A network security detection method, system, device and medium

Abstract

The application discloses a network security detection method, system and device and a medium, relates to the field of network security, and is used for solving the problem of network risks existing in a third-party platform. The scheme receives user identity information through the third-party platform, creates a single sign-on account on a cloud platform and configures operation permissions, detects the corresponding networks of the third-party platform and the cloud platform, determines whether there is a security risk, and limits the operation permissions of the account on the cloud platform when a security risk is found, thereby reducing the influence range of the security risk. It can be seen that the application can solve the problem of network risks existing in the third-party platform, thereby improving the network security when the user logs in to the cloud platform through the third-party platform.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to a network security detection method, system, device and medium. BACKGROUND

[0002] Cloud platform application single sign-on technology has become increasingly common. Specifically, the cloud platform is a platform for providing services, and multiple application programs can run on the cloud platform. The principle of single sign-on is that a user can access multiple application programs by logging in only once without repeatedly entering a username and password. Specifically, when a user inputs his / her identity information on a third-party platform to log in, the third-party platform verifies the user's identity and sends the user's identity information to the cloud platform. After receiving the identity information, the cloud platform verifies and authorizes the application programs running on the cloud platform to access the identity information of the user, thereby realizing login.

[0003] However, if the third-party platform has a network risk, such as account leakage or malicious intrusion, the user's identity information may be stolen, causing the user's account to be maliciously used, and the application programs bound on the cloud platform will also be affected, which may bring serious security risks. SUMMARY

[0004] The purpose of the present application is to provide a network security detection method, system, device and medium. By detecting the networks corresponding to the third-party platform and the cloud platform, it can be determined whether there is a security risk, and the operation permission of the account on the cloud platform can be limited when a security risk is found, thereby reducing the scope of influence of the security risk. It can be seen that the present application can solve the problem of network risk of the third-party platform, thereby improving the network security when the user logs in to the cloud platform through the third-party platform.

[0005] In a first aspect, the present application further provides a network security detection method, comprising:

[0006] According to the user identity information received by the third-party platform, a single sign-on account is created on the cloud platform, and operation permissions are configured for the single sign-on account; the third-party platform is a website for providing the user identity information, and the cloud platform is a website for providing a preset function service;

[0007] Logging into the cloud platform through the single sign-on account according to the account name and account password received by the third-party platform;

[0008] Detecting a first network of the third-party platform, and / or detecting a second network corresponding to the cloud platform to determine whether the first network and / or the second network has a security risk;

[0009] When the first network or the second network has a security risk, the operation permission of the account name to the cloud platform is limited.

[0010] In an embodiment, before the single sign-on account is created in the cloud platform according to the user identity information received by the third-party platform and the operation permission of the single sign-on account is configured, the network security detection method further comprises:

[0011] obtaining a network certificate of a first network of the third-party platform;

[0012] determining whether the network certificate meets a preset security certificate rule;

[0013] When the network certificate meets the preset security certificate rule, a trust relationship between the third-party platform and the cloud platform is established, and the step of creating a single sign-on account in the cloud platform according to the user identity information received by the third-party platform and configuring the operation permission of the single sign-on account is entered.

[0014] In an embodiment, determining whether the network certificate meets the preset security certificate rule comprises:

[0015] determining whether the network certificate is issued by a trusted certificate authority, and / or determining whether the validity period of the network certificate is within the validity period, and / or determining whether the information in the network certificate is consistent with the information of the accessed website, and / or determining whether the key length and the encryption algorithm in the network certificate meet the security encryption standard, and / or determining whether the chain structure in the network certificate is complete, and / or determining whether the network certificate includes online certificate status protocol information and certificate revocation list information;

[0016] If the network certificate is issued by a trusted certificate authority, the validity period is within the validity period, the information in the network certificate is consistent with the information of the accessed website, the key length and the encryption algorithm meet the security encryption standard, the chain structure is complete, and the network certificate includes the online certificate status protocol information and the certificate revocation list information, it is determined that the network certificate meets the preset security certificate rule.

[0017] In an embodiment, obtaining the network certificate of the first network of the third-party platform comprises:

[0018] obtaining a root node address in the network address of the first network of the third-party platform;

[0019] determining the network certificate corresponding to the first network according to the root node address.

[0020] In an embodiment, before obtaining the network certificate of the first network of the third-party platform, the network security detection method further comprises:

[0021] performing network delay testing on a transmission interface between the third-party platform and the cloud platform;

[0022] when the network delay testing time of the transmission interface is within a preset range, entering a step of obtaining a network certificate of a first network corresponding to the third-party platform.

[0023] In an embodiment, according to the user identity information received by the third-party platform, a single sign-on account is created in the cloud platform, and operation permissions are configured for the single sign-on account, and the single sign-on account is isolated from a local login account of the cloud platform, and the process of configuring operation permissions for the single sign-on account is isolated from the process of configuring the operation permissions for the local login account of the cloud platform.

[0024] In an embodiment, detecting a first network of the third-party platform comprises:

[0025] scanning the first network using a vulnerability scanning tool to determine whether the first network has vulnerabilities;

[0026] detecting a login management system of the first network to determine the complexity of a login password;

[0027] detecting whether the first network is subject to cross-site request forgery attacks, injection attacks, directory traversal attacks;

[0028] detecting whether the first network has file upload vulnerabilities to determine whether there are malicious file uploads;

[0029] detecting whether the first network enables a content security policy to determine whether there are malicious scripts and malicious content injections;

[0030] detecting whether the URL header configuration of the first network is secure;

[0031] scanning a host port of the first network to determine whether the opening of the host port is the same as a preset required port;

[0032] detecting whether there are unprotected backup files in the first network to determine whether there are abnormal backup files;

[0033] detecting whether the first network has sensitive information leakage risks, the sensitive information including the account name and / or the account password and / or property information.

[0034] In an embodiment, detecting a second network corresponding to the cloud platform comprises:

[0035] scanning applications, operating systems and networked devices in the cloud platform to determine whether the applications, the operating systems and the networked devices have vulnerabilities or attacks;

[0036] detecting whether configurations of network security groups, firewall rules, access control lists and identity authentication policies in the cloud platform meet security configuration standards;

[0037] monitoring network traffic of the second network and determining whether the cloud platform has abnormal traffic according to the network traffic of the second network;

[0038] monitoring security logs of the cloud platform, determining whether the second network has risks, the security logs including login logs generated by user login, operation logs generated by user operation of the cloud platform, and abnormal logs generated by the operating system and the networked devices;

[0039] detecting whether data in the cloud platform is encrypted during storage and transmission;

[0040] periodically backing up data in the cloud platform and testing data recovery to verify whether there are abnormalities in data backup and recovery in the cloud platform.

[0041] In a second aspect, the present application further provides a network security verification system, comprising:

[0042] an account creation unit configured to create a single sign-on account in a cloud platform according to user identity information received by a third-party platform, and configure operation permissions for the single sign-on account; the third-party platform is a website for providing the user identity information, and the cloud platform is a website for providing preset function services;

[0043] an account login unit configured to log in to the cloud platform through the single sign-on account according to an account name and an account password received by the third-party platform;

[0044] a risk assessment unit configured to detect a first network of the third-party platform and / or a second network corresponding to the cloud platform to determine whether the first network and / or the second network has security risks;

[0045] a permission restriction unit configured to restrict operation permissions of the account name for the cloud platform when the first network or the second network has security risks.

[0046] In a third aspect, the present application further provides a network security verification device, comprising:

[0047] a memory configured to store a computer program;

[0048] A processor is configured to implement the steps of the network security verification method when storing a computer program.

[0049] In a fourth aspect, the present application further provides a non-volatile storage medium, which stores a computer program, and the computer program is configured to implement the steps of the network security verification method when executed by a processor.

[0050] The present application provides a network security detection method, system, device and medium, and relates to the field of network security, and is used for solving the problem of network risks existing in a third-party platform. The scheme receives user identity information through the third-party platform, creates a single sign-on account on a cloud platform and configures operation permissions, detects the corresponding networks of the third-party platform and the cloud platform, determines whether there is a security risk, and limits the operation permissions of the account on the cloud platform when a security risk is found, thereby reducing the influence range of the security risk. It can be seen that the present application can solve the problem of network risks existing in the third-party platform, thereby improving the network security when the user logs in to the cloud platform through the third-party platform. BRIEF DESCRIPTION OF DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the prior art and the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0052] Figure 1 A flow chart of a network security detection method provided by the present application;

[0053] Figure 2 A specific implementation flow chart of a network security detection method provided by the present application;

[0054] Figure 3 A schematic diagram of a network security detection system provided by the present application;

[0055] Figure 4 A schematic diagram of a network security detection device provided by the present application;

[0056] Figure 5 A schematic diagram of a non-volatile storage medium provided by the present application. DETAILED DESCRIPTION

[0057] The core of the present application is to provide a network security detection method, system, device and medium, by detecting the network corresponding to the third-party platform and the cloud platform, it can be determined whether there is a security risk, and when a security risk is found, the operation permission of the account to the cloud platform is limited, thereby reducing the influence range of the security risk. It can be seen that the present application can solve the problem of network risk existing in the third-party platform, thereby improving the network security when the user logs in the cloud platform through the third-party platform.

[0058] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0059] In a first aspect, the present application further provides a network security detection method, comprising:

[0060] S11: creating a single sign-on account in the cloud platform according to the user identity information received by the third-party platform, and configuring operation permissions for the single sign-on account; the third-party platform is a website for providing user identity information, and the cloud platform is a website for providing preset function services;

[0061] This step mainly describes the creation of a single sign-on account in the cloud platform and the configuration of its operation permissions. Specifically, when the third-party platform receives user identity information, the cloud platform creates a single sign-on account in its system according to the information. This account is used to store the user's identity information and authentication credentials in the subsequent login process, so as to verify the user's single sign-on in the future. After creating the single sign-on account, the cloud platform needs to configure the operation permissions for the account, which means determining which functions and services the account can access and execute. The permissions may include accessing specific applications, reading specific data or performing specific operations, etc.

[0062] Among them, the third-party platform as a website for providing user identity information is responsible for receiving user login information and passing it to the cloud platform. The cloud platform as a website for providing preset function services manages the user's access permissions and services through the single sign-on account.

[0063] That is, this step is mainly to establish a centralized single sign-on system to ensure the security and consistency of user identity information. By creating a single sign-on account on the cloud platform and configuring operation permissions, the access rights of users can be effectively managed, ensuring that only verified users can access applications and services on the cloud platform. This method can reduce the login credentials that users need to remember and manage, improving user experience while also enhancing security, as users only need to enter login information on a trusted third-party platform without having to log in to each application or service for verification.

[0064] S12: Log in to the cloud platform through the single sign-on account according to the account name and account password received by the third-party platform;

[0065] This step describes the process of logging into the cloud platform through the single sign-on account according to the account name and account password received by the third-party platform. Specifically, the user enters their account name and password on the third-party platform to log in. After receiving these login credentials, the third-party platform passes them to the cloud platform. After receiving the user's account name and password, the cloud platform verifies it with the single sign-on account created in advance. The cloud platform will use the received account name and password to attempt to log in to the single sign-on account. If the account name and password match the information stored in the single sign-on account, the authentication is successful. This verification process usually includes checking the correctness of the account name and password, and possibly other identity verification measures such as two-factor authentication, etc. When single sign-on is performed, the cloud platform needs to take appropriate security measures to protect the user's account information. This may include encrypted transmission channels, secure storage of user credentials, etc.

[0066] In addition, in one embodiment, if the cloud platform verifies that the account name and account password do not match, a login failure strategy can be executed, including account locking, IP address restriction of the third-party platform.

[0067] To prevent malicious login attempts and unauthorized access, when the cloud platform verifies that the account name and account password do not match, that is, the login credentials provided by the user do not match the information stored in the cloud platform, the cloud platform can implement a login failure strategy. These strategies include account locking and IP address restriction of third-party platforms. Account locking means temporarily disabling the account from continuing to log in, even if the user provides the correct account name and password, such as by limiting the number of login attempts, when someone tries to log in maliciously using brute force cracking or the like, account locking can prevent them from making unlimited attempts, thereby increasing the cost and difficulty for the attacker. Another login failure strategy is to restrict IP addresses from third-party platforms; if multiple login failures occur within a short period of time, and these login attempts all come from the same IP address, the cloud platform can consider that the IP address may be the source of the attacker, and restrict access from that IP address to prevent malicious users or attackers from breaking into the system by constantly trying to log in.

[0068] By implementing these login failure strategies, the cloud platform can enhance protection of account security and system security. Account locking can prevent malicious attacks such as brute force cracking, while IP address restriction can prevent attackers from breaking into the system through malicious login attempts. The implementation of these strategies is based on the identification and prevention of security risks to ensure the security of users' identity information and the system.

[0069] In summary, the main principle of this step is based on the single sign-on mechanism, by verifying the account name and password entered by the user on the third-party platform and comparing it with the single sign-on account on the cloud platform, to achieve user identity verification. This allows users to implement single login between different applications and services without the need to repeatedly enter usernames and passwords, improving user convenience and experience. At the same time, due to the existence of the single sign-on account, the cloud platform can centrally manage users' identity information and access permissions, improving security and management efficiency.

[0070] S13: detecting the first network of the third-party platform, and / or detecting the second network corresponding to the cloud platform, to determine whether the first network and / or the second network has a security risk;

[0071] This step mainly describes detecting the two networks corresponding to the third-party platform and the cloud platform to determine whether there are security risks. Specifically, the third-party platform, as a website that provides user identity information, may have various network security risks, such as account leakage, malicious intrusion, etc. By detecting the network of the third-party platform, it can be found whether there is unauthorized access, abnormal traffic, or other possible security threats. Such detection may include network traffic analysis, vulnerability scanning, security log auditing, etc. Similarly, the cloud platform, as a website that provides preset function services, may also face various network security risks, such as DDoS attacks, SQL injection, data leakage, etc. By detecting the network of the cloud platform, it can be found whether there are abnormal activities, malicious traffic, or other possible security vulnerabilities. Such detection may include intrusion detection systems, intrusion prevention systems, security log analysis, etc. When performing network detection, by analyzing the detection results, possible security risks can be identified. These security risks may include network attacks, malware infections, unauthorized access, etc. By identifying these risks, measures can be taken in time to prevent security incidents from occurring.

[0072] If security risks are found, appropriate security measures can be taken to deal with them, such as blocking malicious traffic, updating security patches, strengthening identity verification measures, etc., to protect the user's identity information and the security of the cloud platform, prevent unauthorized access and malicious attacks.

[0073] S14: When the first network or the second network has security risks, limit the operation permissions of the account name to the cloud platform.

[0074] Specifically, when the first network or the second network has security risks, in order to reduce further security risks, the operation permissions of the account name to the cloud platform are limited. At the same time, appropriate security alerts can also be triggered. The measure of limiting the operation permissions of the account means that the system will temporarily or permanently limit the operation permissions of the account name to the cloud platform, so that it cannot perform specific operations or access specific resources. Limiting the operation permissions of the account name can be done in many ways, such as reducing the permission level of the account, limiting its access to sensitive data, temporarily prohibiting it from performing certain operations, etc., depending on the severity of the security risk and the security policy of the system administrator.

[0075] In summary, in this embodiment, when security risks are found, proactive security measures are taken to reduce further security threats and risks. By limiting the operation permissions of the account name, potential attackers or malicious users can be prevented from continuing to perform unauthorized access or operations on the system, security incidents can be responded to in time, and the loss and impact caused by security risks can be reduced. By reducing the permissions of the affected account, the action ability of the attacker can be limited, and enough time can be provided for the system administrator to investigate the security incident and take further security measures.

[0076] In one embodiment, before creating a single sign-on account in the cloud platform and configuring operation permissions for the single sign-on account according to the user identity information received from the third-party platform, the network security detection method further comprises: obtaining a network certificate of a first network of the third-party platform; determining whether the network certificate meets a preset security certificate rule; when the network certificate meets the preset security certificate rule, establishing a trust relationship between the third-party platform and the cloud platform, and entering the step of creating a single sign-on account in the cloud platform and configuring operation permissions for the single sign-on account according to the user identity information received from the third-party platform.

[0077] This embodiment mainly describes the step of establishing a trust relationship between the third-party platform and the cloud platform before network security detection. Specifically, the cloud platform obtains the network certificate of the third-party platform, which is a digital certificate used to authenticate the identity of a network entity, usually issued by a trusted certificate authority (CA), and contains key information such as the identity and public key of the third-party platform. After obtaining the network certificate of the third-party platform, the cloud platform verifies the certificate to ensure that it meets the preset security certificate rule, which may include verifying the validity of the certificate, checking the trustworthiness of the certificate authority, ensuring the integrity and correctness of the certificate, etc. If the network certificate of the third-party platform meets the preset security certificate rule, the cloud platform will establish a trust relationship with the third-party platform, which means that the cloud platform trusts the identity and security of the third-party platform and is willing to communicate and exchange data securely with it.

[0078] After establishing a trust relationship between the third-party platform and the cloud platform, the step of creating a single sign-on account in the cloud platform and configuring operation permissions for the single sign-on account according to the user identity information received from the third-party platform can be entered. In this step, the cloud platform can safely use the user identity information received from the third-party platform to create a corresponding single sign-on account and configure appropriate operation permissions for the account.

[0079] The principle of this embodiment is to first verify and confirm the identity and security of the third-party platform before performing sensitive operations to ensure the security of the entire system. By establishing a trust relationship, the cloud platform can process user identity information under the premise of security, ensuring the security and reliability of the single sign-on system.

[0080] In an embodiment, determining whether the network certificate meets the preset security certificate rule includes: determining whether the network certificate is issued by a trusted certificate authority, and / or determining whether the validity period of the network certificate is within the validity period, and / or determining whether the information in the network certificate is consistent with the information of the accessed website, and / or determining whether the key length and encryption algorithm in the network certificate meet the security encryption standard, and / or determining whether the chain structure in the network certificate is complete, and / or determining whether the online certificate status protocol information and the certificate revocation list information are included in the network certificate; if the network certificate is issued by a trusted certificate authority, and the validity period is within the validity period, and the information in the network certificate is consistent with the information of the accessed website, and the key length and encryption algorithm meet the security encryption standard, and the chain structure is complete and includes the online certificate status protocol information and the certificate revocation list information, it is determined that the network certificate meets the preset security certificate rule.

[0081] The embodiment describes the steps of determining whether the network certificate meets the preset security certificate rule, mainly including the following aspects: trusted certificate authority issuance: when determining whether the network certificate meets the security rule, it is necessary to verify whether the certificate is issued by a trusted certificate authority. The certificate authority (CA) is an authoritative entity responsible for issuing and managing digital certificates, and the certificates issued by it are generally widely recognized and trusted. Validity period check: check the validity period of the network certificate to ensure that it is within the validity period. The validity period of the certificate is usually specified by the certificate authority, and the certificate beyond the validity period may not be trusted. Information consistency verification: ensure that the information in the network certificate is consistent with the information of the accessed website, which includes verifying whether the subject name (usually the domain name of the website) contained in the certificate matches the domain name of the website actually accessed. Encryption standard and key length check: check whether the key length and encryption algorithm in the network certificate meet the security encryption standard. The public key length and encryption algorithm in the certificate should be strong enough to ensure the security of communication data. Chain structure integrity check: ensure the integrity of the chain structure of the network certificate. The certificate chain structure is composed of root certificate, intermediate certificate and server certificate, and its integrity is crucial to the validity of the certificate. Online certificate status protocol and certificate revocation list check: check whether the online certificate status protocol (OCSP) information and certificate revocation list (CRL) information are included in the network certificate. These information are used to confirm the validity and status of the certificate.

[0082] When the network certificate meets all the above security rules, it can be determined that the certificate is secure. The purpose of these rules is to ensure that the used certificate is legal, valid and secure, so as to guarantee the security and credibility of communication.

[0083] When the network certificate does not meet the above two security rules, the step of limiting the operation permission is entered. Further, in order to reduce potential security risks and protect the safety of the system and the user. Specifically, when checking the security rules of the network certificate, if it is found that the certificate does not meet the conditions, it means that there may be security risks. These risks may include that the authenticity of the certificate is questioned, the certificate may be tampered with or forged, the communication data may be stolen or tampered with, etc. In order to reduce potential security risks, the measure of limiting operation permission is executed. Before executing the measure of limiting operation permission, a notification can be sent to the user to explain that there is a security problem and the corresponding measures will be taken, which helps the user to understand the situation and may prompt the user to take further security measures. At the same time, the system can also strengthen other security measures to prevent further security risks, such as strengthening network security monitoring, updating certificate verification strategy, strengthening identity verification measures, etc.

[0084] By executing the step of limiting the operation permission, the network certificate with security risks can be dealt with in a timely manner, potential security threats can be reduced, and the safety of the system and the user can be protected, while ensuring the security and credibility of communication, the impact of security risks can be minimized.

[0085] In an embodiment, obtaining the network certificate of the first network of the third-party platform includes: obtaining the root node address in the network address of the first network of the third platform; and determining the network certificate corresponding to the first network according to the root node address.

[0086] In this embodiment, obtaining the network certificate of the first network of the third-party platform involves the following steps: first, the network address of the first network of the third-party platform needs to be obtained, which is usually composed of a group of numbers and dots, and is used to uniquely identify the location of the network node or device. In this step, the first network of the third-party platform will be located, and the root node address of the network will be obtained. The root node address is usually the starting address of the network and can be used to further retrieve the certificate information of the network. Once the root node address of the first network is obtained, the system will use the address to retrieve the corresponding network certificate. This usually involves communicating with the certificate authority (CA) or related server in the network to request the network certificate. The system sends a request to the root node address to obtain the certificate information associated with it.

[0087] In summary, the step of obtaining the network certificate of the first network of the third-party platform is an important part of ensuring secure communication between the cloud platform and the third-party platform. By obtaining and verifying the network certificate, the security and reliability of communication can be ensured.

[0088] In an embodiment, before obtaining the network certificate of the first network of the third-party platform, the network security detection method further comprises: performing a network delay test on a transmission interface between the third-party platform and the cloud platform; when the network delay test time of the transmission interface is within a preset range, proceeding to the step of obtaining the network certificate of the first network corresponding to the third-party platform.

[0089] In this embodiment, before obtaining the network certificate of the first network of the third-party platform, the network security detection method further comprises: performing a network delay test on a transmission interface between the third-party platform and the cloud platform. Network delay refers to the time required for data to travel from the sending end to the receiving end, also known as data transmission delay or network delay. The purpose of the test is to evaluate the performance and stability of the transmission interface, and the size of the network delay directly affects the speed and response time of data transmission, so testing the network delay of the transmission interface can help evaluate the efficiency and reliability of communication and whether the transmission interface meets the expected performance requirements.

[0090] Specifically, a threshold or range is set according to a preset network delay range, which may be determined according to the actual network environment, performance requirements or security policies. When the network delay test time of the transmission interface is within the preset range, proceed to the step of obtaining the network certificate of the first network corresponding to the third-party platform. In summary, the steps of this embodiment can ensure that the communication channel is stable and reliable when obtaining the network certificate, thereby ensuring the security and success of the certificate obtaining process.

[0091] In an embodiment, when creating a single sign-on account on the cloud platform according to the user identity information received by the third-party platform and configuring operation permissions for the single sign-on account, the single sign-on account is isolated from the local login account of the cloud platform, and the process of configuring operation permissions for the single sign-on account is isolated from the process of configuring operation permissions for the local login account of the cloud platform.

[0092] In this embodiment, when creating a single sign-on account on the cloud platform according to the user identity information received by the third-party platform and configuring operation permissions for the single sign-on account, the single sign-on account is isolated from the local login account of the cloud platform.

[0093] The single sign-on account is a specific account created on the cloud platform by the user identity information received by the third-party platform, used to implement the single sign-on function. In contrast, the local login account is an account created internally by the cloud platform, used to directly log in and access the cloud platform. In order to ensure the isolation between the single sign-on account and the local login account, measures are taken to ensure that they are independent of each other in terms of logic and permissions, avoiding mutual interference or confusion. When creating a single sign-on account and configuring its operation permissions, a special identity verification and authorization process is used. This process is for the single sign-on account and is separate from the process for the local login account.

[0094] Even in the same cloud platform, the authentication and authorization mechanisms of single sign-on accounts and local login accounts are separate to ensure that the operating permissions of single sign-on accounts do not affect local login accounts, and vice versa. For example, single sign-on accounts may have specific permission restrictions or access control policies that are independent of the permission settings of local login accounts to improve the security and flexibility of the system.

[0095] Maintaining the isolation between single sign-on accounts and local login accounts is crucial to ensuring the security and stability of the system, preventing the security of local login accounts from being affected by problems with the permission settings of single sign-on accounts, and avoiding the threat to single sign-on accounts due to the leakage of local login account permissions.

[0096] In summary, by isolating single sign-on accounts and local login accounts, their independence in authentication and permission settings can be guaranteed, thereby improving the security and reliability of the system.

[0097] As shown in Figure 2 The network security monitoring method of single sign-on can include but is not limited to the following steps: S21: configuring single sign-on website information on the cloud platform; S22: verifying the network certificate of the third-party platform (identity provider); S23: creating a single sign-on account and configuring permissions; S24: starting policy security detection to detect the first network of the third-party platform; S25: the cloud platform starts a periodic function to detect the security of the second network; S26: based on the results of network security detection of the first network and the second network, real-time control the operating permissions of single sign-on users.

[0098] In one embodiment, detecting the first network of the third-party platform includes: using a vulnerability scanning tool to scan the first network to determine whether the first network has vulnerabilities; performing password detection on the login management system of the first network to determine the complexity of the login password; detecting whether the first network is subject to cross-site request forgery attacks, injection attacks, directory traversal attacks; detecting whether the first network has file upload vulnerabilities to determine whether there are malicious file uploads; detecting whether the first network enables content security policies to determine whether there are malicious scripts and malicious content injections; detecting whether the URL header configuration of the first network is secure; scanning the host port of the first network to determine whether the host port is open in the same way as the pre-set required port; detecting whether there are unprotected backup files in the first network to determine whether there are abnormal backup files; detecting whether the first network has sensitive information leakage risks, including account name and / or account password and / or property information.

[0099] Specifically, the first network detection involves a variety of security checks, (1) using a vulnerability scanning tool to scan the first network to discover publicly known vulnerabilities that may exist in the network, which may be security vulnerabilities in third-party systems or applications that can be exploited by hackers to gain unauthorized access or perform malicious operations. (2) Password detection on the login management system of the first network to determine the complexity of the login password. The complexity of the password includes length, character type, etc., and a low complexity password is easy to guess or crack, increasing the security risk of the account. (3) Detect whether the first network is subject to Cross-Site Request Forgery (CSRF) attacks, injection attacks (such as SQL injection), directory traversal attacks, etc., which may cause system data leakage, tampering or destruction, so it is necessary to discover and prevent in time. (4) Detect whether the first network has a file upload vulnerability that can be exploited by attackers to upload malicious files such as Trojans or malicious scripts, thereby causing harm to the system. (5) Detect whether the first network has enabled Content Security Policy (CSP) to prevent the injection of malicious scripts and malicious content and improve network security. (6) Detect whether the first network's website header configuration is secure, including whether there are security headers (such as Strict-Transport-Security headers) to enhance network security. (7) Scan the host ports of the first network to determine which ports are open, and open ports may expose system services, so it is necessary to ensure that only necessary ports are open to reduce the attack surface. (8) Detect whether the first network has unprotected backup files that may contain sensitive information or system configuration information, which can be exploited by attackers if not properly protected. (9) Detect whether there is a risk of sensitive information leakage in the first network, such as account names, passwords, property information, etc., and the leakage of sensitive information may lead to risks such as identity theft and property loss.

[0100] These detection steps aim to discover and address potential security vulnerabilities in the first network to improve the security and stability of the network and protect user data and system resources from malicious attacks.

[0101] In one embodiment, detecting the second network corresponding to the cloud platform includes: scanning the application programs, operating systems and networked devices in the cloud platform to determine whether the application programs, operating systems and networked devices have vulnerabilities or attacks; detecting whether the configurations of network security groups, firewall rules, access control lists and identity authentication policies in the cloud platform conform to security configuration standards; monitoring network traffic of the second network and determining whether the cloud platform has abnormal traffic according to the network traffic of the second network; monitoring security logs of the cloud platform to determine whether the second network has risks, the security logs including login logs generated by user login, operation logs generated by user operation of the cloud platform, and abnormal logs generated by the operating system and the networked device; detecting whether the data in the cloud platform is encrypted during storage and transmission; periodically backing up the data in the cloud platform and testing the data recovery to verify whether there are abnormalities in the data backup and recovery of the cloud platform.

[0102] The steps of detecting the second network corresponding to the cloud platform in the embodiment cover multiple aspects of security checks, specifically including (1) scanning the application programs, operating systems and networked devices in the cloud platform to find possible publicly disclosed vulnerabilities, which may be exploited by hackers to hack the system, steal data or perform other malicious operations. (2) Detecting the configurations of network security groups, firewall rules, access control lists (ACLs) and identity authentication policies in the cloud platform to ensure that they conform to security configuration standards. Correctly configuring these security control measures can reduce the risk of system attacks. (3) Monitoring the network traffic of the second network to detect whether there is an abnormal traffic pattern. Abnormal traffic may indicate that the system has been subjected to a DDoS attack, network scanning or other malicious behavior. (4) Monitoring the security logs of the cloud platform, including user login logs, operation logs and abnormal logs, etc. By analyzing these logs, possible security threats and abnormal activities can be discovered and addressed in a timely manner. (5) Detecting whether the data in the cloud platform is encrypted during storage and transmission. Data encryption is an important measure to protect data confidentiality and can prevent data leakage or theft. (6) Periodically backing up the data in the cloud platform and testing the data recovery to verify the integrity and reliability of the backup. This helps to ensure that data can be recovered in a timely manner in the event of data loss or system failure, and prevents data loss or damage due to incomplete backup and recovery.

[0103] These security detection steps aim to improve the security of the cloud platform, protect the system from various security threats and attacks, and ensure the confidentiality, integrity and availability of data. By performing these detections regularly, potential security risks can be discovered and addressed in a timely manner to protect the security of the cloud platform and the data therein.

[0104] In a second aspect, as shown in Figure 3 The present application also provides a network security verification system, comprising:

[0105] The account creation unit 31 is configured to create a single sign-on account on a cloud platform and configure operation permissions for the single sign-on account according to user identity information received by a third-party platform; the third-party platform is a website for providing user identity information, and the cloud platform is a website for providing preset function services;

[0106] The account login unit 32 is configured to log in to the cloud platform through the single sign-on account according to an account name and an account password received by the third-party platform;

[0107] The risk assessment unit 33 is configured to detect a first network of the third-party platform and / or a second network corresponding to the cloud platform to determine whether the first network and / or the second network has a security risk;

[0108] The permission limitation unit 34 is configured to limit operation permissions of the account name for the cloud platform when the first network or the second network has a security risk.

[0109] In an embodiment, the network security detection system further includes:

[0110] The certificate acquisition unit is configured to acquire a network certificate of the first network of the third-party platform;

[0111] The certificate detection unit is configured to determine whether the network certificate meets a preset security certificate rule;

[0112] The execution unit is configured to establish a trust relationship between the third-party platform and the cloud platform when the network certificate meets the preset security certificate rule, and feed back to the account creation unit 31.

[0113] In an embodiment, the certificate detection unit is specifically configured to determine whether the network certificate is issued by a trusted certificate authority, and / or determine whether a validity period of the network certificate is within a validity period, and / or determine whether information in the network certificate is consistent with website information accessed, and / or determine whether a key length and an encryption algorithm in the network certificate meet a security encryption standard, and / or determine whether a chain structure in the network certificate is complete, and / or determine whether the network certificate includes online certificate status protocol information and certificate revocation list information; if the network certificate is issued by the trusted certificate authority, and the validity period is within the validity period, and the information in the network certificate is consistent with the website information accessed, and the key length and the encryption algorithm meet the security encryption standard, and the chain structure is complete and includes the online certificate status protocol information and the certificate revocation list information, it is determined that the network certificate meets the preset security certificate rule.

[0114] In an embodiment, the certificate obtaining unit is specifically configured to obtain a root node address in a network address of a first network of the third platform; and determine a network certificate corresponding to the first network according to the root node address.

[0115] In an embodiment, the network security detection system further comprises:

[0116] The network testing unit is configured to perform a network delay test on a transmission interface between the third-party platform and the cloud platform; and feed back to the certificate obtaining unit when a network delay test time of the transmission interface is within a preset range.

[0117] In an embodiment, when a single sign-on account is created in the cloud platform according to user identity information received by the third-party platform and operation permissions are configured for the single sign-on account, the single sign-on account is isolated from a local login account of the cloud platform, and a process of configuring the operation permissions for the single sign-on account is isolated from a process of configuring the operation permissions for the local login account of the cloud platform.

[0118] In an embodiment, the risk assessment unit 33 is specifically configured to scan the first network by using a vulnerability scanning tool to determine whether the first network has a vulnerability; perform a password detection on a login management system of the first network to determine a complexity of a login password; detect whether the first network is attacked by a cross-site request forgery attack, an injection attack, a directory traversal attack; detect whether the first network has a file upload vulnerability to determine whether there is a malicious file upload; detect whether the first network enables a content security policy to determine whether there is a malicious script and a malicious content injection; detect whether a website address header configuration of the first network is safe; scan a host port of the first network to determine whether an opening of the host port is the same as a preset required port; detect whether there is an unprotected backup file in the first network to determine whether there is an abnormal backup file; and detect whether the first network has a sensitive information leakage risk, the sensitive information including an account name and / or an account password and / or property information.

[0119] In an embodiment, the risk assessment unit 33 is specifically configured to scan the applications, operating systems and networked devices in the cloud platform to determine whether the applications, operating systems and networked devices have vulnerabilities or attacks; detect whether the configurations of network security groups, firewall rules, access control lists and identity authentication strategies in the cloud platform meet the security configuration standards; monitor the network traffic of the second network and determine whether there is abnormal traffic in the cloud platform according to the network traffic of the second network; monitor the security logs of the cloud platform to determine whether there is a risk in the second network, the security logs including login logs generated by user login, operation logs generated by user operation of the cloud platform, and abnormal logs generated by the operating system and the networked device; detect whether the data in the cloud platform is encrypted during storage and transmission; periodically backup the data in the cloud platform and perform recovery test to verify whether there is an abnormality in the data backup and recovery of the cloud platform.

[0120] For the introduction of the network security verification system, please refer to the above embodiments, which will not be repeated here.

[0121] In a third aspect, as shown in the above embodiments, the present application further provides a network security verification device, comprising: Figure 4

[0122] The memory 41 is configured to store the computer program.

[0123] The processor 42 is configured to implement the steps of the network security verification method when the computer program is stored.

[0124] For the introduction of the network security verification device, please refer to the above embodiments, which will not be repeated here.

[0125] In a fourth aspect, as shown in the above embodiments, the present application further provides a non-volatile storage medium 51, wherein the non-volatile storage medium 51 stores a computer program 52, and the computer program 52 is executed by a processor to implement the steps of the network security verification method. Figure 5

[0126] For the introduction of the non-volatile storage medium 51, please refer to the above embodiments, which will not be repeated here.

[0127] ​​It is also noted that, in this disclosure, relational terms such as first and second, and the like, can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0128] The above description of disclosed embodiments provides enabling concepts for practicing or using the application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein can be applied to other embodiments without departing from the spirit or scope of the application. Thus, the present application is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A network security detection method, characterized in that, include: Obtain the network certificate from the first network of the third-party platform; Determine whether the network certificate meets the preset security certificate rules; wherein, the specific methods for determining whether the network certificate meets the preset security certificate rules are as follows: determine whether the network certificate is issued by a trusted certificate authority, and / or, determine whether the validity period of the network certificate is within the validity period, and / or, determine whether the information in the network certificate is consistent with the information of the accessed website, and / or, determine whether the key length and encryption algorithm in the network certificate meet the security encryption standard, and / or, determine whether the chain structure in the network certificate is complete, and / or, determine whether the network certificate includes online certificate status protocol information and certificate revocation list information; If the network certificate is issued by a trusted certificate authority and is within its validity period, and the information in the network certificate is consistent with the information of the accessed website, and the key length and the encryption algorithm conform to the security encryption standard, and the chain structure is complete and includes the online certificate status protocol information and the certificate revocation list information, then the network certificate is determined to meet the preset security certificate rules. When the network certificate meets the preset security certificate rules, a trust relationship is established between the third-party platform and the cloud platform; Based on the user identity information received from the third-party platform, a single sign-on account is created on the cloud platform, and operation permissions are configured for the single sign-on account; the third-party platform is a website used to provide the user identity information, and the cloud platform is a website used to provide preset functional services; Log in to the cloud platform using the single sign-on account based on the username and password received from the third-party platform; The first network of the third-party platform is detected, and / or the second network corresponding to the cloud platform is detected, to determine whether there are security risks in the first network and / or the second network; If there is a security risk in the first network or the second network, the user's access to the cloud platform will be restricted.

2. The network security detection method as described in claim 1, characterized in that, Obtaining the network certificate of the first network of the third-party platform includes: Obtain the root node address from the network address of the first network of the third-party platform; The network certificate corresponding to the first network is determined based on the root node address.

3. The network security detection method as described in claim 1, characterized in that, Before obtaining the network certificate of the first network of the third-party platform, the network security detection method further includes: Perform network latency testing on the transmission interface between the third-party platform and the cloud platform; When the network latency test time of the transmission interface is within a preset range, the step of obtaining the network certificate of the first network corresponding to the third-party platform is initiated.

4. The network security detection method as described in claim 1, characterized in that, When creating a single sign-on account on the cloud platform based on the user identity information received from the third-party platform and configuring operation permissions for the single sign-on account, the single sign-on account is isolated from the local login account on the cloud platform, and the process of configuring operation permissions for the single sign-on account is isolated from the process of configuring the operation permissions for the local login account on the cloud platform.

5. The network security detection method according to any one of claims 1-4, characterized in that, The first network of the third-party platform is tested, including: Use a vulnerability scanning tool to scan the first network to determine if the first network has any vulnerabilities; Password testing is performed on the login management system of the first network to determine the complexity of the login password; Detect whether the first network is subject to cross-site request forgery attacks, injection attacks, or directory traversal attacks; Detect whether the first network has a file upload vulnerability to determine whether malicious file uploads are occurring; Detect whether the first network has enabled a content security policy to determine whether malicious scripts and malicious content injection exist; Check whether the URL header configuration of the first network is secure; The host ports of the first network are scanned to determine whether the opening status of the host ports is the same as the preset required ports. Detect whether there are unprotected backup files in the first network to determine whether there are abnormal backup files; The system detects whether there is a risk of sensitive information leakage in the first network, including the account name and / or the account password and / or property information.

6. The network security detection method according to any one of claims 1-4, characterized in that, The second network corresponding to the cloud platform is detected, including: Scan the applications, operating systems, and networked devices in the cloud platform to determine whether the applications, operating systems, and networked devices are vulnerable to vulnerabilities or attacks; Check whether the configuration of network security groups, firewall rules, access control lists, and identity authentication policies in the cloud platform meets the security configuration standards; Monitor the network traffic of the second network, and determine whether there is abnormal traffic on the cloud platform based on the network traffic of the second network; Monitor the security logs of the cloud platform to determine whether there is a risk to the second network. The security logs include login logs generated by user login, operation logs generated by user operation of the cloud platform, and abnormal logs generated by the operating system and the networked devices. Detect whether the data in the cloud platform is encrypted during storage and transmission; Regularly perform backup and recovery tests on the data in the cloud platform to verify whether there are any anomalies during data backup and recovery.

7. A network security verification system, characterized in that, include: The account creation unit is used to create a single sign-on account on the cloud platform based on the user identity information received from the third-party platform, and to configure operation permissions for the single sign-on account; the third-party platform is a website that provides the user identity information, and the cloud platform is a website that provides preset functional services; An account login unit is used to log in to the cloud platform using the single sign-on account based on the username and password received by the third-party platform. The risk assessment unit is used to detect the first network of the third-party platform and / or the second network corresponding to the cloud platform to determine whether there are security risks in the first network and / or the second network. The permission restriction unit is used to restrict the account name's operation permissions on the cloud platform when there is a security risk in the first network or the second network; Also includes: A certificate acquisition unit is used to acquire the network certificate of the first network of the third-party platform. A certificate detection unit is used to determine whether the network certificate meets preset security certificate rules. Specifically, the certificate detection unit is used to determine whether the network certificate is issued by a trusted certificate authority, and / or whether the network certificate is valid within its validity period, and / or whether the information in the network certificate is consistent with the accessed website information, and / or whether the key length and encryption algorithm in the network certificate conform to security encryption standards, and / or whether the chain structure in the network certificate is complete, and / or whether the network certificate includes online certificate status protocol information and certificate revocation list information. If the network certificate is issued by a trusted certificate authority, is valid within its validity period, the information in the network certificate is consistent with the accessed website information, the key length and encryption algorithm conform to the security encryption standards, and the chain structure is complete and includes the online certificate status protocol information and the certificate revocation list information, then the network certificate is determined to meet the preset security certificate rules. The execution unit is used to ensure that the network certificate meets the preset security certificate rules, establish a trust relationship between the third-party platform and the cloud platform, and then send the feedback to the account creation unit.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the network security detection method according to any one of claims 1-6 when storing a computer program.

9. A non-volatile storage medium, characterized in that, The non-volatile storage medium stores a computer program, which, when executed by a processor, implements the steps of the network security detection method according to any one of claims 1-6.

Images