Security protection method and device, electronic equipment and storage medium

Abstract

The application relates to a security protection method and device, electronic equipment and a storage medium. The method comprises the following steps: in response to a security protection instruction for a target object, a corresponding protection scene is determined; when the protection scene is a scene for pre-attack protection, historical interface calling information of the target object is acquired, a white list indicating interface calling is generated based on the historical interface calling information, and an association relationship between the white list and the target object is established; when the protection scene is a scene for post-attack protection, a current calling interface of the target object is acquired, a next calling interface of the target object is predicted, a black list for the next calling interface is generated, and an association relationship between the black list and the target object is established. The application improves the effective protection against attacks caused by key leakage and improves the adaptability of security protection. The application can be applied to various scenes such as cloud technology, artificial intelligence, intelligent transportation and auxiliary driving.

Description

Technical Field

[0001] This application relates to the field of Internet communication technology, and in particular to a security protection method, device, electronic device and storage medium. Background Technology

[0002] With the development of internet communication technology, internet products are emerging in large numbers. The user experience of internet products is generally provided by their related business functions, which are implemented through API calls. Keys are often used as authentication credentials for API calls, and attacks resulting from key leakage can affect the implementation of these business functions. In related technologies, plaintext keys are often encrypted to obtain ciphertext keys. When making API calls, the ciphertext keys are decrypted to obtain plaintext keys, which are then used to call the API to implement the relevant business functions. However, both the plaintext keys and the method of decrypting them still pose a risk of leakage, leading to related attacks. Therefore, more effective security protection solutions are needed. Summary of the Invention

[0003] To address at least one of the aforementioned technical problems, this application provides a security protection method, apparatus, electronic device, and storage medium:

[0004] According to a first aspect of this application, a security protection method is provided, the method comprising:

[0005] In response to a security protection instruction for a target object, a corresponding protection scenario is determined; the target object implements business functions by calling an interface based on a key, and the security protection instruction indicates protection against attacks caused by the leakage of the key;

[0006] When the protection scenario is a pre-emptive protection against the attack, the system obtains the target object's historical interface call information, generates a whitelist of interface calls based on the historical interface call information, and establishes an association between the whitelist and the target object; or,

[0007] When the protection scenario is a post-attack protection scenario, the current calling interface of the target object is obtained, the next calling interface of the target object is predicted, a blacklist for the next calling interface is generated, and the association between the blacklist and the target object is established.

[0008] According to a second aspect of this application, a safety protection device is provided, the device comprising:

[0009] Protection Scenario Determination Module: Used to determine the corresponding protection scenario in response to security protection instructions for a target object; the target object implements business functions by calling an interface based on a key, and the security protection instructions indicate protection against attacks caused by key leakage;

[0010] Pre-emptive protection module: When the protection scenario is a scenario for pre-emptive protection against the attack, it is used to obtain the historical interface call information of the target object, generate a whitelist of interface calls based on the historical interface call information, and establish the association between the whitelist and the target object; or,

[0011] Post-attack protection module: When the protection scenario is a post-attack protection scenario, it is used to obtain the current calling interface of the target object, predict the next calling interface of the target object, generate a blacklist for the next calling interface, and establish the association between the blacklist and the target object.

[0012] According to a third aspect of this application, an electronic device is provided, the electronic device including at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores at least one instruction or at least one program, the at least one instruction or at least one program being loaded and executed by the at least one processor to implement the security protection method as described in the first aspect.

[0013] According to a fourth aspect of this application, a computer-readable storage medium is provided, wherein at least one instruction or at least one program is stored therein, the at least one instruction or at least one program being loaded and executed by a processor to implement the security protection method as described in the first aspect.

[0014] According to a fifth aspect of this application, a computer program product is provided, the computer program product comprising at least one instruction or at least one program segment, the at least one instruction or at least one program segment being loaded and executed by a processor to implement the security protection method as described in the first aspect.

[0015] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this application.

[0016] Implementing this application will have the following beneficial effects:

[0017] This application provides a solution for both pre-attack and post-attack protection against attacks. Pre-attack protection focuses on historical API call information to generate a whitelist indicating API calls, thereby establishing an association between the target object and the whitelist. Post-attack protection predicts the next API call to generate a corresponding blacklist, thereby establishing an association between the target object and the blacklist. This application improves the effectiveness of protection against attacks caused by key leakage and also enhances the adaptability of security protection.

[0018] Other features and aspects of this application will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0019] To more clearly illustrate the technical solutions and advantages in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This diagram illustrates an application environment according to an embodiment of the present application.

[0021] Figure 2 A flowchart illustrating a security protection method according to an embodiment of this application is shown;

[0022] Figure 3 A flowchart illustrating the process of updating the protection strategy based on a first type of recent operation information according to an embodiment of this application is shown.

[0023] Figure 4 A flowchart illustrating the process of updating the protection strategy based on a first type of recent operation information according to an embodiment of this application is shown.

[0024] Figure 5 This diagram illustrates a system architecture of a security protection system according to an embodiment of this application.

[0025] Figure 6 A flowchart illustrating a security protection method according to an embodiment of this application is also shown;

[0026] Figure 7 A schematic diagram illustrating the process of permission hardening according to an embodiment of this application is shown;

[0027] Figure 8 A schematic diagram illustrating the attack mitigation process according to an embodiment of this application is shown.

[0028] Figure 9 A flowchart illustrating an adaptive adjustment of a protection strategy according to an embodiment of this application is shown;

[0029] Figure 10 This diagram illustrates a device block diagram according to an embodiment of the present application;

[0030] Figure 11 A schematic diagram of an electronic device according to an embodiment of this application is shown. Detailed Implementation

[0031] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0032] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0033] Various exemplary embodiments, features, and aspects of this application will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.

[0034] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0035] In this document, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0036] Furthermore, to better illustrate this application, numerous specific details are provided in the following detailed description. Those skilled in the art should understand that this application can be implemented without certain specific details. In some instances, methods, means, components, and circuits well-known to those skilled in the art have not been described in detail in order to highlight the main points of this application.

[0037] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0038] Cloud APIs are collections of interfaces provided by cloud service providers, offering advantages such as ease of automation, ease of remote invocation, strong compatibility, and low system requirements. Through cloud APIs, cloud products can be quickly operated with minimal code, improving efficiency for frequently accessed functions.

[0039] AKSK: Persistent API access key on the public cloud, including Access Key ID / Secret Access Key.

[0040] Cloud Access Management (CAM): A user and permission management system used to help customers securely and granularly manage access to related cloud products and resources.

[0041] Cloud auditing is a service that supports the supervision, compliance checks, operational audits, and risk assessments of cloud accounts. With cloud auditing, logs can be recorded, and account activity related to operations across the entire cloud infrastructure can be continuously monitored and retained.

[0042] Adaptive: Generally, it refers to a system adjusting itself according to changes in the environment so that its behavior achieves the best or at least permissible characteristics and functions in a new or changed environment. Such a system with the ability to adapt to environmental changes is called an adaptive system.

[0043] Policy: A policy is a syntax specification used to define and describe one or more permissions. By binding a policy to an account (cloud account), you can restrict the boundaries of permissions that the key under that account can operate on through the API.

[0044] Please see Figure 1 , Figure 1The diagram illustrates an application environment according to an embodiment of this application. The application environment may include a client 10 and a server 20. The client 10 and server 20 can be directly or indirectly connected via wired or wireless communication. Related objects (such as users or simulators) send security protection instructions for the target object to the server 20 through the client 10. In response to the security protection instructions for the target object, the server 20 determines the corresponding protection scenario. When the protection scenario is a pre-emptive protection against attacks, the server 20 obtains the target object's historical interface call information, generates a whitelist indicating interface calls based on the historical interface call information, and establishes an association between the whitelist and the target object. Alternatively, when the protection scenario is a post-attack protection against attacks, the server 20 obtains the target object's current calling interface, predicts the target object's next calling interface, generates a blacklist for the next calling interface, and establishes an association between the blacklist and the target object. It should be noted that... Figure 1 This is just one example.

[0045] Client 10 can be a physical device such as a smartphone, computer (e.g., desktop computer, tablet, laptop), augmented reality (AR) / virtual reality (VR) device, digital assistant, smart voice interaction device (e.g., smart speaker), smart wearable device, smart home appliance, in-vehicle terminal, etc., or software running on the physical device, such as a computer program. The operating system corresponding to Client 10 can be Android, iOS (a mobile operating system developed by Apple), Linux, Microsoft Windows, etc.

[0046] Server 20 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The server may include network communication units, processors, and memory, etc. Server 20 can provide backend services to corresponding clients. As in the security protection scheme provided in this application, multiple servers can form a blockchain, and the servers are nodes on the blockchain.

[0047] In practical applications, the aforementioned pre-emptive and post-emptive protection steps can be executed independently by the client 10. For example, relevant objects (such as users or simulators) trigger the generation of security protection instructions for the target object through the interactive interface provided by the client 10. In response to the security protection instructions for the target object, the client 10 determines the corresponding protection scenario. When the protection scenario is a pre-emptive protection scenario against attacks, the client 10 obtains the target object's historical interface call information, generates a whitelist of interface calls based on the historical interface call information, and establishes the association between the whitelist and the target object; or, when the protection scenario is a post-emptive protection scenario against attacks, the client 10 obtains the target object's current interface call, predicts the target object's next interface call, generates a blacklist for the next interface call, and establishes the association between the blacklist and the target object.

[0048] Taking internet products as an example, the relevant business functions of internet products can be implemented by staff using matching accounts (accounts; corresponding to the aforementioned target objects) and keys to call interfaces. The interface called can be a cloud API, and the key can be an AKSK. Support for calling cloud APIs can be provided by relevant public cloud products. The aforementioned client 10 and server 20 can instruct the relevant public cloud product. Internet products can be browser products, instant messaging products, navigation products, live streaming products, e-commerce products, etc.

[0049] It should be noted that for operational information and other data related to user information, when the embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. Specifically, when the security protection methods provided in this application use cloud audit logs, account purchase services, etc., user permission or consent is required, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0050] Figure 2 This diagram illustrates a flow chart of a security protection method according to an embodiment of this application. Figure 2 As shown, the method includes:

[0051] S201: In response to a security protection instruction for a target object, determine the corresponding protection scenario; the target object implements business functions by calling an interface based on a key, and the security protection instruction indicates protection against attacks caused by the leakage of the key;

[0052] In this embodiment, the target object can be an account or account. Staff can use the matching target object and key (such as AKSK) to call an interface (such as a cloud API) to implement relevant business functions. The security protection instructions for the target object indicate protection against attacks caused by key leakage. The security protection instructions can be generated periodically or based on triggers from related objects (such as users or simulators).

[0053] Protection scenarios can be determined based on security protection instructions, such as the parameters carried by the instructions. For example, if security protection instructions are generated periodically, and no attack occurs between the previous and subsequent generation times, the instruction generated at the later generation time carries a first parameter indicating pre-emptive protection. This first parameter can then be used to determine the scenario for pre-emptive protection against attacks. If security protection instructions are generated periodically, and an attack occurs between the previous and subsequent generation times, the instruction generated at the later generation time carries a second parameter indicating post-attack protection. This second parameter can then be used to determine the scenario for pre-emptive protection against attacks. If security protection instructions are generated based on triggers from relevant objects, these objects can carry parameters indicating pre-emptive or post-attack protection as needed. These parameters can then be used to determine the scenario for either pre-emptive or post-attack protection against attacks. Of course, security protection instructions carrying parameters indicating post-attack protection can be automatically generated based on detected attacks.

[0054] In practical applications, see Figure 5 The security protection solution provided in this application can be applied to security protection systems. The system architecture is divided into three layers according to a general layered architecture: a data access layer for accessing and storing relevant data, a business logic layer involving critical logical calculations, and a user interface layer for external display and providing interactive interfaces. The user interface layer mainly involves API call interfaces (such as API call interfaces), operation modules, and policy change records. The business logic layer mainly involves permission hardening modules, attack mitigation modules, dynamic monitoring modules, and policy calculation modules. The data access layer mainly involves interface call logs (such as API call logs), cloud audit logs, operation logs, a defense knowledge base (such as a cloud API defense knowledge base), and a policy base.

[0055] The user presentation layer is used for user interaction (corresponding to the operation module) and provides standard API interfaces to tenants to meet their automation needs (corresponding to the API call interface). Additionally, considering the need for troubleshooting in case of business anomalies, the user presentation layer also provides a system policy change log for debugging purposes. The business logic layer is mainly responsible for data statistics and policy decisions. Its permission hardening module is used for proactive prevention; the attack mitigation module is used for post-attack defense (or defense during attacks); the dynamic monitoring module is used to monitor interface call logs and the cloud audit module in real time after binding protection policies; and the policy calculation module is used to calculate protection policies based on input information from related modules, which may include the dynamic monitoring module and the operation module. The interface call logs (such as API call logs) in the data access layer are used for storing and retrieving relevant interface call information. The interface call logs can correspond to the call interfaces in the user presentation layer. The cloud audit logs are used to record account activities. The operation logs are used to record user-initiated operations (which can correspond to the operation modules in the user presentation layer) and system-initiated operations when policies are changed. The defense knowledge base (such as the cloud API defense knowledge base) is used to store multiple sets of interface call paths. The policy base is used to store the protection policies calculated now, and can also be used to store protection policies calculated in the past.

[0056] like Figure 6 As shown, triggered by user interface operations and API calls, the operation module determines whether to perform subsequent permission hardening, attack mitigation, or clear all hardening and mitigation strategies based on different input parameters (this allows for quick restoration of normal account use if policy settings become abnormal). In other words, if permission hardening is determined to proceed, the user interface operation and API call can be viewed as a security protection instruction carrying parameters indicating pre-emptive protection; if attack mitigation is determined to proceed, the user interface operation and API call can be viewed as a security protection instruction carrying parameters indicating post-attack protection.

[0057] S202: When the protection scenario is a scenario of pre-emptive protection against the attack, obtain the historical interface call information of the target object, generate a whitelist of interface calls based on the historical interface call information, and establish the association between the whitelist and the target object;

[0058] In this application embodiment, the key may or may not be leaked. Key leakage may or may not lead to an attack. The attack referred to here is an attack caused by key leakage. Since the indicated attack has not occurred or has not yet occurred, a scenario for pre-emptive protection against attacks can be defined by utilizing a relevant time period (such as a time period before the current time, which may include the current time) during which no attacks caused by key leakage have occurred. In the scenario of pre-emptive protection against attacks, a whitelist of interface calls indicating the interface calls is generated using historical interface call information, and then an association relationship is established between the target object and the whitelist (such as binding the whitelist to the target object). It can be understood that since no attacks caused by key leakage have occurred during the relevant time period, the interface calls generated during the relevant time period can ensure the normal implementation of the relevant business functions. Therefore, using historical interface call information indicating the relevant time period to generate a whitelist of interface calls can also serve as an effective protection strategy.

[0059] For example, the starting time of the target object calling the interface to implement business functions based on the key is taken as the first time. If no attack caused by key leakage occurs between the first time and the current time, a first time period can be obtained based on the first time and the current time, and then historical interface call information can be obtained based on the first time period. If the first time period (e.g., 3 months) is greater than the time period threshold (e.g., 1 month), a second time period that meets the time period threshold and includes the current time can be cut out from the first time period, and then historical interface call information can be obtained based on the second time period.

[0060] Interface call information can include the following parameters: the called interface and the called communication address (IP address). For example, when accessing a target object using IP1 to call API1, API1 is the called interface, and IP1 is the called communication address. Of course, interface call information can also include the called proxy object (agent). Protection strategies can include blacklists / whitelists with different parameter dimensions. Taking the called interface as an example, for a blacklist indicating the called interface, the target object cannot call interfaces on the blacklist; for a whitelist indicating the called interface, the target object can call interfaces on the whitelist, but cannot call interfaces outside the whitelist. The same applies to the called communication address and the called proxy object.

[0061] To ensure the adaptability of the generated whitelist of interface call indicators, this application introduces the indicator of data stability to evaluate historical interface call information and determine whether to generate a whitelist. It is understandable that if a target object calls an interface based on a key to implement business function 1 in the previous time period, and then calls the same interface based on a key to implement business function 2 in the next time period, the called interfaces for business function 1 and business function 2 may differ. Therefore, if a whitelist of interface call indicators is generated based on the interface call information from the previous time period, this whitelist may not be applicable in the next time period, wasting the computational resources used to generate it. The same applies to the called communication address and the called proxy object.

[0062] Therefore, obtaining the historical interface call information of the target object may include the following steps: obtaining the historical interface call information of the target object within each of multiple preset periods to obtain a set of historical interface call information. Correspondingly, after obtaining the historical interface call information of the target object, the following steps may be included: first, determining the data stability corresponding to the set of historical interface call information; then, if the data stability is greater than a stability threshold, triggering the generation of a whitelist indicating interface calls based on the historical interface call information.

[0063] Taking a relevant time period of 30 days and a preset cycle of 1 day as an example, the number of preset cycles is 30. If the current time is May 31st, the relevant time period can be from May 1st to May 30th, and the multiple preset cycles correspond to one day from May 1st to May 30th. The historical interface call information xi (i = 1-30) corresponding to each day from May 1st to May 30th is obtained, resulting in a historical interface call information set X = {x1, x2, ..., x30}. The data stability of the historical interface call information set is used to characterize the information relevance of each historical interface call information in the set, that is, to measure the degree of information fluctuation of these historical interface call information. The more relevant the information in the set (e.g., similar, identical), the more stable the data; conversely, the less relevant the information, the more volatile the data. When the data stability is greater than the stability threshold, it indicates that the data stability of the historical interface call information set meets the preset requirements, the interface calls involved in the relevant time period are relatively regular, and the current scenario is a regular interface call scenario. Therefore, the API calls involved in the relevant time period can serve as a reference for subsequent calls. Based on this, triggering the step of generating a whitelist of instruction API calls based on historical API call information can ensure the effectiveness of the whitelist application.

[0064] Furthermore, determining the data stability corresponding to the historical interface call information set may include the following steps: 1) extracting any two historical interface call information from the historical interface call information set to obtain a historical interface call information group; 2) determining the intra-group information correlation of the historical interface call information group; 3) repeating the above steps until the intra-group information correlation of all historical interface call information groups in the historical interface call information set is obtained; 4) obtaining the data stability based on the intra-group information correlation of each group.

[0065] Taking the historical API call information set X = {x1, x2, ..., x30} as an example, the historical API call information group G = (xj, xy), where j = 1-30, y = 1-30 and j ≠ y. The intra-group information relevance is the information relevance between xj and xy, which can be determined by whether they are the same or similar. The total number of all historical API call information groups involved in the historical API call information set is 435 = [30 * (30-1)] / 2. Data stationarity comes from the intra-group information relevance of these 435 historical API call information groups. For example, the intra-group information relevance can be determined based on whether xj and xy are the same; if they are the same, the intra-group information relevance is 1; if they are different, the intra-group information relevance is 0. The data relevance is the mean of the intra-group information relevance of these 435 historical API call information groups (either 0 or 1). Of course, the data relevance can also be the variance of the intra-group information relevance of these 435 historical API call information groups (either 0 or 1). The method for calculating the data stability corresponding to the historical API call information set provided in this application uses the historical API call information set as the data source to construct multiple historical API call information groups. The correlation of information within each group, calculated separately, is then integrated to obtain the data stability. Each piece of historical API call information participates in the relevant calculation steps for obtaining the data stability, ensuring the accuracy and validity of the obtained data stability. The introduction of intra-group information correlation reduces the difficulty of calculating data stability and improves the calculation efficiency.

[0066] In practical applications, considering that API call information includes parameters with different dimensions, when determining the relevance of information within a group, we can first determine the relevance of sub-information within the group for each parameter of the same dimension, and then integrate the relevance of each sub-information to obtain the overall relevance of information within the group. Alternatively, we can split historical API call information into different parameter dimensions to obtain a set of historical API call information indicating different parameter dimensions. Based on this, the obtained data stationarity also indicates the relevant parameter dimensions.

[0067] In conjunction with step S201 above, the permission hardening module is used for proactive defense and is suitable for scenarios where an account (corresponding to the target object) has generated interface call logs for at least one week, and the AKSK calls follow a specific pattern. By statistically learning from the interface call logs within a fixed period, the calling IP and API corresponding to this AKSK are calculated, and this information is input into the policy calculation module to automatically generate a protection policy and bind it to the corresponding account. (See reference...) Figure 7 .

[0068] like Figure 7 As shown, the prerequisite for using the permission hardening module is that the API call records in the cloud audit logs must exhibit certain regularity and periodicity. If this condition is not met, the permission hardening module cannot be used for hardening. Generally, because AKSK is used in programs and code, it has a certain regularity and periodicity. However, in some cases, because AKSK is used by multiple product teams on the user side, some may encapsulate all the functions of the cloud API as operation and maintenance functions for user operation. This makes the calling IP and calling API in the API call records not a fixed range. In this case, if the permission hardening function is used, it is highly likely to affect the normal operation of the calling party's business system.

[0069] The following example illustrates how to determine data stability. Taking a statistical period of 30 days and a minimum period of 1 day as an example, the daily call operation set Ai is collected, and these daily call operation sets Ai together constitute set B. Each pair of Ai in set B is compared; if they are the same, it's 1; if they are different, it's 0, resulting in array D. The mean of D is calculated. If the mean is greater than 0.8, the data in set B is considered stable, and the permission hardening module can be used. After confirming the data stability, duplicates are removed and the union is calculated to obtain the IP set and API set. Then, the policy calculation module automatically derives the corresponding protection policy.

[0070] Protection strategies have corresponding fixed syntax. If the statistical analysis yields a fixed set of accessing IPs and APIs...

[0071] Here, 32 represents the network mask. For the access control module, the protection policy obtained by the triggered policy calculation module is a whitelist of API calls, which prevents access to the account from being made by calling IPs outside the whitelist. Matching accounts and AKSKs cannot call APIs outside the whitelist. In addition, the whitelist also applies to sub-accounts of the account.

[0072] S203: When the protection scenario is a post-attack protection scenario, obtain the current calling interface of the target object, predict the next calling interface of the target object, generate a blacklist for the next calling interface, and establish the association between the blacklist and the target object.

[0073] In this embodiment, referring to the description of whether the password was leaked and whether the password leak led to an attack in step S202, the attack mentioned here is an attack caused by key leakage, indicating that the indicated attack has occurred. Examples include using an IP address outside the protection policy to access the target object for API calls, or modifying the original protection policy causing related business functions to malfunction. In the scenario of post-attack protection, the next calling interface is predicted based on the current calling interface, a blacklist for the next calling interface is generated, and then an association is established between the target object and the blacklist (e.g., binding the target object to the blacklist). It can be understood that since an attack caused by key leakage occurred within a relevant time period, predicting the next calling interface based on the current calling interface and generating a blacklist for the next calling interface allows for timely and effective defense after the attack occurs. It should be noted that under normal circumstances, the predicted next calling interface can be called. If the protection policy includes a whitelist indicating interface calls, and the next calling interface belongs to that whitelist, then the next calling interface needs to be removed from the whitelist. It should be noted that the current API call here refers to the API most recently called by the matching account and AKSK after the attack occurred.

[0074] See Figure 8 In addition to establishing a blacklist and association between the target object and the next API call, security protection can also be implemented in the following ways for post-attack defense scenarios:

[0075] 1) When the protection scenario is a scenario of post-attack protection against the attack, determine the communication addresses involved in accessing the target object, generate a communication address blacklist for the involved communication addresses, and establish the association between the communication address blacklist and the target object;

[0076] 2) When the protection scenario is a post-attack protection scenario, obtain the historical call interfaces of the target object, generate an interface blacklist for the historical call interfaces, and establish the association between the interface blacklist and the target object.

[0077] For option 1), it can be understood as directly blocking access from the relevant communication addresses, meaning that the target object cannot be accessed to call the API by calling IPs from the blacklist. This method is suitable when the IPs called by the attacker are relatively clear. For option 2), it can be understood as directly blocking calls to the relevant interfaces, meaning that the matching account and AKSK cannot call APIs from the blacklist. This method is suitable when the IPs called by the attacker involve IP proxy pools or specific NAT exits. In this case, if option 1) is used, the protection response may be delayed. It should be noted that the communication addresses involved in accessing the target object in option 1) are mainly the IPs of the accounts that were called to access the target object after the attack occurred. If the protection policy includes a whitelist of communication addresses that indicate interface calls, then the communication addresses involved in accessing the target object are not on the whitelist. The historical interface calls in option 2) are mainly the APIs called by the matching accounts and AKSK after the attack occurred.

[0078] Compared to the aforementioned method of establishing a blacklist and association between the target object and the next API call, methods 1) and 2) provide more convenient and timely post-incident defense methods tailored to specific situations. Together, these three methods ensure that this application can mitigate losses promptly through adjustments to its protection strategy and minimize impact on business availability. If it is determined that the key has been obtained and maliciously used by the attacker, this application counteracts the attack by restricting the callable range of IPs and APIs based on API call information (such as the currently called API, the communication addresses involved in accessing the target object, and historical API calls), preventing the attack's impact from expanding and simultaneously buying time for disabling and replacing the key.

[0079] In practical applications, in conjunction with step S201 above, the attack mitigation module is used for post-incident defense, which primarily utilizes a blacklist. For example... Figure 8 As shown, the attack mitigation module provides three post-attack defense methods: 1) When the attacking IP is a fixed IP, execute the IP blacklist blocking policy (corresponding to 1 above); 2) If a complete block is required and business operations are to be affected, execute the sensitive operation blacklist (corresponding to 2 above); 3) Dynamic defense (corresponding to the above-mentioned establishment of a blacklist and target object association for the next calling interface), which will have less impact on business operations than the above-mentioned application of the sensitive operation blacklist.

[0080] Dynamic defense relies on a cloud API defense knowledge base, which contains built-in expert rules. For cloud API operations already performed by an attacker, the knowledge base can determine the corresponding blocking actions. For example, if the input indicates that the attacker has executed "view access management policy information cam:ListPolices", predicting that the attacker might modify the corresponding policy next, the knowledge base can be searched for cam:ListPolices to determine the operation that needs to be blocked: "unbind policies bound to users and user groups cam:DetachUserPolicy, DetachGroupPolicy". Accordingly, a blacklist is generated for "DetachUserPolicy, DetachGroupPolicy".

[0081] "effect":"deny",

[0082] "action":["cam:DetachUserPolicy","DetachGroupPolicy"],

[0083] Therefore, attackers cannot remove existing restrictions by performing CAM-related operations. Even if they can view many things, they cannot perform write operations. The advantage of dynamic defense is that it precisely targets the attacker's current operations to stop the damage, minimizing the impact on normal business availability.

[0084] Whether it's pre-emptive or post-incident protection, changes in account operations and fluctuations in actual usage may render previously set protection strategies ineffective. In such cases, adaptive adjustments and corrections to the protection strategies are necessary. The updates to protection strategies will differ depending on the monitoring data, which will be detailed below:

[0085] (i) Monitoring data is related to the target object:

[0086] The target object is associated with a protection policy that indicates interface calls. The method further includes the following steps: in response to the detection of a first type of recent operation information related to the target object, if the protection policy does not contain content indicating the first type of recent operation information, the protection policy is updated based on the first type of recent operation information; wherein, the first type of recent operation information includes at least one of the following: recent interface call information of the target object, and business function addition information for the target object.

[0087] Monitor recent operational information related to the target object and update the current protection strategy if it does not cover such information. This adaptive update is more efficient and convenient than relying on manual adjustments by staff. It also minimizes the impact on normal business operations.

[0088] The first category of recent operation information can include recent interface call information of the target object and information on business function additions for the target object. Recent interface call information indicates a time interval, where the longest time interval is earlier than or equal to the current time, and the duration of this time interval can be a preset fixed duration. Recent interface call information can include the following parameters: the called interface, the called communication address (IP address), and the called agent object. Since the target object calls interfaces based on keys to implement business functions, the business function addition information indicates the newly added business function. For example, if the original business functions to be implemented were business functions 1-4, the business function addition information indicates the addition of business function 5. Different business functions may involve different called interfaces; accordingly, the original protection strategy may need to adjust the relevant interfaces for the implementation of the newly added business functions.

[0089] Regarding whether a protection policy includes information indicating the first type of recent operation, it can be understood that the conclusion that a certain interface should belong to the whitelist or blacklist is derived from the first type of recent operation information. Taking interface 1 as an example, if the current protection policy's interface whitelist includes interface 1, then the protection policy is determined to contain information indicating the first type of recent operation; if the current protection policy's interface blacklist includes interface 1, then the protection policy is determined not to contain information indicating the first type of recent operation. Subsequently, when generating an interface whitelist entry for interface 1, it is also necessary to delete the interface blacklist entry for interface 1 from the interface blacklist. The same applies to the called communication address and the called proxy object.

[0090] A) such as Figure 3 As shown, when the first type of recent operation information includes the recent interface call information, updating the protection policy based on the first type of recent operation information when the protection policy does not contain content indicating the first type of recent operation information includes:

[0091] S301: Extract the called interface from the recent interface call information;

[0092] S302: When the protection strategy does not contain content indicating the called interface, the called interface is determined to be a candidate interface;

[0093] S303: When the number of failed calls to the candidate interface exceeds the threshold and the candidate interface belongs to a preset interface set, a first interface whitelist entry indicating the interface call is generated based on the candidate interface to update the protection strategy.

[0094] For example, the called interfaces extracted from recent interface call information include APIs 20-30. Generally, APIs 20-30 should belong to the interface whitelist of the protection policy by default. If the interface whitelist of the protection policy does not include APIs 20-25, then APIs 20-25 are candidate interfaces; if the interface whitelist of the protection policy includes APIs 26-30, then APIs 26-30 are not candidate interfaces. It is determined whether there are any interfaces among APIs 20-25 whose number of failed calls exceeds a threshold and belongs to a preset interface set. If API 22's number of failed calls exceeds the threshold and it belongs to the preset interface set, then a first interface whitelist entry for API 22 is generated to update the protection policy. The preset interface set indicates the interfaces involved in non-sensitive read / write operations. Alternatively, it can be determined whether a candidate interface belongs to the preset interface set by checking if it is not in the interface blacklist of the protection policy. Of course, before assuming that APIs 20-30 should be included in the whitelist of the protection policy, it is also possible to first determine whether APIs 20-30 are interfaces involved in non-sensitive read and write operations. If they are not, then it can be concluded that APIs 20-30 should be included in the whitelist.

[0095] For interfaces whose failed calls exceed a certain threshold and belong to a preset set of interfaces, there is an urgent need to call them to implement related business functions. These interfaces are not involved in sensitive operations, so including them in the interface whitelist can ensure the normal implementation of related business functions. In practical applications, combined with step S201 above, multiple failed requests for fixed operations can be detected from the recent interface call logs. If this operation is a non-sensitive read / write operation, it can be added to the permission hardening whitelist.

[0096] B) such as Figure 4 As shown, when the first type of recent operation information includes the recent interface call information, updating the protection policy based on the first type of recent operation information when the protection policy does not contain content indicating the first type of recent operation information includes:

[0097] S401: Extract the called communication address from the recent interface call information;

[0098] S402: When the protection policy does not contain content indicating the called communication address, the called communication address is determined as a candidate communication address;

[0099] S403: When the candidate communication address is the same as the first type of sample communication address or matches the geographical location of the second type of sample communication address, a whitelist entry for the communication address indicating the interface call is generated based on the candidate communication address to update the protection policy.

[0100] For example, the called communication addresses extracted from recent interface call information include IPs 50-60. Generally, IPs 50-60 should be included in the communication address whitelist of the protection policy by default. If the communication address whitelist of the protection policy does not include IPs 50-53, then IPs 50-53 are candidate communication addresses; if the communication address whitelist of the protection policy includes IPs 54-60, then IPs 54-60 are not candidate communication addresses. It is then determined whether there is a communication address in IPs 50-53 that is the same as the first type of sample communication address or matches the geographical location of the second type of sample communication address. If IP 22 is the same as the first type of sample communication address or matches the geographical location of the second type of sample communication address, then a communication address whitelist entry for IP 22 is generated to update the protection policy. It should be noted that if the current protection policy's communication address blacklist includes IP 22, the communication address blacklist entries for IPs 50-53 also need to be removed from the communication address blacklist.

[0101] The first type of sample communication address indicates the communication address involved in accessing the managed object. The managed object indicates the entry point for implementing interface calls based on the target object. The managed object can be the console, which is the entry point for users to manage and use cloud products through the web interface. Users can purchase, view, use, and operate related cloud products and services through the console. The first type of sample communication address can be an IP address involved in logging into the console within a recent period. The second type of sample communication address indicates the current communication address whitelist in the protection policy. If the candidate communication address is an IP address involved in logging into the console within a recent period, or if the geographical location of the candidate communication address matches the geographical location of IP addresses in the current communication address whitelist (e.g., the same, overlapping, or the latter containing the former), it indicates that the candidate communication address can be included in the communication address whitelist. This is because the relationship between the first and second type of sample communication addresses and the candidate communication address provides evidentiary support. The former can prove that the candidate communication address does not need to be excluded from the valid range through successful login to the console, and the latter can prove that the candidate communication address does not need to be excluded from the valid range through its geographical relationship with communication addresses already in the valid range. This improves the accuracy and flexibility of updating the communication address whitelist. For scenarios where IP addresses are added due to normal usage, this can prevent related communication addresses from being mistakenly blocked, thus affecting the normal implementation of newly added business functions.

[0102] C) When the first type of recent operation information includes the business function addition information, updating the protection policy based on the first type of recent operation information when the protection policy does not contain content indicating the first type of recent operation information may include the following steps: First, determine the corresponding newly added business function based on the business function addition information; then, determine the functional interface involved in the newly added business function; furthermore, when the protection policy does not contain content indicating the functional interface, generate a second interface whitelist entry indicating interface calls based on the functional interface to update the protection policy.

[0103] For example, based on the business function addition information, the corresponding newly added business function 5 (such as a business function related to serverless cloud functions) is determined, and the functional interfaces involved in business function 5 are determined to include APIs 80-90. Generally, APIs 80-90 should be included in the interface whitelist of the protection policy by default. If the interface whitelist of the protection policy does not include APIs 80 and 85, then APIs 80 and 85 are the target functional interfaces, and a second interface whitelist entry for APIs 80 and 85 is generated to update the protection policy; if the interface whitelist of the protection policy includes APIs 81-84 and APIs 86-90, then APIs 81-84 and APIs 86-90 are not the target functional interfaces. It should be noted that if the current interface blacklist of the protection policy includes APIs 80 and 85, the communication address blacklist entries for APIs 80 and 85 also need to be removed from the interface blacklist. For newly added business functions, updating the protection policy in the above manner can prevent related functional interfaces from being mistakenly blocked, thus affecting the normal implementation of the newly added business functions.

[0104] (ii) Monitoring data is related to the managed objects:

[0105] The target object is associated with a protection policy that indicates interface calls. The method further includes the following steps: in response to the detected second type of recent operation information involving the access management object, if the protection policy does not contain content indicating the second type of recent operation information, the protection policy is updated based on the second type of recent operation information; the management object indicates the entry point for implementing interface calls based on the target object.

[0106] Monitor recent operations related to managed objects and update the current protection policy if it does not cover such operations. For managed objects, refer to section B) above; further details are omitted. Compared to the first type of recent operation information related to target objects, the second type of recent operation information related to managed objects is more comprehensive, and the IPs and APIs involved are more likely to be included in the whitelist of the protection policy. Including them in the whitelist beforehand better ensures the smooth operation of normal business. Regarding whether the protection policy includes instructions for the second type of recent operation information, refer to section A) above; further details are omitted.

[0107] In practical applications, in conjunction with step S201 above, the operations (specific APIs) performed on the console within a recent period are obtained through cloud audit logs. The adaptive adjustment of protection strategies mentioned in (a) above and (b) here can be achieved by monitoring cloud audit logs in real time through a dynamic monitoring module, as described in reference [reference needed]. Figure 9 .

[0108] As more and more businesses migrate to the public cloud, using AKSK to call cloud APIs to access public cloud services and operate resources has become a crucial way for cloud tenants to interact with cloud services. AKSK has become a critical authentication credential for callers. If AKSK is compromised, attackers can use it to call cloud APIs within seconds, causing significant damage to the confidentiality, integrity, and availability of the victim's cloud-based businesses. The security solution provided in this application, based on cloud tenant logs, ensures adaptability and efficiency through proactive permission hardening, post-attack damage mitigation, and adaptive adjustment strategies.

[0109] As can be seen from the technical solutions provided in the embodiments of this application above, these embodiments offer solutions for both pre-attack and post-attack protection against attacks. Pre-attack protection focuses on historical interface call information to generate a whitelist indicating interface calls, thereby establishing an association between the target object and the whitelist. Post-attack protection predicts the next interface call to generate a corresponding blacklist, thereby establishing an association between the target object and the blacklist. This application improves the effectiveness of protection against attacks caused by key leakage and also enhances the adaptability of security protection.

[0110] This application also provides a safety protection device, such as... Figure 10 As shown, the safety protection device 100 includes:

[0111] Protection scenario determination module 1001: used to determine the corresponding protection scenario in response to a security protection instruction for a target object; the target object implements business functions by calling an interface based on a key, and the security protection instruction indicates protection against attacks caused by the leakage of the key;

[0112] Pre-emptive protection module 1002: When the protection scenario is a scenario for pre-emptive protection against the attack, it is used to obtain the historical interface call information of the target object, generate a whitelist of interface calls based on the historical interface call information, and establish an association between the whitelist and the target object; or,

[0113] Post-attack protection module 1003: When the protection scenario is a scenario of post-attack protection against the attack, it is used to obtain the current calling interface of the target object, predict the next calling interface of the target object, generate a blacklist for the next calling interface, and establish the association between the blacklist and the target object.

[0114] It should be noted that the apparatus and method embodiments described in the device embodiments are based on the same inventive concept.

[0115] In some embodiments, the functions or modules of the apparatus provided in this application can be used to perform the methods described in the above method embodiments. The specific implementation can be referred to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0116] This application also provides a computer-readable storage medium storing at least one instruction or at least one program segment, which is loaded and executed by a processor to implement the above-described method. The computer-readable storage medium may be a non-volatile computer-readable storage medium.

[0117] This application also provides an electronic device, which includes at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by the at least one processor to implement the above method.

[0118] Electronic devices can be provided as terminals, servers, or other forms of devices.

[0119] Figure 11 A block diagram of an electronic device according to an embodiment of this application is shown. For example, electronic device 1900 may be provided as a server. (Refer to...) Figure 11 The electronic device 1900 includes a processing component 1922, which further includes one or more processors, and memory resources represented by memory 1932 for storing instructions, such as application programs, that can be executed by the processing component 1922. The application programs stored in memory 1932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 1922 is configured to execute instructions to perform the methods described above.

[0120] Electronic device 1900 may also include a power supply component 1926 configured to perform power management of electronic device 1900, a wired or wireless network interface 1950 configured to connect electronic device 1900 to a network, and an input / output (I / O) interface 1958. Electronic device 1900 can operate on an operating system stored in memory 1932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or similar.

[0121] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by a processing component 1922 of an electronic device 1900 to perform the above-described method.

[0122] This application may be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this application.

[0123] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0124] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0125] The computer program instructions used to perform the operations of this application may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C+, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuits, such as programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), are personalized by utilizing the status information of the computer-readable program instructions. These electronic circuits can execute the computer-readable program instructions to implement various aspects of this application.

[0126] Various aspects of this application are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0127] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0128] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0129] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction, which includes one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions specified in the blocks may occur in a different order than those specified in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0130] The various embodiments of this application have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical applications, or technological improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A security protection method, characterized in that, The method includes: In response to a security protection instruction for a target object, a corresponding protection scenario is determined; the target object implements business functions by calling an interface based on a key, and the security protection instruction indicates protection against attacks caused by the leakage of the key; When the protection scenario is a scenario of preemptive protection against the attack, the historical interface call information of the target object is obtained, a whitelist of interface calls is generated based on the historical interface call information, and an association relationship is established between the whitelist and the target object; or, When the protection scenario is a post-attack protection scenario, the current calling interface of the target object is obtained, the next calling interface of the target object is predicted, a blacklist for the next calling interface is generated, and the association between the blacklist and the target object is established.

2. The method according to claim 1, characterized in that, The target object is associated with a protection policy indicating interface calls, and the method further includes: In response to the detection of a first type of recent operation information related to the target object, if the protection policy does not contain content indicating the first type of recent operation information, the protection policy is updated based on the first type of recent operation information. The first type of recent operation information includes at least one of the following: recent interface call information of the target object, and information on the addition of business functions for the target object.

3. The method according to claim 2, characterized in that, When the first type of recent operation information includes the recent interface call information, updating the protection policy based on the first type of recent operation information when the protection policy does not contain content indicating the first type of recent operation information includes: Extract the called interfaces from the recent interface call information; When the protection strategy does not contain any content indicating the called interface, the called interface is determined to be a candidate interface; When the number of failed calls to the candidate interface exceeds a threshold and the candidate interface belongs to a preset interface set, a first interface whitelist entry indicating the interface call is generated based on the candidate interface to update the protection strategy.

4. The method according to claim 2, characterized in that, When the first type of recent operation information includes the recent interface call information, updating the protection policy based on the first type of recent operation information when the protection policy does not contain content indicating the first type of recent operation information includes: Extract the called communication address from the recent interface call information; When the protection policy does not contain any content indicating the invoked communication address, the invoked communication address is determined as a candidate communication address; When the candidate communication address is the same as the first type of sample communication address or matches the geographical location of the second type of sample communication address, a whitelist entry for the communication address indicating the interface call is generated based on the candidate communication address to update the protection policy; the first type of sample communication address indicates the communication address involved in the access management object, and the management object indicates the entry point for implementing the interface call based on the target object; the second type of sample communication address indicates the current communication address whitelist in the protection policy.

5. The method according to claim 2, characterized in that, When the first type of recent operation information includes the business function addition information, updating the protection policy based on the first type of recent operation information when the protection policy does not contain content indicating the first type of recent operation information includes: Based on the information added to the aforementioned business functions, the corresponding new business functions are determined. Determine the functional interfaces involved in the newly added business functions; When the protection policy does not contain content indicating the functional interface, a second interface whitelist entry indicating the interface call is generated based on the functional interface to update the protection policy.

6. The method according to claim 2, characterized in that, The target object is associated with a protection policy indicating interface calls, and the method further includes: In response to the detected second type of recent operation information involving the access management object, if the protection policy does not contain content indicating the second type of recent operation information, the protection policy is updated based on the second type of recent operation information; the management object indicates the entry point for implementing interface calls based on the target object.

7. The method according to any one of claims 1-6, characterized in that: The step of obtaining the historical interface call information of the target object includes: The historical interface call information of the target object is obtained in each of the multiple preset periods to obtain a set of historical interface call information. After obtaining the historical interface call information of the target object, the process includes: Determine the data stability corresponding to the historical interface call information set; If the data stability is greater than the stability threshold, the whitelist for indicating interface calls is generated based on the historical interface call information.

8. The method according to claim 7, characterized in that, Determining the data stability corresponding to the historical interface call information set includes: Extract any two historical interface call information from the historical interface call information set to obtain a historical interface call information group; Determine the relevance of the information within the historical interface call information group; Repeat the above steps until the intra-group information relevance of all historical interface call information groups in the historical interface call information set is obtained; The data stationarity is obtained based on the correlation of information within each group.

9. A safety protection device, characterized in that, The device includes: Protection Scenario Determination Module: Used to determine the corresponding protection scenario in response to security protection instructions for a target object; the target object implements business functions by calling an interface based on a key, and the security protection instructions indicate protection against attacks caused by key leakage; Pre-emptive protection module: When the protection scenario is a scenario for pre-emptive protection against the attack, it is used to obtain the historical interface call information of the target object, generate a whitelist of interface calls based on the historical interface call information, and establish the association between the whitelist and the target object; or, Post-attack protection module: When the protection scenario is a post-attack protection scenario, it is used to obtain the current calling interface of the target object, predict the next calling interface of the target object, generate a blacklist for the next calling interface, and establish the association between the blacklist and the target object.

10. The apparatus according to claim 9, characterized in that, The target object is associated with a protection policy that indicates interface calls, and the device is further used for: In response to the detection of a first type of recent operation information related to the target object, if the protection policy does not contain content indicating the first type of recent operation information, the protection policy is updated based on the first type of recent operation information. The first type of recent operation information includes at least one of the following: recent interface call information of the target object, and information on the addition of business functions for the target object.

11. The apparatus according to claim 10, characterized in that, When the first type of recent operation information includes the recent interface call information, updating the protection policy based on the first type of recent operation information when the protection policy does not contain content indicating the first type of recent operation information includes: Extract the called interfaces from the recent interface call information; When the protection strategy does not contain any content indicating the called interface, the called interface is determined to be a candidate interface; When the number of failed calls to the candidate interface exceeds a threshold and the candidate interface belongs to a preset interface set, a first interface whitelist entry indicating the interface call is generated based on the candidate interface to update the protection strategy.

12. The apparatus according to claim 10, characterized in that, When the first type of recent operation information includes the recent interface call information, updating the protection policy based on the first type of recent operation information when the protection policy does not contain content indicating the first type of recent operation information includes: Extract the called communication address from the recent interface call information; When the protection policy does not contain any content indicating the invoked communication address, the invoked communication address is determined as a candidate communication address; When the candidate communication address is the same as the first type of sample communication address or matches the geographical location of the second type of sample communication address, a whitelist entry for the communication address indicating the interface call is generated based on the candidate communication address to update the protection policy; the first type of sample communication address indicates the communication address involved in the access management object, and the management object indicates the entry point for implementing the interface call based on the target object; the second type of sample communication address indicates the current communication address whitelist in the protection policy.

13. The apparatus according to claim 10, characterized in that, When the first type of recent operation information includes the business function addition information, updating the protection policy based on the first type of recent operation information when the protection policy does not contain content indicating the first type of recent operation information includes: Based on the information added to the aforementioned business functions, the corresponding new business functions are determined. Determine the functional interfaces involved in the newly added business functions; When the protection policy does not contain content indicating the functional interface, a second interface whitelist entry indicating the interface call is generated based on the functional interface to update the protection policy.

14. The apparatus according to claim 10, characterized in that, The target object is associated with a protection policy that indicates interface calls, and the device is further used for: In response to the detected second type of recent operation information involving the access management object, if the protection policy does not contain content indicating the second type of recent operation information, the protection policy is updated based on the second type of recent operation information; the management object indicates the entry point for implementing interface calls based on the target object.

15. The apparatus according to any one of claims 9-14, characterized in that: The step of obtaining the historical interface call information of the target object includes: The historical interface call information of the target object is obtained in each of the multiple preset periods to obtain a set of historical interface call information. After obtaining the historical interface call information of the target object, the process includes: Determine the data stability corresponding to the historical interface call information set; If the data stability is greater than the stability threshold, the whitelist for indicating interface calls is generated based on the historical interface call information.

16. The apparatus according to claim 15, characterized in that, Determining the data stability corresponding to the historical interface call information set includes: Extract any two historical interface call information from the historical interface call information set to obtain a historical interface call information group; Determine the relevance of the information within the historical interface call information group; Repeat the above steps until the intra-group information relevance of all historical interface call information groups in the historical interface call information set is obtained; The data stationarity is obtained based on the correlation of information within each group.

17. An electronic device, characterized in that, The electronic device includes at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores at least one instruction or at least one program, the at least one instruction or at least one program being loaded and executed by the at least one processor to implement the security protection method as described in any one of claims 1-8.

18. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one instruction or at least one program, which is loaded and executed by a processor to implement the security protection method as described in any one of claims 1-8.

19. A computer program product, characterized in that, The computer program product includes at least one instruction or at least one program segment, which is loaded and executed by a processor to implement the security protection method as described in any one of claims 1-8.

Images