Security access policy matching method and device, computer device and storage medium

Abstract

The application relates to the technical field of network security, and discloses a secure access policy matching method and device, computer equipment and a storage medium, the method comprises the following steps: acquiring access information of a host, wherein the access information comprises first path information and second path information, the first path information is path information of an access subject, and the second path information is path information of an access object; based on a preset file name and file identifier corresponding relation table, the first path information is converted into digital form first target path information, and the second path information is converted into digital form second target path information; based on the first target path information and the second target path information, a target secure access policy is matched from a secure access policy library; and based on the target secure access policy, the access right of the access subject to the access object is determined. The path information of the access subject and the access object is converted into digital form, and the matching efficiency of the secure access policy is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a secure access policy matching method and device, computer equipment and a storage medium. BACKGROUND

[0002] With the development of digital transformation and the network, the position of host security in network security is becoming more and more important. In order to ensure the security of the host and the business, the secure access policy is essential, and the key to its implementation is to improve the matching efficiency of the subject and the object.

[0003] In related technologies, in order to improve the matching efficiency of the host security access policy, the resource path in the policy can be constructed as a tree structure. When processing the secure access policy matching request, a tree matching algorithm is used for matching to improve the efficiency.

[0004] However, the matching of related technologies is still the matching of resource paths, and in the case of many secure access policies and long resource paths, the matching efficiency is still not high, the system response speed is slow, and real-time protection cannot be achieved. SUMMARY

[0005] Therefore, the present application provides a secure access policy matching method, device, computer equipment and storage medium to solve the problems of low secure access policy matching efficiency, slow system response speed and poor real-time protection effect in related technologies.

[0006] In a first aspect, the present application provides a secure access policy matching method, which comprises:

[0007] obtaining access information of a host, wherein the access information comprises first path information and second path information, the first path information is path information of an access subject, and the second path information is path information of an access object;

[0008] based on a preset file name and file identifier correspondence table, converting the first path information into digital form first target path information, and converting the second path information into digital form second target path information;

[0009] based on the first target path information and the second target path information, matching a target secure access policy from a secure access policy library;

[0010] based on the target secure access policy, determining the access permission of the access subject to the access object.

[0011] The security access strategy matching method provided in the embodiment converts the first path information and the second path information into digital first target path information and second target path information, and matches a target security access strategy from a security access strategy library according to the first target path information and the second target path information, thereby improving the matching efficiency, further improving the system response speed, and achieving the effect of real-time protection.

[0012] In an optional implementation, the converting the first path information into digital first target path information and the converting the second path information into digital second target path information based on the preset file name and file identifier correspondence table comprises:

[0013] Splitting the first path information and the second path information into multiple file names based on file split identifiers;

[0014] Judging whether the preset file name and file identifier correspondence table contains the multiple file names;

[0015] In the case that the preset file name and file identifier correspondence table contains the multiple file names, obtaining file identifiers corresponding to the multiple file names based on the preset file name and file identifier correspondence table;

[0016] In the case that the preset file name and file identifier correspondence table does not contain at least one file name of the multiple file names, updating the preset file name and file identifier correspondence table based on the at least one file name not contained, so as to obtain the file identifiers corresponding to the multiple file names based on the updated preset file name and file identifier correspondence table;

[0017] Converting file split identifiers between the multiple file names in the first path information into digital connection identifiers, and replacing the multiple file names in the first path information with the file identifiers corresponding to the file names, to obtain the first target path information;

[0018] Converting file split identifiers between the multiple file names in the second path information into digital connection identifiers, and replacing the multiple file names in the second path information with the file identifiers corresponding to the file names, to obtain the second target path information.

[0019] The security access strategy matching method provided in the embodiment converts the file names in the first path information and the second path information into corresponding file identifiers, converts file split identifiers in the first path information and the second path information into digital connection identifiers, to obtain the first target path information and the second target path information, thereby improving the matching efficiency, further improving the system response speed, and achieving the effect of real-time protection.

[0020] In an optional implementation, the matching of the target security access policy from the security access policy library based on the first target path information and the second target path information comprises:

[0021] obtaining path matching feature values of the first target path information and the second target path information;

[0022] filtering a target path matching information set from the security access policy library based on the path matching feature values;

[0023] obtaining a target security access policy set from the security access policy library based on the target path matching information set;

[0024] matching the target security access policy from the target security access policy set based on the first target path information and the second target path information.

[0025] The security access policy matching method provided in the embodiment filters a target path matching information set from the security access policy library based on path matching feature values of the first target path information and the second target path information, obtains a target security access policy set from the security access policy library based on the target path matching information set, excludes a large number of non-matching items, improves the matching degree of the access subject and the access object, and then matches the target security access policy from the target security access policy set based on the first target path information and the second target path information. The number of accurate matching of the access subject and the access object path is reduced, and the matching efficiency is greatly improved.

[0026] In an optional implementation, the obtaining of the path matching feature values of the first target path information and the second target path information comprises:

[0027] determining a first target path level represented by a first path matching feature value based on the number of digital connection identifiers in the first target path information;

[0028] determining a middle value of the first target path represented by a second path matching feature value based on the total number of file identifiers and digital connection identifiers in the first target path information;

[0029] determining a file identifier sum of the first target path represented by a third path matching feature value based on the file identifiers in the first target path information;

[0030] determining a second target path level represented by a fourth path matching feature value based on the number of digital connection identifiers in the second target path information;

[0031] determine a fifth path matching characteristic value representing a middle value of the second target path based on a total number of file identifiers and digital connection identifiers in the second target path information;

[0032] determine a sixth path matching characteristic value representing a file identifier sum of the second target path based on the file identifiers in the second target path information.

[0033] The security access strategy matching method provided in the embodiment can realize the priority matching of the path matching characteristic values by obtaining three path matching characteristic values of the access subject and three path matching characteristic values of the access object, exclude a large number of non-matching items in the security access strategy library, improve the matching degree of the access subject and the access object, reduce the number of accurate matching of the path of the access subject and the path of the access object, and thus greatly improve the matching efficiency.

[0034] In an optional implementation, the filtering of the target path matching information set from the security access strategy library based on the path matching characteristic values comprises:

[0035] filtering, from the security access strategy library, a first path matching information set in which the first characteristic value of the access subject is not greater than the first path matching characteristic value and the first characteristic value of the access object is not greater than the fourth path matching characteristic value based on the first path matching characteristic value and the fourth path matching characteristic value;

[0036] filtering, from the first path matching information set, a second path matching information set in which the second characteristic value of the access subject is the same as the second path matching characteristic value based on the second path matching characteristic value;

[0037] in a case where the second path matching information set is empty, performing a hierarchical update operation on the first target path information to obtain an updated second path matching characteristic value and an updated third path matching characteristic value, and filtering, from the first path matching information set, a second path matching information set in which the second characteristic value of the access subject is the same as the updated second path matching characteristic value based on the updated second path matching characteristic value;

[0038] in a case where the second path matching information set is empty and the first target path information is updated to the root directory, determining that the target path matching information set fails to match;

[0039] in a case where the second path matching information set is not empty and the first target path information is not updated hierarchically, filtering, from the second path matching information set, a third path matching information set in which the third characteristic value of the access subject is the same as the third path matching characteristic value based on the third path matching characteristic value;

[0040] In a case where the second path matching information set is not empty and the first target path information is updated hierarchically, third path matching information sets in which the third characteristic value of the access subject is the same as the updated third path matching characteristic value are filtered from the second path matching information set based on the updated third path matching characteristic value;

[0041] Fourth path matching information sets in which the second characteristic value of the access object is the same as the fifth path matching characteristic value are filtered from the third path matching information set based on the fifth path matching characteristic value;

[0042] In a case where the fourth path matching information set is empty, the second target path information is updated hierarchically to obtain an updated fifth path matching characteristic value and an updated sixth path matching characteristic value, and fourth path matching information sets in which the second characteristic value of the access object is the same as the updated fifth path matching characteristic value are filtered from the third path matching information set based on the updated fifth path matching characteristic value;

[0043] In a case where the fourth path matching information set is empty and the second target path information is updated hierarchically to the root directory, it is determined that the target path matching information set fails to match;

[0044] In a case where the fourth path matching information set is not empty and the second target path information is not updated hierarchically, target path matching information sets in which the third characteristic value of the access object is the same as the sixth path matching characteristic value are filtered from the fourth path matching information set based on the sixth path matching characteristic value;

[0045] In a case where the fourth path matching information set is not empty and the second target path information is updated hierarchically, target path matching information sets in which the third characteristic value of the access object is the same as the updated sixth path matching characteristic value are filtered from the fourth path matching information set based on the updated sixth path matching characteristic value.

[0046] The security access strategy matching method provided in the embodiment achieves the priority matching of the path matching characteristic values, excludes a large number of non-matching items in the security access strategy library, improves the matching degree of the access subject and the access object, reduces the number of accurate matching of the path of the access subject and the access object, and thus greatly improves the matching efficiency.

[0047] In an optional implementation, the matching of the target security access strategy from the target security access strategy set based on the first target path information and the second target path information comprises:

[0048] The first target path information and the second target path information that trigger the matching information set of the target path to be matched successfully are acquired.

[0049] The target security access strategy is matched from the target security access strategy set based on the first target path information and the second target path information that trigger the matching information set of the target path to be matched successfully.

[0050] The security access strategy matching method provided in the embodiment can more accurately determine the target security access strategy based on the first target path information and the second target path information that trigger the matching information set of the target path to be matched successfully, and ensures the security of the system.

[0051] In an optional implementation, the target security access strategy set is acquired from the security access strategy library based on the target path matching information set, and the method comprises:

[0052] The association identifier in the target path matching information set is acquired.

[0053] The target security access strategy set is acquired from the security access strategy library based on the association identifier.

[0054] The security access strategy matching method provided in the embodiment can ensure the accuracy of the acquired target security access strategy set by acquiring the target security access strategy set from the security access strategy library based on the association identifier in the target path matching information set.

[0055] In a second aspect, the present application provides a security access strategy matching device, and the device comprises:

[0056] An acquisition module is configured to acquire access information of a host, wherein the access information comprises first path information and second path information, the first path information is path information of an access subject, and the second path information is path information of an access object.

[0057] A conversion module is configured to convert the first path information into first target path information in a digital form and convert the second path information into second target path information in a digital form based on a preset file name and file identifier correspondence table.

[0058] A matching module is configured to match a target security access strategy from a security access strategy library based on the first target path information and the second target path information.

[0059] determining module, configured to determine, based on the target security access policy, an access right of the access subject to the access object.

[0060] In a third aspect, the present application provides a computer device, comprising a memory and a processor, which are connected with each other in communication, the memory stores computer instructions, and the processor executes the computer instructions to perform the security access policy matching method of the first aspect or any of the corresponding embodiments.

[0061] In a fourth aspect, the present application provides a computer readable storage medium, which stores computer instructions, and the computer instructions are used to make a computer execute the security access policy matching method of the first aspect or any of the corresponding embodiments.

[0062] In a fifth aspect, the present application provides a computer program product, which comprises computer instructions, and the computer instructions are used to make a computer execute the security access policy matching method of the first aspect or any of the corresponding embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0063] In order to more clearly illustrate the technical solutions of the specific embodiments or the related art, the following will briefly introduce the drawings needed to be used in the specific embodiments or the related art description. Obviously, the drawings in the following description are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0064] Figure 1 FIG. 1 is a flowchart of a security access policy matching method according to an embodiment of the present application;

[0065] Figure 2 FIG. 2 is a flowchart of another security access policy matching method according to an embodiment of the present application;

[0066] Figure 3 FIG. 3 is a structural diagram of a security access policy matching system according to an embodiment of the present application;

[0067] Figure 4 FIG. 4 is a flowchart of a security access policy storage method according to an embodiment of the present application;

[0068] Figure 5 FIG. 5 is a flowchart of still another security access policy matching method according to an embodiment of the present application;

[0069] Figure 6 FIG. 6 is a structural block diagram of a security access policy matching device according to an embodiment of the present application;

[0070] Figure 7Fig. 1 is a schematic diagram of a hardware structure of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0071] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0072] With the development of networks, network security is becoming more and more important. A host is a key device for storing and processing sensitive information, and therefore, host security plays a very important role in network security. In order to ensure the security of a host and a service running on the host, many security access policies, which can also be referred to as security access control policies, are manually issued.

[0073] It should be noted that a security access control policy is a security rule configured manually, which is issued to an agent installed on a host through a web management end or a command line interface of the host, and is finally effective in the host after being parsed, aiming to improve the security of local resource access of the host. Exemplarily, a security access control policy on Linux can be as shown in Table 1.

[0074] Table 1

[0075] Subject Object Permission / etc / bin / usr / local / check rw (read and write permission) / usr / local / ZeC / usr / local / ZeC / bin x (execute permission)

[0076] An agent end refers to a software component, application program, middleware or other type of program in a host, which is responsible for performing a specific task, collecting data, interacting with a user or communicating with other system components.

[0077] Among them, the three fields in the security access control policy are explained as follows:

[0078] Subject: refers to an active entity, which is an initiator of access. Generally refers to a process, service, program or access user, etc., causing information flow and system state change.

[0079] It should be noted that the subject can be configured with a directory, and when the directory is configured, the subject contains all processes, services or programs in the directory or subdirectories.

[0080] Object: refers to a passive entity containing or accepting information, which is passive in information flow and under the action of the subject. The object can be a called program or accessed data, or a directory. Access to the object means access to the information contained in the object.

[0081] Right: refers to the access or execution right of the subject to the protected resource in the object.

[0082] As shown in Table 1, in the case that the subject is / etc / bin and the object is / usr / local / check, the subject has read and write permissions for the object, that is, the subject can perform read or write operations on the object.

[0083] In the case that the subject is / usr / local / ZeC and the object is / usr / local / ZeC / bin, the subject has execution permissions for the object, that is, the subject can perform various operations on the object.

[0084] After the user configures the security access control policy, the security access control policy is issued to the agent end of the host, and the agent end of the host parses the security access control policy to obtain the security access control policy in the above format.

[0085] When a subject (user or process) in the host wants to access an object (host resource), the security access policy matching is triggered, and in the case of successful matching, the subject can only perform the corresponding permissions matched in the security access policy on the object, and the execution of the permissions not configured will be rejected. In the case that the subject or the object fails to match the corresponding security access policy, no processing will be performed, that is, no permission restriction, and the access of the subject to the object has no permission restriction.

[0086] It should be noted that the matching of the security access policy refers to one-to-one matching of the actual subject executing on the host and the subject in the security access control policy, and the object accessed on the host and the object in the security access control policy. After successful matching, the permission control is performed.

[0087] When the user operates the host resource or other processes access the host resource, the matching of the security access policy is triggered. In order to improve the ease of use of the user, not to affect the stability of the running business on the host and to protect the host resource in real time, improving the matching efficiency of the host security access control policy becomes the key. The matching efficiency of the host security access policy is ultimately the matching efficiency of the subject and the object in the security access control policy, and the matching efficiency of the subject and the object is essentially the matching efficiency of the resource path on the host.

[0088] In the related art, in order to improve the matching efficiency of the host security access policy, the resource path in the policy can be constructed as a tree structure. When processing the security access policy matching request, that is, processing the matching of the subject and the object, the tree matching algorithm is used for matching, that is, tree matching, to improve the efficiency.

[0089] However, the matching of the related art is still the matching of the resource path on the host, and in the case that the security access policy is multiple and the resource path of the subject and the object is long, the efficiency of the matching algorithm using the tree data structure is not obvious when triggering the security access policy matching, resulting in slow response speed of the system and poor real-time protection effect.

[0090] Of course, in the case that the security access policy is multiple and the resource path of the subject and the object is long, the disk space occupied by the storage of the security access policy is also large.

[0091] The embodiment of the application provides a security access policy matching method, which converts the first path information into digital form of first target path information and converts the second path information into digital form of second path information according to the correspondence table of the preset file name and the file identifier, and matches the target security access policy from the security access policy library based on the first target path information and the second target path information, so as to improve the security access policy matching efficiency and realize the effect of real-time protection.

[0092] According to the embodiment of the application, a security access policy matching method is provided, and it should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a group of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0093] In the embodiment, a security access policy matching method is provided, which can be used in mobile terminals such as servers, central processing units, etc. Figure 1 The flowchart of the security access policy matching method according to the embodiment of the application is shown in FIG. 1, which includes the following steps: Figure 1

[0094] In step S101, the access information of the host is obtained.

[0095] The access information includes first path information and second path information, the first path information is the path information of the access subject, and the second path information is the path information of the access object. The access subject is the same as the subject described above, and the access object is the same as the object described above.

[0096] The access information is the information of the access subject (user or process or service, etc.) accessing the access object (host resource) on the host.

[0097] It should be noted that when the user operates the host resource or other processes access the host resource, the access information is generated, and the server obtains the access information of the host.

[0098] ​Step S102, converting the first path information into digital form of first target path information and converting the second path information into digital form of second target path information based on the preset file name and file identification corresponding relationship table.

[0099] The preset file name and file identification corresponding relationship table is set by a user in a server and contains the corresponding relationship between the file name and the file identification. For example, the preset file name and file identification corresponding relationship table can be shown in Table 2.

[0100] Table 2

[0101] ID File name 1 usr 2 root … … 45 local 46 bin … … 500 xxx

[0102] The file identification can be represented by an identification (ID for short). As shown in Table 2, the file name is usr, and the corresponding file identification is 1. The file name is root, and the corresponding file identification is 2, and so on.

[0103] After obtaining the first path information and the second path information, the first path information is converted into digital form of first target path information, and the second path information is converted into digital form of second target path information according to the preset file name and file identification corresponding relationship table.

[0104] Step S103, matching the target security access policy from the security access policy library based on the first target path information and the second target path information.

[0105] The security access policy library is set in the host agent end and is used to store the security access policy issued by the user. It should be noted that the security access policy in the security access policy library can exist in the form shown in Table 3.

[0106] Table 3

[0107] Access subject Access object Access permission 1-45-46 2-501 r

[0108] It can be seen that the path information of the subject and the object in the security access policy in the security access policy library also exists in digital form.

[0109] After obtaining the first target path information and the second target path information, the target security access policy is matched from the security access policy library according to the first target path information and the second target path information.

[0110] Step S104, determining the access permission of the access subject to the access object based on the target security access policy.

[0111] Wherein, in the case that the target security access policy is matched from the security access policy library, the access right of the access subject to the access object is determined according to the target security access policy.

[0112] The security access policy matching method provided by the embodiment converts the first path information and the second path information into the first target path information and the second target path information in digital form, matches the target security access policy from the security access policy library according to the first target path information and the second target path information, improves the matching efficiency, and further improves the system response speed, so as to realize the effect of real-time protection. Moreover, the subject and the object of the security access policy stored in the security access policy library are also in digital form, so that the disk space occupied by the storage of the security access policy is saved.

[0113] In the embodiment, a security access policy matching method is provided, which can be used in mobile terminals such as servers, central processing units, etc. Figure 2 The flowchart of the security access policy matching method according to the embodiment of the application is shown in FIG. 1, which includes the following steps: Figure 2

[0114] In step S201, the access information of the host is acquired. For details, refer to step S101 of the embodiment shown in FIG. 1, which will not be repeated here. Figure 1

[0115] In step S202, the first path information is converted into the first target path information in digital form, and the second path information is converted into the second target path information in digital form based on the preset correspondence table of file names and file identifiers.

[0116] Specifically, step S202 includes:

[0117] In step S2021, the first path information and the second path information are split into multiple file names based on the file split identifier.

[0118] Wherein, after the first path information and the second path information are acquired, the first path information and the second path information are split into multiple file names according to the file split identifier in the first path information and the second path information.

[0119] It should be noted that the file split identifier can be “ / ”. For example, the first path information is / usr / local / bin, and the first path information is split into usr, local and bin according to the file split identifier.

[0120] Similarly, the second path information is split into multiple file names.

[0121] In step S2022, it is judged whether the multiple file names are contained in the preset correspondence table of file names and file identifiers.​​

[0122] wherein, after splitting the first path information into a plurality of file names and splitting the second path information into a plurality of file names, it is determined whether the plurality of file names split from the first path information and the plurality of file names split from the second path information are contained in the correspondence table of the preset file name and the file identifier.

[0123] In step S2023, in a case where the plurality of file names are contained in the correspondence table of the preset file name and the file identifier, the file identifiers corresponding to the plurality of file names are obtained based on the correspondence table of the preset file name and the file identifier.

[0124] wherein, the correspondence table of the preset file name and the file identifier contains the plurality of file names split from the first path information and the plurality of file names split from the second path information, which indicates that the file identifiers corresponding to the plurality of file names split from the first path information and the plurality of file names split from the second path information can be obtained based on the correspondence table of the preset file name and the file identifier.

[0125] wherein, the correspondence table of the preset file name and the file identifier contains the plurality of file names split from the first path information and the plurality of file names split from the second path information, which indicates that the file identifiers corresponding to the plurality of file names split from the first path information and the plurality of file names split from the second path information can be obtained based on the correspondence table of the preset file name and the file identifier.

[0126] In step S2024, in a case where at least one of the plurality of file names is not contained in the correspondence table of the preset file name and the file identifier, the correspondence table of the preset file name and the file identifier is updated based on the at least one of the plurality of file names not contained, so as to obtain the file identifiers corresponding to the plurality of file names based on the updated correspondence table of the preset file name and the file identifier.

[0127] wherein, the correspondence table of the preset file name and the file identifier contains the plurality of file names split from the first path information and the plurality of file names split from the second path information, which indicates that the file identifiers corresponding to the plurality of file names split from the first path information and the plurality of file names split from the second path information can be obtained based on the correspondence table of the preset file name and the file identifier.

[0128] The preset file name and file identification corresponding relationship table needs to be updated, and specifically, the at least one file name not contained and the file identification corresponding to the file name are added to the preset file name and file identification corresponding relationship table in the form shown in Table 2. It can be understood that the file identification corresponding to the file name not contained can be set by the user, or the server can generate the file identification corresponding to the file name not contained by sequentially adding 1 to the current maximum value of the ID in the preset file name and file identification corresponding relationship table. For example, the maximum value of the current ID is 500, if there are 2 file names not contained, one of the file names not contained corresponds to the file identification 501, and the other file name corresponds to the file identification 502.

[0129] For example, the updated preset file name and file identification corresponding relationship table can be as shown in Table 4.

[0130] Table 4

[0131]

[0132]

[0133] For example, when the first path information is / root / test, since the test file name is not contained in the preset file name and file identification corresponding relationship table shown in Table 2, the preset file name and file identification corresponding relationship table needs to be updated, and after the update, the test file name and the file identification corresponding to the test, i.e., 501, are added as shown in Table 4.

[0134] Based on the updated preset file name and file identification corresponding relationship table, the file identifications corresponding to the multiple file names split from the first path information and the multiple file names split from the second path information are obtained.

[0135] In step S2025, the file split identifications between the multiple file names in the first path information are converted into digital connection identifications, and the multiple file names in the first path information are replaced by the file identifications corresponding to the file names, to obtain first target path information.

[0136] In step S2025, the file split identifications between the multiple file names in the first path information are converted into digital connection identifications, and the multiple file names in the first path information are replaced by the file identifications corresponding to the file names, to obtain first target path information.

[0137] It should be noted that the digital connection identification can be “-”. For example, when the first path information is / usr / local / bin, the file split identifications between the multiple file names in the first path information are converted into digital connection identifications, and the first path information becomes usr-local-bin.

[0138] The file names in the first path information are replaced by the file identifiers corresponding to the file names. For example, as shown in Table 2, the file identifier corresponding to usr is 1, the file identifier corresponding to local is 45, and the file identifier corresponding to bin is 46. The first target path information is 1-45-46.

[0139] In step S2026, the file split identifiers between the file names in the second path information are converted into digital connection identifiers, and the file names in the second path information are replaced by the file identifiers corresponding to the file names, to obtain the second target path information.

[0140] The second target path information can be obtained in the same way as the first target path information.

[0141] In step S203, the target security access policy is matched from the security access policy library based on the first target path information and the second target path information. For details, refer to Figure 1 The step S103 of the embodiment shown in FIG. 1 is not repeated here.

[0142] In step S204, the access permission of the access subject to the access object is determined based on the target security access policy. For details, refer to Figure 1 The step S104 of the embodiment shown in FIG. 1 is not repeated here.

[0143] The security access policy matching method provided in the embodiment converts the file names in the first path information and the second path information into corresponding file identifiers, converts the file split identifiers in the first path information and the second path information into digital connection identifiers, obtains the first target path information and the second target path information, improves the matching efficiency, and further improves the system response speed, thereby achieving the effect of real-time protection.

[0144] In some optional embodiments, the step S203 includes:

[0145] In step a1, the path matching feature values of the first target path information and the second target path information are obtained.

[0146] The path matching feature values of the first target path information and the second target path information are obtained after the first target path information and the second target path information are obtained.

[0147] In step a2, the target path matching information set is filtered from the security access policy library based on the path matching feature values.

[0148] After the path matching feature values of the first target path information and the second target path information are obtained, the target path matching information set is filtered from the security access policy library according to the path matching feature values of the first target path information and the second target path information.

[0149] Step a3, obtaining the target security access policy set from the security access policy library based on the target path matching information set.

[0150] After the target path matching information set is filtered, the target security access policy set is obtained from the security access policy library according to the target path matching information set.

[0151] Step a4, matching the target security access policy from the target security access policy set based on the first target path information and the second target path information.

[0152] After the target security access policy set is obtained, the target security access policy is matched from the target security access policy set according to the first target path information and the second target path information.

[0153] The security access policy matching method provided in the embodiment can obtain the path matching feature values of the first target path information and the second target path information, filter the target path matching information set from the security access policy library based on the path matching feature values, obtain the target security access policy set from the security access policy library based on the target path matching information set, exclude a large number of unmatched items, improve the matching degree of the access subject and the access object, and match the target security access policy from the target security access policy set based on the first target path information and the second target path information. The number of accurate matching of the access subject and the access object path is reduced, and the matching efficiency is greatly improved.

[0154] In some optional embodiments, the above step a1 includes:

[0155] Step a11, determining the level of the first target path represented by the first path matching feature value based on the number of the digital connection identifiers in the first target path information.

[0156] The level of the first target path represented by the first path matching feature value is obtained by adding 1 to the number of the digital connection identifiers in the first target path information.

[0157] For example, the first target path information is 1-45-46, and the number of the digital connection identifiers is 2. Therefore, the first path matching feature value is 3.

[0158] Step a12, determining the intermediate value of the first target path represented by the second path matching characteristic value based on the total number of file identifiers and digital connection identifiers in the first target path information.

[0159] The intermediate value of the first target path represented by the second path matching characteristic value is obtained by obtaining the total number of file identifiers and digital connection identifiers in the first target path information, and then obtaining the median of the total number, and determining the intermediate value corresponding to the median in the first target path information, i.e. the intermediate value of the first target path.

[0160] For example, the first target path information is 1-45-46, the total number of file identifiers and digital connection identifiers is 5, the median of the total number is 3, and the intermediate value corresponding to the median 3 is 45, i.e. the intermediate value of the first target path is 45, and the second path matching characteristic value is 45.

[0161] Step a13, determining the file identifier sum of the first target path represented by the third path matching characteristic value based on the file identifiers in the first target path information.

[0162] The file identifier sum of the first target path represented by the third path matching characteristic value is obtained by adding all the file identifiers in the first target path information.

[0163] For example, the first target path information is 1-45-46, the total sum of all file identifiers is 1+45+46=92, and the third path matching characteristic value is 92.

[0164] Step a14, determining the level of the second target path represented by the fourth path matching characteristic value based on the number of digital connection identifiers in the second target path information.

[0165] The level of the second target path represented by the fourth path matching characteristic value is obtained by adding 1 to the number of digital connection identifiers in the second target path information.

[0166] For example, the second target path information is 2-501, and the number of digital connection identifiers is 1, so the fourth path matching characteristic value is 2.

[0167] Step a15, determining the intermediate value of the second target path represented by the fifth path matching characteristic value based on the total number of file identifiers and digital connection identifiers in the second target path information.

[0168] The intermediate value of the second target path represented by the fifth path matching characteristic value is obtained by obtaining the total number of file identifiers and digital connection identifiers in the second target path information, and then obtaining the median of the total number, and determining the intermediate value corresponding to the median in the second target path information, i.e. the intermediate value of the second target path.

[0169] Exemplarily, the second target path information is 2-501, the total number of the file identifier and the digital connection identifier is 3, the median of the total number is 2, the intermediate value corresponding to the median 3 is -, that is, the intermediate value of the second target path is -, and the fifth path matching feature value is -.

[0170] In step a16, the sixth path matching feature value is determined based on the file identifier in the second target path information, and the file identifier sum of the second target path represented by the sixth path matching feature value is determined.

[0171] In step a16, the sixth path matching feature value is determined based on the file identifier in the second target path information, and the file identifier sum of the second target path represented by the sixth path matching feature value is determined.

[0172] Exemplarily, the second target path information is 2-501, the total sum of all file identifiers is 2+501=503, and the sixth path matching feature value is 503.

[0173] The security access strategy matching method provided in the embodiment can obtain three path matching feature values of the access subject and three path matching feature values of the access object, and then realize the priority matching of the path matching feature values, so as to exclude a large number of non-matching items in the security access strategy library, improve the matching degree of the access subject and the access object, reduce the number of accurate matching of the path of the access subject and the access object, and greatly improve the matching efficiency.

[0174] In some optional embodiments, the above step a2 comprises:

[0175] In step a21, based on the first path matching feature value and the fourth path matching feature value, the first path matching information set in which the first feature value of the access subject is not greater than the first path matching feature value and the first feature value of the access object is not greater than the fourth path matching feature value is filtered out from the security access strategy library.

[0176] In step a21, based on the first path matching feature value and the fourth path matching feature value, the first path matching information set in which the first feature value of the access subject is not greater than the first path matching feature value and the first feature value of the access object is not greater than the fourth path matching feature value is filtered out from the security access strategy library.

[0177] It should be noted that, because the access subject and the access object in the host security access policy can configure a directory, when the directory is configured, all the sub-files under the directory are subject to the security access policy of the directory, that is, the access subject and the access object triggering the security access policy can only be affected by the security access policy when they are at the same level of the directory or are subdirectories of the directory, and therefore the directory level of the path of the access subject and the access object triggering the security access policy is greater than or equal to the directory level of the access subject and the access object in the security access policy.

[0178] It should be further noted that the security access policy library includes a feature value storage table and a security access policy storage table, and the feature value storage table stores the feature value of the access subject and the feature value of the access object in each security access policy issued. The feature value of the access subject and the feature value of the access object in each security access policy correspond to a feature value identifier, that is, a feature value ID. For example, the feature value storage table can be as shown in Table 5.

[0179] Table 5

[0180]

[0181] The access subject in each security access policy issued is converted into a digital form of the access subject, that is, digital form of the subject path information, and the access object is converted into a digital form of the access object, that is, digital form of the object path information. The digital form of the access subject, the digital form of the access object, and the permission information of the access subject to the access object in each security access policy are stored in the security access policy storage table. The digital form of the access subject, the digital form of the access object, and the permission information of the access subject to the access object in each security access policy correspond to a security access policy ID. For example, the security access policy storage table can be as shown in Table 6.

[0182] Table 6

[0183] Security access policy ID Subject Object Permission 1 1-45-46 2-501 r

[0184] For example, when a user operation or a process accesses a host resource, the host security access control policy matching is triggered. For example, when the / usr / local / bin / vim process wants to access the data under the / root / test / bin directory, the access subject and the access object triggering the security access policy matching behavior are as shown in Table 7.

[0185] Table 7

[0186] Subject Object / usr / local / bin / vim / root / test / bin

[0187] The path information of the access subject and the path information of the access object are converted into digital form. As shown in Table 8.

[0188] Table 8

[0189] Subject Object 1-45-46-47 2-501-46

[0190] At this time, the path matching feature values of the access subject and the path matching feature values of the access object are as shown in Table 9.

[0191] Table 9

[0192]

[0193] At this time, it is necessary to screen the target path matching information set from the security access policy library according to the path matching feature values.

[0194] First, from the feature value storage table in the security access policy library, data with the first feature value of the access subject less than or equal to 4 and the first feature value of the access object less than or equal to 3 is screened out, that is, the first path matching information set. The screened data is shown in Table 10.

[0195] Table 10

[0196]

[0197] Among them, the subject feature value 1 corresponds to the first feature value of the access subject, the subject feature value 2 corresponds to the second feature value of the access subject, and the subject feature value 3 corresponds to the third feature value of the access subject. The object feature value 1 corresponds to the first feature value of the access object, the object feature value 2 corresponds to the second feature value of the access object, and the object feature value 3 corresponds to the third feature value of the access object.

[0198] Step a22, based on the second path matching feature value, screening the second path matching information set with the same second feature value of the access subject and the second path matching feature value from the first path matching information set.

[0199] Among them, after the first path matching information set is screened out, the second path matching information set with the same second feature value of the access subject and the second path matching feature value is screened out from the first path matching information set according to the second path matching feature value.

[0200] Exemplarily, the screened first path matching information set is shown in Table 10, the second path matching feature value is -, and the second feature value of the access subject in the first path matching information set is 45, which does not match, and it is determined that the second path matching information set is empty.

[0201] Step a23, in the case that the second path matching information set is empty, performing a hierarchical update operation on the first target path information to obtain an updated second path matching characteristic value and an updated third path matching characteristic value, and based on the updated second path matching characteristic value, screening the second path matching information set with the same second characteristic value of the access subject from the first path matching information set.

[0202] In the case that the second path matching information set is empty, it means that the second path matching information set fails to match, and after the hierarchical update operation on the first target path information, the matching is continued.

[0203] It should be noted that the hierarchical update operation is a hierarchical reduction operation. For example, the first target path information is 1-45-46-47, and after the hierarchical reduction operation, the first target path information becomes 1-45-46, the updated second path matching characteristic value is 45, and the updated third path matching characteristic value is 92. The second characteristic value of the access subject in the screened first path matching information set is 45, and it is determined that the matching is successful. The second path matching information set is shown in Table 10.

[0204] Step a24, in the case that the second path matching information set is empty and the first target path information is updated to the root directory, it is determined that the target path matching information set fails to match.

[0205] It should be noted that the second path matching information set is empty, which means that the second path matching information set fails to match, and the first target path information is updated to the root directory, which means that the hierarchical update cannot be continued. Since the hierarchical update cannot be continued and the second path matching information set has not been screened out, it is determined that the target path matching information set fails to match.

[0206] Step a25, in the case that the second path matching information set is not empty and the first target path information is not updated, based on the third path matching characteristic value, screening the third path matching information set with the same third characteristic value of the access subject from the second path matching information set.

[0207] In the case that the second path matching information set is not empty and the first target path information is not updated, it means that the second path matching information set screened out for the first time is not empty, and then the screening of the target path matching information set can be continued according to the third path matching characteristic value.

[0208] Step a26, in the case that the second path matching information set is not empty and the first target path information is updated, based on the updated third path matching characteristic value, screening the third path matching information set with the same third characteristic value of the access subject from the second path matching information set.

[0209] Wherein, the second path matching information set is not empty and the first target path information is updated hierarchically, it is indicated that the third path matching characteristic value is also updated, and then the third path matching information set with the same third characteristic value of the access subject as the updated third path matching characteristic value is filtered from the second path matching information set according to the updated third path matching characteristic value.

[0210] Exemplarily, the first target path information becomes 1-45-46 after the hierarchical reduction 1 operation, the updated second path matching characteristic value is 45, the updated third path matching characteristic value is 92, and the second path matching information set is shown in Table 10. The third characteristic value of the access subject in the second path matching information set is 92, which is the same as the updated third path matching characteristic value, and then the third path matching information set is determined as shown in Table 10.

[0211] It can be understood that if the third path matching information set is empty, it is determined that the target path matching information set fails to match.

[0212] Up to now, the path matching characteristic value of the access subject matches the characteristic value of the access subject in the security access policy successfully, and a large number of security access policies that do not meet the matching are filtered out, reducing the number of subsequent matching. It can be understood that if the first target path information is updated to the root directory and still fails to match, it is determined that the matching fails.

[0213] Step a27, filtering the fourth path matching information set with the same second characteristic value of the access subject as the fifth path matching characteristic value from the third path matching information set based on the fifth path matching characteristic value.

[0214] Wherein, after the third path matching information set is filtered, the fourth path matching information set with the same second characteristic value of the access subject as the fifth path matching characteristic value is filtered from the third path matching information set according to the fifth path matching characteristic value.

[0215] Exemplarily, the filtered third path matching information set is shown in Table 10, the fifth path matching characteristic value is 501, and the second characteristic value of the access subject in the third path matching information set is -, which does not match, and it is determined that the fourth path matching information set is empty.

[0216] Step a28, in the case that the fourth path matching information set is empty, performing hierarchical update operation on the second target path information to obtain the updated fifth path matching characteristic value and the updated sixth path matching characteristic value, and filtering the fourth path matching information set with the same second characteristic value of the access subject as the updated fifth path matching characteristic value from the third path matching information set based on the updated fifth path matching characteristic value.

[0217] The fourth path matching information set is empty, which indicates that the fourth path matching information set fails to match. The second target path information is subjected to the level updating operation and then is subjected to matching.

[0218] It should be noted that the level updating operation is a level minus 1 operation. Exemplarily, the second target path information is 2-501-46, and after the level minus 1 operation, the second target path information becomes 2-501. The fifth path matching feature value after updating is -, and the third path matching feature value after updating is 503. The second feature value of the access subject in the third path matching information set screened out is -, and it is determined that the matching is successful. The fourth path matching information set is shown in Table 10.

[0219] In step a29, in a case where the fourth path matching information set is empty and the second target path information is updated to the root directory, it is determined that the target path matching information set fails to match.

[0220] It should be noted that the fourth path matching information set is empty, which indicates that the fourth path matching information set fails to match. The second target path information is updated to the root directory, which indicates that the level updating operation cannot be continued. The level updating operation cannot be continued, and the fourth path matching information set is still not screened out, and it is determined that the target path matching information set fails to match.

[0221] In step a210, in a case where the fourth path matching information set is not empty and the second target path information is not subjected to the level updating operation, the target path matching information set, in which the third feature value of the access subject is the same as the sixth path matching feature value, is screened out from the fourth path matching information set based on the sixth path matching feature value.

[0222] The fourth path matching information set is not empty, and the second target path information is not subjected to the level updating operation, which indicates that the first screened fourth path matching information set is not empty. Therefore, the screening of the target path matching information set can be continued based on the sixth path matching feature value.

[0223] In step a211, in a case where the fourth path matching information set is not empty and the second target path information is subjected to the level updating operation, the target path matching information set, in which the third feature value of the access subject is the same as the updated sixth path matching feature value, is screened out from the fourth path matching information set based on the updated sixth path matching feature value.

[0224] The fourth path matching information set is not empty, and the second target path information is subjected to the level updating operation, which indicates that the sixth path matching feature value is also updated. Therefore, the target path matching information set, in which the third feature value of the access subject is the same as the updated sixth path matching feature value, is screened out from the fourth path matching information set based on the updated sixth path matching feature value.

[0225] Exemplarily, the second target path information becomes 2-501 after the level reduction 1 operation, the updated fifth path matching feature value is -, and the updated sixth path matching feature value is 503. The fourth path matching information set is shown in Table 10. The third feature value of the access subject in the fourth path matching information set is 503, which is the same as the updated sixth path matching feature value. Therefore, the target path matching information set is determined as shown in Table 10.

[0226] It can be understood that if the target path matching information set is empty, it is determined that the target path matching information set fails to match.

[0227] Up to now, the matching degree of the access subject and the access subject in the security access policy in the target security access policy set corresponding to the screened target path matching information set is greatly improved.

[0228] The security access policy matching method provided in the embodiment matches the three path matching feature values of the access subject with the three feature values of the access subject in the security access policy library, and matches the three path matching feature values of the access subject with the three feature values of the access subject in the security access policy library, and then obtains the target path matching information set. The priority matching of the path matching feature value is realized, a large number of non-matching items in the security access policy library are excluded, the matching degree of the access subject and the access subject is improved, the number of accurate matching of the access subject and the access subject path is reduced, and the matching efficiency is greatly improved.

[0229] In some optional embodiments, the above step a4 comprises:

[0230] Step a41, obtaining the first target path information and the second target path information that trigger the target path matching information set to match successfully.

[0231] The first target path information and the second target path information that trigger the target path matching information set to match successfully can be the original first target path information and the original second target path information, or the level updated first target path information and the level updated second target path information.

[0232] Exemplarily, the original first target path information and the original second target path information are shown in Table 9. In the process of performing the target path matching information set matching, if the target path matching set is matched according to the original first target path information and the original second target path information, the original first target path information and the original second target path information trigger the success of the target path matching information set matching. In the process of performing the target path matching information set matching, if the target path matching set is matched according to the hierarchically updated first target path information and the hierarchically updated second target path information, the hierarchically updated first target path information and the hierarchically updated second target path information trigger the success of the target path matching information set matching.

[0233] As the foregoing example, the hierarchically updated first target path information 1-45-46 and the hierarchically updated second target path information 2-501 trigger the success of the target path information matching.

[0234] In step a42, the target security access policy is matched from the target security access policy set based on the first target path information and the second target path information triggering the success of the target path matching information set matching.

[0235] In step a42, the target security access policy is matched from the target security access policy set based on the first target path information and the second target path information triggering the success of the target path matching information set matching.

[0236] The first target path information and the second target path information triggering the success of the target path matching information set matching are matched with each security access policy in the target security access policy set one by one to obtain the target security access policy, and then the permission control can be performed, and no disposal is performed for the matching failure.

[0237] Exemplarily, the hierarchically updated first target path information 1-45-46 and the hierarchically updated second target path information 2-501 are matched with each security access policy in the target security access policy set one by one, if the hierarchically updated first target path information 1-45-46 and the hierarchically updated second target path information 2-501 are matched with any security access policy in the target security access policy set one by one successfully, the security access policy is determined as the target security access policy.

[0238] The security access policy matching method provided in the embodiment can more accurately determine the target security access policy based on the first target path information and the second target path information triggering the success of the target path matching information set matching, and ensures the security of the system.

[0239] In some optional embodiments, the step a3 comprises:

[0240] Step a31, obtaining the association identifier in the target path matching information set.

[0241] Wherein, the association identifier (association ID) exists in the feature value storage table, and the association identifier is the corresponding security access policy ID of the feature value in the security access policy storage table. Therefore, the corresponding security access policy in the security access policy storage table can be determined according to the association identifier in the feature value storage table.

[0242] It can be understood that the target path matching information set screened out is in the feature value storage table, and therefore the association identifier in the target path matching information set can be obtained.

[0243] Step a32, obtaining the target security access policy set from the security access policy library based on the association identifier.

[0244] According to the association identifier, the corresponding target security access policy set can be obtained from the security access policy storage table.

[0245] The security access policy matching method provided in the embodiment guarantees the accuracy of the obtained target security access policy set by obtaining the target security access policy set from the security access policy library based on the association identifier in the target path matching information set.

[0246] In some optional embodiments, the security access policy matching method further comprises:

[0247] In the case of failure of the target path matching information set matching or the target security access policy matching, the information of the failure of the target path matching information set matching or the target security access policy matching is logged, so that the user can view the log record and take corresponding measures.

[0248] Specifically, a log framework suitable for security access policy matching is selected, such as Log4j, Logback, etc. A proper log level is set to record detailed failure information when needed.

[0249] By adding a log record statement, the log record of the information of the failure of the target path matching information set matching or the target security access policy matching is realized.

[0250] It can be understood that the output format of the log can also be customized as needed to better understand and analyze the matching failure information.

[0251] The user can regularly view the log record, and determine whether a new security access policy needs to be issued to ensure network security, repair access vulnerabilities, etc. by viewing the matching failure information.

[0252] The security access policy matching method provided in this embodiment can view information about the failure to match the target path matching information set or the failure to match the target security access policy through log records, and then take corresponding measures to handle it, thereby improving the stability and reliability of the system.

[0253] This embodiment also provides a secure access policy matching system, such as Figure 3 As shown, the system includes a built-in path module, a security policy storage module, and a security policy matching module.

[0254] The built-in path module is used to convert host resource paths into numerical representations. It consists of a built-in path table, a built-in path conversion module, and a built-in path table maintenance module. Taking a Linux operating system host as an example, the built-in path table is a table that pre-defines the correspondence between file names and file identifiers, as shown in Table 2.

[0255] Figure 4 This is a flowchart illustrating a storage security access policy according to an embodiment of the present invention. Figure 4 As shown, when a security access policy needs to be stored, for example, if the subject is ` / usr / local / bin`, the built-in path table is used, and the subject and object in the security policy are transformed by the built-in path transformation module. It should be noted that the security policy is a security access policy. The transformed subject is `1-45-46`. The transformation rule is: filename is transformed into the ID value in the table corresponding to the filename, and ` / ` is transformed into `-`. It checks if the filename to be transformed exists in the built-in path table. If it exists, the subject and object matching feature values ​​after the security policy transformation are calculated; if not, the built-in path table is maintained, where the matching feature values ​​are the feature values ​​of the access subject and the access object. If the subject is the ` / root / test` directory, since `test` does not exist in the built-in path table, the built-in path table needs to be updated. The updated built-in path table after the built-in path table maintenance module is shown in Table 4. After updating the built-in path table, the path representation after the subject transformation is `2-501`.

[0256] The security policy storage module stores the security access policies transformed by the built-in path module. It consists of a security policy transformation storage module, a matching feature value storage module, and a matching feature value calculation module. The issued security access control policies are shown in Table 11.

[0257] Table 11

[0258] Subject Object Permission / usr / local / bin / root / test r

[0259] First, the path is converted by the built-in path conversion module in the built-in path module. The converted security access policy is shown in Table 3.

[0260] like Figure 4As shown, the matching characteristic value calculation module is used to calculate the subject and object matching characteristic values of the security policy after conversion, and the matching characteristic value calculation method is as described in a11-a16, which will not be repeated here.

[0261] After the matching characteristic values are calculated, the matching characteristic value storage module is used to store the security access policy, and specifically, the path matching characteristic values corresponding to the security access policy are stored in the characteristic value storage table, i.e., the subject and object matching characteristic values of the security policy are stored, as shown in Table 5. The security access policy is stored in the security access policy storage table, i.e., the subject and object paths after conversion of the security policy are stored, as shown in Table 6.

[0262] Figure 5 is a flowchart of the security access policy matching method according to an embodiment of the present application. The security policy matching module is used to perform the security access policy matching method as shown in Figure 5 , which preferentially matches the path matching characteristic values and then accurately matches the security access policy after improving the matching degree. Specifically, as shown in Figure 5 , the method includes:

[0263] First step: when a user operation or a process accesses a host local resource, trigger the security policy matching, and convert the subject and object of the triggering behavior according to the built-in path conversion module. The corresponding description of step S102 is described above and will not be repeated here.

[0264] Second step: calculate the matching characteristic values of the subject and object of the triggering behavior. The corresponding description of steps a11-a16 is described above and will not be repeated here.

[0265] Third step: screen the items in the configuration policy in which the subject and object characteristic value 1 is less than or equal to the matching characteristic value 1 of the subject and object. The corresponding description of step a21 is described above and will not be repeated here.

[0266] Fourth step: in the case of successful screening in the third step, screen the items in the configuration policy in which the subject matching characteristic value 2 and the characteristic value 3 are respectively equal to the subject matching characteristic value 2 and the characteristic value 3 of the triggering behavior. In the case of failed screening in the third step, determine that the first path matching information set fails to match.

[0267] Fifth step: in the case of successful screening in the fourth step, screen the items in the configuration policy in which the object matching characteristic value 2 and the characteristic value 3 are respectively equal to the object matching characteristic value 2 and the characteristic value 3 of the triggering behavior.

[0268] In the case of failed screening in the fourth step, the subject path level of the triggering behavior is reduced by 1, and the second step is returned to be executed.

[0269] It should be noted that the fourth step and the fifth step correspond to the description of steps a22-a27 described above, which will not be repeated here.

[0270] Step 6: In the case of successful screening in step 5, the post-conversion path of the subject and object of the behavior is triggered to be accurately matched with the post-conversion path of the configured security policy.

[0271] In the case of failed screening in step 5, the object path level of the behavior is triggered to be reduced by 1, and the second step is returned to be executed.

[0272] It should be noted that step 6 corresponds to the related description of steps a28-a211 and steps a41 and a42 described above, which will not be repeated here.

[0273] Step 7: In the case of successful matching in step 6, the access control of the resource is limited according to the permission value in the configured security policy.

[0274] In the case of failed matching in step 6, it is determined that the target security access policy matching fails.

[0275] The description of step S104 described above will not be repeated here.

[0276] It should be noted that the scenarios related to path resource matching can be implemented by the security access policy matching method provided in the embodiment.

[0277] The security access policy matching method provided in the embodiment, through a built-in corresponding table of the names and numbers of common files on a host, when storing the security access policy, the subject and the object are no longer stored with the actual resource path ( / usr / lttc / tcz), but are stored with the converted subject and object (1-23-45). When the resource path is very long, only a short number is needed to replace it, which saves storage space and improves matching efficiency.

[0278] Three matching characteristic values are additionally stored when storing. Before matching the subject and the object, the three matching characteristic values are preferentially matched to exclude a large number of non-matching items, further improve the matching degree of the subject and the object, and reduce the number of times of accurate matching of the subject and the object path, thereby greatly improving the matching efficiency. The subject and the object that are matched with the matching characteristic values are accurately matched with the user-configured host security access control policy stored after the conversion of the resource path, and the permission control is performed after the matching is successful.

[0279] In the embodiment, a security access policy matching device is also provided, which is used to implement the above-described embodiments and preferred embodiments, and the description has been made. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware is also possible and is contemplated.

[0280] The embodiment provides a security access policy matching device, as follows:Figure 6 As shown, comprising:

[0281] The acquisition module 601 is configured to acquire access information of the host, wherein the access information comprises first path information and second path information, the first path information is path information of an access subject, and the second path information is path information of an access object.

[0282] The conversion module 602 is configured to convert the first path information into first target path information in a digital form and convert the second path information into second target path information in a digital form based on a preset file name and file identifier correspondence table.

[0283] The matching module 603 is configured to match a target security access policy from a security access policy library based on the first target path information and the second target path information.

[0284] The determination module 604 is configured to determine an access right of the access subject to the access object based on the target security access policy.

[0285] In some optional embodiments, the conversion module 602 comprises:

[0286] The splitting unit is configured to split the first path information and the second path information into a plurality of file names based on file splitting identifiers.

[0287] The first judgment unit is configured to judge whether the plurality of file names are contained in the preset file name and file identifier correspondence table.

[0288] The first acquisition unit is configured to acquire file identifiers corresponding to the plurality of file names based on the preset file name and file identifier correspondence table in a case where the plurality of file names are contained in the preset file name and file identifier correspondence table.

[0289] The second acquisition unit is configured to update the preset file name and file identifier correspondence table based on at least one file name not contained in the plurality of file names in a case where the at least one file name is not contained in the preset file name and file identifier correspondence table, so as to acquire the file identifiers corresponding to the plurality of file names based on the updated preset file name and file identifier correspondence table.

[0290] The third acquisition unit is configured to convert file splitting identifiers between the plurality of file names in the first path information into digital connection identifiers, and replace the plurality of file names in the first path information with the file identifiers corresponding to the file names, to obtain the first target path information.

[0291] The fourth obtaining unit is configured to convert file division identifiers between the multiple file names in the second path information into digital connection identifiers, and replace the multiple file names in the second path information with file identifiers corresponding to the file names, to obtain second target path information.

[0292] In some optional embodiments, the matching module 603 includes:

[0293] The fifth obtaining unit is configured to obtain path matching feature values of the first target path information and the second target path information.

[0294] The screening unit is configured to screen a target path matching information set from the security access policy library based on the path matching feature values.

[0295] The sixth obtaining unit is configured to obtain a target security access policy set from the security access policy library based on the target path matching information set.

[0296] The first matching unit is configured to match a target security access policy from the target security access policy set based on the first target path information and the second target path information.

[0297] In some optional embodiments, the fifth obtaining unit includes:

[0298] The first determining unit is configured to determine a level of the first target path represented by the first path matching feature value based on a number of the digital connection identifiers in the first target path information.

[0299] The second determining unit is configured to determine a middle value of the first target path represented by the second path matching feature value based on a total number of the file identifiers and the digital connection identifiers in the first target path information.

[0300] The third determining unit is configured to determine a file identifier sum of the first target path represented by the third path matching feature value based on the file identifiers in the first target path information.

[0301] The fourth determining unit is configured to determine a level of the second target path represented by the fourth path matching feature value based on a number of the digital connection identifiers in the second target path information.

[0302] The fifth determining unit is configured to determine a middle value of the second target path represented by the fifth path matching feature value based on a total number of the file identifiers and the digital connection identifiers in the second target path information.

[0303] The sixth determining unit is configured to determine a file identifier sum of the second target path represented by the sixth path matching feature value based on the file identifiers in the second target path information.

[0304] In some optional embodiments, the screening unit includes:

[0305] The first screening subunit is configured to screen, based on the first path matching characteristic value and the fourth path matching characteristic value, a first path matching information set from the security access policy library, wherein the first characteristic value of the access subject is not greater than the first path matching characteristic value, and the first characteristic value of the access object is not greater than the fourth path matching characteristic value.

[0306] The second screening subunit is configured to screen, based on the second path matching characteristic value, a second path matching information set from the first path matching information set, wherein the second characteristic value of the access subject is the same as the second path matching characteristic value.

[0307] The third screening subunit is configured to, in a case where the second path matching information set is empty, perform a hierarchical update operation on the first target path information to obtain an updated second path matching characteristic value and an updated third path matching characteristic value, and screen, based on the updated second path matching characteristic value, a second path matching information set from the first path matching information set, wherein the second characteristic value of the access subject is the same as the updated second path matching characteristic value.

[0308] The seventh determining unit is configured to, in a case where the second path matching information set is empty and the first target path information is updated to the root directory, determine that the target path matching information set fails to match.

[0309] The fourth screening subunit is configured to, in a case where the second path matching information set is not empty and the first target path information is not updated hierarchically, screen, based on the third path matching characteristic value, a third path matching information set from the second path matching information set, wherein the third characteristic value of the access subject is the same as the third path matching characteristic value.

[0310] The fifth screening subunit is configured to, in a case where the second path matching information set is not empty and the first target path information is updated hierarchically, screen, based on the updated third path matching characteristic value, a third path matching information set from the second path matching information set, wherein the third characteristic value of the access subject is the same as the updated third path matching characteristic value.

[0311] The sixth screening subunit is configured to screen, based on the fifth path matching characteristic value, a fourth path matching information set from the third path matching information set, wherein the second characteristic value of the access object is the same as the fifth path matching characteristic value.

[0312] The seventh screening subunit is configured to, in a case where the fourth path matching information set is empty, perform a hierarchical update operation on the second target path information to obtain an updated fifth path matching characteristic value and an updated sixth path matching characteristic value, and screen, based on the updated fifth path matching characteristic value, a fourth path matching information set from the third path matching information set, wherein the second characteristic value of the access object is the same as the updated fifth path matching characteristic value.

[0313] The eighth determining unit is configured to determine that the target path matching information set fails to match in a case where the fourth path matching information set is empty and the second target path information is updated to the root directory.

[0314] The eighth screening sub-unit is configured to screen, from the fourth path matching information set, a target path matching information set with a third feature value of an access subject being same as the sixth path matching feature value based on the sixth path matching feature value in a case where the fourth path matching information set is not empty and the second target path information is not updated in a hierarchy.

[0315] The ninth screening sub-unit is configured to screen, from the fourth path matching information set, a target path matching information set with a third feature value of an access subject being same as the updated sixth path matching feature value based on the updated sixth path matching feature value in a case where the fourth path matching information set is not empty and the second target path information is updated in a hierarchy.

[0316] In some optional embodiments, the first matching unit comprises:

[0317] The seventh obtaining unit is configured to obtain the first target path information and the second target path information triggering the target path matching information set to match successfully.

[0318] The first matching sub-unit is configured to match, from the target security access policy set, a target security access policy based on the first target path information and the second target path information triggering the target path matching information set to match successfully.

[0319] In some optional embodiments, the sixth obtaining unit comprises:

[0320] The eighth obtaining unit is configured to obtain an association identifier in the target path matching information set.

[0321] The ninth obtaining unit is configured to obtain the target security access policy set from the security access policy library based on the association identifier.

[0322] Further function descriptions of the above-mentioned modules and units are the same as those of the above-mentioned embodiments, and will not be described here.

[0323] The security access policy matching device in the embodiment is presented in the form of functional units. The units herein refer to ASIC (Application Specific Integrated Circuit) circuits, processors and memories executing one or more software or fixed programs, and / or other devices that can provide the above-mentioned functions.

[0324] The embodiment of the present application further provides a computer device having the above-mentioned Figure 6The security access policy matching device shown.

[0325] Please see Figure 7 , Figure 7 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 7 As shown, the computer device includes one or more processors 701, memory 702, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 7 Take the 701 processor as an example.

[0326] Processor 701 may be a central processing unit, a network processor, or a combination thereof. Processor 701 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GPA), or any combination thereof.

[0327] The memory 702 stores instructions executable by at least one processor 701 to cause at least one processor 701 to perform the method shown in the above embodiments.

[0328] The memory 702 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 702 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 702 may optionally include memory remotely located relative to the processor 701, and these remote memories can be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0329] The memory 702 can include a volatile memory, for example, a random access memory, and can also include a non-volatile memory, for example, a flash memory, a hard disk, or a solid state disk, and can also include a combination of the above-mentioned memories.

[0330] The computer device further includes a communication interface 703 for the computer device to communicate with other devices or communication networks.

[0331] The embodiments of the present application also provide a computer readable storage medium, and the method according to the embodiments of the present application can be implemented in hardware, firmware, or recorded in a storage medium, or stored in a remote storage medium or a non-transitory machine readable storage medium and downloaded to a local storage medium through network, so that the method described herein can be processed by such software on a storage medium using a general purpose computer, a special purpose processor, or programmable or special purpose hardware. The storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk, or a solid state disk, etc. Further, the storage medium can also include a combination of the above-mentioned memories. It can be understood that the computer, the processor, the microprocessor controller, or the programmable hardware includes a storage component that can store or receive software or computer code, when the software or computer code is accessed and executed by the computer, the processor, or the hardware, the method shown in the above embodiments is implemented.

[0332] Part of the present application can be applied as a computer program product, for example, computer program instructions, when executed by a computer, through the operation of the computer, the method and / or technical solutions according to the present application can be called or provided. Those skilled in the art should understand that the form of computer program instructions in computer readable medium includes but is not limited to source file, executable file, installation package file, etc., and accordingly, the way of computer program instructions executed by computer includes but is not limited to: the computer directly executes the instructions, or the computer executes the corresponding compiled program after compiling the instructions, or the computer reads and executes the instructions, or the computer reads and installs the instructions and then executes the corresponding installed program. Here, the computer readable medium can be any available computer readable storage medium or communication medium accessible to the computer.

[0333] Although the embodiments of the present application are described in conjunction with the accompanying drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application, and such modifications and changes fall within the scope defined by the appended claims.

Claims

1. A method for matching secure access policies, characterized in that, The method includes: Obtain access information of the host, wherein the access information includes first path information and second path information, the first path information being the path information of the accessing subject and the second path information being the path information of the accessing object; Based on a preset correspondence table between file names and file identifiers, the first path information is converted into first target path information in numerical form, and the second path information is converted into second target path information in numerical form. The first path information and the second path information are split into multiple file names based on file segmentation identifiers. Based on the first target path information and the second target path information, a target security access policy is matched from the security access policy library; Based on the target security access policy, determine the access permissions of the accessing subject to the accessing object; The step of matching a target security access policy from the security access policy library based on the first target path information and the second target path information includes: Obtain path matching feature values ​​of the first target path information and the second target path information; Based on the path matching feature values, a set of target path matching information is selected from the security access policy library; Based on the target path matching information set, obtain the target security access policy set from the security access policy library; Based on the first target path information and the second target path information, a target security access policy is matched from the target security access policy set; The step of obtaining the path matching feature values ​​of the first target path information and the second target path information includes: Based on the number of digital connection identifiers in the first target path information, the level of the first target path represented by the first path matching feature value is determined; Based on the total number of file identifiers and numeric connection identifiers in the first target path information, the median value of the first target path represented by the second path matching feature value is determined. Based on the file identifiers in the first target path information, determine the sum of file identifiers of the first target path represented by the third path matching feature value; Based on the number of digital connection identifiers in the second target path information, the level of the second target path represented by the fourth path matching feature value is determined; Based on the total number of file identifiers and numeric connection identifiers in the second target path information, the median value of the second target path represented by the fifth path matching feature value is determined; Based on the file identifiers in the second target path information, determine the sum of file identifiers of the second target path represented by the sixth path matching feature value; The step of filtering the target path matching information set from the security access policy library based on the path matching feature value includes: Based on the first path matching feature value and the fourth path matching feature value, a first path matching information set is selected from the security access policy library, wherein the first feature value of the access subject is not greater than the first path matching feature value and the first feature value of the access object is not greater than the fourth path matching feature value. Based on the second path matching feature value, a second path matching information set is selected from the first path matching information set, where the second feature value of the access subject is the same as the second path matching feature value. When the second path matching information set is empty, a hierarchical update operation is performed on the first target path information to obtain the updated second path matching feature value and the updated third path matching feature value. Based on the updated second path matching feature value, a second path matching information set with the same second feature value of the access subject as the updated second path matching feature value is selected from the first path matching information set. If the second path matching information set is empty and the first target path information hierarchy is updated to the root directory, it is determined that the target path matching information set has failed to match. If the second path matching information set is not empty and the first target path information has not been hierarchically updated, based on the third path matching feature value, a third path matching information set with the same third feature value of the access subject as the third path matching feature value is selected from the second path matching information set. If the second path matching information set is not empty and the first target path information is updated hierarchically, based on the updated third path matching feature value, a third path matching information set that has the same third feature value as the access subject as the updated third path matching feature value is selected from the second path matching information set. Based on the fifth path matching feature value, a fourth path matching information set is selected from the third path matching information set, where the second feature value of the accessed object is the same as the fifth path matching feature value. When the fourth path matching information set is empty, a hierarchical update operation is performed on the second target path information to obtain the updated fifth path matching feature value and the updated sixth path matching feature value. Based on the updated fifth path matching feature value, a fourth path matching information set is selected from the third path matching information set whose second feature value of the accessed object is the same as the updated fifth path matching feature value. If the fourth path matching information set is empty and the second target path information hierarchy is updated to the root directory, it is determined that the target path matching information set has failed to match. If the fourth path matching information set is not empty and the second target path information has not been hierarchically updated, based on the sixth path matching feature value, a target path matching information set whose third feature value of the accessed object is the same as the sixth path matching feature value is selected from the fourth path matching information set. If the fourth path matching information set is not empty and the second target path information is updated hierarchically, based on the updated sixth path matching feature value, a target path matching information set is selected from the fourth path matching information set whose third feature value of the accessed object is the same as the updated sixth path matching feature value.

2. The method according to claim 1, characterized in that, The method of converting the first path information into a first target path information in numerical form and the second path information into a second target path information in numerical form, based on a preset correspondence table between file names and file identifiers, includes: Determine whether the preset file name and file identifier correspondence table contains multiple file names; If the preset file name and file identifier correspondence table contains multiple file names, the file identifiers corresponding to the multiple file names are obtained based on the preset file name and file identifier correspondence table. If at least one of the multiple file names is not included in the preset file name and file identifier correspondence table, the preset file name and file identifier correspondence table is updated based on the at least one missing file name, so as to obtain the file identifiers corresponding to the multiple file names based on the updated preset file name and file identifier correspondence table; The file segmentation identifier between multiple file names in the first path information is converted into a numeric connection identifier, and the multiple file names in the first path information are replaced with the file identifiers corresponding to the file names to obtain the first target path information; The file segmentation identifiers between multiple file names in the second path information are converted into numeric connection identifiers, and the multiple file names in the second path information are replaced with the file identifiers corresponding to the file names to obtain the second target path information.

3. The method according to claim 1, characterized in that, The step of matching a target security access policy from the target security access policy set based on the first target path information and the second target path information includes: Obtain the information of the first and second target paths that successfully matched the trigger target path matching information set; Based on the first target path information and the second target path information that are successfully matched in the target path matching information set, the target security access policy is matched from the target security access policy set.

4. The method according to claim 1, characterized in that, The step of obtaining the target security access policy set from the security access policy library based on the target path matching information set includes: Obtain the association identifier from the target path matching information set; Based on the associated identifier, the target security access policy set is obtained from the security access policy library.

5. A secure access policy matching device, characterized in that, The device includes: The acquisition module is used to acquire access information of the host, wherein the access information includes first path information and second path information, the first path information being the path information of the accessing subject and the second path information being the path information of the accessing object. The conversion module is used to convert the first path information into first target path information in numerical form and the second path information into second target path information in numerical form based on a preset correspondence table between file names and file identifiers, wherein the first path information and the second path information are split into multiple file names based on file segmentation identifiers; The matching module is used to match a target security access policy from the security access policy library based on the first target path information and the second target path information. The determination module is used to determine the access permissions of the access subject to the access object based on the target security access policy; The matching module includes: The fifth acquisition unit is used to acquire path matching feature values ​​of the first target path information and the second target path information; The filtering unit is used to filter out a set of target path matching information from the security access policy library based on path matching feature values. The sixth acquisition unit is used to acquire the target security access policy set from the security access policy library based on the target path matching information set; The first matching unit is used to match a target security access policy from the target security access policy set based on the first target path information and the second target path information. The fifth acquisition unit includes: The first determining unit is used to determine the level of the first target path represented by the first path matching feature value based on the number of digital connection identifiers in the first target path information. The second determining unit is used to determine the intermediate value of the first target path represented by the second path matching feature value based on the total number of file identifiers and numeric connection identifiers in the first target path information. The third determining unit is used to determine the sum of file identifiers of the first target path represented by the third path matching feature value based on the file identifiers in the first target path information. The fourth determining unit is used to determine the level of the second target path represented by the fourth path matching feature value based on the number of digital connection identifiers in the second target path information. The fifth determining unit is used to determine the intermediate value of the second target path represented by the fifth path matching feature value based on the total number of file identifiers and numeric connection identifiers in the second target path information. The sixth determining unit is used to determine the sum of file identifiers of the second target path represented by the sixth path matching feature value based on the file identifiers in the second target path information; The filtering unit includes: The first filtering subunit is used to filter out a first path matching information set from the security access policy library based on the first path matching feature value and the fourth path matching feature value, where the first feature value of the access subject is not greater than the first path matching feature value and the first feature value of the access object is not greater than the fourth path matching feature value. The second filtering subunit is used to filter out a second path matching information set from the first path matching information set based on the second path matching feature value, where the second feature value of the access subject is the same as the second path matching feature value. The third filtering subunit is used to perform a hierarchical update operation on the first target path information when the second path matching information set is empty, to obtain the updated second path matching feature value and the updated third path matching feature value, and to filter out the second path matching information set from the first path matching information set whose second feature value of the access subject is the same as the updated second path matching feature value based on the updated second path matching feature value. The seventh determining unit is used to determine that the target path matching information set has failed to match when the second path matching information set is empty and the first target path information hierarchy has been updated to the root directory. The fourth filtering subunit is used to filter out the third path matching information set from the second path matching information set based on the third path matching feature value, when the second path matching information set is not empty and the first target path information has not been hierarchically updated. The fifth filtering subunit is used to filter out the third path matching information set from the second path matching information set when the second path matching information set is not empty and the first target path information is updated hierarchically, based on the updated third path matching feature value; The sixth filtering subunit is used to filter out the fourth path matching information set from the third path matching information set based on the fifth path matching feature value, where the second feature value of the accessed object is the same as the fifth path matching feature value. The seventh filtering subunit is used to perform a hierarchical update operation on the second target path information when the fourth path matching information set is empty, to obtain the updated fifth path matching feature value and the updated sixth path matching feature value, and based on the updated fifth path matching feature value, to filter out the fourth path matching information set from the third path matching information set whose second feature value of the accessed object is the same as the updated fifth path matching feature value. The eighth determining unit is used to determine that the target path matching information set has failed to match when the fourth path matching information set is empty and the second target path information hierarchy has been updated to the root directory. The eighth filtering subunit is used to filter out the target path matching information set from the fourth path matching information set based on the sixth path matching feature value, when the fourth path matching information set is not empty and the second target path information has not been hierarchically updated. The ninth filtering subunit is used to filter out target path matching information sets from the fourth path matching information set where the third feature value of the accessed object is the same as the updated sixth path matching feature value, based on the updated sixth path matching feature value, when the fourth path matching information set is not empty and the second target path information is updated hierarchically.

6. A computer device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the security access policy matching method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the security access policy matching method according to any one of claims 1 to 4.

Images