Access control method and device based on stability

Abstract

The embodiments of the present specification provide a stability-based access control method and device, wherein the stability-based access control method includes: obtaining asset data, grouping assets based on the asset data, and determining at least two asset groups; determining a target dimension, obtaining target access data between assets of at least two asset groups based on the target dimension; determining the stability of the access relationship of at least two asset groups based on the target access data; and determining an access control policy based on the stability of the access relationship. By obtaining target access data between assets of at least two asset groups based on the target dimension, determining the stability of the access relationship of at least two asset groups based on the target access data, and determining an access control policy based on the stability of the access relationship, it is possible to implement a stability assessment of the access relationship, and configure the access control policy based on the result of the stability assessment, thereby improving security.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of network security technology, and in particular to a stability-based access control method. Background Art

[0002] When users want to implement secure network access control for a business system environment, relatively stable access relationships are the cornerstone of configuring access control policies. For example, when configuring a whitelist access control policy, the access relationships of existing businesses will be observed and sorted out, and then whitelist policies will be configured based on the sorted stable access relationships to ensure that the access control policy matches a stable business baseline.

[0003] During this process, customers hope that the access control policy can achieve a balance between business stability, protection security, and low maintenance costs. In other words, the configuration of the whitelist policy can not only prevent business access from being blocked, but also ensure that the policy configuration based on the business access relationship is stable, reducing unnecessary frequent changes that lead to excessively high operation and maintenance costs.

[0004] To achieve this goal, only by making macroscopic observations and descriptions of microscopic data can we discover and summarize relatively stable relationship perspectives; if the perspective of observation and analysis of sampled access relationship data is too atomic, the configuration of whitelist access policies based on this overly fine-grained access relationship perspective will also be unstable. Either the access control policy is missing, resulting in normal business access being blocked; or the policy needs to be changed frequently, resulting in extremely high maintenance costs; for example, in a service process using dynamic ports and a container environment with dynamic IP, the stability of all access policies configured based on the perspective of specific IP and ports is extremely poor. When the IP and port change (when the business service attributes of the computing asset itself do not change, but only the IP address changes dynamically, there is no need to frequently change the maintenance policy.), the original policy becomes invalid, and new security policies need to be added in a timely manner, resulting in extremely high maintenance costs.

[0005] In existing practices, the network department either asks the business department to actively provide an access relationship table (for example, IP A1 accesses port P1 of IP B1), or uses specific network devices to capture and learn network traffic for a period of time, and then directly obtains the access relationship (for example: the 5-tuple information of the traffic session, original IP, original port, protocol, destination IP, destination port), and uses the atomic access relationship captured by the traffic to directly configure access control policies based on this.

[0006] The above method is difficult to grasp and provide complete, accurate and stable access relationships, so users cannot establish any stable access control or management strategy, which brings security risks. Therefore, a better solution is urgently needed. Summary of the invention

[0007] In view of this, the embodiments of this specification provide an access control method based on stability. One or more embodiments of this specification also relate to an access control device based on stability, a computing device, a computer-readable storage medium and a computer program to solve the technical defects existing in the prior art.

[0008] According to a first aspect of an embodiment of this specification, a stability-based access control method is provided, including:

[0009] Acquire asset data, group the assets based on the asset data, and determine at least two asset groups;

[0010] Determine a target dimension, and obtain target access data between at least two asset grouping assets based on the target dimension;

[0011] Determining access relationship stability of at least two asset groups based on the target access data;

[0012] Determine the access control strategy based on the stability of the access relationship.

[0013] In a possible implementation, assets are grouped based on the asset data to determine at least two asset groups, including:

[0014] Determine the business information, location information, environment information, application information and role information of asset data;

[0015] The assets are grouped based on the business information, location information, environment information, application information, and role information to determine at least two asset groups.

[0016] In a possible implementation, determining a target dimension, and acquiring target access data between at least two asset grouping assets based on the target dimension, includes:

[0017] Determining a first asset grouping and a second asset grouping based on the target dimension;

[0018] Acquire the communication record between the first asset group and the second asset group;

[0019] Based on the communication records, determine the target access data.

[0020] In a possible implementation, determining target access data based on the communication record includes:

[0021] determining communication assets based on communication records;

[0022] Determining access progress based on communication assets;

[0023] Determining a communication port based on an access process;

[0024] Target access data based on communication assets, access processes, and communication ports.

[0025] In a possible implementation, determining the access relationship stability of at least two asset groups based on the target access data includes:

[0026] determining a target time period, and determining stable assessment data from the target access data based on the target time period;

[0027] Based on the stability assessment data and the stability assessment algorithm, the access relationship stability of at least two asset groups is determined.

[0028] In a possible implementation, based on the stability evaluation data and the stability evaluation algorithm, determining the access relationship stability of at least two asset groups includes:

[0029] Determine a first access set and a second access set based on the stable evaluation data; wherein the first access set and the second access set have different time nodes;

[0030] determining a set change difference based on the first access set and the second access set;

[0031] Based on the set change difference and the stability evaluation algorithm, the access relationship stability of at least two asset groups is determined.

[0032] In one possible implementation, the stability assessment algorithm includes:

[0033] A =1-(C2-C1) / C1;

[0034] Wherein, A represents stability, C1 represents the first access set, and C2 represents the second access set.

[0035] According to a second aspect of an embodiment of this specification, there is provided an access control device based on stability, comprising:

[0036] An asset grouping module is configured to obtain asset data, group the assets based on the asset data, and determine at least two asset groups;

[0037] A data determination module is configured to determine a target dimension, and obtain target access data between at least two asset grouping assets based on the target dimension;

[0038] a stability determination module configured to determine the access relationship stability of at least two asset groups based on the target access data;

[0039] The policy configuration module is configured to determine the access control policy based on the stability of the access relationship.

[0040] According to a third aspect of an embodiment of this specification, a computing device is provided, including:

[0041] Memory and processor;

[0042] The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions. When the computer executable instructions are executed by the processor, the steps of the above-mentioned stability-based access control method are implemented.

[0043] According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the above-mentioned stability-based access control method are implemented.

[0044] According to a fifth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned stability-based access control method.

[0045] The embodiments of the present specification provide a stability-based access control method and device, wherein the stability-based access control method includes: obtaining asset data, grouping assets based on the asset data, and determining at least two asset groups; determining a target dimension, obtaining target access data between assets of at least two asset groups based on the target dimension; determining the stability of the access relationship of at least two asset groups based on the target access data; and determining an access control policy based on the stability of the access relationship. By obtaining target access data between assets of at least two asset groups based on the target dimension, determining the stability of the access relationship of at least two asset groups based on the target access data, and determining an access control policy based on the stability of the access relationship, it is possible to implement a stability assessment of the access relationship, and configure the access control policy based on the result of the stability assessment, thereby improving security. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 is a flow chart of a stability-based access control method provided by an embodiment of this specification;

[0047] Figure 2 It is a structural diagram of a stability-based access control device provided by an embodiment of this specification;

[0048] Figure 3 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0049] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0050] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0051] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0052] In this specification, a stability-based access control method is provided. This specification also relates to a stability-based access control apparatus, a computing device, and a computer-readable storage medium, which are described in detail one by one in the following embodiments.

[0053] See also Figure 1 , Figure 1 A flowchart of a stability-based access control method provided according to an embodiment of the present specification is shown, which specifically includes the following steps.

[0054] Step 101: Acquire asset data, group assets based on the asset data, and determine at least two asset groups.

[0055] Among them, assets can be information technology assets, which are any information or data, software or hardware used by an organization during its business operations. Hardware assets include physical computing devices, such as physical servers in data centers, desktop computers, mobile devices, laptops, keyboards, and printers. On the other hand, software assets include applications that are usually licensed per user or machine, as well as software systems and databases built with open source resources. Software assets also include cloud-based assets and cloud services, such as Software as a Service (SaaS) applications.

[0056] The asset data may be the attribute data corresponding to the asset. For example, the Internet service system is located in Beijing and deployed in the public cloud. It is a development and testing environment. There are two containers W1 and W2, which provide front-end HTTP services and back-end ASCS services respectively, using TCP port 8000 and TCP port 80. Among them, the assets are containers W1 and W2, and the corresponding attribute data include location, business, environment, application and role. Based on these attribute data such as location, business, environment, application and role, the assets can be grouped. The business here can be understood as a business system, which is a description of the functional entity composed of assets in the network. Business is a logical concept, which is usually used to identify the functional grouping of communication assets. For example, several servers provide online banking services, which constitute a business called online banking. This business will access the database business, which is composed of several other servers. For details about asset grouping, please refer to the following implementation method.

[0057] In one possible implementation, assets are grouped based on asset data to determine at least two asset groups, including: determining business information, location information, environment information, application information, and role information of the asset data; and assets are grouped based on business information, location information, environment information, application information, and role information to determine at least two asset groups.

[0058] Using the above example, in the actual business network environment, there are 6 assets, which provide services for 3 business systems. The description of the business attributes is as follows:

[0059] 1. The Internet service system is located in Beijing and deployed in the public cloud. It is a development and testing environment. There are two containers, W1 and W2, which provide front-end HTTP services and back-end ASCS services respectively, using TCP port 8000 and TCP port 80.

[0060] 2. The database service system is located in Beijing and deployed in the company's self-built data center. It is a production network environment with two virtual machine servers D1 and D2. D1 provides both Mysql and Oracle services, while D2 only provides Oracle services, using TCP ports 3306 and 1521.

[0061] 3. The financial reporting system is located in Nanjing and is deployed in the company's self-built data center. It is a production network environment with two physical servers F1 and F2, providing SAP and Oracle services and using TCP ports 3200 and 3300.

[0062] Based on the above business system description, three different working groups can be created by selecting the above business attribute information. For example, three category group labels can be created: location category: including Beijing and Nanjing; environment category: including public cloud, data center, test network, production network; application category: including Internet system, database system, financial report system.

[0063] Furthermore, these assets are divided into corresponding groups, and role tags are assigned according to the service attributes of the assets in the business system. The following grouping and tag management results can be obtained:

[0064] (1) Working Group G1:

[0065] Group name: Internet System; Group tags: Location tag is "Beijing", Environment tag is "Development and Testing", Application tag is "Internet Service", Role tag of W1 is HTTP Service, and Role tag of W2 is ASCS Service.

[0066] (2) Working Group G2:

[0067] Group name: Database system; Group tags: Location tag is "Beijing", Environment tag is "Production network", Application tag is "Database service", Role tag of D1 is MySQL service, and Role tag of D2 is Oracle service.

[0068] (3) Working Group G3:

[0069] Group name: Financial Reporting System; Group tags: Location tag is "Nanjing", Environment tag is "Production Network", Application tag is "Financial Reporting Service", Role tag of F1 is SAP Service, and Role tag of F2 is Oracle Service.

[0070] At this point, each asset is divided into workgroups with different business attributes and has different service roles. In the subsequent access relationship observation and analysis, the access relationship can be described according to different granularity and collection perspectives, and the stability of the access relationship can be evaluated.

[0071] Step 102: Determine a target dimension, and obtain target access data between at least two asset grouping assets based on the target dimension.

[0072] The target access data may be an access relationship, which is a set of records of access information. The target dimension may include a time dimension and different perspective dimensions, wherein the perspective dimension may include dimensions such as ports, assets, and businesses. For example, the time dimension is 7 days, and the perspective dimension is the port perspective. The asset grouping may be an asset grouping based on business, location, environment, role, application, and service, etc., or a single asset may be used as a group.

[0073] In one possible implementation, a target dimension is determined, and target access data between assets of at least two asset groups is obtained based on the target dimension, including: determining a first asset grouping and a second asset grouping based on the target dimension; obtaining a communication record between the first asset grouping and the second asset grouping; and determining the target access data based on the communication record.

[0074] Specifically, for example, the network connection information record generated when asset A2 accesses the service port P1 of a service process S1 of asset A1 is a four-tuple including the IP address of asset A2, the IP address of asset A1, the service port P1 of asset A1 and the protocol TCP / UDP, such as the five-tuple information of the session in the firewall.

[0075] In one possible implementation, target access data is determined based on communication records, including: determining communication assets based on communication records; determining access processes based on communication assets; determining communication ports based on access processes; and determining target access data based on communication assets, access processes, and communication ports.

[0076] For example: Asset A2 is a web service node, and asset A1 is a service node of the database db. The db process of asset A1 (such as mysql) listens to the tcp / 3306 port on asset A1. The web process of asset A2 initiates network access to the tcp 3306 port of asset A1 to obtain specific data on the db. This creates an access relationship from asset A1 to the TCP 3306 port of asset A2.

[0077] Step 103: Determine the access relationship stability of at least two asset groups based on the target access data.

[0078] Among them, access relationship stability refers to the evaluation of the variability and continuity of the access relationship of a target or perspective. The target or perspective can be a service (port), an asset (server), or a business system.

[0079] In one possible implementation, the access relationship stability of at least two asset groups is determined based on target access data, including: determining a target time period, determining stability evaluation data from the target access data based on the target time period; and determining the access relationship stability of at least two asset groups based on the stability evaluation data and a stability evaluation algorithm.

[0080] In practical applications, the stability of access relationships can be evaluated from the dimensions of time and perspective. That is, whether there is periodic stable access between two target asset groups under a given time range and a given observation perspective. In the time dimension, the longer the observation window, the more accurate the business stability assessment. For example, the accuracy of assessing the stability of an asset's business access in the past day is lower than the accuracy of assessing the stability of the business access in the past 14 days. In the observation perspective, the larger the data from the perspective, the more accurate the assessment of the stability of business access. For example, in the same time dimension, the stability of access data observed from the perspective of all assets in a business system is higher than that of a single asset or a single port.

[0081] For example, asset W1 in the Internet business system accesses the Oracle service of asset D2 in the database system every 7 days, and W1 accesses the Mysql service of D1 every day; asset F1 in the financial system accesses the Mysql service of asset D1 in the database system every 7 days, and accesses the Oracle service of asset D1 in the database system every day; and asset F2 accesses the Oracle service of D2 in the database system every 14 days. So, from the perspective of the time dimension, from the perspective of the 1-day time dimension, the access from W1 to D1 is stable, with a stability of 100%, and the access from W1 to D2 is unstable, with a stability of 14.3%. From the perspective of the 7-day time dimension, the access from W1 to D1 is stable, with a stability of 100%, and the access from W1 to D2 is stable, with a stability of 100%.

[0082] In one possible implementation, the access relationship stability of at least two asset groups is determined based on stable evaluation data and a stable evaluation algorithm, including: determining a first access set and a second access set based on the stable evaluation data; wherein the time nodes of the first access set and the second access set are different; determining a set change difference based on the first access set and the second access set; and determining the access relationship stability of at least two asset groups based on the set change difference and a stable evaluation algorithm.

[0083] Furthermore, when the business systems are grouped as assets, sampling is done on a 1-day time dimension, and from the perspective of the MySQL service: the access from the Internet business system (asset W1) to the database system (asset D1) is stable, with a stability of 100%; the access from the financial system (F1 asset) to the database system (asset D1) is unstable, with a stability of 14.3%; from the perspective of the Oracle service, the access from the Internet business system (asset W1) to the database system (asset D1) is unstable, with a stability of 14.3%; the access from the financial system (F1 asset) to the database system (asset D1) is stable, with a stability of 100%; This example shows that evaluating the access stability between two business systems only based on the access stability / frequency of different single service ports can lead to completely opposite conclusions, which is not very reasonable in itself.

[0084] From the perspective of assets, the access from the Internet business system (asset W1) to the database system (asset D1) is stable, with a stability of 100%; the access from the financial statement system (asset F1) to the database system (asset D1) is stable, with a stability of 100%; the access from the Internet business system (asset W1) to the database system (asset D2) is unstable, with a stability of 14.3%; the access from the financial statement system (asset F2) to the database system (asset D2) is stable, with a stability of 100%.

[0085] Furthermore, from the business perspective of the database system, the access from the Internet system to the database system is stable, with a stability of 100%; the access from the financial system to the database system is also stable, with a stability of 100%.

[0086] In summary, the stability obtained by observing in different time dimensions and perspective dimensions is also different, so the accuracy of stability assessment can be improved by evaluating stability through a longer time dimension or a wider perspective.

[0087] In a possible implementation, the stability evaluation algorithm includes: A = 1-(C2-C1) / C1; wherein A represents stability, C1 represents the first access set, and C2 represents the second access set.

[0088] Specifically, the stability can be calculated by the above formula. That is, in a specific observation period and perspective, there is an initial access relationship set C1 at the beginning of the period and an access relationship set C2 at the end of the period. The larger the value of A is, the higher the stability is.

[0089] For example, C1 is the set of all access records from the Internet business system (asset W1) to the database system (asset D1) on day N, and C2 is the set of all access records from the Internet business system (asset W1) to the database system (asset D1) on day N+7. The stability of the Internet business system (asset W1) to the database system (asset D1) can be calculated based on the above formula.

[0090] Step 104: Determine an access control policy based on the access relationship stability.

[0091] In practical applications, the access control policy of the business system can be determined based on the value of A, thereby achieving more accurate access control.

[0092] In one embodiment, in a computing environment, there are two business systems A and B accessing each other, each business system includes several assets, each asset includes several business processes, and each process uses a business port for communication. Now, the stability of the access relationship of different levels of business B within 14 days is evaluated, and the steps are as follows:

[0093] The assets of the above business systems are grouped by tags, for example:

[0094] The tags of asset A1 in business A include: location: Beijing; environment: testing; application: online banking; role: front-end service.

[0095] The tags of asset A2 in business A include: location: Beijing; environment: testing; application: online banking; role: middle office service.

[0096] The tags of asset B1 in business B include: location: Beijing; environment: test; application: database; role: DB service.

[0097] The tags of asset B2 in business B include: location: Beijing; environment: test; application: database; role: DB service.

[0098] Furthermore, the communication process information within all assets A1, A2, B1, B2 in the above-mentioned business A and B, as well as the access relationship between assets, can be learned. The access relationship may be recorded as follows:

[0099] Process P_A1_1 in A1 accesses TCP port Port_B1 of process P_B1_1 in B1;

[0100] Process P_A2_1 in A2 accesses TCP port Port_B1 of process P_B1_1 in B1;

[0101] Process P_A1_2 in A1 accesses TCP port Port_B2 of process P_B1_2 in B1;

[0102] It should be noted that learning the communication process information can be implemented using the technology in the art, which is not limited here, as long as the function can be achieved.

[0103] Furthermore, according to the label mapping, access relationships are established between entities at different levels: for example, process to process; asset to asset; role to role; business to business; business to role; business to asset. This step is to aggregate the access relationships collected and learned in the previous step at different levels according to the label mapping set in the first step. For details, please refer to the following method.

[0104] Process to process: For example, access from "process P_A1_1" to "process P_B1_1";

[0105] Role to role: For example, access from all communication assets with the role tag "Middle Office Service" to all communication assets with the role tag "DB Service";

[0106] Business to business: For example, access from all communication assets with the application tag "Business A" to all communication assets with the application tag "Business B";

[0107] Business to role: For example, access from all communication assets with the application tag "Business A" to all communication assets with the role tag "DB Service";

[0108] Business to asset: For example, all communications assets with the application tag "Business A" accessing communications asset B1.

[0109] Furthermore, for each business, such as business B mentioned above, the access relationships aggregated at different levels in the third step can be evaluated for stability based on time. The algorithm for evaluating the stability is as follows: within a specific observation period, there is an initial access relationship set C1 at the beginning of the period and an access relationship set C2 at the end of the period. The stability A = 1-(C2-C1) / C1.

[0110] Possible evaluation results are as follows:

[0111]

[0112] Based on the above stability assessment results, users can choose to analyze the access relationship at two relatively more stable levels, "business level" or "external role to business port set of this business", and establish corresponding access control policies. In this way, network access can be controlled more stably, achieving better security effects and reducing the impact on normal business.

[0113] The embodiments of the present specification provide a stability-based access control method and device, wherein the stability-based access control method includes: obtaining asset data, grouping assets based on the asset data, and determining at least two asset groups; determining a target dimension, obtaining target access data between assets of at least two asset groups based on the target dimension; determining the stability of the access relationship of at least two asset groups based on the target access data; and determining an access control policy based on the stability of the access relationship. By obtaining target access data between assets of at least two asset groups based on the target dimension, determining the stability of the access relationship of at least two asset groups based on the target access data, and determining an access control policy based on the stability of the access relationship, it is possible to implement a stability assessment of the access relationship, and configure the access control policy based on the result of the stability assessment, thereby improving security.

[0114] Corresponding to the above method embodiment, this specification also provides an access control device embodiment based on stability. Figure 2 FIG. 1 shows a schematic diagram of a stability-based access control device provided by an embodiment of the present specification. Figure 2 As shown, the device comprises:

[0115] The asset grouping module 201 is configured to obtain asset data, group the assets based on the asset data, and determine at least two asset groups;

[0116] The data determination module 202 is configured to determine a target dimension, and obtain target access data between at least two asset grouping assets based on the target dimension;

[0117] A stability determination module 203, configured to determine the access relationship stability of at least two asset groups based on the target access data;

[0118] The policy configuration module 204 is configured to determine the access control policy based on the access relationship stability.

[0119] In a possible implementation, the asset grouping module 201 is further configured to:

[0120] Determine the business information, location information, environment information, application information and role information of asset data;

[0121] The assets are grouped based on the business information, location information, environment information, application information, and role information to determine at least two asset groups.

[0122] In a possible implementation, the data determination module 202 is further configured to:

[0123] Determining a first asset grouping and a second asset grouping based on the target dimension;

[0124] Acquire the communication record between the first asset group and the second asset group;

[0125] Based on the communication records, determine the target access data.

[0126] In a possible implementation, the data determination module 202 is further configured to:

[0127] determining communication assets based on communication records;

[0128] Determining access progress based on communication assets;

[0129] Determining a communication port based on an access process;

[0130] Target access data based on communication assets, access processes, and communication ports.

[0131] In a possible implementation, the stability determination module 203 is further configured to:

[0132] determining a target time period, and determining stable assessment data from the target access data based on the target time period;

[0133] Based on the stability assessment data and the stability assessment algorithm, the access relationship stability of at least two asset groups is determined.

[0134] In a possible implementation, the stability determination module 203 is further configured to:

[0135] Determine a first access set and a second access set based on the stable evaluation data; wherein the first access set and the second access set have different time nodes;

[0136] determining a set change difference based on the first access set and the second access set;

[0137] Based on the set change difference and the stability evaluation algorithm, the access relationship stability of at least two asset groups is determined.

[0138] In a possible implementation, the stability determination module 203 is further configured to:

[0139] The stability assessment algorithm includes:

[0140] A =1-(C2-C1) / C1;

[0141] Wherein, A represents stability, C1 represents the first access set, and C2 represents the second access set.

[0142] The embodiments of the present specification provide a stability-based access control method and device, wherein the stability-based access control device includes: obtaining asset data, grouping assets based on the asset data, and determining at least two asset groups; determining a target dimension, obtaining target access data between assets of at least two asset groups based on the target dimension; determining the stability of the access relationship of at least two asset groups based on the target access data; and determining an access control policy based on the stability of the access relationship. By obtaining target access data between assets of at least two asset groups based on the target dimension, determining the stability of the access relationship of at least two asset groups based on the target access data, and determining an access control policy based on the stability of the access relationship, it is possible to implement a stability assessment of the access relationship, and configure the access control policy based on the result of the stability assessment, thereby improving security.

[0143] The above is a schematic scheme of a stability-based access control device of this embodiment. It should be noted that the technical scheme of the stability-based access control device and the technical scheme of the stability-based access control method described above belong to the same concept, and the details of the stability-based access control device technical scheme that are not described in detail can all be found in the description of the stability-based access control method technical scheme.

[0144] Figure 3 The block diagram of a computing device 300 according to an embodiment of the present specification is shown. The components of the computing device 300 include but are not limited to a memory 310 and a processor 320. The processor 320 is connected to the memory 310 via a bus 330, and the database 350 is used to store data.

[0145] The computing device 300 also includes an access device 340 that enables the computing device 300 to communicate via one or more networks 360. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 340 may include one or more of any type of network interface (e.g., a network interface card (NIC)) of wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a world-wide interoperability for microwave access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, and a near field communication (NFC).

[0146] In one embodiment of the present specification, the above components of the computing device 300 and Figure 3 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 3 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0147] The computing device 300 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 300 may also be a mobile or stationary server.

[0148] The processor 320 is used to execute the following computer executable instructions, which, when executed by the processor, implement the steps of the above-mentioned stability-based access control method. The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the above-mentioned stability-based access control method belong to the same concept. For the details not described in detail in the technical scheme of the computing device, please refer to the description of the technical scheme of the above-mentioned stability-based access control method.

[0149] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned stability-based access control method.

[0150] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the above-mentioned access control method based on stability belong to the same concept, and the details not described in detail in the technical scheme of the storage medium can be found in the description of the technical scheme of the above-mentioned access control method based on stability.

[0151] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned stability-based access control method.

[0152] The above is a schematic scheme of a computer program of this embodiment. It should be noted that the technical scheme of the computer program and the technical scheme of the above-mentioned access control method based on stability are of the same concept, and the details not described in detail in the technical scheme of the computer program can be found in the description of the technical scheme of the above-mentioned access control method based on stability.

[0153] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0154] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0155] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0156] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0157] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A stability-based access control method, characterized in that: include: Acquire asset data, group assets based on the asset data, and determine at least two asset groups; Determine a target dimension, and obtain target access data between the at least two asset grouping assets based on the target dimension; Determining the access relationship stability of the at least two asset groups based on the target access data; Determining an access control strategy based on the access relationship stability; The determining the access relationship stability of the at least two asset groups based on the target access data includes: determining a target time period, and determining stable assessment data from the target access data based on the target time period; Determining the access relationship stability of the at least two asset groups based on the stability assessment data and the stability assessment algorithm; The determining the access relationship stability of the at least two asset groups based on the stability evaluation data and the stability evaluation algorithm includes: Determine a first access set and a second access set based on the stability evaluation data; wherein the first access set and the second access set have different time nodes; determining a set change difference based on the first access set and the second access set; Based on the set change difference and a stability evaluation algorithm, the access relationship stability of the at least two asset groups is determined.

2. The method according to claim 1, characterized in that: The grouping of assets based on the asset data to determine at least two asset groups includes: Determine business information, location information, environment information, application information and role information of the asset data; The assets are grouped based on the business information, the location information, the environment information, the application information, and the role information to determine at least two asset groups.

3. The method according to claim 1, characterized in that The determining of the target dimension and obtaining the target access data between the at least two asset grouping assets based on the target dimension includes: determining a first asset grouping and a second asset grouping based on the target dimension; Acquire the communication record between the first asset group and the second asset group; Based on the communication record, target access data is determined.

4. The method according to claim 3, characterized in that The determining target access data based on the communication record includes: determining a communication asset based on the communication record; determining an access process based on the communication asset; determining a communication port based on the access process; Target access data is determined based on the communication asset, the access process, and the communication port.

5. The method according to claim 1, characterized in that The stability assessment algorithm includes: A =1-(C2-C1) / C1; The A represents stability, the C1 represents the first access set, and the C2 represents the second access set.

6. A stability-based access control device, used to implement the steps of the stability-based access control method according to any one of claims 1 to 5, characterized in that: include: An asset grouping module is configured to obtain asset data, group assets based on the asset data, and determine at least two asset groups; a data determination module configured to determine a target dimension, and obtain target access data between the at least two asset grouping assets based on the target dimension; a stability determination module configured to determine the access relationship stability of the at least two asset groups based on the target access data; The policy configuration module is configured to determine the access control policy based on the access relationship stability.

7. A computing device, characterized in that include: Memory and processor; The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions. When the computer executable instructions are executed by the processor, the steps of the stability-based access control method described in any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the stability-based access control method described in any one of claims 1 to 5.

Images