Process communication control method, apparatus, device, and storage medium

Abstract

The application provides a process communication control method and device, equipment and a storage medium, relates to the technical field of Internet, can be applied to cloud technology, artificial intelligence, intelligent transportation, auxiliary driving and the like, and the method comprises the following steps: in response to an access ticket request of a target application process, obtaining target process characteristic information of the target application process; based on a pre-stored authentication information library, the target process characteristic information and the target access address are authenticated, if the process authentication result is authentication passed, the access ticket request and the target process characteristic information are sent to the server; based on the network access ticket and the server, a target network session connection corresponding to the access ticket request is established; if an update operation of the pre-stored authentication information library is detected, the target process characteristic information is authenticated based on the updated pre-stored authentication information library, and in the case that the secondary process authentication result is authentication failed, the target network session connection is blocked. The application can reduce the server traffic pressure.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to a process communication control method, apparatus, device and storage medium. Background Technology

[0002] With the development of internet technology, process communication control technology has become one of the key means to ensure network information security, especially in enterprise resource access scenarios. In existing process communication control schemes, terminals typically report application characteristic information to the server, which then determines whether the application has the necessary permissions based on network access policies and responds to the terminal for processing. In this scheme, whenever an application initiates an access ticket request to business system resources, the server needs to obtain the application's characteristic information and authenticate each application's characteristics. This results in a large amount of redundant and repetitive ticket request traffic and authentication pressure on the server, leading to high bandwidth consumption and increased access latency. Summary of the Invention

[0003] This application provides a process communication control method, apparatus, device, and storage medium, which can significantly improve the efficiency and reliability of process communication control.

[0004] On the one hand, this application provides a process communication control method, the method comprising: In response to an access ticket request from the target application process, obtain the target process characteristic information of the target application process; Based on the pre-stored authentication information database, the target process feature information and the target access address are authenticated to obtain the process authentication result. If the authentication result of the process is successful, the access ticket request and the target process feature information are sent to the server, so that the server responds to the access ticket network request to perform synchronous risk identification on the target process feature information, and if the synchronous risk identification result is that no risk is identified, the server sends the network access ticket corresponding to the access ticket network request to the terminal. Based on the network access ticket, a target network session connection corresponding to the access ticket request is established between the server; If an update operation of the pre-stored authentication information database is detected, a secondary authentication process is performed on the target process feature information based on the updated pre-stored authentication information database to obtain a secondary process authentication result. If the authentication result of the secondary process is that the authentication fails, the target network session connection is blocked.

[0005] On the other hand, a process communication control device is provided, the device comprising: Information acquisition module: used to acquire target process characteristic information of the target application process in response to the access ticket request of the target application process; Authentication module: used to perform authentication processing on the target process feature information and the target access address based on the pre-stored authentication information database, and obtain the process authentication result; Information sending module: When the authentication result of the process is successful, the information sending module sends the access ticket request and the target process feature information to the server, so that the server responds to the access ticket network request to perform synchronous risk identification on the target process feature information, and sends the network access ticket corresponding to the access ticket network request to the terminal when the synchronous risk identification result is no risk identified. Session connection establishment module: used to establish a target network session connection corresponding to the access ticket request between the network access ticket and the server; Secondary authentication module: When an update operation of the pre-stored authentication information database is detected, it performs secondary authentication processing on the target process feature information based on the updated pre-stored authentication information database to obtain the secondary process authentication result. Session blocking module: used to block the target network session connection if the authentication result of the secondary process is authentication failure.

[0006] On the other hand, a computer device is provided, the device including a processor and a memory, the memory storing at least one instruction or at least one program, the at least one instruction or the at least one program being loaded and executed by the processor to implement the process communication control method as described above.

[0007] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction or at least one program is stored therein, the at least one instruction or the at least one program being loaded and executed by a processor to implement the process communication control method as described above.

[0008] On the other hand, a server is provided, the server including a processor and a memory, the memory storing at least one instruction or at least one program, the at least one instruction or the at least one program being loaded and executed by the processor to implement the process communication control method as described above.

[0009] On the other hand, a terminal is provided, the terminal including a processor and a memory, the memory storing at least one instruction or at least one program, the at least one instruction or the at least one program being loaded and executed by the processor to implement the process communication control method as described above.

[0010] On the other hand, a computer program product or computer program is provided, which includes computer instructions that, when executed by a processor, implement the process communication control method described above.

[0011] The process communication control method, apparatus, device, storage medium, server, terminal, computer program, and computer program product provided in this application have the following technical effects: The technical solution of this application obtains the target process characteristic information of the target application process by responding to the access ticket request of the target application process from the terminal. The access ticket request carries the target access address. Based on the pre-stored authentication information database, the target process characteristic information and the target access address are authenticated to obtain the process authentication result. If the process authentication result is successful, the access ticket request and the target process characteristic information are sent to the server, so that the server responds to the access ticket network request to perform synchronous risk identification on the target process characteristic information. If the synchronous risk identification result is no risk identified, the server sends the network access ticket corresponding to the access ticket network request to the terminal. In this way, the initial authentication processing of process characteristic information and target access address is performed on the terminal. Only if the authentication is successful is the corresponding information sent to the server. This achieves the initial screening of access ticket requests, significantly reducing access ticket request traffic. In scenarios with high-frequency access to business resources, it can effectively reduce the pressure on the server ticket service and reduce bandwidth consumption. At the same time, it reduces the latency of application accessing the network, effectively improves the user experience, and enhances the availability of the process communication control system. Then, based on the network access ticket, a target network session connection corresponding to the access ticket request is established between the server. If an update operation to the pre-stored authentication information database is detected, secondary authentication processing is performed on the target process characteristic information based on the updated pre-stored authentication information database to obtain the secondary process authentication result. If the secondary process authentication result is authentication failure, the target network session connection is blocked. In this way, authentication information updates are detected on the terminal side, and secondary authentication is performed in a timely manner. Existing network session connections are blocked on the terminal, reducing the session detection and maintenance burden on the server side. The server does not need to disconnect and restart all network sessions on the terminal, thus improving session processing efficiency. Attached Figure Description

[0012] To more clearly illustrate the technical solutions and advantages in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1This is a schematic diagram of an application environment provided in an embodiment of this application; Figure 2 This is a flowchart illustrating a process communication control method provided in an embodiment of this application; Figure 3 This is a flowchart illustrating another process communication control method provided in an embodiment of this application; Figure 4 This is a flowchart illustrating another process communication control method provided in an embodiment of this application; Figure 5 This is a schematic diagram of the framework of a process communication control device provided in an embodiment of this application; Figure 6 This is a hardware structure block diagram of an electronic device for a process communication control method provided in an embodiment of this application. Detailed Implementation

[0014] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0015] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or sub-modules is not necessarily limited to those steps or sub-modules explicitly listed, but may include other steps or sub-modules not explicitly listed or inherent to such processes, methods, products, or devices.

[0016] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0017] Trusted Applications: Applications that can be accessed by terminals authorized by the management system; Login Ticket: After a visitor successfully logs in to the client, the trust management client assigns an encrypted string to the visitor, representing the visitor's login authorization information, including ticket information and authorization validity period, which is encrypted and stored on the client.

[0018] Network Request Ticket: Authorization information issued by the application trust server for a single access ticket request, used to identify the authorization status of the access ticket request.

[0019] Network session: The process of a terminal and a business system performing an information exchange, such as the process of data sending or receiving after a client and a server establish a network connection, including connection establishment and termination, or data sending and receiving.

[0020] A quintuple is a communications term that refers to a set of five quantities in network access traffic: the source IP address, source port, destination IP address, destination port, and transport layer protocol.

[0021] Please see Figure 1 , Figure 1 This is a schematic diagram of an application environment provided in an embodiment of this application, such as... Figure 1 As shown, the application environment may include at least terminal 01 and server 02. In practical applications, terminal 01 and server 02 can be directly or indirectly connected via wired or wireless communication, and this application does not impose any restrictions on this.

[0022] In this application embodiment, server 02 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0023] Specifically, cloud technology refers to a managed technology that unifies hardware, software, and network resources within a wide area network (WAN) or local area network (LAN) to achieve data computation, storage, processing, and sharing. Cloud technology can be applied to various fields, such as medical cloud, cloud IoT, cloud security, cloud education, cloud conferencing, AI cloud services, cloud applications, cloud calling, and cloud social networking. Based on the cloud computing business model, cloud technology distributes computing tasks across a resource pool composed of numerous computers, enabling various application systems to obtain computing power, storage space, and information services as needed. The network providing these resources is called the "cloud." From the user's perspective, the resources in the "cloud" are infinitely scalable, readily available, on-demand, expandable, and pay-as-you-go. As a provider of basic cloud computing capabilities, a cloud resource pool (referred to as a cloud platform, generally called an IaaS (Infrastructure as a Service) platform) is established. Various types of virtual resources are deployed in the resource pool for external customers to choose from. The cloud resource pool mainly includes: computing devices (virtualized machines containing operating systems), storage devices, and network devices.

[0024] Based on logical function, a PaaS (Platform as a Service) layer can be deployed on top of the IaaS layer, and a SaaS (Software as a Service) layer can be deployed on top of the PaaS layer. Alternatively, SaaS can be deployed directly on top of IaaS. PaaS is a platform for running software, such as databases and web containers. SaaS refers to various types of business software, such as web portals and bulk SMS senders. Generally speaking, SaaS and PaaS are upper layers compared to IaaS.

[0025] Specifically, the server 02 mentioned above may include physical devices, such as network communication submodules, processors, and memory, and may also include software running on the physical devices, such as applications.

[0026] Specifically, terminal 01 may include physical devices such as smartphones, desktop computers, tablets, laptops, digital assistants, augmented reality (AR) / virtual reality (VR) devices, smart voice interaction devices, smart home appliances, smart wearable devices, and in-vehicle terminal devices, and may also include software running on the physical devices, such as applications.

[0027] In this embodiment, terminal 01 can respond to an access ticket request from a target application process, obtain target process characteristic information of the target application process, and perform authentication processing on the access ticket request and target process characteristic information based on a local pre-stored authentication information database. If authentication fails, the access ticket request is blocked; if authentication succeeds, the access ticket request and target process characteristic information are sent to the server. Server 02 is used to respond to the access ticket request, perform risk identification on the target process characteristic information, and send a network access ticket or a ticket request failure response to terminal 01. Terminal 01 is used to block the access ticket request in response to a ticket request failure response, without performing network session establishment operations, or to establish a target network session connection based on the network access ticket. The terminal is also used to detect updates to the pre-stored authentication information database. If an update is detected, the terminal performs secondary authentication processing on the target process characteristic information based on the updated pre-stored authentication information database, and determines whether to block the target network session connection based on the secondary authentication result. Specifically, the server can run an application trust server, and the terminal can run a trust management client corresponding to the application trust server to perform the above-mentioned specific operations. The technical capabilities of this application can be applied to scenarios such as remote access control of business system resources.

[0028] Furthermore, it is understandable that Figure 1 The example shown is merely an application environment for a process communication control method. This application environment may include more or fewer nodes, and this application does not impose any limitations on it.

[0029] The application environment involved in this application embodiment, or the terminal 01 and server 02 in the application environment, can be a distributed system formed by connecting clients and multiple nodes (any form of computing device accessing the network, such as servers and user terminals) through network communication. The distributed system can be a blockchain system, which can provide the aforementioned process communication control services and data storage services.

[0030] The following describes a process communication control method based on the above application environment, applied to a terminal. This embodiment can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, and assisted driving. Please refer to... Figure 2 , Figure 2This is a flowchart illustrating a process communication control method provided in an embodiment of this application. This specification provides method operation steps as shown in the embodiments or flowcharts, but based on conventional or non-inventive methods, more or fewer operation steps may be included. The order of steps listed in the embodiments is merely one possible execution order among many and does not represent the only execution order. In actual system or server product execution, the method can be executed sequentially according to the embodiments or drawings, or in parallel (e.g., in a parallel processor or multi-threaded processing environment). Specifically, as... Figure 2 As shown, the method may include the following steps S201-S211.

[0031] S201: In response to the access ticket request of the target application process, obtain the target process characteristic information of the target application process.

[0032] In this embodiment, the target application process can be a process created when the target application on the terminal starts. The target application can include, but is not limited to, browser applications, instant messaging applications, game applications, video applications, or office applications. Specifically, a network access ticket is an access ticket issued by the server for each network access process. It is obtained by the client from the server based on the login ticket of the authenticated visitor, process information, device information, etc., to finely control each network access. Correspondingly, an access ticket request is a network request sent by the target application process to the server before establishing a network session connection to request a network access ticket. Specifically, the target process characteristic information can include, but is not limited to, the executable file description information, copyright information, last modification time, file path, digest information (such as MD5 or SHA256), and signature information of the target application process. Among them, the file path can be the absolute path of the executable file.

[0033] In practical applications, please refer to Figure 3 Prior to S201, the method also includes S301-S303.

[0034] S301: In response to the startup of the target application process, create the target process node corresponding to the target application process in the process linked list of the dynamic process cache.

[0035] S303: Store the target process characteristic information to the target process node.

[0036] Specifically, a process list is created in the dynamic process cache, which can be a doubly linked list structure. The process nodes in the process list correspond to the currently running application processes on the terminal, with each process node corresponding to one application process. Specifically, the process list can correspond to the terminal's process list; the process nodes in the process list correspond to application processes that have been created and have not yet exited in the terminal's process list. When a new application process is created, the newly created process node is added to the process list; when the process exits, the process node is removed from the process list.

[0037] In practical applications, the server can run an application trust server, and the terminal can run the corresponding trust management client. When the trust management client is running, it executes a trust management process, and the client can also run a proxy process. Accordingly, the trust management process can detect the startup and shutdown of application processes on the terminal. It can obtain notifications of the dynamic creation and shutdown of all processes on the terminal through callbacks. Upon detecting the startup and creation of an application process, it creates a process node for the application process in the process chain, which can be associated with the application process's process ID. Furthermore, based on the trust management process, it retrieves the process characteristic information of the created application processes from the terminal storage through callbacks and stores this information in the corresponding process node for subsequent reading based on the process ID.

[0038] It should be noted that the trust management process can retrieve the target application process's process ID, process name, last modified time, file path (such as the absolute process path), version information, description information, and digital signature from storage. Then, based on the last modified time and file path, it calculates the target application process's process digest information. This calculation can be a hash operation, and the process digest information can be MD5 or SHA256, etc. Finally, the obtained process information of each category is stored in the target process node.

[0039] Accordingly, obtaining the target process characteristic information of the target application process includes: searching for the target process node in the process list; and reading the target process characteristic information from the target process node. Specifically, the target process node can be searched from each process node in the process list based on the process identifier of the target application process, and then the target process characteristic information can be read.

[0040] It should be noted that process characteristic information includes various types of information, and it takes a long time to obtain it from the terminal storage. By creating the process linked list mentioned above, and executing the process characteristic information retrieval from the terminal storage and the associated storage to the process node when the application process starts and is created, the efficiency of obtaining process characteristic information in subsequent communication control processes can be improved and communication latency can be reduced.

[0041] In practical applications, the access ticket request carries a five-tuple of information, which may include the target access address, i.e., the address of the object being accessed; before obtaining the target process characteristic information of the target application process, the method also includes S401-S403.

[0042] S401: In response to the access ticket request of the target application process, match the target access address pair based on the preset business resource set.

[0043] The preset business resource set includes the business resource addresses of multiple preset business objects.

[0044] S403: If a target access address exists among the business resource addresses of multiple preset business objects, execute the step of obtaining the target process characteristic information of the target application process.

[0045] Specifically, the preset business objects can be resource objects preset in the network access policy, such as enterprise resources. The preset business resource set can be sent by the application trust server running on the server.

[0046] Specifically, the proxy process intercepts the access ticket request of the target application process and matches the target access address carried by it with the addresses of various business resources in a pre-stored set of business resources. If the target access address exists in the pre-stored set of business resources, the proxy process reads the target process characteristic information from the dynamic process cache based on the process identifier, such as reading the target process characteristic information from the process node corresponding to the process identifier in the process chain. If the target access address does not exist in the business resource addresses of multiple pre-stored business objects, the access ticket request is sent to the server without traffic interception. It should be noted that if the target access address does not exist, it indicates that the business resource corresponding to the target access address is unknown or not within the scope of resource control, and the request is directly sent to the server so that the server can make a judgment.

[0047] S203: Based on the pre-stored authentication information database, perform authentication processing on the target process feature information and the target access address to obtain the process authentication result.

[0048] In this embodiment, the pre-stored authentication information database includes a process blacklist and a business object mapping table. The business object mapping table represents the correspondence between the process characteristic information of a trusted application process and the business resource address table that the trusted application process is allowed to access. The process blacklist includes the correspondence between multiple risky application processes and their process characteristic information. By matching the target process characteristic information with the process characteristic information in the process blacklist, it can be determined whether the target application process is a risky application process. Furthermore, by matching the target process characteristic information and the target access address with the process characteristic information and the business resource address table in the business object mapping table, it can be determined whether the target application process has the permission to access the target access address, thereby achieving process authentication.

[0049] Specifically, the application trust server on the server side can maintain a database of risky application processes and a database of network access policies. The application trust server can filter out a certain number of core risky processes from the risky application process database to obtain a process blacklist, which is then sent to the terminal. In this way, sending the initial process blacklist to the terminal avoids consuming excessive storage resources on the terminal. Specifically, the application trust server can sort and categorize application processes in the risky application process database based on different attributes such as severity level, number of installations, and frequency of occurrence, and then filter out the process blacklist based on the sorting results.

[0050] Specifically, the application trust server can also issue network access policies to the terminal. These policies can define the necessary characteristic information or application type required by predefined application processes to access business resources, thereby defining trusted application processes that can access those resources. This allows for limiting access to different business objects, such as enterprise resources, by different types of application processes, and prohibiting application processes that do not meet specific attribute characteristics from accessing core business systems, thus improving system security. After receiving the network access policy from the application trust server, the trust management process pushes the policy to the agent process via IPC communication or an agent process interface. The agent process then calls the policy information conversion module to parse the policy and obtain a business object mapping table. Correspondingly, the business object mapping table represents the correspondence between the process characteristic information of trusted application processes and the address table of business resources that the trusted application processes are allowed to access.

[0051] Accordingly, please refer to Figure 4 S203 may include S2031-S2033.

[0052] S2031: Match the target process feature information with the process blacklist.

[0053] Specifically, the process ID generated on the terminal may be different each time the target application process is launched and created. Therefore, the process characteristic information of risky processes is stored in the process blacklist to avoid false matching. In some cases, process matching is achieved based on process summary information to improve matching efficiency. Accordingly, the target process characteristic information includes the file path and last modification time of the executable file of the target application process, and the process blacklist includes the process summary information of multiple risky processes; S2031 may include the following steps.

[0054] 1) Perform information mapping processing on the file path and the most recent modification time to obtain the target process summary information of the target application process; 2) Match the target process digest information with the process digest information in the process blacklist; 3) If the target process summary information is not found in the process summary information of the process blacklist, it is determined that the target process feature information does not match the process blacklist.

[0055] Specifically, the information mapping process described above can be a hash operation, and the target process digest information can be the MD5 or SHA256 hash of the target application process. If a process digest matching the target process digest information exists in the process blacklist, then the process feature information is determined to match the process blacklist, and the target application process is a risky process. If it does not exist, then there is no match, and the terminal determines that the target application process is a process to be verified.

[0056] S2032: If the target process characteristic information does not match the process blacklist, match the target process characteristic information and the target access address with the business object mapping table.

[0057] S2033: If the target process characteristic information exists in the business object mapping table, and the target access address exists in the business resource address table corresponding to the target process characteristic information, the process authentication result is determined to be authentication passed.

[0058] Specifically, if it is determined that the target application process is not in the process blacklist, the target process's characteristic information is matched against the characteristic information of each target process in the business object mapping table. If a matching process characteristic is found, the target access address is then searched in its corresponding business resource address table. If found, the process authentication result is determined to be successful. Thus, the terminal determines that the target application process has the conditions to request a network access ticket from the server. If not found, it indicates that the target application process does not have permission to access the target access address, and authentication fails.

[0059] In practical applications, if the target process feature information matches the process blacklist, and / or the target access address does not exist in the business resource address table corresponding to the target process feature information, the process authentication result is determined to be authentication failure.

[0060] Specifically, if the target process's characteristic information matches the process blacklist (i.e., the target process's characteristic information exists in the process blacklist), then the target application process is determined to be a risky process, the process authentication result fails, and S213 is executed below. If the target process's characteristic information does not match the process blacklist, and the target access address does not exist in the business resource address table corresponding to the target process's characteristic information, then the target application process is determined to lack permission to access the business resources in the target access address, the authentication fails, and S213 is executed below. Specifically, S2031-2033 above can be executed based on the proxy process.

[0061] In some embodiments, the network access policy may further include personalized access rules for the currently authenticated visitor in the trust management client of the terminal, including a table of business resource addresses accessible to the currently authenticated visitor. Correspondingly, the business object mapping table also includes the correspondence between authenticated visitors and visitor business resource address tables. S2033 is as follows: If the business object mapping table contains target process characteristic information, the business resource address table corresponding to the target process characteristic information contains a target access address, and the visitor business resource address table corresponding to the currently authenticated visitor contains a target access address, then authentication is confirmed to be successful. If any of the above three conditions is not met, authentication fails, and S213 is executed.

[0062] S213: If the process authentication result is authentication failure, block the access ticket request.

[0063] Specifically, the trust control process generates a request blocking command and sends it to the agent process if authentication fails, causing the agent process to block the access ticket request. In addition, it can simultaneously generate alarm information and link with security control functions for risk management.

[0064] S205: If the process authentication result is successful, the access ticket request and target process characteristic information are sent to the server, so that the server responds to the access ticket network request to perform synchronous risk identification on the target process characteristic information. If the synchronous risk identification result is that no risk is identified, the server sends the network access ticket corresponding to the access ticket network request to the terminal. If the synchronous risk identification result is that there is a risk, the server sends a ticket request failure response to the terminal.

[0065] In this embodiment, after authentication, the proxy process sends an access ticket request to the trust management process, which then forwards it to the server. Specifically, the proxy process can send an access ticket request to the trust management process via a local socket. The server-side application trust server performs synchronous risk identification based on a risky application process database, checking if the target process's characteristic information exists in the database. If the target process's characteristic information exists, the synchronous risk identification result indicates a risk, and the server refuses to respond to the network access ticket, sending a ticket request failure response to the terminal. Correspondingly, the method may further include: S301: In response to a ticket request failure, the access to the ticket request is blocked.

[0066] S303: Update the pre-stored authentication information database based on the target process feature information.

[0067] Specifically, in response to a failed ticket request, the trust control process sends a request blocking instruction to the proxy process. The proxy process then blocks the ticket access request based on this instruction. Thus, during the ticket access request phase, risk authentication is performed on the process characteristics corresponding to the ticket access request based on a locally stored pre-stored authentication information database, and permission authentication is performed on the target access address. If risk authentication fails, or if risk authentication succeeds but permission authentication fails, the request is intercepted and blocked. This eliminates the need to send process characteristic information to the server for risk identification, and also eliminates the need to forward requests to the resource server where the target access address resides. This significantly reduces the traffic pressure on the server's ticket service and the resource consumption for risk identification, while also reducing network latency.

[0068] Furthermore, the trust management process adds the target process's characteristic information to the process blacklist to synchronize and update the process blacklist in the pre-stored authentication information database. If the process blacklist stores process summary information, the target process summary information is added to the process blacklist. This expands the terminal's pre-stored authentication information database and improves the success rate of intercepting risky process requests from the terminal.

[0069] Furthermore, if the target process characteristic information is not found in the risk application process library, the synchronization risk identification result is determined to be no risk identified, and a network access ticket is sent to the terminal so that the terminal executes the following S207.

[0070] S207: Establish a target network session connection between the server and the access ticket request based on the network access ticket.

[0071] In this embodiment, the trust management process receives network access tickets and sends them to the agent process. The agent process sends a session connection request to the gateway on the server side based on the network access tickets to establish a target network session connection with the gateway on the server side, so as to perform process network communication and access the business resources corresponding to the target access address.

[0072] Understandably, in cases where the target process's characteristic information is not found in the aforementioned risk application process library, the target application process may be a trusted application, but it could also be a gray application, i.e., an application with unknown risks. Correspondingly, in some situations, the application trust server also pre-stores a trusted application library. If the target process's characteristic information exists in the trusted application library, the target application process is determined to be a trusted process, and after sending a network access ticket to the terminal, asynchronous application risk identification is unnecessary. If the target process's characteristic information is not found in the trusted application library, the application trust server performs asynchronous risk identification on the target process's characteristic information, obtaining an asynchronous risk identification result. If the asynchronous risk identification result indicates a risk, a session blocking instruction is generated, and the asynchronous risk identification result and session blocking instruction are sent to the terminal. The terminal, based on this session blocking instruction, interrupts the target network session connection to deny the target application process access to the business resources corresponding to the target access address. Furthermore, the pre-stored authentication information library is updated based on the target process's characteristic information; that is, the trust control process adds the target process's characteristic information to the process blacklist. In this way, the initial pre-stored authentication information database of the terminal is updated and expanded synchronously, and the local hit rate of risky applications is increased as much as possible within the limited storage space, so as to block risky session connections and reduce the request traffic of network access tickets.

[0073] Specifically, asynchronous risk identification can be achieved by the application trust server calling a preset interface to send the target process service information to the application identification service.

[0074] In some embodiments, the network access ticket has validity period information, which is set by the agent process for the network access ticket, including but not limited to the lifespan of the network access ticket and the maximum number of uses. Within the validity period corresponding to the validity period information, if the terminal receives a session blocking instruction, it will interrupt the target network session connection if the connection is within its lifespan or the current number of uses has not exceeded the maximum number of uses. Specifically, blocking the target network session connection can be done by closing the target network session connection and clearing the session cache, or by setting the validity period information of the network access ticket to expired.

[0075] Understandably, if no session blocking instruction is received within the validity period corresponding to the validity period information, the target application process can use this network access ticket to access the resource when accessing the business resource of the same target access address.

[0076] Based on some or all of the above implementation methods, after successful authentication, the proxy process sends the access ticket request to the trust management process. The trust management process generates a unique session identifier for the access ticket request currently hijacked by the proxy process, and associates the unique session identifier with at least one of the following: target application characteristic information, current device information, and login information of the currently authenticated visitor, and stores it in the main service cache maintained by the trust management process. The unique session identifier can be generated by mapping the five-tuple of the access ticket request; the mapping can be a hash calculation, etc.

[0077] Furthermore, after the target network session connection is established, the proxy process stores the network session information of the target network session connection (such as the process identifier of the target application process, the target access address, the business resource identifier corresponding to the target access address, protocol port information, etc.) in the session cache. In this way, by maintaining the session cache, the proxy process can find the network session information of each application process and the network session information corresponding to the business resources, and then, based on the granularity of application processes and business resources, achieve targeted blocking of network session connections and cache clearing. Specifically, the proxy process can map session information to specific sockets for storage in the session cache.

[0078] Furthermore, the proxy process sends a session connection request to the gateway. Regardless of whether the session connection is successfully established, it synchronizes the network session information and connection establishment result of the target network session connection to the trust management process in near real-time via local communication. Specifically, this synchronization method involves associating the unique session identifier of the target network session connection in the trust management process's main service cache with the network session information and connection establishment result of the target network session connection in the session cache. Thus, upon receiving a session blocking instruction from the server, the trust management process can send a session blocking instruction for the target network session connection to the proxy process based on the unique session identifier to terminate or revoke access control information, including the session. Specifically, the trust management process can encapsulate the unique session identifier in the session blocking instruction sent by the server to achieve targeted session control. This reduces the amount of communication within the terminal, improves communication control processing efficiency, and reduces latency.

[0079] S209: If an update operation of the pre-stored authentication information database is detected, a secondary authentication process is performed on the target process feature information based on the updated pre-stored authentication information database to obtain the secondary process authentication result.

[0080] Specifically, updating the pre-stored authentication information database includes updating the list of risky processes and updating the business object mapping table. Understandably, the server communicates with multiple terminals, allowing it to receive process characteristic information of different application processes submitted by these terminals for risk identification. Upon identifying a new core risky process, the application trust server on the server can send the new core risky process to each terminal to update the pre-stored authentication information database; specifically, it updates and adds it to the process blacklist. Furthermore, upon receiving an updated network access policy, the application trust server sends the updated network access policy to the terminal, enabling the terminal to parse the updated network access policy and update the business object mapping table, or update the business object mapping table based on the network access policy and then send the updated business object mapping table to the terminal. Correspondingly, the correspondence in the business object mapping table changes. For example, application process A's business resource address table adds business resource address m, application process B's business resource address table deletes business resource address n, or application process C, which could only access a single business resource address, is updated to be able to access all business resource addresses, etc.

[0081] In addition, the terminal's trust management process can also detect changes in network access policies based on the policy synchronization mechanism, and proactively pull updated network access policies or updated business object mapping tables from the server to update the locally stored business object mapping tables.

[0082] Furthermore, if an update operation of the pre-stored authentication information database is detected, a secondary authentication process is performed on the target process feature information. This secondary authentication process is similar to the authentication process in step S203 above, and will not be described in detail here.

[0083] S211: If the authentication result of the secondary process is that the authentication fails, block the target network session connection.

[0084] In this embodiment, if the secondary authentication process passes, the target network session connection is maintained. Specifically, if the secondary authentication process fails, the trust management process generates a session blocking command and sends it to the proxy process. The proxy process then blocks the target network session connection based on the session blocking command. This blocking method is similar to the aforementioned method and will not be described in detail here.

[0085] In this way, initial authentication of process characteristics and target access addresses is performed at the terminal. Only after successful authentication is the corresponding information sent to the server, achieving initial screening of access ticket requests. This significantly reduces access ticket application traffic and effectively reduces the pressure on the server's ticket service and bandwidth consumption in scenarios with high-frequency access to business resources. Simultaneously, it reduces application network access latency, effectively improving user experience and enhancing the availability of the process communication control system. Furthermore, detecting authentication information updates at the terminal side allows for timely secondary authentication and enables blocking of existing network session connections on the terminal. This reduces the session detection and maintenance burden on the server, eliminating the need for the server to disconnect and restart all network sessions for the terminal, thus improving session processing efficiency.

[0086] Specifically, when the trust management process generates and stores a unique session identifier for a network session connection, if the secondary authentication determines that the target application process information matches the updated process blacklist, the session blocking instruction carries the unique session identifier for the target network session connection. The proxy process blocks the target network session connection based on this unique session identifier and clears the network session information corresponding to the unique session identifier from the session cache. If the secondary authentication determines that the target application process information does not match the updated process blacklist, but the target process feature information and the target access address do not match the business object mapping table, and it is determined that the target application process does not have the permission to access the business resources corresponding to the target access address, then a session blocking instruction is generated.

[0087] Similarly, a mismatch between the target process feature information and the target access address and the business object mapping table includes: the target process feature information exists in the business object mapping table and the target access address exists in the business resource address table corresponding to the target process feature information, or the target process feature information does not exist in the business object mapping table.

[0088] Understandably, upon detecting an update operation to the pre-stored authentication information database, the trust management process performs the aforementioned secondary authentication process on all existing network session connections in the session cache to determine whether to execute the corresponding blocking action. Furthermore, it can also check whether the target access address of each existing network session connection exists in the business object mapping table. If not, it searches the session cache for the network session connection corresponding to the target access address based on the target access address or the business resource identifier corresponding to the target access address. The trust management process generates a session blocking instruction for the network session connection corresponding to the target access address and sends it to the agent process, which then executes the blocking action for the network session connection corresponding to the target access address.

[0089] Thus, targeted session blocking during policy and service configuration updates on the terminal does not require the server to interrupt and restart all network sessions, further reducing the difficulty and maintenance pressure of session connection management on the server and improving session blocking efficiency.

[0090] In summary, the proposed solution first establishes a pre-stored authentication information database on the terminal as the initial authentication information database. During the process of the client initiating an access ticket request to the server, the terminal performs an authentication process based on the pre-stored authentication information database to determine whether the application initiating network access is a risky application and whether it has the basic permissions to access the corresponding enterprise resources. If it has the permissions, the terminal is allowed to initiate an access ticket request to the server. The server synchronously identifies the application as risky and refuses to respond to the network access ticket to the terminal. For gray application processes, the server initially allows access, asynchronously identifies security risks, refuses to respond, and pushes risky application information to the terminal to update the pre-stored authentication information database, achieving dynamic expansion of the pre-stored authentication information database. Furthermore, when the server interacts with multiple terminals and identifies new risky applications or changes in network access policies, it sends updated process characteristic information and network access policies of the risky applications to multiple terminals, enabling the terminals to update the pre-stored authentication information database and achieving real-time synchronous expansion. In response to updates to the pre-stored authentication information database, the terminal performs secondary authentication on the target application process in the existing session connection to determine whether it is still a secure connection or whether it still has access permissions. This enables the application access permission determination to be moved from the server side to the terminal. When the process blacklist and network access policies change, the terminal can promptly adjust the existing sessions based on network access control rules, reducing access ticket application traffic in the enterprise network. In scenarios with high-frequency access to enterprise resources, this can effectively reduce the pressure on the server ticket service.

[0091] This application also provides a process communication control device 600, such as... Figure 5 As shown, Figure 5 The diagram shows a structural schematic of a process communication control device provided in an embodiment of this application. The device may include the following modules.

[0092] Information acquisition module 10: used to obtain target process characteristic information of the target application process in response to the access ticket request of the target application process; Authentication module 20: Used to perform authentication processing on the target process feature information and target access address based on the pre-stored authentication information database, and obtain the process authentication result; Information sending module 30: When the process authentication result is successful, it sends the access ticket request and target process feature information to the server, so that the server responds to the access ticket network request to perform synchronous risk identification on the target process feature information, and sends the network access ticket corresponding to the access ticket network request to the terminal when the synchronous risk identification result is no risk identified. Session connection establishment module 40: used to establish a target network session connection with the server based on the network access ticket request; Secondary authentication module 50: When an update operation of the pre-stored authentication information database is detected, it performs secondary authentication processing on the target process feature information based on the updated pre-stored authentication information database to obtain the secondary process authentication result. Session blocking module 60: Used to block the target network session connection when the authentication result of the secondary process is authentication failure.

[0093] In some embodiments, the apparatus further includes a request blocking module for blocking access ticket requests if the process authentication result is authentication failure.

[0094] In some embodiments, the pre-stored authentication information database includes a process blacklist and a business object mapping table. The business object mapping table represents the correspondence between the process characteristic information of a trusted application process and the address table of business resources that the trusted application process is allowed to access. The authentication module 20 may include: Blacklist Matching Submodule: Used to match target process characteristic information with the process blacklist; Object mapping table matching submodule: used to match the target process characteristic information and target access address with the business object mapping table when the target process characteristic information does not match the process blacklist; The authentication result determination submodule is used to determine the process authentication result as successful if the target process characteristic information exists in the business object mapping table and the target access address exists in the business resource address table corresponding to the target process characteristic information.

[0095] In some embodiments, the authentication result determination submodule is also used to: if the target process feature information matches the process blacklist, and / or the target access address does not exist in the business resource address table corresponding to the target process feature information, determine the process authentication result as authentication failure.

[0096] In some embodiments, the target process characteristic information includes the file path and last modification time of the executable file of the target application process, and the process blacklist includes process summary information of multiple risky processes; the blacklist matching submodule may include: Information mapping processing unit: used to perform information mapping processing on file path and last modification time to obtain target process summary information of target application process; Summary information matching unit: used to match the summary information of the target process with the process summary information in the process blacklist; Matching result generation unit: used to determine that the target process feature information does not match the process blacklist when the target process summary information does not exist in the process summary information of the process blacklist.

[0097] In some embodiments, if the synchronous risk identification result indicates that there is a risk, the server sends a ticket request failure response to the terminal; the request blocking module is also used to block access to the ticket in response to the ticket request failure response. The device also includes an information database update module: used to update the pre-stored authentication information database based on the target process feature information.

[0098] In some embodiments, the apparatus further includes, in response to an access ticket request from an application process: Process node creation module: Before obtaining the target process characteristic information of the application process, in response to the startup of the target application process, it creates the target process node corresponding to the target application process in the process chain of the dynamic process cache. The process nodes in the process chain are set to correspond to the currently running application process on the terminal. Process feature information storage module: used to store the target process feature information to the target process node; Accordingly, the information acquisition module 10 includes: Process Node Lookup Submodule: Used to find the target process node from the process list; Process Feature Information Reading Submodule: Used to read the feature information of the target process from the target process node.

[0099] In some embodiments, the apparatus further includes: Access address matching module: Before obtaining the target process characteristic information of the target application process, in response to the access ticket request of the target application process, the module matches the target access address pairs based on a preset business resource set, which includes the business resource addresses of multiple preset business objects. Information Acquisition Trigger Module: When a target access address exists among the business resource addresses of multiple preset business objects, the module executes the step of acquiring the target process characteristic information of the application process.

[0100] It should be noted that the above-described device embodiments and method embodiments are based on the same implementation methods.

[0101] This application provides a process communication control device. The scheduling device can be a terminal or a server, including a processor and a memory. The memory stores at least one instruction or at least one program. The at least one instruction or at least one program is loaded and executed by the processor to implement the process communication control method provided in the above method embodiments.

[0102] Memory is used to store software programs and modules. The processor executes various functional applications and process communication control by running the software programs and modules stored in memory. Memory can mainly include a program storage area and a data storage area. The program storage area stores the operating system, application programs required for functions, etc.; the data storage area stores data created according to the use of the device, etc. Furthermore, memory can include high-speed random access memory, and can also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, memory can also include a memory controller to provide the processor with access to the memory.

[0103] The methods and embodiments provided in this application can be executed in electronic devices such as mobile terminals, computer terminals, servers, or similar computing devices. Figure 6 This is a hardware structure block diagram of an electronic device for a process communication control method provided in an embodiment of this application. For example... Figure 6 As shown, the electronic device 900 can vary significantly due to different configurations or performance. It may include one or more Central Processing Units (CPUs) 910 (CPUs 910 may include, but are not limited to, microprocessors such as MCUs or programmable logic devices such as FPGAs), a memory 930 for storing data, and one or more storage media 920 (e.g., one or more mass storage devices) for storing application programs 923 or data 922. The memory 930 and storage media 920 may be temporary or persistent storage. The program stored in the storage media 920 may include one or more modules, each module including a series of instruction operations on the electronic device. Furthermore, the CPU 910 may be configured to communicate with the storage media 920 and execute a series of instruction operations in the storage media 920 on the electronic device 900. The electronic device 900 may also include one or more power supplies 960, one or more wired or wireless network interfaces 950, one or more input / output interfaces 940, and / or one or more operating systems 921, such as Windows Server. TM Mac OS X TM Unix TM Linux™, FreeBSD™, etc.

[0104] The input / output interface 940 can be used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the electronic device 900. In one example, the input / output interface 940 includes a network interface controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the input / output interface 940 may be a radio frequency (RF) module used for wireless communication with the Internet.

[0105] Those skilled in the art will understand that Figure 6 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device described above. For example, the electronic device 900 may also include... Figure 6 The more or fewer components shown, or having the same Figure 6 The different configurations shown.

[0106] Embodiments of this application also provide a computer-readable storage medium, which can be disposed in an electronic device to store at least one instruction or at least one program related to implementing a process communication control method in the method embodiment. The at least one instruction or the at least one program is loaded and executed by the processor to implement the process communication control method provided in the above method embodiment.

[0107] Optionally, in this embodiment, the storage medium may be located at at least one of the multiple network servers in a computer network. Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0108] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various alternative implementations described above.

[0109] As can be seen from the embodiments of the process communication control method, apparatus, device, server, terminal, storage medium, and program product provided in this application, the technical solution of this application obtains the target process characteristic information of the target application process by responding to the access ticket request of the target application process by the terminal. The access ticket request carries the target access address. Based on the pre-stored authentication information database, the target process characteristic information and the target access address are authenticated to obtain the process authentication result. If the process authentication result is successful, the access ticket request and the target process characteristic information are sent to the server, so that the server responds to the access ticket network request to perform synchronous risk identification on the target process characteristic information. If the synchronous risk identification result is that no risk is identified, the server sends the network access ticket corresponding to the access ticket network request to the terminal. In this way, the initial authentication of the process characteristic information and the target access address is performed at the terminal. Only when the authentication is successful is the corresponding information sent to the server. This achieves the initial screening of access ticket requests, significantly reducing access ticket request traffic. In scenarios with high-frequency access to business resources, it can effectively reduce the pressure on the server ticket service and reduce bandwidth consumption. At the same time, it reduces the latency of application access to the network, effectively improves the user experience, and enhances the availability of the process communication control system. Then, based on the network access ticket, a target network session connection corresponding to the access ticket request is established between the server. If an update operation to the pre-stored authentication information database is detected, secondary authentication processing is performed on the target process characteristic information based on the updated pre-stored authentication information database to obtain the secondary process authentication result. If the secondary process authentication result is authentication failure, the target network session connection is blocked. In this way, authentication information updates are detected on the terminal side, and secondary authentication is performed in a timely manner. Existing network session connections are blocked on the terminal, reducing the session detection and maintenance burden on the server side. The server does not need to disconnect and restart all network sessions on the terminal, thus improving session processing efficiency.

[0110] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, the above description focuses on specific embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims can be performed in a different order than that shown in the embodiments and still achieve the desired results. Additionally, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing are also possible or may be advantageous.

[0111] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device, equipment, and storage medium embodiments are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0112] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware, or by a program instructing the relevant hardware to implement them. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0113] The above are merely preferred embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A process communication control method, characterized in that, Applied to a terminal, the method includes: In response to an access ticket request from a target application process, the target process characteristic information of the target application process is obtained, wherein the access ticket request carries the target access address. The target process feature information is matched with the process blacklist in the pre-stored authentication information database; If the target process feature information does not match the process blacklist, the target process feature information and the target access address are matched with the business object mapping table of the pre-stored authentication information database. The business object mapping table represents the correspondence between the process feature information of the trusted application process and the business resource address table that the trusted application process is allowed to access. If the target process feature information exists in the business object mapping table, and the target access address exists in the business resource address table corresponding to the target process feature information, the process authentication result is determined to be authentication passed. The access ticket request and the target process feature information are sent to the server, so that the server responds to the access ticket request by performing synchronous risk identification on the target process feature information, and if the synchronous risk identification result is that no risk is identified, sends the network access ticket corresponding to the access ticket request to the terminal. Based on the network access ticket, a target network session connection corresponding to the access ticket request is established between the server; If an update operation of the pre-stored authentication information database is detected, a secondary authentication process is performed on the target process feature information based on the updated pre-stored authentication information database to obtain a secondary process authentication result. If the authentication result of the secondary process is that the authentication fails, the target network session connection is blocked.

2. The method according to claim 1, characterized in that, The method further includes: If the authentication process fails, the access ticket request is blocked.

3. The method according to claim 1, characterized in that, The method further includes: If the target process feature information matches the process blacklist, and / or the target access address does not exist in the business resource address table corresponding to the target process feature information, the process authentication result is determined to be authentication failure.

4. The method according to claim 1, characterized in that, The target process feature information includes the file path and last modification time of the executable file of the target application process, and the process blacklist includes process summary information of multiple risky processes; The step of matching the target process feature information with the process blacklist includes: The file path and the most recent modification time are mapped to obtain the target process summary information of the target application process. The target process digest information is matched with the process digest information in the process blacklist; If the target process summary information is not found in the process summary information of the process blacklist, it is determined that the target process feature information does not match the process blacklist.

5. The method according to claim 1, characterized in that, If the server determines that a risk exists in the synchronous risk identification result, it sends a ticket request failure response to the terminal; the method further includes: In response to the ticket request failure response, the access ticket request is blocked; The pre-stored authentication information database is updated based on the target process feature information.

6. The method according to claim 1, characterized in that, Before obtaining the target process characteristic information of the application process in response to the application process's access ticket request, the method further includes: In response to the startup of the target application process, a target process node corresponding to the target application process is created in the process chain of the dynamic process cache, and the process nodes in the process chain are set to correspond to the application process currently running on the terminal. Store the target process feature information into the target process node; The step of obtaining the target process feature information of the target application process includes: Find the target process node from the process list; Read the target process feature information from the target process node.

7. The method according to claim 1, characterized in that, Before obtaining the target process characteristic information of the target application process, the method further includes: In response to the access ticket request of the target application process, the target access address is matched based on a preset set of business resources, the preset set of business resources including the business resource addresses of multiple preset business objects; If the target access address exists among the business resource addresses of multiple preset business objects, the step of obtaining the target process characteristic information of the application process is executed.

8. A process communication control device, characterized in that, The device includes: Information acquisition module: used to obtain target process feature information of the target application process in response to the access ticket request of the target application process, wherein the access ticket request carries the target access address; The authentication module is used to match the target process feature information with a process blacklist in a pre-stored authentication information database. If the target process feature information does not match the process blacklist, the module matches the target process feature information and the target access address with a business object mapping table in the pre-stored authentication information database. The business object mapping table represents the correspondence between the process feature information of a trusted application process and the business resource address table that the trusted application process is allowed to access. If the target process feature information exists in the business object mapping table and the target access address exists in the business resource address table corresponding to the target process feature information, the process authentication result is determined to be successful. Information sending module: used to send the access ticket request and the target process feature information to the server, so that the server responds to the access ticket request to perform synchronous risk identification on the target process feature information, and sends the network access ticket corresponding to the access ticket request to the terminal if the synchronous risk identification result is that no risk is identified; Session connection establishment module: used to establish a target network session connection corresponding to the access ticket request between the network access ticket and the server; Secondary authentication module: When an update operation of the pre-stored authentication information database is detected, it performs secondary authentication processing on the target process feature information based on the updated pre-stored authentication information database to obtain the secondary process authentication result. Session blocking module: used to block the target network session connection if the authentication result of the secondary process is authentication failure.

9. The apparatus according to claim 8, characterized in that, The device further includes: Request blocking module: used to block the access ticket request if the authentication result of the process is authentication failure.

10. The apparatus according to claim 8, characterized in that, The authentication module includes an authentication result determination submodule, used for: If the target process feature information matches the process blacklist, and / or the target access address does not exist in the business resource address table corresponding to the target process feature information, the process authentication result is determined to be authentication failure.

11. The apparatus according to claim 8, characterized in that, The target process feature information includes the file path and last modification time of the executable file of the target application process, and the process blacklist includes process summary information of multiple risky processes; The authentication module includes a blacklist matching submodule, which includes: Information mapping processing unit: used to perform information mapping processing on the file path and the most recent modification time to obtain the target process summary information of the target application process; Summary information matching unit: used to match the target process summary information with the process summary information of the process blacklist; Matching result generation unit: used to determine that the target process feature information does not match the process blacklist when the target process summary information does not exist in the process summary information of the process blacklist.

12. The apparatus according to claim 9, characterized in that, If the server determines that there is a risk in the synchronous risk identification result, it sends a ticket request failure response to the terminal. The request blocking module is also used to block the access ticket request in response to the ticket request failure response; The device also includes an information database update module: used to update the pre-stored authentication information database based on the target process feature information.

13. The apparatus according to claim 8, characterized in that, The device further includes: Process node creation module: Before obtaining the target process characteristic information of the application process in response to the access ticket request of the application process, in response to the startup of the target application process, the module creates a target process node corresponding to the target application process in the process chain of the dynamic process cache, and the process nodes in the process chain are set to correspond to the application processes currently running on the terminal. Process feature information storage module: used to store the target process feature information to the target process node; The information acquisition module includes: Process Node Lookup Submodule: Used to find the target process node from the process list; Process feature information reading submodule: used to read the target process feature information from the target process node.

14. The apparatus according to claim 8, characterized in that, The device also includes: Access address matching module: Before obtaining the target process feature information of the target application process, in response to the access ticket request of the target application process, the module matches the target access address based on a preset business resource set, wherein the preset business resource set includes the business resource addresses of multiple preset business objects; Information acquisition triggering module: used to execute the step of acquiring the target process characteristic information of the application process when the target access address exists in the business resource addresses of multiple preset business objects.

15. A computer-readable storage medium, characterized in that, The storage medium stores at least one instruction or at least one program segment, which is loaded and executed by a processor to implement the process communication control method as described in any one of claims 1-7.

16. A computer device, characterized in that, The device includes a processor and a memory, the memory storing at least one instruction or at least one program, the at least one instruction or the at least one program being loaded and executed by the processor to implement the process communication control method as described in any one of claims 1-7.

17. A computer program product, characterized in that, The computer program product includes computer instructions that, when executed by a processor, implement the process communication control method as described in any one of claims 1-7.

Images