Resource access method and apparatus, electronic device, and storage medium

Abstract

The application provides a resource access method and device, electronic equipment and storage medium. The resource access method is applied to a firewall. A security policy is preset in the firewall. The security policy is used to verify whether an access request has access permission of a special resource in a sandbox. The special resource is prohibited from being accessed in a personal space outside the sandbox. The resource access method comprises the following steps: in response to detecting a first access request for a special resource in a sandbox from a personal space outside the sandbox; judging whether the first access request has access permission of the special resource based on the security policy; if yes, rejecting the first access request, and issuing a second access request for accessing the special resource in the sandbox, so as to access the special resource based on the second access request. A user with access permission can automatically jump into the sandbox for special resource access from outside the sandbox, so that the user realizes resource access jumping in a non-aware state, and the resource access experience of the user is improved.

Description

Technical Field

[0001] This application relates to the field of security protection technology, and in particular to a resource access method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the continuous development of computer technology, information security has become increasingly important. To achieve secure information protection, security software such as sandboxes and firewalls have emerged.

[0003] Currently, users frequently access resources using browsers. To ensure that certain resources are not leaked, access to these resources needs to be restricted to a secure working space, and this access needs to be monitored through preset security policies. The secure working space is a sandbox, and the security policies are configured in the firewall. Specifically, when a user needs to access a resource, if that resource is restricted to access only within the sandbox, the user needs to enable the sandbox on their terminal and access the resource using a browser within the sandbox. However, if the user is unaware that the resource access requires a sandbox, they may access the resource outside of it. After the resource access request is sent, the firewall intercepts the request, determining based on the security policy that the access should be within the sandbox, but since it wasn't actually done there, the firewall rejects the access request. Because the user is unaware that the resource access requires a sandbox, they will not transfer their access behavior from outside the sandbox to the secure sandbox, thus preventing the user from accessing the corresponding resource. In order to enable users to access these resources, it is necessary to inform users in advance that "access to resource XX needs to be done in the sandbox" to ensure that users can access the corresponding resources smoothly directly in the sandbox.

[0004] However, when there are a large number of users, the above-mentioned matters may not be communicated to every user in a timely manner. Some users may attempt to access the corresponding resources directly (outside of the sandbox) without being aware of these matters, resulting in access failure. Alternatively, some users may be aware of the matters but forget about them when accessing the resources and still attempt to access them directly (outside of the sandbox), also resulting in access failure. Ultimately, this leads to a poor user experience when accessing resources. Summary of the Invention

[0005] The purpose of this application is to provide a resource access method, apparatus, electronic device, and storage medium to improve the user's resource access experience.

[0006] To address the aforementioned technical problems, the embodiments of this application provide the following technical solutions:

[0007] The first aspect of this application provides a resource access method applied to a firewall. The firewall has a preset security policy that verifies whether an access request has access rights to a private resource within a sandbox. Access to the private resource is prohibited in personal spaces outside the sandbox. The method includes: responding to detecting a first access request from a personal space outside the sandbox for a private resource within the sandbox; determining whether the first access request has access rights to the private resource based on the security policy; if so, rejecting the first access request and issuing a second access request within the sandbox to access the private resource, thereby accessing the private resource based on the second access request.

[0008] Compared to existing technologies, the resource access method provided in the first aspect of this application verifies access permissions for requests made from outside the personal space to access private resources within the sandbox through a security policy. This ensures that requests with authorized access to private resources are ultimately made within the sandbox. Thus, even if a user with access permissions attempts to access a private resource outside the sandbox, they are automatically redirected to the sandbox. This allows users to seamlessly transition from outside to inside the sandbox, preventing them from being unable to access resources and avoiding a situation where they are unable to resolve the issue, thereby improving the user's resource access experience.

[0009] In some modified embodiments of the first aspect of this application, before responding to the detection of a first access request for a private resource within the sandbox issued from a personal space outside the sandbox, the method further includes: intercepting the target access request issued from outside the sandbox; determining whether the resource to be accessed by the target access request is a private resource; if so, then treating the target access request as the first access request.

[0010] By intercepting all access requests originating outside the sandbox and employing security policies to determine whether a request is intended to access private resources, compared to automatically submitting requests to access private resources, it is possible to prevent requests to access private resources outside the sandbox from being missed, thereby improving the comprehensiveness of access control for private resources within the sandbox.

[0011] In some modified embodiments of the first aspect of this application, the first access request is sent through a browser; determining whether the resource to be accessed by the target access request is a proprietary resource includes: determining whether the URL currently accessed by the browser matches the proprietary resource; if yes, then determining that the resource to be accessed by the target access request is a proprietary resource; if no, then determining that the resource to be accessed by the target access request is not a proprietary resource.

[0012] When determining whether an access request is for accessing a proprietary resource, the browser can accurately and quickly determine whether the current access request is for accessing a proprietary resource because the URL currently accessed by the browser can represent the resource that the user wants to access. This improves the accuracy and efficiency of proprietary resource access determination.

[0013] In some modified embodiments of the first aspect of this application, determining whether the URL currently accessed by the browser matches the proprietary resource includes: obtaining the Uniform Resource Locator (URL) in the URL currently accessed by the browser; extracting the domain name from the URL; determining whether the domain name matches the proprietary resource; if yes, then determining that the URL currently accessed by the browser matches the proprietary resource; if no, then determining that the URL currently accessed by the browser does not match the proprietary resource.

[0014] In the process of matching URLs with proprietary resources, the domain name in the URL is used to match the proprietary resource. Since the domain name can simply and accurately represent the resource, the efficiency of matching with proprietary resources can be improved, thereby improving the efficiency of moving access to proprietary resources from outside the sandbox to inside the sandbox.

[0015] In some modified embodiments of the first aspect of this application, the firewall and sandbox are installed inside the terminal; intercepting target access requests issued outside the sandbox includes: intercepting all access requests issued inside the terminal; deleting access requests issued inside the sandbox from all access requests to obtain the target access request.

[0016] In the process of intercepting access requests originating from outside the sandbox, all access requests within the terminal are intercepted, and access requests originating from within the sandbox are deleted from all access requests. This allows us to obtain access requests originating from outside the sandbox. Since all access requests within the terminal and access requests originating from within the sandbox can be easily obtained through the overall control of the terminal and the characteristics of the sandbox, the accuracy of obtaining access requests originating from outside the sandbox can be improved.

[0017] In some modified embodiments of the first aspect of this application, the security policy includes multiple sandboxes and their corresponding proprietary resources; before issuing a second access request for accessing the proprietary resources within a sandbox, the method further includes: determining the resource to be accessed based on the first access request; determining the target sandbox corresponding to the resource to be accessed based on the security policy; issuing a second access request for accessing the proprietary resources within a sandbox includes: issuing a second access request for accessing the proprietary resources within the target sandbox.

[0018] Before accessing a private resource within a sandbox, first determine the sandbox corresponding to the resource to be accessed, so that the access to the private resource takes place within the appropriate sandbox, ensuring smooth access to the private resource.

[0019] In some modified embodiments of the first aspect of this application, the first access request is sent through a browser; sending a second access request for accessing the proprietary resource within a sandbox includes: within the sandbox, launching a browser, and sending a second access request for accessing the proprietary resource through the launched browser.

[0020] When accessing private resources within a sandbox, if the access is made through a browser, restarting the browser and then accessing the private resources through the browser can minimize the risk of malicious tampering of the access request and ensure the security of private resource access.

[0021] In some modified embodiments of the first aspect of this application, the first access request is sent through a browser. When the first access request is a background operation, the URL does not exist in the URL currently accessed by the browser. Before rejecting the first access request, the method further includes: determining whether the URL can be obtained from the URL currently accessed by the browser; if yes, then the step of rejecting the first access request is performed; if no, then the first access request is allowed.

[0022] Before accessing proprietary resources within the sandbox, checking the presence of the URL in the browser's current address can distinguish whether the first access request is a normal access to the proprietary resource or a background operation. If it is determined to be a background operation, access to the proprietary resource within the sandbox will not be performed, thus improving the accuracy of proprietary resource access within the sandbox.

[0023] A second aspect of this application provides a resource access device applied to a firewall. The firewall has a preset security policy that verifies whether an access request has access rights to a private resource within a sandbox. Access to the private resource is prohibited in personal spaces outside the sandbox. The device includes: a response module for responding to a first access request from a personal space outside the sandbox for a private resource within the sandbox; a judgment module for determining whether the first access request has access rights to the private resource based on the security policy; if so, proceeding to the access module; and an access module for rejecting the first access request and issuing a second access request within the sandbox to access the private resource based on the second access request.

[0024] A third aspect of this application provides an electronic device, which includes a processor, a memory, and a bus; wherein the processor and the memory communicate with each other via the bus; the processor is used to call program instructions in the memory to execute the method in the first aspect.

[0025] A fourth aspect of this application provides a computer-readable storage medium, the storage medium comprising: a stored program; wherein, when the program is running, it controls the device where the storage medium is located to execute the method of the first aspect.

[0026] The resource access device provided in the second aspect, the electronic device provided in the third aspect, and the computer-readable storage medium provided in the fourth aspect of this application have the same or similar beneficial effects as the resource access method provided in the first aspect. Attached Figure Description

[0027] The above and other objects, features, and advantages of exemplary embodiments of this application will become readily understood by reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of this application are illustrated by way of example and not limitation, with the same or corresponding reference numerals denoteing the same or corresponding parts, wherein:

[0028] Figure 1 This is a schematic diagram of the scenario architecture for the resource access method in the embodiments of this application. Figure 1 ;

[0029] Figure 2 This is a flowchart illustrating the resource access method in the embodiments of this application. Figure 1 ;

[0030] Figure 3 This is a flowchart illustrating the resource access method in the embodiments of this application. Figure 2 ;

[0031] Figure 4 This is a flowchart illustrating the resource access method in the embodiments of this application. Figure 3 ;

[0032] Figure 5 This is a schematic diagram of the structure of the resource access device in the embodiments of this application. Figure 1 ;

[0033] Figure 6 This is a schematic diagram of the structure of the resource access device in the embodiments of this application. Figure 2 ;

[0034] Figure 7 This is a schematic diagram of the structure of the electronic device in the embodiments of this application. Detailed Implementation

[0035] Exemplary embodiments of this application will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of this application are shown in the drawings, it should be understood that this application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of this application and to fully convey the scope of this application to those skilled in the art.

[0036] It should be noted that, unless otherwise stated, the technical or scientific terms used in this application shall have the ordinary meaning as understood by one of ordinary skill in the art to which this application pertains.

[0037] Currently, certain resources are only accessible within a sandbox. To ensure users can access these resources smoothly, they need to be informed beforehand that access requires being within the sandbox. However, users may unknowingly or forgetting to access resources directly outside the sandbox, leading to access failures. Users then need to investigate the cause of the failure, resulting in a poor user experience.

[0038] In view of this, embodiments of this application provide a resource access method, apparatus, electronic device, and storage medium. For access requests originating from a personal space outside the sandbox for accessing proprietary resources within the sandbox, the method performs permission verification based on a security policy. Upon successful verification, it automatically accesses the proprietary resources within the sandbox. Thus, even if a user unknowingly accesses proprietary resources outside the sandbox, as long as they have the necessary access permissions, they can be automatically redirected to the sandbox to access the proprietary resources without being aware of it, improving the user's resource access experience.

[0039] First, the scenario architecture of the resource access method provided in the embodiments of this application will be described.

[0040] Figure 1 This is a schematic diagram of the scenario architecture for the resource access method in the embodiments of this application. Figure 1 See Figure 1 As shown, the scenario architecture may include: firewall 11 and sandbox 12.

[0041] Firewall 11 refers to the gateway device that allows or denies access. Firewall 11 has preset security policies. These policies verify whether an access request has permission to access private resources within the sandbox. Access to private resources is prohibited in the personal space outside the sandbox.

[0042] Sandbox 12 provides a closed environment. Programs running within this environment cannot modify files, the registry, or related objects on the local system, ensuring program security.

[0043] For access to important or sensitive proprietary resources, administrators can pre-configure the security policy of firewall 11, specifically configuring the authentication methods for proprietary resources and their access permissions. When a user accesses a proprietary resource, if the access is within sandbox 12, firewall 11 does not intervene. If the access is outside sandbox 12, firewall 11 will intercept the access request and verify whether the access request has the necessary permissions based on the security policy. If the user does not have the necessary permissions, the access request will be rejected. If the user has the necessary permissions, it means that the user with the required permissions has accessed the proprietary resource outside sandbox 12, so the access request will be rejected, and the user will re-initiate the access request for the proprietary resource within sandbox 12. In this way, access to proprietary resources can be achieved without the user's knowledge.

[0044] The resources mentioned here can refer to various business resources, such as wiki systems, office automation (OA) systems, etc.

[0045] Next, the resource access method provided in the embodiments of this application will be described in detail.

[0046] Figure 2 This is a flowchart illustrating the resource access method in the embodiments of this application. Figure 1 See Figure 2 As shown, the method may include:

[0047] S21: In response to the detection of a first access request for a private resource within the sandbox originating from a personal space outside the sandbox.

[0048] Within the firewall's jurisdiction, all access requests are intercepted and evaluated to determine whether access is allowed or denied. In this step, however, only access requests originating from outside the sandbox's personal space targeting private resources within the sandbox are blocked.

[0049] In the specific interception process, all access requests can be intercepted first. Then, from the intercepted requests, requests originating from within the sandbox and those accessing non-proprietary resources can be allowed through. This effectively intercepts access requests from outside the personal space targeting proprietary resources within the sandbox. All access requests are intercepted using existing firewall request interception methods. The identification of access requests originating from within the sandbox is based on whether the request carries sandbox-related information or characteristics. The identification of non-proprietary resource access requests is based on whether the request carries characteristics related to proprietary resources.

[0050] Alternatively, configuration can be done on the dedicated resource server. Upon receiving an access request, the server can determine whether the request originated within the sandbox. If so, it provides feedback based on the request; otherwise, it forwards the request to the firewall. This way, the firewall receives access requests from outside the personal space targeting dedicated resources within the sandbox. The server's determination of whether an access request originates within or outside the sandbox can be based on sandbox characteristics. If the access request contains sandbox characteristics, it's determined that the request originated within the sandbox; otherwise, it's determined that the request originated outside the sandbox.

[0051] S22: Determine whether the first access request has access permissions to the proprietary resource based on the security policy. If yes, proceed to S23; otherwise, proceed to S24.

[0052] Since security policies are used to verify whether access requests have the necessary permissions for proprietary resources, they must include not only the identifier of the proprietary resource but also the identifier of the permissions. In practice, the identifier of the proprietary resource can refer to its Internet Protocol (IP) address, name, etc., while the identifier of the permissions can refer to the username, password, etc.

[0053] Upon detecting an access request for a private resource originating outside the sandbox, the system can determine two things: first, whether the request contains the IP address and name of the private resource; and second, whether the username and password carried in the request match the username and password specified in the security policy for accessing private resources. If both of these conditions are met, the access request originating outside the sandbox is deemed to have permission to access the private resource. If at least one of these conditions is not met, the access request either attempts to access a non-private resource or lacks the necessary permission to access a private resource, thus determining that the access request originating outside the sandbox does not have permission to access the private resource.

[0054] S23: Deny the first access request and issue a second access request for accessing the proprietary resource within the sandbox, so as to access the proprietary resource based on the second access request.

[0055] After determining that the first access request has the permission to access the private resource, but the first access request did not go through the sandbox, in order to ensure that the user can successfully access the private resource, a second access request is generated within the sandbox based on the first access request, and the second access request is sent through the sandbox. In this way, the access request for the private resource is migrated from outside the sandbox to inside the sandbox, thereby enabling successful access to the private resource.

[0056] In the process of generating a second access request based on a first access request, the first access request can be directly copied to obtain the second access request. Alternatively, the access object, access password, and other relevant access information can be determined based on the first access request, and then the second access request can be regenerated based on that information.

[0057] S24: Deny first access request.

[0058] Once it is determined that the first access request does not have the permission to access the proprietary resource, the first access request should be rejected regardless of whether the access request is sent from inside or outside the sandbox, in order to prevent access to the proprietary resource.

[0059] When the first access request is denied, it can be discarded directly, or a denial message can be generated based on the first access request and sent to the user. In this way, the user can know the specific reason why their access was denied, namely that they do not have permission to access the proprietary resource, thereby helping the user to obtain access permission as soon as possible and speeding up the access process for the proprietary resource.

[0060] As described above, the resource access method provided in this application verifies access permissions for requests originating from outside the personal space to access private resources within the sandbox through a security policy. This ensures that requests with authorized access to private resources are ultimately made within the sandbox. Thus, even if a user with authorized access attempts to access a private resource outside the sandbox, the user is automatically redirected to the sandbox. This allows for seamless access to private resources without the user being aware of the process, preventing a situation where the user cannot access resources and is unable to resolve the issue, thereby improving the user's resource access experience.

[0061] Furthermore, as a response to Figure 2 In a refinement and extension of the method shown, this application also provides a resource access method.

[0062] Figure 3 This is a flowchart illustrating the resource access method in the embodiments of this application. Figure 2 See Figure 3 As shown, the method may include:

[0063] S31: Intercept target access requests originating from outside the sandbox.

[0064] To prevent users from accessing private resources that need to be accessed within the sandbox from outside the sandbox, the firewall first blocks all access requests outside the sandbox, i.e., the target access requests, and then allows access to non-private resources while blocking access to private resources.

[0065] Since sandboxes are installed within a specific terminal, and the firewall installed on that terminal is designed to ensure that access to private resources within that terminal occurs within the sandbox, the target access requests intercepted in this case are those originating from within the terminal.

[0066] Specifically, step S31 above may include:

[0067] Step A1: Intercept all access requests sent by the terminal.

[0068] The specific blocking method is the same as that of a regular firewall blocking requests, so it will not be described in detail here.

[0069] Step A2: Delete the access requests issued within the sandbox from all access requests to obtain the target access request.

[0070] Among all the access requests sent by the intercepted terminal, some were sent from inside the sandbox and some were sent from outside the sandbox. Access requests sent from inside the sandbox may carry the sandbox's identifier or the inherent format of the sandbox's message sending, making them easy to identify. Therefore, access requests sent from inside the sandbox can be identified and allowed among all access requests, while the remaining ones are target access requests sent from outside the sandbox, which can be intercepted.

[0071] S32: Determine whether the resource requested by the target access request is a private resource. If not, proceed to S33; if yes, proceed to S34.

[0072] Generally, access requests include an identifier of the resource to be accessed, allowing gateway devices to forward the request and perform security checks. For example, the access request might include the destination IP address and port, enabling the gateway device to determine the target resource and forward the request accordingly. Alternatively, the access request can also include the resource name for forwarding. Therefore, by comparing the resource-related identifiers in the target access request with predefined identifiers for proprietary resources, it can be determined whether the resource is proprietary.

[0073] In addition, if the first access request is sent through a browser, the URL in the browser can be used to determine whether the target access request is accessing a proprietary resource.

[0074] Specifically, step S32 above may include:

[0075] Step B1: Determine if the URL currently accessed by the browser matches the proprietary resource. If yes, proceed to step B2; otherwise, proceed to step B3.

[0076] Step B2: Determine that the resource requested by the target access request is a private resource.

[0077] Step B3: Determine that the resource requested by the target access request is not a proprietary resource.

[0078] During the matching process, the currently displayed URL can be extracted directly from the browser's address bar. Then, the similarity between the URL and the resource name is calculated. If the similarity is higher than a certain preset value, it means that the URL is the accessed proprietary resource. If the similarity is equal to or lower than a certain preset value, it means that the URL is not the accessed proprietary resource, but may be a non-proprietary resource or another operation.

[0079] In addition to extracting the URL, the domain name can be extracted from the URL first, and then the domain name can be matched with the name of the proprietary resource. This reduces the amount of matching, improves matching efficiency, and thus improves resource access efficiency.

[0080] Specifically, step B1 above may include:

[0081] Step B11: Obtain the URL from the URL currently accessed by the browser.

[0082] Step B12: Extract the domain name from the URL.

[0083] Step B13: Determine if the domain name matches the proprietary resource. If yes, proceed to B14; otherwise, proceed to B15.

[0084] Step B14: Determine if the URL currently accessed by the browser matches the proprietary resource.

[0085] Step B15: Determine that the URL currently accessed by the browser does not match the proprietary resource.

[0086] Finding the currently accessed website in the browser, extracting the URL from the website, and extracting the domain name from the URL are all conventional methods of information extraction in the browser, which will not be elaborated here.

[0087] Security policies can also include the domain names of proprietary resources. This way, after extracting the URL from the currently accessed website and then the domain name from the URL, the domain name can be directly matched against the domain names in the security policy. If a match is successful, it means the currently accessed website matches the proprietary resource; if a match fails, it means the currently accessed website does not match the proprietary resource. Of course, the security policy can also include the name of the proprietary resource to match the domain name extracted from the browser.

[0088] S33: Access request via target.

[0089] If the target access request is not to access a private resource, it means that the target access request can be accessed outside the sandbox. In this case, the target access request can be allowed to access the resource, that is, the target access request can be forwarded, or the target access request can be sent successfully.

[0090] S34: Treat the target access request as the first access request.

[0091] If the target access request is for a private resource, and the target access request is currently being made outside the sandbox, then the target access request is the first access request from the personal space outside the sandbox to the private resource inside the sandbox that the firewall needs to pay special attention to.

[0092] S35: In response to detecting a first access request for a private resource within the sandbox originating from a personal space outside the sandbox.

[0093] Once a first access request for a private resource within the sandbox is detected from a personal space outside the sandbox, a response must be given to the first access request to ensure that access to the private resource is conducted within the sandbox in accordance with security requirements.

[0094] S36: Determine whether the first access request has access permissions to the proprietary resource based on the security policy. If not, proceed to S39; if yes, proceed to S37.

[0095] The security policy includes verification methods for access permissions to private resources. For example, the security policy contains usernames or keys for access permissions to private resources. When the username or password carried in the first access request matches the username or password in the security policy, it is determined that the first access request has permission; otherwise, it is determined that the first access request does not have permission.

[0096] Although the first access request is made outside the sandbox to access a private resource, it does not have the necessary permissions to access that resource. Therefore, the first access request should still be rejected. The rejection can be achieved by discarding the request, not responding, or sending a rejection message.

[0097] Generally, the first access request can be made through a browser to access the resource. A browser not only allows users to access the resource but also allows administrators to perform background operations on it. Since administrators have high-level privileges for background operations on resources and do not require a sandbox, after confirming that the first access request outside the sandbox has access to the dedicated resource, it is still necessary to exclude administrator operation requests.

[0098] S37: Determine if the URL can be obtained from the currently accessed URL of the browser. If not, proceed to S38; if yes, proceed to S39.

[0099] After determining that the first access request is for a private resource outside the sandbox and that the first access request has the necessary permissions, it is still necessary to determine whether the first access request is a background operation before finally transferring the access request into the sandbox. Since background operations are fewer in number than access operations, determining whether they are background operations at the end will not affect the earlier determination of access requests, thus improving resource access efficiency.

[0100] When the access request is a user's access operation, the URL will be present in the browser's current URL list, and this URL corresponds to the accessed resource. When the access request is a background operation, the URL will not be present in the browser's current URL list. This is because the request in this case is not the same as the request made during the access process, but rather an operation performed by the administrator in the background, which requires no request and is executed directly.

[0101] In the specific judgment, the URL can be obtained directly from the browser's address bar, and the URL can be extracted based on the characteristics of the URL. If the extraction is successful, the URL can be obtained from the URL currently accessed by the browser. If the extraction fails, the URL cannot be obtained from the URL currently accessed by the browser.

[0102] S38: Passing the first access request.

[0103] Although the first access request at this time is an operation request for a private resource outside the sandbox, it is a background operation of the private resource by the administrator and can be performed without being in the sandbox. Therefore, the first access request is approved.

[0104] S39: Deny first access request.

[0105] The first access request at this point is a request to access private resources outside the sandbox. This request is not allowed outside the sandbox and must be rejected. The rejection process can be either to give no response or to send a rejection message.

[0106] After determining that the first access request outside the sandbox needs to access a dedicated resource within the sandbox, and considering the diverse nature of resources and the varied functions of sandboxes, different resources are restricted to different sandboxes. For example, access to resources A and B needs to be performed in sandbox 1, while access to resource C needs to be performed in sandbox 2. Therefore, it is also necessary to determine in which sandbox the currently accessed dedicated resource should be accessed.

[0107] S310: Determine the resource to be accessed based on the first access request.

[0108] Access requests typically include the IP address, port, and domain name of the resource to be accessed. By analyzing the information in the initial access request, the specific resource to be accessed can be determined.

[0109] S311: Determine the target sandbox corresponding to the resource to be accessed based on the security policy.

[0110] Security policies typically include multiple sandboxes and their corresponding dedicated resources. The mapping between sandboxes and dedicated resources in a security policy can be pre-configured by the user or automatically obtained by connecting to various sandboxes.

[0111] S312: Issue a second access request within the target sandbox for accessing proprietary resources.

[0112] If the first access request is sent through a browser, then the browser can be launched inside the target sandbox, and the URL entered in the browser outside the sandbox can be re-entered into the browser launched inside the sandbox to prevent the request from being tampered with and to achieve accurate access to the proprietary resources.

[0113] Specifically, step S312 above may include:

[0114] Step C1: Within the sandbox, launch the browser and issue a second access request through the launched browser to access the proprietary resource, thereby accessing the proprietary resource based on the second access request.

[0115] The first step is to check if the sandbox is enabled to prevent secure access to dedicated resources from occurring outside the sandbox. This is done by checking if any sandbox-related threads exist in the system. If they exist, the sandbox is enabled; otherwise, it is disabled. If the sandbox is disabled, it is enabled automatically, and the browser is launched within it. If the sandbox is already enabled, the browser is launched directly within the sandbox.

[0116] Once the browser inside the sandbox is started, you can enter the URL that you previously entered in the browser outside the sandbox, and then send a second access request. Alternatively, you can modify the first access request to adapt to the sandbox environment and obtain a second access request, which the browser will then send. This ultimately enables access to proprietary resources, transferring access from outside the sandbox to inside the sandbox without the user's awareness, thus improving the efficiency of resource access.

[0117] Finally, a complete example will be used to illustrate the resource access method provided in the embodiments of this application.

[0118] Figure 4 This is a flowchart illustrating the resource access method in the embodiments of this application. Figure 3 See Figure 4 As shown, the method may include:

[0119] S41: Users access business resources through their personal workspaces.

[0120] A personal workspace is the opposite of a secure workspace. A workspace is a space where multiple programs can run. Each program can access its own resources. A secure workspace isolates its programs from external programs, preventing data leakage. A personal workspace, however, does not provide strict data isolation between its programs and external programs.

[0121] The safe workspace here can be considered as being inside the sandbox mentioned above. The personal workspace, on the other hand, can be considered as being outside the sandbox.

[0122] When users access business resources through their personal workspaces, access requests are sent out outside the sandbox.

[0123] S42: The firewall intercepts the access request and determines whether to allow it based on the security policy. If yes, proceed to S43; otherwise, proceed to S44.

[0124] The domain name to be accessed is determined from the access request. Since the security policy is configured with the domain names corresponding to resources that need to be accessed within the sandbox, the domain name determined from the access request is matched with the domain names in the security policy. If the match fails, it means that the access does not need to be performed within the sandbox and can be allowed. If the match succeeds, it means that the access needs to be performed within the sandbox, but the access is currently outside the sandbox and cannot be allowed.

[0125] S43: Allow access request.

[0126] S44: Get the URL of the currently accessed website from the browser.

[0127] S45: Obtain the URL domain name and iterate through the security policies to verify whether it can be accessed within the corresponding secure workspace. If yes, proceed to S46; otherwise, proceed to S47.

[0128] The security policy not only configures the domain names corresponding to resources that need to be accessed within the sandbox, but also the authentication methods for accessing those domain names. Therefore, by checking the URL domain name in conjunction with the security policy, we can verify whether the username, password, and other information contained in the URL domain name match the username and password specified in the security policy. If they match, authentication is successful; otherwise, authentication fails.

[0129] S46: Open a browser within a secure workspace and access business resources.

[0130] This means launching a browser in a secure workspace and entering the previously obtained domain name, URL, or website address into the browser to access the corresponding business resources.

[0131] S47: Access request denied.

[0132] This concludes the description of the resource access methods provided in the embodiments of this application.

[0133] Based on the same inventive concept, as an implementation of the above method, this application also provides a resource access device. This device is applied to a firewall, which has a preset security policy. The security policy verifies whether an access request has access permissions to a private resource within the sandbox; access to the private resource is prohibited in the personal space outside the sandbox.

[0134] Figure 5 This is a schematic diagram of the structure of the resource access device in the embodiments of this application. Figure 1 See Figure 5 As shown, the device may include a response module 51, a judgment module 52, and an access module 53. The interception module 51, the judgment module 52, and the access module 53 are connected sequentially.

[0135] Response module 51 is used to respond to the detection of a first access request for a private resource within the sandbox from a personal space outside the sandbox.

[0136] The judgment module 52 is used to determine whether the first access request has access permissions to the proprietary resource based on the security policy. If so, it proceeds to the access module 53.

[0137] Access module 53 is used to reject the first access request and issue a second access request for accessing the proprietary resource within the sandbox, so as to access the proprietary resource based on the second access request.

[0138] Furthermore, as a response to Figure 5 Further refinement and expansion of the illustrated device, this application embodiment also provides a resource access device. In this device, a firewall and a sandbox are installed within the terminal. The first access request is sent through a browser. When the first access request is a background operation, the URL currently accessed by the browser does not exist. The security policy includes multiple sandboxes and their corresponding proprietary resources.

[0139] Figure 6 This is a schematic diagram of the structure of the resource access device in the embodiments of this application. Figure 2 See Figure 6 As shown, the device may include: an interception module 61, a response module 62, a first judgment module 63, a second judgment module 64, a release module 65, a denial module 66, and an access module 68. The interception module 61, response module 62, first judgment module 63, second judgment module 64, denial module 66, and access module 68 are connected sequentially. The release module 65 is connected to the second judgment module 64.

[0140] The interception module 61 includes a request interception unit 611, a resource judgment unit 612, and a request determination unit 613. The request interception unit 611, the resource judgment unit 612, and the request determination unit 613 are connected sequentially.

[0141] Request interception unit 611 is used to intercept target access requests originating from outside the sandbox.

[0142] The request interception unit 611 is specifically used to intercept all access requests sent by the terminal; delete the access requests sent from the sandbox among all access requests to obtain the target access request.

[0143] Resource determination unit 612 is used to determine whether the resource requested by the target access request is a private resource. If so, the request determination unit 613 is then entered.

[0144] The resource determination unit 612 is specifically used to determine whether the URL currently accessed by the browser matches the proprietary resource; if yes, it determines that the resource to be accessed by the target access request is a proprietary resource; if no, it determines that the resource to be accessed by the target access request is not a proprietary resource.

[0145] The resource judgment unit 612 is specifically used to obtain the URL in the URL currently accessed by the browser; extract the domain name from the URL; determine whether the domain name matches the proprietary resource; if yes, then determine that the URL currently accessed by the browser matches the proprietary resource; if no, then determine that the URL currently accessed by the browser does not match the proprietary resource.

[0146] The request determination unit 613 is used to determine the target access request as the first access request.

[0147] Response module 62 is used to respond to the detection of a first access request for a private resource within the sandbox originating from a personal space outside the sandbox.

[0148] The first judgment module 63 is used to determine whether the first access request has access permissions to the proprietary resource based on the security policy. If so, it proceeds to the second judgment module 64.

[0149] The second judgment module 64 is used to determine whether the URL can be obtained from the URL currently accessed by the browser. If not, it proceeds to the allow module 65; if so, it proceeds to the deny module 66.

[0150] Release module 65 is used to grant access to the first access request.

[0151] Module 66 is used to reject the first access request.

[0152] The determination module 67 includes a resource determination unit 671 and a sandbox determination unit 672. The resource determination unit 671 is connected to the sandbox determination unit 672.

[0153] Resource determination unit 671 is used to determine the resource to be accessed based on the first access request.

[0154] The sandbox determination unit 672 is used to determine the target sandbox corresponding to the resource to be accessed based on the security policy.

[0155] Access module 68 is used to issue a second access request for accessing proprietary resources within the target sandbox, so as to access proprietary resources based on the second access request.

[0156] Access module 68 is specifically used to launch a browser within the sandbox and issue a second access request for accessing proprietary resources through the launched browser.

[0157] It should be noted that the description of the above device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0158] Based on the same inventive concept, embodiments of this application also provide an electronic device.

[0159] Figure 7 This is a schematic diagram of the electronic device in an embodiment of this application. See also... Figure 7 As shown, the electronic device may include: a processor 71, a memory 72, and a bus 73; wherein the processor 71 and the memory 72 communicate with each other through the bus 73; the processor 71 is used to call program instructions in the memory 72 to execute the methods in one or more of the above embodiments.

[0160] It should be noted that the descriptions of the above electronic device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the electronic device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0161] Based on the same inventive concept, embodiments of this application also provide a computer-readable storage medium, which may include: a stored program; wherein, when the program is running, it controls the device where the storage medium is located to execute the methods in one or more of the above embodiments.

[0162] It should be noted that the descriptions of the storage medium embodiments above are similar to those of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0163] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A resource access method, characterized by, The method is applied to a firewall, wherein a security policy is preset in the firewall, the security policy is used to verify whether an access request has access right of a resource in a sandbox, and the resource is prohibited to be accessed from a personal space outside the sandbox; the method comprises: in response to detecting a first access request for a resource in the sandbox from the personal space outside the sandbox; judging whether the first access request has access right of the resource based on the security policy; if yes, rejecting the first access request, and issuing a second access request for accessing the resource in the sandbox to access the resource based on the second access request.

2. The method of claim 1, wherein, Before the step of responding to detecting a first access request for a resource in the sandbox from the personal space outside the sandbox, the method further comprises: intercepting a target access request from outside the sandbox; judging whether a resource to be accessed by the target access request is the resource; if yes, taking the target access request as the first access request.

3. The method of claim 2, wherein, The first access request is issued through a browser; the step of judging whether a resource to be accessed by the target access request is the resource comprises: judging whether a current accessed website of the browser matches the resource; if yes, determining that the resource to be accessed by the target access request is the resource; if no, determining that the resource to be accessed by the target access request is not the resource.

4. The method of claim 3, wherein, The step of judging whether a current accessed website of the browser matches the resource comprises: acquiring a URL in the current accessed website of the browser; extracting a domain name from the URL; judging whether the domain name matches the resource; if yes, determining that the current accessed website of the browser matches the resource; if no, determining that the current accessed website of the browser does not match the resource.

5. The method of claim 2, wherein, The firewall and the sandbox are installed in a terminal; the step of intercepting a target access request from outside the sandbox comprises: intercepting all access requests issued by the terminal; deleting access requests issued in the sandbox from the all access requests to obtain the target access request.

6. The method according to any one of claims 1 to 5, characterized in that, The security policy comprises a plurality of sandboxes and corresponding resources of the sandboxes; Before the step of issuing a second access request for accessing the resource in the sandbox, the method further comprises: determining a resource to be accessed according to the first access request; determining a target sandbox corresponding to the resource to be accessed according to the security policy; The step of issuing a second access request for accessing the resource in the sandbox comprises: issuing a second access request for accessing the resource in the target sandbox.

7. The method according to any one of claims 1 to 5, characterized in that, The first access request is issued through a browser; the step of issuing a second access request for accessing the resource in the sandbox comprises: in the sandbox, starting the browser, and issuing a second access request for accessing the resource through the started browser.

8. The method according to any one of claims 1 to 5, characterized in that, The first access request is sent through a browser, and when the first access request is a background operation, no URL exists in a website currently accessed by the browser; before the first access request is rejected, the method further includes: determining whether a URL can be obtained from the website currently accessed by the browser; if yes, performing the step of rejecting the first access request; if no, sending the first access request.

9. A resource access device, characterized by The device is applied to a firewall, and a security policy is preset in the firewall, the security policy is used to verify whether an access request has access authority of a special resource in a sandbox, and the special resource is prohibited to be accessed in a personal space outside the sandbox; the device includes: a response module, used to respond to a first access request for a special resource in the sandbox sent from a personal space outside the sandbox; a judgment module, used to judge, based on the security policy, whether the first access request has the access authority of the special resource; if yes, entering an access module; the access module, used to reject the first access request, and send a second access request for accessing the special resource in the sandbox, so as to access the special resource based on the second access request.

10. An electronic device, comprising: The electronic device includes a processor, a memory and a bus; the processor, the memory and the bus complete communication with each other through the bus; the processor is used to call program instructions in the memory, so as to execute the method in any one of claims 1 to 8.

11. A computer readable storage medium, characterized in that, The storage medium includes a stored program; when the program runs, the storage medium controls a device where the storage medium is located to execute the method in any one of claims 1 to 8.

Images