Method, device, equipment, medium and program product for preventing vertical overreach

Abstract

The application provides a vertical privilege escaping method, device, equipment, medium and program product, and relates to the technical field of system security. The vertical privilege escaping method receives a page access request of a target user carrying an access interface, determines whether the target user is a public user in response to the access interface not being in an open interface list, and determines whether the access interface is in a public interface matching white list when the target user is a public user. Further, the page access request is rejected when the access interface is not in the public interface matching white list. The application performs permission verification on the access interface carried in the page access request to improve the security of the online system operation.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of system security, and particularly relates to a vertical privilege prevention method and device, equipment, medium and program product. BACKGROUND

[0002] An online system refers to a system in which multiple computers or devices are connected together through a computer network to realize data sharing, resource sharing and collaborative work. When the online system provides online transactions to the outside, an attacker can use the authentication information of a low-privilege user in the online system to access and / or call the interface or page of a high-privilege user, so as to tamper with and access the key data in the online system, thereby causing great harm to the operation safety of the online system.

[0003] In the related art, the menu pages of user roles are designed for permission, different roles of users are controlled to access different pages, so as to realize page access of different roles. However, in this way, the safety of the online system is low. SUMMARY

[0004] The present application provides a vertical privilege prevention method, device, equipment, medium and program product, to solve the problem of low safety of the online system in the prior art when preventing vertical privilege based on user role menu permission.

[0005] In a first aspect, the present application provides a vertical privilege prevention method, comprising: receiving a page access request of a target user, the page access request carrying an access interface; in response to the access interface not being in an open interface list, determining whether the target user is a public user; if the target user is a public user, determining whether the access interface is in a public interface matching white list; if the access interface is not in the public interface matching white list, rejecting the page access request.

[0006] In a possible design, the vertical privilege prevention method further comprises: if the access interface is in the public interface matching white list, allowing the page access request.

[0007] In a possible design, determining whether the target user is a public user comprises: determining whether the page access request carries an authentication identifier of the target user; if the authentication identifier is not carried, determining that the target user is a public user; if the authentication identifier is carried, determining whether the target user is a public user according to the authentication identifier.

[0008] In a possible design, the vertical privilege-avoiding method further includes: if the target user is a private-domain user, determining whether the authentication identifier is valid; if the authentication identifier is valid, obtaining a first role permission set corresponding to the target user and a page association set corresponding to the access interface; determining whether an associated page in the page association set is in a menu page set corresponding to the first role permission set; if the associated page does not exist in the menu page set corresponding to the first role permission set, rejecting the page access request; and if at least one associated page exists in the menu page set corresponding to the first role permission set, allowing the page access request.

[0009] In a possible design, the vertical privilege-avoiding method further includes: if the authentication identifier is valid, obtaining a second role permission set of the target user according to the authentication identifier; obtaining a third role permission set of the access interface based on a mapping relationship between the interface and the role; and determining whether a role in the second role permission set exists in the third role permission set; if the role exists, allowing the page access request; and if the role does not exist, rejecting the page access request.

[0010] In a possible design, the vertical privilege-avoiding method further includes: in response to the access interface being in the open interface list, performing verification on the access interface based on a custom system-level authentication verification logic, and in response to the verification failing, rejecting the page access request, and in response to the verification passing, allowing the page access request.

[0011] In a possible design, the vertical privilege-avoiding method further includes: obtaining an interface environment configuration list; determining whether the access interface is in the interface environment configuration list; if the access interface is in the interface environment configuration list, verifying a second environment parameter in a source identifier of the access interface according to a first environment parameter configured by the access interface in the interface environment configuration list; if the verification fails, rejecting the page access request; and if the verification passes, determining whether the access interface is in the open interface list.

[0012] In a possible design, the vertical privilege-avoiding method further includes: if the access interface is not in the interface environment configuration list, determining whether the access interface is in the open interface list.

[0013] In a second aspect, the present application provides a vertical privilege-avoiding apparatus, including:

[0014] a receiving module configured to receive a page access request of a target user, the page access request carrying an access interface;

[0015] a first determining module configured to, in response to the access interface not being in an open interface list, determine whether the target user is a public-domain user;

[0016] a second determining module configured to, in response to the target user being a public-domain user, determine whether the access interface is in a public-domain interface matching white list.

[0017] The rejecting module is configured to reject the page access request when the access interface is not in the public interface matching whitelist.

[0018] In a possible design, the anti-vertical privilege violation apparatus further includes an allowing module (not shown in the figure), which is configured to allow the page access request when the access interface is in the public interface matching whitelist.

[0019] In a possible design, the first determining module is specifically configured to determine whether the page access request carries an authentication identifier of the target user; if the authentication identifier is not carried, determine that the target user is a public user; and if the authentication identifier is carried, determine whether the target user is a public user according to the authentication identifier.

[0020] In a possible design, the anti-vertical privilege violation apparatus further includes a third determining module (not shown in the figure), which is configured to, when the target user is a private user, determine whether the authentication identifier is valid; if the authentication identifier is valid, obtain a first role permission set corresponding to the target user and a page association set corresponding to the access interface; determine whether an associated page in the page association set is in a menu page set corresponding to the first role permission set; if the associated page does not exist in the menu page set corresponding to the first role permission set, reject the page access request; and if at least one associated page exists in the menu page set corresponding to the first role permission set, allow the page access request.

[0021] In a possible design, the third determining module is further configured to, when the authentication identifier is valid, obtain a second role permission set of the target user according to the authentication identifier; obtain a third role permission set of the access interface based on a mapping relationship between interfaces and roles; determine whether a role in the second role permission set exists in the third role permission set; if the role exists, allow the page access request; and if the role does not exist, reject the page access request.

[0022] In a possible design, the anti-vertical privilege violation apparatus further includes a verification module (not shown in the figure), which is configured to, in response to the access interface being in the open interface list, verify the access interface based on a self-defined system-level authentication verification logic, and reject the page access request when the verification fails, and allow the page access request when the verification passes.

[0023] In a possible design, the checking module is further configured to: acquire an interface environment configuration list; determine whether the access interface is in the interface environment configuration list; if the access interface is in the interface environment configuration list, check the second environment parameter in the source identifier of the access interface according to a first environment parameter configured for the access interface in the interface environment configuration list; if the checking fails, reject the page access request; and if the checking succeeds, determine whether the access interface is in the open interface list.

[0024] In a possible design, the anti-vertical privilege violation apparatus further includes a fourth determination module (not shown in the figure), configured to: when the access interface is not in the interface environment configuration list, determine whether the access interface is in the open interface list.

[0025] In a third aspect, an electronic device is provided, including: at least one processor and a memory; the memory stores computer-executable instructions; and the at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the anti-vertical privilege violation method in the first aspect and various possible designs of the first aspect.

[0026] In a fourth aspect, a computer-readable storage medium is provided, and the computer-readable storage medium stores computer-executable instructions, when a processor executes the computer-executable instructions, the anti-vertical privilege violation method in the first aspect and various possible designs of the first aspect is implemented.

[0027] In a fifth aspect, a computer program product is provided, including a computer program, when a processor executes the computer program, the anti-vertical privilege violation method in the first aspect and various possible designs of the first aspect is implemented.

[0028] The anti-vertical privilege violation method, apparatus, device, medium and program product provided in the present application, by receiving a page access request carrying an access interface of a target user, in response to the access interface not being in the open interface list, determining whether the target user is a public user, and when the target user is a public user, determining whether the access interface is in a public interface matching white list, and further when the access interface is not in the public interface matching white list, rejecting the page access request. The present application, by checking the access interface carried in the page access request, improves the security of the online system. BRIEF DESCRIPTION OF DRAWINGS

[0029] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the application.

[0030] Figure 1 The application scenarios of the anti-vertical privilege violation method provided in the embodiments of the present application are shown in the following schematic diagram.

[0031] Figure 2 Flowchart of the method for preventing vertical overreach provided by an embodiment of the present application Figure 1 ;

[0032] Figure 3 Flowchart of the method for preventing vertical overreach provided by an embodiment of the present application Figure 2 ;

[0033] Figure 4 Flowchart of the method for preventing vertical overreach provided by an embodiment of the present application Figure 3 ;

[0034] Figure 4 Flowchart of the method for preventing vertical overreach provided by an embodiment of the present application Figure 6 ;

[0035] Figure 5 Flowchart of the method for preventing vertical overreach provided by an embodiment of the present application Figure 7 ;

[0036] Figure 6 Flowchart of the method for preventing vertical overreach provided by an embodiment of the present application Figure 8 ;

[0037] Figure 9 Structure diagram of the device for preventing vertical overreach provided by an embodiment of the present application

[0038] Figure 1 Structure diagram of the electronic device provided by an embodiment of the present application.

[0039] The specific embodiments of the present application have been shown through the above-mentioned drawings, and will be described in more detail hereinafter. These drawings and the written description are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0040] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The same or similar components are denoted by the same reference numerals throughout the drawings and the following description, unless otherwise specified. The embodiments described in the following exemplary embodiments do not represent all the embodiments consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present application, as detailed in the appended claims.

[0041] In the technical solution of the present application, the collection, storage, use, processing, transmission, provision and disclosure of the information such as financial data or user data, etc. involved in the technical solution comply with the relevant legal regulations and do not violate public order and good customs.

[0042] It should be noted that in the embodiments of the present application, some software, components, models and the like in the prior art may be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility of the implementation of the technical solutions of the present application, but does not mean that the applicant has or will necessarily use the scheme.

[0043] First, the technical terms involved in the embodiments of the present application are explained.

[0044] Online transaction: Online transaction refers to a transaction provided by an online system directly, which has real-time and transactional characteristics.

[0045] Vertical privilege escalation (VPE for short): Vertical privilege escalation refers to a behavior in which a user with low permission in a multi-level permission online system can access or operate resources or functions that can only be accessed by a user with high permission, thereby threatening the security of the online system.

[0046] Call environment: refers to an environment parameter customized for interface access, such as internal and external network identification, client identification, etc.

[0047] Public interface: refers to an open interface provided for external calls, which checks the permissions of the interface based on system-level authentication.

[0048] Public domain user: refers to a type of user who can access system resources without logging in and authorization, such as tourists, etc.

[0049] Private domain user: refers to a user of the current online system, which generally needs authorization to use the corresponding functions of the online system.

[0050] In related technologies, the commonly used method to prevent vertical privilege escalation is based on user role menu permission design, which controls different roles to access different pages. In this method, menu pages can achieve page access of different roles through role control, but cannot achieve interface control on the role control page, thereby creating conditions for website attackers to penetrate the system, resulting in low security of the online system.

[0051] To solve the technical problems in the related art, the present application proposes the following technical concept: by performing public interface permission verification on the access interface when accessing the page, and further performing public domain user permission verification on the access interface when the access interface is not in the open interface list, to improve the security of the online system.

[0052] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below with specific examples. The following specific examples can be combined with each other, and the same or similar concepts or processes can not be described again in some examples. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0053] First, the application scenarios to which the embodiments of the present application are applicable will be described below.

[0054] Figure 1 An application scenario diagram of the anti-vertical privilege escalation method provided by the embodiments of the present application is shown in FIG. 1. Figure 1 As shown in FIG. 1, the application scenario includes a client 11 and a server 12.

[0055] For example, the client 11 and the server 12 are connected through a wired network or a wireless network.

[0056] For example, the client specifically includes, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, portable wearable devices, and the like.

[0057] The anti-vertical privilege escalation method provided by the embodiments of the present application is that a user sends a page access request for an online system to the server 12 based on the interface of the client 11, the server 12 performs calling environment verification and anti-vertical privilege escalation permission verification on the access interface carried in the page access request in sequence after receiving the page access request, and allows the user to access the online system through the access interface when the verification passes, and refuses the user to access the online system through the access interface when the verification fails. The calling environment verification mainly determines whether the current calling party is calling in an authorized safe environment; the anti-vertical privilege escalation permission verification consists of anti-vertical privilege escalation public interface verification and public-private domain user permission verification.

[0058] The anti-vertical privilege escalation method provided by the embodiments of the present application will be described in detail below with the server shown in the above Figure 2 as the execution subject and in combination with specific embodiments.

[0059] Figure 1 A flowchart of the anti-vertical privilege escalation method provided by the embodiments of the present application is shown in FIG. 2. Figure 2 As shown in FIG. 2, the specific implementation of the anti-vertical privilege escalation method includes the following steps: Figure 1 S201, receiving a page access request of a target user, the page access request carrying an access interface.

[0060] S202, performing calling environment verification on the access interface.

[0061] The target user can be a public domain user or a private domain user. The public domain user can be a visitor user or a registered user. The private domain user is a user in the current online system, and the private domain user generally needs authorization to access the functions of the online system.

[0062] It can be understood that when the public domain user is a visitor user, the user does not need to log in or be authorized to access the online system resources. When the public domain user is a registered user, the user needs to log in to the online system based on a registered account to access the online system resources.

[0063] The page access request is generated when the user accesses the online system based on a client page.

[0064] The same client page can include one or more different transaction controls, and the different transaction controls correspond to different access interfaces.

[0065] In S202, it is determined whether the target user is a public domain user in response to the access interface not being in the open interface list.

[0066] The open interface list can be stored in the server shown in the above Figure 3 .

[0067] The open interface list can include at least one public interface. The public interface can be an open interface provided by the online system for external calls.

[0068] It can be understood that when the access interface is not in the open interface list, it indicates that the access interface does not belong to the public interface.

[0069] In a possible implementation, the open interface list is obtained, it is determined whether the access interface is in the open interface list, and in response to the access interface not being in the open interface list, it is further determined whether the target user is a public domain user.

[0070] In a possible implementation, it is determined whether the interface name corresponding to the access interface is in the open interface list. If the interface name corresponding to the access interface is in the open interface list, it is determined that the access interface is in the open interface list. If the interface name corresponding to the access interface is not in the open interface list, it is determined that the access interface is not in the open interface list.

[0071] In a possible implementation, whether the target user is a public domain user can be determined based on the user attribute information of the target user.

[0072] In the step, when it is determined that the target user is a public domain user, the access interface is checked based on public domain user judgment logic; and when it is determined that the target user is a private domain user, the access interface is checked based on private domain user judgment logic.

[0073] The specific implementation of checking the access interface based on the public domain user judgment logic will be described below in combination with steps S203 and S204.

[0074] S203, if the target user is a public domain user, it is determined whether the access interface is in a public domain interface matching white list.

[0075] In a possible implementation, it is determined whether the interface name corresponding to the access interface is in the public domain interface matching white list.

[0076] For example, the public domain interface matching white list can be stored in the server.

[0077] S204, if the access interface is not in the public domain interface matching white list, the page access request is rejected.

[0078] It can be understood that when the access interface is not in the public domain interface matching white list, that is, the access interface does not pass the public domain user permission check, the page access request is rejected to reject the user's page access to the online system.

[0079] In the embodiment of the application, the page access request of the target user carrying the access interface is received, it is determined whether the target user is a public domain user in response to the access interface not being in the open interface list, it is determined whether the access interface is in the public domain interface matching white list when the target user is a public domain user, and the page access request is rejected when the access interface is not in the public domain interface matching white list. In the embodiment of the application, the access interface carried in the page access request is checked for permission to improve the security of the online system.

[0080] Optionally, the anti-vertical privilege escalation method provided in the embodiment of the application further includes: if the access interface is in the public domain interface matching white list, the page access request is allowed.

[0081] It can be understood that when the access interface is in the public domain interface matching white list, that is, the access interface passes the public domain user permission check, the page access request is allowed to allow the user to access the page of the online system.

[0082] The specific implementation of determining whether the target user is a public domain user in step S202 will be described in detail below. Figure 3

[0083] Figure 2 The flowchart of the anti-vertical privilege escalation method provided in the embodiment of the application​Figure 3 As shown in Figure 4 The specific implementation of determining whether the target user is a public user includes the following steps:

[0084] S301, determining whether the page access request carries an authentication identifier of the target user.

[0085] For example, the authentication identifier of the target user can be a login token generated by the target user when logging in to the online system page.

[0086] In a possible implementation, it is determined whether the page access request carries the authentication identifier of the target user. If the page access request does not carry the authentication identifier of the target user, step S302 is performed; if the page access request carries the authentication identifier of the target user, step S303 is performed.

[0087] S302, determining that the target user is a public user.

[0088] It can be understood that when the page access request does not carry the authentication identifier of the target user, it indicates that the target user can access the online system resource without logging in or being authorized, that is, the target user is a visitor user, and the visitor user belongs to a public user.

[0089] S303, determining whether the target user is a public user according to the authentication identifier.

[0090] For example, the authentication identifier can include attribute information of the target user, such as an identity ID of the target user, a login name of the target user, an email of the target user, and a name of the target user.

[0091] In a possible implementation, whether the target user is a public user is determined according to the attribute information of the target user included in the authentication identifier. If the attribute information of the target user exists in the user attributes corresponding to a public user, it is determined that the target user is a public user; if the attribute information of the target user exists in the user attributes corresponding to a private user, it is determined that the target user is a private user.

[0092] In the embodiment of the application, it is determined whether the page access request carries the authentication identifier of the target user, and when the authentication identifier is not carried, it is determined that the target user is a public user, and when the authentication identifier is carried, it is further determined whether the target user is a public user according to the authentication identifier. In the embodiment of the application, the target user is determined to be a public user or a private user based on the authentication identifier, and the access interface is further verified by the public user verification logic or the private user verification logic, so as to improve the security of the online system.

[0093] The following will be described in combination with Figure 4The specific implementation of the method for checking the access interface based on the private domain user judgment logic when the target user is a private domain user is described in detail.

[0094] Figure 3 The flowchart of the vertical authority prevention method provided by the embodiments of the present application Figure 4 . As Figure 5 shown, the specific implementation of the method for checking the access interface based on the private domain user judgment logic when the target user is a private domain user includes the following steps:

[0095] S401, if the target user is a private domain user, determine whether the authentication identifier is valid.

[0096] For example, the authentication identifier can also include a timestamp, which is used to indicate the valid time period of the authentication identifier.

[0097] In one possible implementation, it is determined whether the current time is within the valid time period. If the current time is within the valid time period, the authentication identifier is determined to be valid. If the current time is not within the valid time period, the authentication identifier is determined to be invalid.

[0098] In this step, when the authentication identifier is valid, step S402 is performed; when the authentication identifier is invalid, the page access request is rejected.

[0099] S402, if the authentication identifier is valid, obtain the first role permission set corresponding to the target user and the page association set corresponding to the access interface.

[0100] For example, the first role permission set can be a set of role permissions that the target user has the right to.

[0101] For example, the page association set can be a page association set configured by the server for the access interface, i.e. the associated pages in the page association set have the right to call the access interface.

[0102] For example, the first role permission set and the page association set can be stored on the server.

[0103] In one possible implementation, the first role permission set corresponding to the target user is obtained according to the user attribute information of the target user contained in the authentication identifier, and the page association set corresponding to the access interface is obtained according to the interface name of the access interface.

[0104] S403, determine whether the associated pages in the page association set are in the menu page set corresponding to the first role permission set.

[0105] For example, the set of menu pages corresponding to the first role's permission set can be the menu pages that the first role has permission to access, that is, the menu pages that the target user has permission to access.

[0106] In one possible implementation, it is determined whether there is at least one associated page in the set of menu pages corresponding to the first set of role permissions.

[0107] S404 If there is no associated page in the menu page set corresponding to the first role permission set, then the page access request is rejected.

[0108] It is understandable that if there is no associated page in the menu page set corresponding to the first role permission set, it means that the target user does not have permission to call the access interface, and further indicates that the target user does not have permission to access the online system through the access interface.

[0109] S405 If there is at least one associated page in the menu page set corresponding to the first role permission set, then the page access request is allowed.

[0110] It is understandable that if there is at least one associated page in the menu page set corresponding to the first role permission set, it means that the target user has the permission to call the access interface, and further indicates that the target user has the permission to access the online system through the access interface.

[0111] In this embodiment, when the target user is a private domain user, the validity of the authentication identifier is determined. If the authentication identifier is valid, the first role permission set corresponding to the target user and the page association set corresponding to the access interface are obtained. It is then determined whether the associated pages in the page association set are in the menu page set corresponding to the first role permission set. If no associated page exists in the menu page set corresponding to the first role permission set, the page access request is rejected. If at least one associated page exists in the menu page set corresponding to the first role permission set, the page access request is allowed. In this embodiment, when the target user is a private domain user, the access interface is verified based on the private domain user judgment logic to improve the security of the online system operation.

[0112] The following is combined with Figure 5 When the target user is a private domain user, another specific implementation method for verifying the access interface based on the private domain user judgment logic is explained in detail.

[0113] Figure 4 A flowchart illustrating the method for preventing vertical overreach provided in this application embodiment. Figure 5 .like Figure 6 As shown, when the target user is a private domain user, another specific implementation method for verifying the access interface based on the private domain user judgment logic includes the following steps:

[0114] S501, if the authentication identifier is valid, obtaining a second role permission set of the target user according to the authentication identifier.

[0115] For example, the second role permission set can be a set of role permissions that the target user has the permission of.

[0116] For example, the second role permission set can be stored on the server.

[0117] In a possible implementation, the second role permission set corresponding to the target user is obtained according to the user attribute information of the target user contained in the authentication identifier.

[0118] S502, obtaining a third role permission set of the access interface based on the mapping relationship between the interface and the role.

[0119] For example, the third role permission set can be a set of roles that have the permission to call the access interface.

[0120] For example, the third role permission set can be stored on the server.

[0121] In a possible implementation, the third role permission set of the access interface is obtained according to the interface name of the access interface based on the mapping relationship between the interface and the role.

[0122] S503, determining whether there is a role in the second role permission set in the third role permission set.

[0123] It can be understood that when there is at least one same role in the third role permission set and the second role permission set, it indicates that the target user has the permission to call the access interface, and the target user is allowed to access the online system based on the access interface; when there is no same role in the third role permission set and the second role permission set, it indicates that the target user does not have the permission to call the access interface, and the target user is refused to access the online system based on the access interface.

[0124] In this step, if there is a role in the second role permission set in the third role permission set, step S504 is performed; if there is no role in the second role permission set in the third role permission set, step S505 is performed.

[0125] S504, if there is, allowing the page access request.

[0126] In this step, it can be understood that the access interface is verified based on the private domain user judgment logic.

[0127] S505, if there is not, refusing the page access request.

[0128] In this step, it can be understood that the access interface is not verified by the private domain user judgment logic.

[0129] It should be noted that there is no sequence between the above steps S504 and S505.

[0130] In the embodiment of the application, when the authentication identifier is valid, the second role permission set of the target user is obtained according to the authentication identifier, and the third role permission set of the access interface is obtained based on the mapping relationship between the interface and the role, and it is further determined whether there is a role in the second role permission set in the third role permission set, and when there is, the page access request is allowed, and when there is not, the page access request is rejected. In the embodiment of the application, when the target user is a private domain user, the access interface is verified based on the private domain user judgment logic, so as to improve the security of the online system.

[0131] Optionally, in response to the access interface being in the open interface list, the anti-vertical privilege abuse method provided in the embodiment of the application further includes the following implementation manner: the access interface is verified based on the custom system-level authentication verification logic, and when the verification fails, the page access request is rejected, and when the verification passes, the page access request is allowed.

[0132] For example, the custom system-level authentication verification logic can be AKSK verification.

[0133] In a possible implementation manner, the client signs the page access request to generate a signature of the client, and carries the signature of the client in the page access request. After receiving the page access request, the server signs the page access request based on the same standardization processing and signature algorithm as that for generating the signature of the client to generate a signature of the server, and when the signature of the server matches the signature of the client, it indicates that the verification of the access interface passes, and the page access request is allowed; when the signature of the server does not match the signature of the client, it indicates that the verification of the access interface fails, and the page access request is rejected.

[0134] The specific implementation manner of the calling environment verification of the access interface in the anti-vertical privilege abuse method provided in the embodiment of the application will be described in detail below. Figure 6 The specific implementation manner of the calling environment verification of the access interface in the anti-vertical privilege abuse method provided in the embodiment of the application will be described in detail below.

[0135] Figure 5 The flow of the anti-vertical privilege abuse method provided in the embodiment of the application is shown in Figure 6 . As Figure 7 shown, the specific implementation manner of the calling environment verification of the access interface includes the following steps:

[0136] S601, obtaining an interface environment configuration list.

[0137] Exemplarily, the interface environment configuration list can include different interfaces and corresponding environment parameters of each interface.

[0138] Exemplarily, the environment parameters can be network identification and client identification, etc. The network identification can be external network identification, internal network identification, and Internet identification, etc.

[0139] It can be understood that the network identification can be used to represent the network source channel of the access interface.

[0140] Exemplarily, the interface environment configuration list can be stored in the server.

[0141] S602, determining whether the access interface is in the interface environment configuration list.

[0142] In a possible implementation manner, it can be determined whether the interface name corresponding to the access interface exists in the interface environment configuration list.

[0143] S603, if the access interface is in the interface environment configuration list, verifying the second environment parameter in the source identification of the access interface according to the first environment parameter configured by the access interface in the interface environment configuration list.

[0144] It can be understood that if the access interface is in the interface environment configuration list, the first environment parameter configured by the access interface can be obtained in the interface environment configuration list. The first environment parameter can be network identification and client identification.

[0145] Exemplarily, the source identification of the access interface can be the request header identification added by the server when obtaining and calling the environment identification based on the page access request and forwarding through the reverse proxy server in different regions.

[0146] Exemplarily, the request header identification can be represented as X-Login-Source.

[0147] Exemplarily, the second environment parameter in the source identification can be client identification and network identification. The network identification can be any one of external network identification, internal network identification, and Internet identification.

[0148] It can be understood that the second environment parameter in the source identification is determined according to the page access request.

[0149] In a possible implementation manner, if the first environment parameter configured by the access interface in the interface environment configuration list is the same as the second environment parameter in the source identification of the access interface, the verification is passed; if the first environment parameter configured by the access interface in the interface environment configuration list is not the same as the second environment parameter in the source identification of the access interface, the verification is not passed.

[0150] In the step, when the check fails, step S604 is performed; when the check passes, step S605 is performed.

[0151] S604, rejecting the page access request.

[0152] S605, determining whether the access interface is in the open interface list.

[0153] The specific implementation is similar to the above, and will not be repeated here.

[0154] It should be noted that there is no sequence between step S604 and step S605.

[0155] In the embodiment of the application, the interface environment configuration list is acquired to determine whether the access interface is in the interface environment configuration list, and when the access interface is in the interface environment configuration list, the second environment parameter in the source identifier of the access interface is checked according to the first environment parameter configured by the access interface in the interface environment configuration list, and further, when the check fails, the page access request is rejected, and when the check passes, it is determined whether the access interface is in the open interface list. In the embodiment of the application, the calling environment of the access interface is checked by the interface environment configuration list to further enhance the security of the online system.

[0156] Optionally, the anti-vertical privilege method provided in the embodiment of the application further includes determining whether the access interface is in the open interface list if the access interface is not in the interface environment configuration list.

[0157] The specific implementation of determining whether the access interface is in the open interface list is similar to the above, and will not be repeated here.

[0158] It can be understood that in the anti-vertical privilege method provided in the embodiment of the application, when the access interface is in the interface environment configuration list, the calling environment of the access interface is first checked, and when the check passes, the anti-vertical privilege check is continued, that is, the public interface check and the public-private domain user privilege check; when the access interface is not in the interface environment configuration list, the anti-vertical privilege check of the access interface is directly performed.

[0159] It should be noted that in the anti-vertical privilege method provided in the embodiment of the application, the whole process control of the anti-vertical privilege is a lightweight and efficient processing process, which has little influence on the response of the online transaction and the user experience, and ensures the user experience while improving the security of the online system.

[0160] In summary, the specific implementation of the anti-vertical privilege method provided in the embodiment of the application will be described in detail. Figure 7

[0161] Figure 6 ​Flow of the method for preventing vertical privilege violation provided for the embodiments of the present application Figure 7 As shown in Figure 8 the specific implementation of the method for preventing vertical privilege violation includes the following steps:

[0162] S701, in response to receiving a page access request of a target user, obtaining an interface environment configuration list, the page access request carrying an access interface.

[0163] S702, determining whether the access interface is in the interface environment configuration list.

[0164] The specific implementation is similar to the above, and will not be repeated here.

[0165] In this step, it is determined whether the access interface is in the interface environment configuration list. If the access interface is in the interface environment configuration list, step S703 is performed; if the access interface is not in the interface environment configuration list, step S704 is performed.

[0166] S703, according to the first environment parameter configured by the access interface in the interface environment configuration list, verifying the second environment parameter in the source identifier of the access interface.

[0167] The specific implementation is similar to the above, and will not be repeated here.

[0168] In this step, when the verification fails, the page access request is rejected, and when the verification passes, step S704 is performed.

[0169] S704, determining whether the access interface is in the open interface list.

[0170] The specific implementation is similar to the above, and will not be repeated here.

[0171] In this step, it is determined whether the access interface is in the open interface list. If the access interface is in the open interface list, step S705 is performed; if the access interface is not in the open interface list, step S706 is performed.

[0172] S705, verifying the access interface based on a custom system-level authentication verification logic.

[0173] The specific implementation is similar to the above, and will not be repeated here.

[0174] In this step, when the verification fails, the page access request is rejected, and when the verification passes, the page access request is allowed.

[0175] S706, determining whether the target user is a public user.

[0176] The specific implementation is similar to the above, and will not be repeated here.

[0177] In this step, it is determined whether the target user is a public domain user. If the target user is a public domain user, step S707 is performed. If the target user is a private domain user, step S708 is performed.

[0178] S707, verifying the access interface based on public domain user judgment logic.

[0179] The specific implementation is similar to the above, and will not be repeated here.

[0180] In this step, when the verification fails, the page access request is rejected, and when the verification passes, the page access request is allowed.

[0181] S708, verifying the access interface based on private domain user judgment logic.

[0182] The specific implementation is similar to the above, and will not be repeated here.

[0183] In this step, when the verification fails, the page access request is rejected, and when the verification passes, the page access request is allowed.

[0184] The following is an embodiment of the device of the present application, which can be used to execute the method embodiments of the present application. For details not disclosed in the device embodiments of the present application, please refer to the method embodiments of the present application.

[0185] Figure 8 The structure diagram of the vertical authority prevention device provided by an embodiment of the present application. As shown in the figure, the vertical authority prevention device 80 includes a receiving module 810, a first determination module 820, a second determination module 830, and a rejection module 840. Figure 9

[0186] The receiving module 810 is configured to receive a page access request of a target user, and the page access request carries an access interface.

[0187] The first determination module 820 is configured to determine whether the target user is a public domain user in response to the access interface not being in the open interface list.

[0188] The second determination module 830 is configured to determine whether the access interface is in the public domain interface matching whitelist when the target user is a public domain user.

[0189] The rejection module 840 is configured to reject the page access request when the access interface is not in the public domain interface matching whitelist.

[0190] In one possible design, the vertical authority prevention device further includes an allowing module (not shown), which is configured to allow the page access request when the access interface is in the public domain interface matching whitelist.

[0191] ​In a possible design, the first determining module 820 is specifically configured to: determine whether the page access request carries an authentication identifier of the target user; if the authentication identifier is not carried, determine that the target user is a public domain user; and if the authentication identifier is carried, determine whether the target user is a public domain user according to the authentication identifier.

[0192] In a possible design, the anti-vertical privilege-escalation apparatus further includes a third determining module (not shown in the figure), configured to: when the target user is a private domain user, determine whether the authentication identifier is valid; if the authentication identifier is valid, obtain a first role permission set corresponding to the target user and a page association set corresponding to the access interface; determine whether an associated page in the page association set is in a menu page set corresponding to the first role permission set; if there is no associated page in the menu page set corresponding to the first role permission set, reject the page access request; and if there is at least one associated page in the menu page set corresponding to the first role permission set, allow the page access request.

[0193] In a possible design, the third determining module is further configured to: when the authentication identifier is valid, obtain a second role permission set of the target user according to the authentication identifier; obtain a third role permission set of the access interface based on a mapping relationship between the interface and the role; and determine whether there is a role in the second role permission set in the third role permission set; if there is, allow the page access request; and if there is not, reject the page access request.

[0194] In a possible design, the anti-vertical privilege-escalation apparatus further includes a verification module (not shown in the figure), configured to: in response to the access interface being in the open interface list, verify the access interface based on a self-defined system-level authentication verification logic, and when the verification fails, reject the page access request, and when the verification passes, allow the page access request.

[0195] In a possible design, the verification module is further configured to: obtain an interface environment configuration list; determine whether the access interface is in the interface environment configuration list; if the access interface is in the interface environment configuration list, verify a second environment parameter in a source identifier of the access interface according to a first environment parameter configured by the access interface in the interface environment configuration list; if the verification fails, reject the page access request; and if the verification passes, determine whether the access interface is in the open interface list.

[0196] In a possible design, the anti-vertical privilege-escalation apparatus further includes a fourth determining module (not shown in the figure), configured to: when the access interface is not in the interface environment configuration list, determine whether the access interface is in the open interface list.

[0197] The vertical privilege prevention device provided by the embodiments of the present application can be used to execute the technical solutions of the vertical privilege prevention method in the above embodiments, and has similar implementation principles and technical effects, which will not be described here again.

[0198] It should be noted that the division of each module of the above device is only a logical division of functions, and all or part of the modules can be integrated into one physical entity or physically separated when actually implemented. Moreover, all of the modules can be implemented in the form of software invoked by a processing element, all of the modules can be implemented in the form of hardware, or part of the modules can be implemented in the form of software invoked by a processing element and part of the modules can be implemented in the form of hardware. For example, the receiving module 810 can be a separately established processing element, or can be integrated into a chip of the above device, and in addition, the receiving module 810 can be stored in the form of program code in a memory of the above device and invoked and executed by a processing element of the above device. The implementation of other modules is similar. Moreover, all or part of the modules can be integrated together or independently implemented. The processing element herein can be an integrated circuit having a signal processing capability. In the implementation process, each step of the above method or each module can be completed by an integrated logic circuit of hardware or an instruction in the form of software in the processing element.

[0199] Figure 9 The structure schematic diagram of the electronic device provided by an embodiment of the present application is shown in FIG. 8. ​ As shown in the figure, the electronic device 90 can include at least one processor 901 and a memory 902.

[0200] Optionally, the electronic device 90 further includes a communication interface 903 and a system bus 904.

[0201] The memory 902 and the communication interface 903 are connected with the processor 901 through the system bus 904 and complete communication with each other, the memory 902 is used to store instructions, and the communication interface 903 is used to communicate with other devices.

[0202] In the specific implementation process, the at least one processor 901 executes the computer execution instructions stored in the memory 902, so that the at least one processor 901 executes the above method.

[0203] The specific implementation process of the processor 901 can refer to the above method embodiments, which has similar implementation principles and technical effects, and will not be described here again.

[0204] In the above embodiments, it should be understood that the processor 901 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor and the like. The steps of the method disclosed in the application can be directly embodied as hardware processor execution, or executed by a combination of hardware and software modules in the processor.

[0205] The memory 902 can include a random access memory (RAM) and can also include a non-volatile memory (NVM), such as at least one disk memory.

[0206] The system bus 904 can be an industry standard architecture (ISA) bus, a peripheral component (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The system bus 904 can be divided into an address bus, a data bus, a control bus, etc. For the sake of representation, the system bus in the drawings of the present application does not limit to only one bus or one type of bus.

[0207] The embodiments of the present application also provide a computer program product, comprising a computer program, which, when executed by a processor, implements the technical solutions of the anti-vertical privilege escalation method in the above embodiments.

[0208] The embodiments of the present application also provide a chip for running instructions, which is used to execute the technical solutions of the anti-vertical privilege escalation method in the above embodiments.

[0209] The embodiments of the present application also provide a computer readable storage medium, which stores computer execution instructions, and when a processor executes the computer execution instructions, the technical solutions of the anti-vertical privilege escalation method in the above embodiments are implemented.

[0210] The above readable storage medium can be realized by any type of volatile or nonvolatile storage device or combination thereof, such as Static Random-Access Memory (SRAM), Electrically-Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0211] An exemplary readable storage medium is coupled to the processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a part of the processor. The processor and the readable storage medium can be located in an Application Specific Integrated Circuits (ASIC). Of course, the processor and the readable storage medium can also exist as discrete components in the device.

[0212] The division of units is only a logical function division, and in actual implementation, there can be another division manner, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0213] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, can be located in one place, or can be distributed on multiple network units. According to actual needs, part or all of the units can be selected to achieve the purpose of the embodiment scheme.

[0214] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit.

[0215] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the embodiments of the method of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0216] Those of ordinary skill in the art can understand that all or part of the steps of the above-mentioned method embodiments can be completed by program instruction-related hardware. The aforementioned program can be stored in a computer readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: a ROM, a RAM, a magnetic disk or an optical disk, and various media that can store program codes.

[0217] Finally, it should be noted that: those skilled in the art will easily derive other embodiments of the present application after considering the specification and practicing the application disclosed herein. The present application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of the present application and include common knowledge or conventional technical means in the art that are not disclosed in the present application, and is not limited to the precise structure described above and shown in the drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present application is only limited by the appended claims.

Claims

1. A method of preventing vertical privilege escalation, characterized by, Comprising: receiving a page access request of a target user, the page access request carrying an access interface; in response to the access interface not being in an open interface list, determining whether the page access request carries an authentication identifier of the target user; if the authentication identifier is not carried, determining that the target user is a public domain user; if the authentication identifier is carried, determining whether the target user is a private domain user according to the authentication identifier; if the target user is a private domain user, determining whether the authentication identifier is valid; if the authentication identifier is valid, obtaining a first role permission set corresponding to the target user and a page association set corresponding to the access interface; and determining whether an associated page in the page association set is in a menu page set corresponding to the first role permission set; if the associated page does not exist in the menu page set corresponding to the first role permission set, rejecting the page access request; if at least one associated page exists in the menu page set corresponding to the first role permission set, allowing the page access request; if the target user is a public domain user, determining whether the access interface is in a public domain interface matching whitelist; if the access interface is not in the public domain interface matching whitelist, rejecting the page access request.

2. The method of preventing vertical privilege escalation of claim 1, wherein, Further comprising: if the access interface is in the public domain interface matching whitelist, allowing the page access request.

3. The method of preventing vertical privilege escalation of claim 1, wherein, Further comprising: if the authentication identifier is valid, obtaining a second role permission set of the target user according to the authentication identifier; based on a mapping relationship between an interface and a role, obtaining a third role permission set of the access interface; determining whether a role in the second role permission set exists in the third role permission set; if it exists, allowing the page access request; if it does not exist, rejecting the page access request.

4. The method of preventing vertical privilege escalation according to any one of claims 1 to 3, characterized in that, Further comprising: in response to the access interface being in the open interface list, verifying the access interface based on a custom system-level authentication verification logic, and rejecting the page access request when the verification fails, and allowing the page access request when the verification passes.

5. The method of preventing vertical privilege escalation according to any one of claims 1 to 3, wherein, Further comprising: obtaining an interface environment configuration list; determining whether the access interface is in the interface environment configuration list; if the access interface is in the interface environment configuration list, verifying a second environment parameter in a source identifier of the access interface according to a first environment parameter configured by the access interface in the interface environment configuration list; if the verification fails, rejecting the page access request; if the verification passes, determining whether the access interface is in the open interface list.

6. The method of preventing vertical privilege escalation of claim 5, wherein, Further comprising: if the access interface is not in the interface environment configuration list, determining whether the access interface is in the open interface list.

7. A vertical overreach prevention device, characterized by, Comprising: a receiving module configured to receive a page access request of a target user, the page access request carrying an access interface; a first determining module configured to, in response to the access interface not being in an open interface list, determine whether the page access request carries an authentication identifier of the target user; If the authentication identifier is not carried, the target user is determined as a public domain user; if the authentication identifier is carried, whether the target user is a private domain user is determined according to the authentication identifier; If the target user is a private domain user, whether the authentication identifier is valid is determined; If the authentication identifier is valid, a first role permission set corresponding to the target user and a page association set corresponding to the access interface are obtained; whether an association page in the page association set is in a menu page set corresponding to the first role permission set is determined; If the association page does not exist in the menu page set corresponding to the first role permission set, the page access request is rejected; If at least one association page exists in the menu page set corresponding to the first role permission set, the page access request is allowed; The second determination module is configured to determine whether the access interface is in a public domain interface matching white list when the target user is a public domain user; The rejection module is configured to reject the page access request when the access interface is not in the public domain interface matching white list.

8. An electronic device, comprising: Comprise: A processor and a memory connected with the processor in communication; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory to implement the method in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the method in any one of claims 1-6.

10. A computer program product, characterised in that, The computer program is executed by the processor to implement the method in any one of claims 1-6.

Images