents a flowchart of an access control method applied to a terminal device according to Embodiment 4 of this application.

[0098] Figure 5 This diagram illustrates an access control device deployed on a terminal device according to Embodiment 5 of this application.

[0099] Figure 6 This diagram illustrates an access control device deployed on an edge node according to Embodiment 6 of this application.

[0100] Figure 7 This diagram illustrates an access control device deployed on a security management platform according to Embodiment 7 of this application.

[0101] Figure 8 This diagram illustrates an access control device deployed on a terminal device according to Embodiment 8 of this application.

[0102] Figure 9 This diagram illustrates an access control system according to Embodiment 9 of this application.

[0103] Figure 10 This diagram illustrates the structure of a terminal device according to an optional embodiment of Embodiment 1 of this application.

[0104] Figure 11 This diagram illustrates the structure of a terminal device according to an optional embodiment of Embodiment 4 of this application.

[0105] The same or similar reference numerals in the accompanying drawings represent the same or similar parts. Detailed Implementation

[0106] The present invention will now be described in further detail with reference to the accompanying drawings.

[0107] In a typical configuration of this application, each module of the system and the trusted party includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0108] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0109] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include non-transitory computer-readable media, such as modulated data signals and carrier waves.

[0110] To further illustrate the technical means adopted and the effects achieved in this application, the technical solution of this application will be clearly and completely described below in conjunction with the accompanying drawings and preferred embodiments.

[0111] A typical system for providing access control in this application includes terminal devices, edge nodes, and a security management platform.

[0112] The terminal device must have at least a protected target application client and a local proxy that support the TCP protocol installed. The protected target application can be a browser application or a native web application (e.g., Outlook, SSH (Secure Shell) for remote host login). The application client and the local proxy can be two separate clients or integrated into a single client. The terminal device can be various computer devices or smart terminal devices. These devices may be enterprise assets or personal BYOD (Bring Your Own Device) devices. Computer devices include, but are not limited to, personal computers and laptops, while smart terminal devices include, but are not limited to, smartphones and tablets. The computer devices and / or smart terminal devices mentioned here are merely examples; other existing or future devices and / or resources applicable to this application should also be included within the scope of protection of this application, and are hereby incorporated by reference.

[0113] The edge node can be, but is not limited to, a logical functional unit of a CDN (Content Delivery Network). As the main entity providing CDN services, it authenticates the terminal device upon receiving a security channel construction request. Upon successful authentication, a secure channel is established between the edge node and the terminal device. Based on this secure channel, the edge node receives network requests from users for protected target applications, user identity, and / or terminal device security information. It then authenticates these requests based on access control policies. If authentication is successful, a response corresponding to the network request is sent to the terminal device; if authentication fails, a corresponding security event is pushed to the terminal device. It is important to emphasize that the edge node can also be an edge node of an SD-WAN (Software Defined Wide Area Network), a zero-trust network, or an edge cloud network, including but not limited to edge servers, edge gateways, and edge controllers. No further limitations are imposed here, and any other existing or future forms of edge nodes applicable to this application should be included within the scope of protection of this application.

[0114] The security management platform acquires access control policies created by enterprise security administrators or other authorized personnel. These access control policies include at least the protected target application and its attribute information, as well as the access control rules corresponding to the protected target application. The platform also synchronizes the access control policies to edge nodes and sends the attribute information of the target application to the terminal device according to the terminal device's request.

[0115] Figure 1This invention discloses a flowchart of an access control method applied to a terminal device according to Embodiment 1 of this application, wherein the method includes:

[0116] S101 obtains the attribute information of the target application and constructs a secure channel with the edge node;

[0117] S102 initiates a network request for the target application. When the local system detects a DNS resolution request corresponding to the network request, it allocates a local IP address to the target application.

[0118] S103 Based on the local IP address and the attribute information of the target application, the network request is redirected to the local proxy to establish a TCP connection for the network request;

[0119] S104 receives the network request based on the TCP connection and sends the network request to the edge node through the secure channel to achieve access control over the network request.

[0120] In this embodiment, a client 110 is deployed in the terminal device 100, wherein the client 110 has integrated a protected target application client 111 and a local agent 112, such as Figure 10 As shown.

[0121] In this embodiment, in step S101, the user starts the client 110 in the terminal device 100, and through the integrated local agent 112, enters the account and identity information to initiate a login and identity authentication request to the security management platform 300. When the authentication is successful, the client 110 receives the attribute information of the protected target application and the configuration parameters for building a secure channel from the security management platform 300. Then, according to the received configuration parameters for building a secure channel, a secure channel for data communication with the edge node 200 is built. The secure channel can be built based on existing technologies such as encrypted TCP connection, tunnel, VPN, etc., which will not be elaborated here.

[0122] In one optional embodiment, the user launches client 110 in terminal device 100. Through the integrated local agent 112, a login page is displayed, prompting the user to log in. The user enters their account, password, and / or organization identifier and submits it to security management platform 300. Security management platform 300 checks whether the user's input information is correct. If correct, it sends the organization's authentication method to client 110. Upon receiving the request, client 110 enters its identity information, selects the authentication method, and submits an authentication request to security management platform 300. If authentication is successful, security management platform 300 sends a corresponding configuration file to client 110 based on the organization identifier and user's identity information. This configuration file includes at least the configuration parameters of the secure channel and the attribute information of the protected target application. Based on the configuration parameters of the secure channel, client 110 establishes a secure channel for data communication with edge node 200 to ensure that the traffic of the protected target application can be diverted into the secure channel. The attribute information of the protected target application is stored locally for processing different protected target applications.

[0123] If terminal device 100 receives m protected target applications, and each protected target application has n attribute information, they can be stored in the manner shown in Table 1 below.

[0124] Table 1

[0125]

[0126] Continuing in this embodiment, in step S102, a network request for the protected target application is initiated through the protected target application client 111 integrated in the client 110. When the local agent 112 detects the DNS resolution request corresponding to the network request, a local IP address is allocated to the target application.

[0127] Specifically, any network request initiated by terminal device 100 from an application that supports the TCP protocol will be intercepted by local proxy 112 to the corresponding DNS resolution request, and DNS resolution will be performed to obtain the attribute information of the corresponding application, such as the application's domain name. This information will be compared with the stored attribute information of protected target applications. If the application is a protected target application, a local IP address will be assigned to it; otherwise, the application will continue to request DNS resolution at the next higher level to obtain the corresponding IP address. In one optional application scenario, the local DNS of terminal device 100 is set to the local address, such as 127.0.0.1, through local proxy 112. When a TCP-enabled application client on terminal device 100 initiates a network request, the corresponding DNS resolution request is intercepted by the local DNS. First, a judgment is made. If the application's attribute information matches the stored protected target application attribute information, a local IP address is assigned to the target application after DNS resolution, such as any address between 127.10.0.0 and 127.255.0.0. Different local IP addresses assigned to different protected target applications can be recorded to ensure no duplicate allocation and to guarantee the establishment of different TCP connections for each protected target application. If the application's attribute information does not match the stored protected target application attribute information, it means the application is not protected. If the local DNS does not cache the IP address corresponding to its attribute information, a DNS resolution request is sent to the next higher-level DNS for processing. The processing by the next higher-level DNS is existing technology and will not be elaborated here.

[0128] Continuing in this embodiment, in step S103, based on the local IP address assigned to the target application and the received attribute information of the target application, the network request for the target application is redirected to the local proxy to establish a TCP connection for the network request.

[0129] Specifically, based on the local IP address and the attribute information of the target application, the protected target application client 111 initiates a TCP connection request to the local IP address. After the request is redirected to the local proxy 112, a TCP connection is established for the network request.

[0130] Continuing in this embodiment, in step S104, the local proxy 112 receives a network request for the target application via a TCP connection and sends the network request to the edge node 200 through a pre-established secure channel to achieve access control over the network request. The network request includes the domain name of the target application.

[0131] In one optional embodiment, in step S101, constructing the secure channel with the edge node includes:

[0132] A request to establish a secure channel is sent to the edge node. If authentication is successful, a secure channel is established with the edge node, and the user's identity and / or the user's device security information are sent to the edge node for access control of the network request.

[0133] After obtaining the target application information, the terminal device 100 sends a request to the edge node 200 to establish a secure channel. This request can be sent when initiating a network request for the target application, or after receiving the target application's attribute information from the security management platform 300, depending on the specific product form or application scenario. No specific limitation is made here. Upon receiving the request, the edge node 200 performs identity authentication. If authentication is successful, a secure channel for data communication is established between the terminal device 100 and the edge node 200. The edge node 100 then sends the user's identity and / or the terminal device 100's device security information to the edge node 200 for access control of the network request.

[0134] In one optional embodiment, in step S101, the attribute information of the protected target application received by the terminal device 100 includes at least:

[0135] The identifier, domain name, and port of the target application.

[0136] The identifier of the protected target application can be a number assigned sequentially when the protected target application is created. For example, the number assigned to the first protected target application is 1, the number assigned to the second protected target application is 2, and so on. The attribute information of the protected target application received by the terminal device may also include other attribute information such as the application name, for example, the application name of the protected target application may be OA (Office Automation) system, CRM (Customer Relationship Management) system, etc. It may also include the application mode of the protected target application, such as using a TCP proxy mode. Here, no limitation is made on the attribute information of the protected target application; any attribute information of the protected target application that is applicable to this application should be included within the scope of protection of this application.

[0137] In one optional embodiment, when the attribute information of the protected target application includes at least the identifier, domain name, and port of the protected target application, in step S102, for any network request initiated on the terminal device 100 that supports the TCP protocol, the local DNS will intercept the DNS resolution request corresponding to the network request, perform DNS resolution, obtain the domain name of the corresponding application, and compare it with the stored domain name of the protected target application. If it is the same as the domain name of the protected target application, a local IP address will be assigned to the target application; if it is not the same as the domain name of the protected target application, the next higher level DNS resolution will be requested to obtain the corresponding IP address.

[0138] In one optional embodiment, when the attribute information of the protected target application includes at least the identifier, domain name and port of the protected target application, in step S103, a network request based on a TCP connection is sent to the local agent 112 according to the local IP address assigned to the target application and the port of the target application, and a TCP connection is established for the network request.

[0139] To further eliminate the risks of sniffing and hijacking on network links and make network access more secure, in an optional embodiment, when the attribute information of the protected target application includes at least the identifier, domain name, and port of the protected target application, after step S102, the method further includes:

[0140] S1021 (not shown) establishes a mapping relationship between the identifier of the target application and the local IP address.

[0141] In the above optional application scenarios, if the attribute information of the three protected target applications received by the terminal device 100 includes the identifier (number), domain name, and port of the target application, and the local IP addresses allocated to each protected target application after initiating a network application are 127.10.0.1, 127.10.0.2, and 127.10.0.3 respectively, then the mapping relationship between the attribute information of the target application and the local IP address established in the terminal device 100 can be shown in Table 2 below.

[0142] Table 2

[0143] 127.10.0.1 1 Target application 1 domain Target application port 1 127.10.0.2 2 Target application 2 domains Target application port 2 127.10.0.3 3 Target application 3 domains Target application port 3

[0144] In an optional embodiment, step S104 includes:

[0145] Obtain the local IP address corresponding to the TCP connection through the local proxy;

[0146] Based on this mapping relationship, obtain the identifier of the target application corresponding to the local IP address;

[0147] The identifier of the target application is encapsulated in the data packet corresponding to the network request and sent to the edge node through a secure channel to achieve access control of the network request based on the identifier of the target application.

[0148] By encapsulating the target application's identifier into the data packet corresponding to the network request and then encrypting the transmitted data, the security of data transmission can be further improved. The encapsulated data packet is then sent to edge node 200 through a secure channel to achieve access control for the network request based on the target application's identifier.

[0149] In an optional embodiment, in step S104, a header can be added to the header of the first TCP payload of the data packet corresponding to the network request for the target application for encryption and verification. This header includes at least the identifier of the target application, such as its application ID. When the edge node 200 receives the data packet of the network request for the protected target application sent by the terminal device 100, after decapsulation and verification, it parses the application identifier from the header obtained from the first TCP payload header, thereby determining the target application and subsequently determining the access control rule corresponding to the target application from the access control policy.

[0150] In an optional embodiment, after step S104, the method further includes:

[0151] S105 (not shown) receives a response from the edge node corresponding to the network request, or a security event pushed by the edge node.

[0152] When edge node 200 receives a network request for a target application from terminal device 100 via client 111 integrated in client 110 through a secure channel, it authenticates the user's identity information and / or the terminal device's security information by combining the access control rules corresponding to the target application in the access control policy. If authentication is successful, terminal device 100 receives a response from edge node 200 corresponding to the network request. If edge node 200 does not store response data, it determines the corresponding origin server, requests response data from the origin server, and then sends the response data to terminal device 100. 0. If there are multiple origin servers, response data can be obtained through a load balancer. If it is an intranet application, it can retrieve response data from the intranet through a bound connector. Requesting response data from the origin server or intranet is existing technology and will not be elaborated upon here. If authentication fails, the terminal device 100 will receive a corresponding security event pushed by the edge node 200 to inform the user of the reason for the unsuccessful access. For example, the security event could be a notification like "Your access to the OA application has been blocked. Reason: Unauthorized," to show the user the reason for the blocked access. The security event may also be pushed to the terminal device 100 via a third-party push platform, rather than directly from the edge node 200. No specific push method is limited here; any method by which the edge node 200 pushes security events to the terminal device 100, if applicable to this application, should be included within the scope of protection of this application.

[0153] Figure 2 This paper presents a flowchart of an access control method applied to an edge node according to Embodiment 2 of this application, wherein the method includes:

[0154] S201 receives a network request for a target application sent by a terminal device based on a secure channel, wherein the network request includes attribute information of the target application and the identity of the user initiating the network request and / or the device security information of the terminal device;

[0155] S202 Based on the attribute information of the target application, determine the access control rules corresponding to the target application from the access control policy, wherein the access control policy is obtained from the security management platform;

[0156] S203, based on the access control rules, determines the identity of the user initiating the network request and / or the device security information of the user terminal, and performs corresponding processing according to the determination result, so as to realize access control of the network request.

[0157] In this embodiment, in step S201, the edge node 200 receives a network request for a protected target application sent by the terminal device 100 based on the secure channel established between the edge node 200 and the terminal device 100. The network request includes attribute information of the target application, as well as the user identity and / or device security information of the terminal device 100 that initiated the network request for the protected target application.

[0158] In one optional embodiment, if the terminal device 100 sends the user identity and / or the device security information of the terminal device 100 to the edge node 200 after initiating the establishment of a secure channel with the edge node 200, then the network request initiated by the terminal device 100 for the protected target application may not carry the user identity and / or the device security information of the terminal device 100, so as to avoid repeated transmission and improve network communication and data processing efficiency.

[0159] Continuing in this embodiment, in step S202, the edge node 200 obtains the attribute information of the target application from the received network request, and determines the access control rules corresponding to the target application from the access control policy based on the attribute information of the target application, wherein the access control policy is obtained from the security management platform 300.

[0160] Continuing in this embodiment, in step S203, the edge node 200 judges the identity of the user who initiated the network request and / or the device security information of the user terminal according to the access control rule, and performs corresponding processing according to the judgment result, so as to realize access control of the network request.

[0161] In one optional embodiment, the access control policy obtained by the edge node 200 from the security management platform 300 is set based on the following information:

[0162] The attribute information of the protected target application;

[0163] Access control rules corresponding to the target application, wherein the access control rules set the user identity and / or device security information of the terminal device that have permission to access the target application.

[0164] The protected target application's attribute information includes at least the application identifier, domain name, port, proxy mode, and origin server information. This origin server information includes the origin server's IP address and port. If the same target application includes multiple origin servers, it may also include load balancer information used to balance the load across these origin servers, allowing authorized users to access the origin servers. If the protected target application is an internal enterprise application, its attribute information should also include connector information bound to the target application, allowing authorized users to access the internal application.

[0165] Among them, the access control rules corresponding to the protected target application are set with the identity of the user and / or the device security information of the terminal device that have permission to access the protected target application.

[0166] In one optional embodiment, the corresponding processing based on the judgment result in step S203 includes:

[0167] Based on the judgment result, if access is allowed, a response corresponding to the network request is sent to the terminal device;

[0168] If access is not permitted, a security event is pushed to the terminal device.

[0169] When edge node 200 receives a network request for a target application from terminal device 100 through a secure channel, it obtains the application's attribute information, identifies the target application based on this information, and then determines the corresponding access control rules from the access control policy. It then authenticates the user's identity information and / or the terminal device's security information. If authentication is successful, it sends a response to the network request to terminal device 100. If edge node 200 does not store response data, it identifies the corresponding origin server, requests response data from the origin server, and then sends it to terminal device 100. If there are multiple origin servers, a load balancer can also be used to obtain response data. If it is an intranet application, it can access the intranet through a bound connector to obtain response data. Requesting response data from the origin server or intranet is existing technology and will not be elaborated upon. If authentication fails, a corresponding security event is pushed to terminal device 100 to inform the user of the reason for the unsuccessful access. The security event may also be pushed to terminal device 100 via a third-party push platform, rather than directly from edge node 200. Here, no specific push method is limited. Any method by which an edge node 200 pushes security events to a terminal device 100, if applicable to this application, should be included within the scope of protection of this application.

[0170] In one optional embodiment, if the edge node 200 receives a data packet from the terminal device 100 that includes an application identifier for a network request to a protected target application, the edge node 200 obtains the application identifier to determine the target application, and then determines the access control rule corresponding to the target application from the access control policy.

[0171] Figure 3 This paper illustrates a flowchart of an access control method applied to a security management platform according to Embodiment 3 of this application, wherein the method includes:

[0172] S301 Obtain access control policy, wherein the access control policy includes attribute information of the target application and access control rules corresponding to the target application;

[0173] S302 sends the access control policy to the edge node and sends the attribute information of the target application to the terminal device, so that when the terminal device initiates a network request for the target application, the edge node implements access control on the network request based on the access control policy.

[0174] In this embodiment, in step S301, the security management platform 300 obtains the access control policy created by the enterprise security administrator or other authorized personnel. The access control policy includes at least the attribute information of at least one protected target application and the access control rules corresponding to each target application.

[0175] Continuing in this embodiment, in step S302, the security management platform 300 sends the access control policy to the edge node 200 and sends the corresponding target application attribute information to the authenticated terminal device 100, so that when the terminal device 100 initiates a network request for the target application, the edge node 200 can implement access control for the network request based on the access control rules corresponding to the target application in the access control policy.

[0176] Figure 4 This invention provides a flowchart of an access control method for a terminal device according to Embodiment 4 of this application, wherein the method includes:

[0177] S401 obtains the attribute information of the target application and constructs a secure channel with the edge node;

[0178] S402 receives a DNS resolution request corresponding to a network request for a target application and assigns a local IP address to the target application.

[0179] S403 establishes a TCP connection for the network request based on the local IP address and the attribute information of the target application;

[0180] S404 receives the network request based on the TCP connection and sends the network request to the edge node through the secure channel to achieve access control over the network request.

[0181] In this embodiment, a protected target application client 111 and a local proxy 112 are deployed in the terminal device 100, such as Figure 11 As shown.

[0182] In this embodiment, in step S401, the user starts the local agent 112 in the terminal device 100, enters the account and identity information, and initiates a login and identity authentication request to the security management platform 300. When the authentication is successful, the local agent 112 will receive the attribute information of the protected target application and the configuration parameters for building a secure channel. Then, according to the received configuration parameters for building a secure channel, a secure channel for data communication with the edge node 200 is built.

[0183] In one optional embodiment, the local agent 112 in the startup terminal device 100 displays a login page, requiring the user to log in, enter their account, password, and / or organization identifier, and submit it to the security management platform 300. The security management platform 300 checks whether the input information is correct. If correct, it sends the organization's authentication method to the local agent. After receiving the information, the local agent 112 provides its identity information, selects the authentication method, and submits an authentication request to the security management platform 300. If the authentication is successful, the security management platform 300 sends a corresponding configuration file to the local agent 112 based on the organization number and the user's identity information. This configuration file includes at least the configuration parameters of the secure channel and the attribute information of the protected target application. The configuration parameters of the secure channel are input to establish a secure channel for data communication with the edge node 200, ensuring that the traffic of the protected target application can be diverted into the secure channel. The attribute information of the protected target application is stored locally for processing different protected target applications.

[0184] When a user initiates a network request through the protected target application client 111 in the terminal device 100, in this embodiment, in step S402, the local agent receives the DNS resolution request corresponding to the network request for the target application and assigns a local IP address to the target application.

[0185] Specifically, any network request initiated by terminal device 100 from an application that supports the TCP protocol will be intercepted by the local proxy and redirected to the corresponding DNS resolution request. DNS resolution will be performed to obtain the attribute information of the corresponding application, such as the application's domain name, and compared with the stored attribute information of the protected target application. If it is a protected target application, a local IP address will be assigned to the target application; if it is not a protected target application, the proxy will continue to request the upper-level DNS resolution to obtain the corresponding IP address. In one optional application scenario, the local DNS of terminal device 100 is set to its local address, such as 127.0.0.1, through a local proxy. When a TCP-enabled application client on the terminal device initiates a network request, the corresponding DNS resolution request is intercepted by the local DNS. First, a judgment is made. If the application's attribute information matches the stored protected target application attribute information, a local IP address is assigned to the target application after DNS resolution, such as any address between 127.10.0.0 and 127.255.0.0. The local IP addresses assigned to different protected target applications are recorded to ensure no duplicate allocation and to guarantee the establishment of different TCP connections for each protected target application. If the application's attribute information does not match the stored protected target application attribute information, it means the application is not protected. If the local DNS does not cache the IP address corresponding to its attribute information, a DNS resolution request is sent to the next higher-level DNS for processing. The processing by the next higher-level DNS is existing technology and will not be elaborated here.

[0186] Continuing in this embodiment, in step S403, a TCP connection is established for the network request based on the local IP address assigned to the target application and the received attribute information of the target application.

[0187] Specifically, the protected target application client 111 that initiates the network request receives the local IP address resolved by the local DNS and the attribute information of the target application, and initiates a TCP connection request to the local IP address. After receiving the TCP connection request, the local proxy 112 establishes a TCP connection for the network request.

[0188] Continuing in this embodiment, in step S404, the local proxy 112 receives a network request for the target application via a TCP connection and sends the network request to the edge node 200 through a pre-established secure channel to achieve access control over the network request. The network request includes the domain name of the target application.

[0189] In one optional embodiment, in step S401, constructing the secure channel with the edge node includes:

[0190] A request to establish a secure channel is sent to the edge node. If authentication is successful, a secure channel is established with the edge node, and the user's identity and / or the user's device security information are sent to the edge node for access control of the network request.

[0191] After obtaining the target application information, the terminal device 100 sends a request to the edge node 200 to establish a secure channel. This request can be sent when initiating a network request for the target application, or after receiving the target application's attribute information from the security management platform 300, depending on the specific product form or application scenario. No specific limitation is made here. Upon receiving the request, the edge node 200 performs identity authentication. If authentication is successful, a secure channel for data communication is established between the terminal device 100 and the edge node 200. The edge node 100 then sends the user's identity and / or the terminal device 100's device security information to the edge node 200 for access control of the network request.

[0192] In one optional embodiment, in step S401 of the above embodiment, the attribute information of the protected target application received by the terminal device 100 includes at least:

[0193] The identifier, domain name, and port of the target application.

[0194] The identifier of the protected target application can be a number assigned sequentially when the protected target application is created. For example, the number assigned to the first protected target application is 1, the number assigned to the second protected target application is 2, and so on. The attribute information of the protected target application received by the terminal device 100 may also include other attribute information such as the application name, for example, the application name of the protected target application may be OA (Office Auto) system, CRM (Customer Relationship Management) system, etc. It may also include the application mode of the protected target application, such as using TCP proxy mode. Here, no limitation is made on the attribute information of the protected target application; any attribute information of the protected target application that is applicable to this application should be included within the scope of protection of this application.

[0195] In one optional embodiment, when the attribute information of the protected target application includes at least the identifier, domain name, and port of the protected target application, in step S402, for any network request initiated on the terminal device 100 that supports the TCP protocol, the local proxy will intercept the DNS resolution request corresponding to the network request, perform DNS resolution, obtain the domain name of the corresponding application, and compare it with the stored domain name of the protected target application. If it is the same as the domain name of the protected target application, a local IP address will be assigned to the target application; if it is not the same as the domain name of the protected target application, the next higher level DNS resolution will be requested to obtain the corresponding IP address.

[0196] In one optional embodiment, when the attribute information of the protected target application includes at least the identifier, domain name and port of the protected target application, in step S403, a TCP connection for the network request is established based on the local IP address assigned to the target application and the port of the target application.

[0197] To further eliminate the risks of sniffing and hijacking on network links and make network access more secure, in one optional embodiment, when the attribute information of the protected target application includes at least the identifier, domain name, and port of the protected target application, after step S402, the method further includes:

[0198] S4021 (not shown) establishes a mapping relationship between the identifier of the target application and the local IP address.

[0199] In an optional embodiment, step S404 includes:

[0200] Obtain the local IP address corresponding to this TCP connection;

[0201] Based on this mapping relationship, obtain the identifier of the target application corresponding to the local IP address;

[0202] The identifier of the target application is encapsulated in the data packet corresponding to the network request and sent to the edge node through a secure channel to achieve access control of the network request based on the identifier of the target application.

[0203] By encapsulating the target application's identifier into the data packet corresponding to the network request and then encrypting the transmitted data, the security of data transmission can be further improved. The encapsulated data packet is then sent to edge node 200 through a secure channel to achieve access control for the network request based on the target application's identifier.

[0204] In an optional embodiment, in step S404, a header can be added to the header of the first TCP payload of the data packet corresponding to the network request for the target application for encryption and verification. This header includes at least the identifier of the target application, such as its application ID. When the edge node 200 receives the data packet of the network request for the protected target application sent by the terminal device 100, it first decapsulates and verifies the packet, then parses the application identifier from the header obtained from the first TCP payload header to determine the target application. Subsequently, it determines the access control rule corresponding to the target application from the access control policy.

[0205] In one alternative embodiment, after step S404, the protected target application client 111 of the terminal device 100 will also receive a response to the network request sent by the edge node 200, or a security event pushed by the edge node 200.

[0206] When edge node 200 receives a network request for a target application from terminal device 100 through a secure channel, it authenticates the user's identity information and / or the terminal device's security information based on the access control rules corresponding to the target application in the access control policy. If authentication is successful, terminal device 100 receives a response from edge node 200 corresponding to the network request. If edge node 200 does not store response data, it determines the corresponding origin server, requests response data from the origin server, and then sends it to terminal device 100. If there are multiple origin servers, a load balancer can also be used to obtain response data. If it is an intranet application, it can access the intranet through a bound connector to obtain response data. Requesting response data from the origin server or intranet is existing technology and will not be elaborated on here. If authentication fails, terminal device 100 receives a corresponding security event pushed by edge node 200 to inform the user of the reason for the unsuccessful access. The security event may also be pushed to terminal device 100 via a third-party push platform, rather than directly from edge node 200. Here, no specific push method is limited. Any method by which an edge node 200 pushes security events to a terminal device 100, if applicable to this application, should be included within the scope of protection of this application.

[0207] Figure 5 The diagram illustrates an access control device deployed on a terminal device according to Embodiment 5 of this application, wherein the device includes:

[0208] The acquisition module 510 is used to acquire the attribute information of the target application and build a secure channel with the edge node;

[0209] Processing module 520 is used to initiate a network request for the target application, and when a DNS resolution request corresponding to the network request is detected locally, it allocates a local IP address to the target application.

[0210] The connection module 530 is used to redirect the network request to a local proxy to establish a TCP connection for the network request based on the local IP address and the attribute information of the target application.

[0211] The sending module 540 is used to receive the network request based on the TCP connection and send the network request to the edge node through the secure channel to realize access control over the network request.

[0212] In an optional embodiment, the processing module 520 is further configured to establish a mapping relationship between the identifier of the target application and the local IP address. The sending module 540 is configured to obtain the local IP address corresponding to the TCP connection through a local proxy, and based on the mapping relationship, obtain the identifier of the target application corresponding to the local IP address. Then, the identifier of the target application is encapsulated into the data packet corresponding to the network request and sent to the edge node 200 through the secure channel to realize access control of the network request based on the identifier of the target application.

[0213] In one alternative embodiment, the device further includes a receiving module 550 (not shown) for receiving a response to the network request sent by the edge node, or a security event pushed by the edge node.

[0214] In this embodiment and its optional embodiments, the device is deployed in the terminal device 100, wherein the terminal device 100 has the same hardware and software environment as the related device in the aforementioned method embodiment 1, and each module is used to execute the corresponding steps of the aforementioned method embodiment 1 or its optional embodiments, which will not be described again here.

[0215] Figure 6 The diagram illustrates an access control device deployed on an edge node according to Embodiment 6 of this application, wherein the device includes:

[0216] The receiving module 610 is configured to receive a network request for a target application sent by a terminal device via a secure channel, wherein the network request includes attribute information of the target application and the identity of the user initiating the network request and / or the device security information of the terminal device.

[0217] The acquisition module 620 is used to determine the access control rules corresponding to the target application from the access control policy based on the attribute information of the target application, wherein the access control policy is acquired from the security management platform;

[0218] The access control module 630 is used to determine the identity of the user initiating the network request and / or the device security information of the user terminal based on the access control rules, and to perform corresponding processing according to the determination result, so as to realize access control of the network request.

[0219] In this embodiment, the device is deployed in an edge node 200, wherein the edge node 200 has the same hardware and software environment as the related device in the aforementioned method embodiment 2, and each module is used to execute the corresponding steps of the aforementioned method embodiment 2, which will not be described again here.

[0220] Figure 7 The diagram illustrates an access control device deployed on a security management platform according to Embodiment 7 of this application, wherein the device includes:

[0221] The acquisition module 710 is used to acquire access control policies, wherein the access control policies include attribute information of the target application and access control rules corresponding to the target application;

[0222] The sending module 720 is used to send the access control policy to the edge node and send the attribute information of the target application therein to the terminal device, so that when the terminal device initiates a network request for the target application, the edge node implements access control on the network request based on the access control policy.

[0223] In this embodiment, the device is deployed in a security management platform 300, which has the same hardware and software environment as the related devices in the aforementioned method embodiment 3. Each module is used to execute the corresponding steps of the aforementioned method embodiment 3, which will not be described again here.

[0224] Figure 8 The diagram illustrates an access control device deployed on a terminal device according to Embodiment 8 of this application, wherein the device includes:

[0225] The acquisition module 810 is used to acquire the attribute information of the target application and build a secure channel with the edge node;

[0226] Processing module 820 is used to receive DNS resolution requests corresponding to network requests for a target application and to allocate a local IP address to the target application;

[0227] The connection module 830 is used to establish a TCP connection for the network request based on the local IP address and the attribute information of the target application;

[0228] The sending module 840 is used to receive the network request based on the TCP connection and send the network request to the edge node through the secure channel to realize access control over the network request.

[0229] In an optional embodiment, the processing module 820 is further configured to establish a mapping relationship between the identifier of the target application and the local IP address. The sending module 840 is configured to obtain the local IP address corresponding to the TCP connection through a local proxy, and based on the mapping relationship, obtain the identifier of the target application corresponding to the local IP address. Then, the identifier of the target application is encapsulated into the data packet corresponding to the network request and sent to the edge node 200 through the security channel to realize access control of the network request based on the identifier of the target application.

[0230] In one alternative embodiment, the device further includes a receiving module 850 (not shown) for receiving a response to the network request sent by the edge node, or a security event pushed by the edge node.

[0231] In this embodiment and its optional embodiments, the device is deployed in the terminal device 100, wherein the terminal device 100 has the same hardware and software environment as the related device in the aforementioned method embodiment 4, and each module is used to execute the corresponding steps of the aforementioned method embodiment 4 or its optional embodiments, which will not be described again here.

[0232] Figure 9 This diagram illustrates an access control system according to Embodiment 9 of this application, wherein the system includes:

[0233] The security management platform 300 is used to obtain access control policies, wherein the access control policies include attribute information of the target application and access control rules corresponding to the target application, and synchronize the access control policies to edge nodes, and send the attribute information of the target application to terminal devices, so that when the terminal device initiates a network request for the target application, the edge nodes implement access control on the network request based on the access control policies.

[0234] Terminal device 100 deploys a client and a local proxy for the target application, used to obtain the attribute information of the target application and build a secure channel with the edge node. Based on the local proxy, when a network request for the target application is detected, a local IP address is assigned to the target application, and based on the local IP address and the attribute information of the target application, the network request is diverted to the local proxy to establish a TCP connection for the network request. The network request is received based on the TCP connection, and the network request is sent to the edge node through the secure channel.

[0235] Edge node 200 is configured to acquire network requests sent by terminal devices for target applications via a secure channel. The network requests include attribute information of the target application and the identity of the user initiating the network request and / or the device security information of the user terminal. Based on the network requests, the edge node determines the attribute information of the target application and, based on the attribute information of the target application, determines access control rules corresponding to the target application from access control policies obtained from a security management platform. Based on the access control rules, the edge node judges the identity of the user initiating the network request and / or the device security information of the user terminal and performs corresponding processing based on the judgment result.

[0236] In this embodiment, the security management platform 300, terminal device 100, and edge node 200 have the same hardware and software environment as the relevant devices in the aforementioned method embodiments, and are used to execute the aforementioned method embodiments.

[0237] According to another aspect of this application, a computer-readable medium is also provided, the computer-readable medium storing computer-readable instructions that can be executed by a processor to implement the aforementioned method.

[0238] It should be noted that this application can be implemented in software and / or a combination of software and hardware, for example, using an application-specific integrated circuit (ASIC), a general-purpose computer, a cache computer, and / or any other similar hardware device. In one embodiment, the software program involved in this application can be executed by a processor to implement the steps or functions described above. Similarly, the software program of this application (including related data structures) can be stored in a computer-readable recording medium. Additionally, some steps or functions of this application can be implemented in hardware, for example, as circuitry that cooperates with a processor to perform the various steps or functions.

[0239] Furthermore, a portion of this application can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to this application through the operation of the computer. The program instructions invoking the methods of this application may be stored in a fixed or removable recording medium, and / or transmitted via a data stream in a broadcast or other signal carrying medium, and / or stored in the working memory of a computer device operating according to the program instructions. Here, one embodiment of this application includes a device comprising a memory for storing computer program instructions and a processor for executing the program instructions, wherein, when the computer program instructions are executed by the processor, the device is triggered to run methods and / or technical solutions based on the foregoing embodiments of this application.

[0240] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered illustrative and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be embraced within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims. Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices recited in the apparatus claims may also be implemented by a single unit or device through software and / or hardware. The terms "first," "second," etc., are used to indicate names and do not indicate any particular order.

Claims

1. An access control method, characterized in that, Applied to a terminal device, the method includes: The target application's attribute information is obtained from the security management platform, and a secure channel is constructed with the edge node. The target application's attribute information includes at least the target application's identifier, domain name, and port. Initiate a network request for the target application. When the local machine intercepts the DNS resolution request corresponding to the network request, it performs DNS resolution to allocate a local IP address to the target application based on the domain name of the target application and establish a mapping relationship between the identifier of the target application and the local IP address. Based on the local IP address and the attribute information of the target application, the network request is redirected to the local proxy to establish a TCP connection for the network request; The local proxy obtains the local IP address corresponding to the TCP connection; based on the mapping relationship, it obtains the identifier of the target application corresponding to the local IP address; after encapsulating the identifier of the target application into the data packet corresponding to the network request, it sends it to the edge node through the secure channel to realize access control of the network request based on the identifier of the target application, wherein the header of the first TCP payload of the data packet corresponding to the network request includes the header of the identifier of the target application.

2. The method according to claim 1, characterized in that, The step of redirecting the network request to a local proxy to establish a TCP connection for the network request based on the local IP address and the attribute information of the target application includes: Based on the local IP address and the port of the target application, a network request based on a TCP connection is sent to the local proxy, and a TCP connection is established for the network request.

3. The method according to claim 1, characterized in that, The secure channel between the construction and the edge node includes: A request to establish a secure channel is sent to the edge node. If authentication is successful, a secure channel is established with the edge node, and the user's identity and / or the user's device security information are sent to the edge node for access control of the network request.

4. The method according to claim 1, characterized in that, The method further includes: Receive the response sent by the edge node corresponding to the network request, or the security event pushed by the edge node.

5. An access control method, characterized in that, Applied to edge nodes, the method includes: Based on a secure channel, a network request for a target application is received from a terminal device. The network request includes attribute information of the target application and the identity of the user initiating the network request and / or the device security information of the terminal device. The attribute information of the target application includes at least: the identifier, domain name, and port of the target application. The header of the first TCP payload of the data packet corresponding to the network request includes a header of the identifier of the target application. Based on the attribute information of the target application, access control rules corresponding to the target application are determined from the access control policy, wherein the access control policy is obtained from the security management platform; Based on the access control rules, the identity of the user initiating the network request and / or the device security information of the user terminal are judged, and corresponding processing is performed according to the judgment result, so as to realize access control of the network request.

6. The method according to claim 5, characterized in that, The access control policy is set based on the following information: Attribute information of the target application; Access control rules corresponding to the target application, wherein the access control rules set the user identity and / or device security information of the terminal device that have permission to access the target application.

7. The method according to claim 5, characterized in that, The corresponding processing based on the judgment result includes: Based on the judgment result, if access is allowed, a response corresponding to the network request is sent to the terminal device; If access is not permitted, a security event is pushed to the terminal device.

8. An access control method, characterized in that, The method, applied to a security management platform, includes: Obtain an access control policy, wherein the access control policy includes attribute information of the target application and access control rules corresponding to the target application, wherein the attribute information of the target application includes at least: the identifier, domain name and port of the target application; The access control policy is sent to the edge node, and the attribute information of the target application is sent to the terminal device. When the terminal device initiates a network request for the target application, the edge node implements access control for the network request based on the access control policy. The header of the first TCP payload of the data packet corresponding to the network request includes a header identifying the target application.

9. An access control method, characterized in that, Applied to a terminal device, the method includes: The target application's attribute information is obtained from the security management platform, and a secure channel is constructed with the edge node. The target application's attribute information includes at least the target application's identifier, domain name, and port. When a network request is initiated through a protected target application client, the local proxy receives the corresponding DNS resolution request and performs DNS resolution to allocate a local IP address to the target application based on the domain name of the target application, and establishes a mapping relationship between the identifier of the target application and the local IP address. Based on the local IP address and the attribute information of the target application, establish a TCP connection for the network request; Obtain the local IP address corresponding to the TCP connection; based on the mapping relationship, obtain the identifier of the target application corresponding to the local IP address; encapsulate the identifier of the target application into the data packet corresponding to the network request and send it to the edge node through the secure channel to realize access control of the network request based on the identifier of the target application, wherein the header of the first TCP payload of the data packet corresponding to the network request includes the header of the identifier of the target application.

10. The method according to claim 9, characterized in that, Establishing a TCP connection for the network request based on the local IP address and the attribute information of the target application includes: A TCP connection is established for the network request based on the local IP address and the port of the target application.

11. The method according to claim 9, characterized in that, The secure channel between the construction and the edge node includes: A request to establish a secure channel is sent to the edge node. If authentication is successful, a secure channel is established with the edge node, and the user's identity and / or the user's device security information are sent to the edge node for access control of the network request.

12. The method according to claim 9, characterized in that, The method further includes: Receive the response sent by the edge node corresponding to the network request, or the security event pushed by the edge node.

13. An access control device, characterized in that, Deployed on a terminal device, the device includes: The acquisition module is used to acquire the attribute information of the target application and construct a secure channel with the edge node, wherein the attribute information of the target application includes at least: the identifier, domain name and port of the target application; The processing module is used to initiate network requests for the target application. When the local machine intercepts the DNS resolution request corresponding to the network request, it performs DNS resolution to allocate a local IP address to the target application based on the domain name of the target application and establish a mapping relationship between the identifier of the target application and the local IP address. A connection module is used to redirect the network request to a local proxy to establish a TCP connection for the network request based on the local IP address and the attribute information of the target application. The sending module is configured to obtain the local IP address corresponding to the TCP connection through the local proxy; obtain the identifier of the target application corresponding to the local IP address based on the mapping relationship; encapsulate the identifier of the target application into the data packet corresponding to the network request and send it to the edge node through the secure channel, so as to realize access control of the network request based on the identifier of the target application, wherein the header of the first TCP payload of the data packet corresponding to the network request includes the header of the identifier of the target application.

14. An access control device, characterized in that, Deployed at an edge node, the device includes: A receiving module is configured to receive network requests for a target application sent by a terminal device via a secure channel. The network request includes attribute information of the target application and the identity of the user initiating the network request and / or the device security information of the terminal device. The attribute information of the target application includes at least: the identifier, domain name, and port of the target application. The header of the first TCP payload of the data packet corresponding to the network request includes a header of the identifier of the target application. The acquisition module is used to determine the access control rules corresponding to the target application from the access control policy based on the attribute information of the target application, wherein the access control policy is acquired from the security management platform; The access control module is used to determine the identity of the user initiating the network request and / or the device security information of the user terminal based on the access control rules, and to perform corresponding processing according to the determination result, so as to realize access control of the network request.

15. An access control device, characterized in that, Deployed on a security management platform, the device includes: An acquisition module is used to acquire access control policies, wherein the access control policies include attribute information of the target application and access control rules corresponding to the target application, wherein the attribute information of the target application includes at least: the identifier, domain name and port of the target application; The sending module is used to send the access control policy to the edge node and send the attribute information of the target application to the terminal device, so that when the terminal device initiates a network request for the target application, the edge node implements access control on the network request based on the access control policy, wherein the header of the first TCP payload of the data packet corresponding to the network request includes a header identifying the target application.

16. An access control device, characterized in that, Deployed on a terminal device, the device includes: The acquisition module is used to acquire the attribute information of the target application and construct a secure channel with the edge node, wherein the attribute information of the target application includes at least: the identifier, domain name and port of the target application; The processing module is used to perform DNS resolution when a network request is initiated through a protected target application client and the local proxy receives the corresponding DNS resolution request, so as to allocate a local IP address to the target application according to the domain name of the target application and establish a mapping relationship between the identifier of the target application and the local IP address. A connection module is used to establish a TCP connection for the network request based on the local IP address and the attribute information of the target application. The sending module is used to obtain the local IP address corresponding to the TCP connection; obtain the identifier of the target application corresponding to the local IP address based on the mapping relationship; encapsulate the identifier of the target application into the data packet corresponding to the network request and send it to the edge node through the secure channel to realize access control of the network request based on the identifier of the target application, wherein the header of the first TCP payload of the data packet corresponding to the network request includes the header of the identifier of the target application.

17. An access control system, characterized in that, The system includes: A security management platform is used to acquire access control policies, wherein the access control policies include attribute information of a target application and access control rules corresponding to the target application, wherein the attribute information of the target application includes at least: the identifier, domain name, and port of the target application, and synchronizes the access control policies to edge nodes, and sends the attribute information of the target application to terminal devices, so that when the terminal device initiates a network request for the target application, the edge nodes implement access control on the network request based on the access control policies, wherein the header of the first TCP payload of the data packet corresponding to the network request includes a header of the identifier of the target application; A terminal device deploys a client and a local proxy for the target application to obtain the target application's attribute information, which includes at least the target application's identifier, domain name, and port. It also constructs a secure channel with an edge node. Based on the local proxy, when a DNS resolution request corresponding to a network request is intercepted locally, DNS resolution is performed to allocate a local IP address to the target application based on its domain name. A mapping relationship is established between the target application's identifier and the local IP address. Based on the local IP address and the target application's attribute information, the network request is redirected to the local proxy to establish a TCP connection for the network request, and the local proxy obtains the corresponding local IP address for the TCP connection. Based on the mapping relationship, the identifier of the target application corresponding to the local IP address is obtained. The identifier of the target application is encapsulated into a data packet corresponding to the network request and sent to the edge node through the secure channel to achieve access control of the network request based on the target application's identifier. The header of the first TCP payload of the data packet corresponding to the network request includes a header containing the identifier of the target application. An edge node is used to acquire network requests sent by a terminal device for a target application based on a secure channel. The network request includes attribute information of the target application and the identity of the user initiating the network request and / or the device security information of the user terminal. The attribute information of the target application includes at least: the identifier, domain name, and port of the target application. The header of the first TCP payload of the data packet corresponding to the network request includes a header with the identifier of the target application. Based on the network request, the attribute information of the target application is determined. Based on the attribute information of the target application, access control rules corresponding to the target application are determined from access control policies obtained from a security management platform. Based on the access control rules, the identity of the user initiating the network request and / or the device security information of the user terminal are judged, and corresponding processing is performed according to the judgment result.

18. A computer-readable medium, characterized in that, It stores computer-readable instructions that are executed by a processor to implement the method as described in any one of claims 1 to 12.

19. An access control device, characterized in that, The device includes: One or more processors; and A memory storing computer-readable instructions, which, when executed, cause the processor to perform the operations of the method as described in any one of claims 1 to 12.

Images